Bugku Reverse ez fibon

用exeinfope扫

然后用IDA打开，看到main的代码如下：

易知，输入的Str经过一系列变换，最终需要与v5相等，才能输出right flag。

于是便直接用python写代码：

v5 = [0]*22
v1 = [0]*22
v5[0] = 100
v5[1] = 121
v5[2] = 110
v5[3] = 118
v5[4] = 70
v5[5] = 85
v5[6] = 123
v5[7] = 109
v5[8] = 64
v5[9] = 94
v5[10] = 109
v5[11] = 99
v5[12] = 116
v5[13] = 81
v5[14] = 109
v5[15] = 86
v5[16] = 83
v5[17] = 126
v5[18] = 119
v5[19] = 101
v5[20] = 110
v5[21] = 114
v8 = 1
v9 = 1
flag = ''
for i in range(22):
    if((i%2)==1 ):
        v8 += v9
        for a in range(33,127):
            if (v5[i] == (v8+i+a )%64+64):
                flag = flag+chr(a)
                v1[i] = 1
            if(v1[i]==1):
                break
    else:
        v9 = v9 + v8
        for a in range(33,127):
            if (v5[i] == (v9+i+a)%64+64):
                flag = flag +chr(a)
                v1[i] = 1
            if(v1[i]==1):
                break
print(flag)

输出看不懂。

恍然大悟，“%64”使得flag有了两种可能（两种可能除以64的余数相同）.

v5 = [0]*22
v1 = [0]*22
v2 = [0]*22
v3 = [0]*22
v5[0] = 100
v5[1] = 121
v5[2] = 110
v5[3] = 118
v5[4] = 70
v5[5] = 85
v5[6] = 123
v5[7] = 109
v5[8] = 64
v5[9] = 94
v5[10] = 109
v5[11] = 99
v5[12] = 116
v5[13] = 81
v5[14] = 109
v5[15] = 86
v5[16] = 83
v5[17] = 126
v5[18] = 119
v5[19] = 101
v5[20] = 110
v5[21] = 114
v8 = 1
v9 = 1
flag = ''
flag2 = ''
for i in range(22):
    if((i%2)==1 ):
        v8 += v9
        for a in range(33,127):
            if (v5[i] == (v8+i+a )%64+64):
                flag = flag+chr(a)
                v1[i] = 1
                for b in range(a+1,127):
                    if(v5[i] == (v8+i+b )%64+64):
                        flag2 = flag2+chr(b)
                        v2[i] = 1
                    elif(v5[i] != (v8+i+b )%64+64 and b ==126):
                        flag2 = flag2 + ' '
                    if(v2[i]== 1):
                        break
            if(v1[i]==1):
                break
    else:
        v9 = v9 + v8
        for a in range(33,127):
            if (v5[i] == (v9+i+a)%64+64):
                flag = flag +chr(a)
                v1[i] = 1
                for b in range(a+1,127):
                    if(v5[i] == (v9+i+b)%64+64):
                        flag2 = flag2 + chr(b)
                        v2[i] = 1
                    elif(v5[i] != (v9+i+b)%64+64 and b ==126):
                        flag2 = flag2 + ' '
                    if(v2[i]==1):
                        break
            if(v1[i]==1):
                break
print(flag)
print(flag2)

输出：

便想，若将第二个结果的空格，用第一个结果填上，会怎么样？

flag3 = ''
for i in range(22):
    if flag2[i]!=' ':
        flag3 = flag3 + flag2[i]
    else:
        flag3 = flag3 + flag[i]
print(flag3)

得到结果。