BUUCTF Reverse/[ACTF新生赛2020]rome

BUUCTF Reverse/[ACTF新生赛2020]rome

先看文件信息，没有加壳，是一个32位程序

打开运行，推测又是字符串比较的题目

拖入IDA32位进行分析，依旧是先找字符串

跟踪跳转，来到func()函数

int func()
{
   
  int result; // eax
  int v1[4]; // [esp+14h] [ebp-44h]
  unsigned __int8 v2; // [esp+24h] [ebp-34h] BYREF
  unsigned __int8 v3; // [esp+25h] [ebp-33h]
  unsigned __int8 v4; // [esp+26h] [ebp-32h]
  unsigned __int8 v5; // [esp+27h] [ebp-31h]
  unsigned __int8 v6; // [esp+28h] [ebp-30h]
  int v7; // [esp+29h] [ebp-2Fh]
  int v8; // [esp+2Dh] [ebp-2Bh]
  int v9; // [esp+31h] [ebp-27h]
  int v10; // [esp+35h] [ebp-23h]
  unsigned __int8 v11; // [esp+39h] [ebp-1Fh]
  char v12[29]; // [esp+3Bh] [ebp-1Dh] BYREF

  strcpy(v12, "Qsw3sj_lz4_Ujw@l");
  printf("Please input:");
  scanf("%s", &v2);
  result = v2;
  if ( v2 == 65 )
  {
   
    result = v3;
    if ( v3 == 67 )
    {
   
      result = v4;
      if ( v4 == 84 )
      {
   
        result = v5;
        if ( v5 == 70 )
        {
   
          result = v6;
          if ( v6 == 123 )
          {
   
            result = v11;
            if ( v11 == 125 )
            {
   
              v1[0] = v7;
              v1[1] = v8;
              v1[2] = v9;
              v1[3] = v10;
              *(_DWORD *)&v12[17]