64位exe,无壳,直接动调看看基本逻辑
flag长度为38,构造一个38位的字符串放进去动调
这里是加密逻辑,将输入的flag每四位为一轮异或,
动调通过buf2找到密文,直接写回去就行了,注意密文需要逆序
print('1'*38)
arr=[ 10, 11, 125, 47, 127, 103, 101, 48, 99, 96,
55, 63, 60, 63, 51, 58, 60, 59, 53, 60,
62, 108, 100, 49, 100, 108, 59, 104, 97, 98,
101, 54, 51, 96, 98, 54, 28, 125]
print(len(arr))
'''v7[0]^=v6[1]
v7[1]^=v6[2]
v7[2]^=v6[3]'''
arr=arr[::-1]
print(arr)
for i in range(3,int(len(arr))):
arr[i-2] ^= arr[i-3]
arr[i-1] ^= arr[i-2]
arr[i] ^= arr[i-1]
print(arr)
for i in arr:
print(chr(i),end='')
strr='}a65ce00b391d1d1963084618520b1c73{galf'
hello=[]
for i in range(len(strr)):
hello.append(strr[i])
hello=hello[::-1]
print()
for i in hello:
print(i,end='')
flag{37c1b0258164803691d1d193b00ec56a}