re | BUUCTF [ACTF新生赛2020]easyre

题目： BUUCTF [ACTF新生赛2020]easyre

我真菜啊

---

查壳，有upx壳，脱壳
再查
ok，ida打开，找到main函数
思路比较清晰，输入的字符串有一系列限制，都满足则输出 你对啦，否则会提前return 0
输入字符串是包含v6、v7、v8、v9、v10的，ida把它们切开了
想办法造出正确的字符串

首先由那一系列的if(v6可以得到v6和v10（一开始是数字，右键改成char就能看出来像flag的样式）

  char v6[] = {"ACTF{"};
  char v10 = '}'; // [esp+3Bh] [ebp-5h]

关于_data_start__：
这个数组有一些是显示不出来的，干脆全部用数值不容易错右键选择data
就得到了十六进制值，稍微改改代码里就能用

给定的字符串v4和_data_start__和v5的神秘关系，v5是int数组，但是把v5指针转换成了char*，推测就是char数组，把v5定义成char数组
反推一下得到v5
（这里不放心对不对的话可以把原代码拿来验证一下，我一开始就写错了

  for ( i = 0; i <= 11; ++i )
  {
    for (int j = 0; j < strlen(_data_start__); j++)
    {
    	if (v4[i] == _data_start__[j])
    		v5[i] = j + 1;
	}
  }

之后按照代码逻辑还要

v7 = v5[0];
v8 = v5[1];
v9 = v5[2];

不过反正和v5一个东西，直接输出v5就行

完整代码

int main()
{
   char v4[] = {"*F'\"N,\"(I?+@"};
   cout << v4 << endl;
  char v5[12];
  char v6[] = {"ACTF{"};
  int v7; // [esp+2Fh] [ebp-11h]
  int v8; // [esp+33h] [ebp-Dh]
  int v9; // [esp+37h] [ebp-9h]
  char v10 = '}'; // [esp+3Bh] [ebp-5h]
  int i; // [esp+3Ch] [ebp-4h]
	char _data_start__[] = {0x7E, 0x7D, 0x7C, 0x7B, 0x7A, 
	0x79, 0x78, 0x77, 0x76, 0x75, 0x74, 0x73, 0x72, 
	0x71, 0x70, 0x6F, 0x6E, 0x6D, 0x6C, 0x6B, 0x6A, 0x69, 
	0x68, 0x67, 0x66, 0x65, 0x64, 0x63, 0x62, 0x61, 0x60, 0x5F, 
	0x5E, 0x5D, 0x5C, 0x5B, 0x5A, 0x59, 0x58, 0x57, 0x56, 0x55, 0x54, 
	0x53, 0x52, 0x51, 0x50, 0x4F, 0x4E, 0x4D, 0x4C, 0x4B, 0x4A, 0x49, 0x48, 
	0x47, 0x46, 0x45, 0x44, 0x43, 0x42, 0x41, 0x40, 0x3F, 0x3E, 0x3D, 0x3C, 0x3B, 
	0x3A, 0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2F, 0x2E, 
	0x2D, 0x2C, 0x2B, 0x2A, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24, 0x23, 0x20, 0x21, 0x22};
	cout << _data_start__ << endl;
	
  if ( v6[0] != 65 || v6[1] != 67 || v6[2] != 84 || v6[3] != 70 || v6[4] != 123 || v10 != 125 )
    return 0;
  for ( i = 0; i <= 11; ++i )
  {
  	//cout << v4[i] << endl;
    for (int j = 0; j < strlen(_data_start__); j++)
    {
    	if (v4[i] == _data_start__[j])
    		v5[i] = j + 1;
	}
    //printf("v5 %d %d\n", i, v5[i]);
  }
  for ( i = 0; i <= 11; ++i )
  {
    if ( v4[i] != _data_start__[*((char *)v5 + i) - 1] )
      return 0;
  }
  printf("%s%s%c", v6, v5, v10);
     
    return 0;
}

flag: flag{U9X_1S_W6@T?}