BUUCTF Reverse/[GUET-CTF2019]re

BUUCTF Reverse/[GUET-CTF2019]re

先查一下文件信息，发现是UPX加壳

用kali脱壳

得到脱壳后的文件

用IDA64位打开，跟踪跳转

__int64 __fastcall sub_400E28(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  int v6; // edx
  int v7; // ecx
  int v8; // er8
  int v9; // er9
  __int64 result; // rax
  __int64 v11[5]; // [rsp+0h] [rbp-30h] BYREF
  unsigned __int64 v12; // [rsp+28h] [rbp-8h]

  v12 = __readfsqword(0x28u);
  v11[1] = 0LL;
  v11[2] = 0LL;
  v11[3] = 0LL;
  sub_40F950((__int64)"input your flag:", a2, a3, a4, a5, a6);
  sub_40FA80((unsigned int)"%s", (unsigned int)v11, v6, v7, v8, v9, 0);
  if ( sub_4009AE((char *)v11) )
    sub_410350("Correct!");
  else
    sub_410350("Wrong!");
  result = 0LL;
  if ( __readfsqword(0x28u) != v12 )
    sub_443550();
  return result;
}

跟进这个函数

 if ( sub_4009AE((char *)v11) )

_BOOL8 __fastcall sub_4009AE(char *a1)
{
  if ( 1629056 * *a1 != 166163712 )
    return 0LL;
  if ( 6771600 * a1[1] != 731332800 )
    return 0LL;
  if ( 3682944 * a1[2] != 357245568 )
    return 0LL;
  if ( 10431000 * a1[3] != 1074393000 )
    return 0LL;
  if ( 3977328 * a1[4] != 489211344 )
    return 0LL;
  if ( 5138336 * a1[5] != 518971936 )
    return 0LL;
  if ( 7532250 * a1[7] != 406741500 )
    return 0LL;
  if ( 5551632 * a1[8] != 294236496 )
    return 0LL;
  if ( 3409728 * a1[9] != 177305856 )
    return 0LL;
  if ( 13013670 * a1[10] != 650683500 )
    return 0LL;
  if ( 6088797 * a1[11] != 298351053 )
    return 0LL;
  if ( 7884663 * a1[12] != 386348487 )
    return 0LL;
  if ( 8944053 * a1[13] != 438258597 )
    return 0LL;
  if ( 5198490 * a1[14] != 249527520 )
    return 0LL;
  if ( 4544518 * a1[15] != 445362764 )
    return 0LL;
  if ( 3645600 * a1[17] != 174988800 )
    return 0LL;
  if ( 10115280 * a1[16] != 981182160 )
    return 0LL;
  if ( 9667504 * a1[18] != 493042704 )
    return 0LL;
  if ( 5364450 * a1[19] != 257493600 )
    return 0LL;
  if ( 13464540 * a1[20] != 767478780 )
    return 0LL;
  if ( 5488432 * a1[21] != 312840624 )
    return 0LL;
  if ( 14479500 * a1[22] != 1404511500 )
    return 0LL;
  if ( 6451830 * a1[23] != 316139670 )
    return 0LL;
  if ( 6252576 * a1[24] != 619005024 )
    return 0LL;
  if ( 7763364 * a1[25] != 372641472 )
    return 0LL;
  if ( 7327320 * a1[26] != 373693320 )
    return 0LL;
  if ( 8741520 * a1[27] != 498266640 )
    return 0LL;
  if ( 8871876 * a1[28] != 452465676 )
    return 0LL;
  if ( 4086720 * a1[29] != 208422720 )
    return 0LL;
  if ( 9374400 * a1[30] == 515592000 )
    return 5759124 * a1[31] == 719890500;
  return 0LL;
}

写出脚本

#include <stdlib.h>
#include <stdio.h>
#include <string.h>








int main()
{
   int a1[32] = {0};
    a1[0] = 166163712 / 1629056;
    a1[1] = 731332800 / 6771600;
     a1[2] = 357245568/3682944 ;
   a1[3] = 1074393000  / 10431000;
   a1[4] = 489211344/3977328 ;
   a1[5] = 518971936 / 5138336 ;
  a1[7] = 406741500  / 7532250;
 a1[8] = 294236496 / 5551632 ;
  a1[9] = 177305856 /3409728 ;
  a1[10] = 650683500/13013670 ;
  a1[11] = 298351053 /6088797;
  a1[12] = 386348487 / 7884663 ;
   a1[13] = 438258597 / 8944053 ;
   a1[14] = 249527520 /5198490;
   a1[15] = 445362764/4544518 ;
   a1[17] = 174988800 /3645600;
  a1[16] = 981182160/10115280 ;
a1[18] = 493042704 /9667504;
a1[19] = 257493600 /5364450 ;
 a1[20] = 767478780 /13464540;
 a1[21] = 312840624 /5488432;
a1[22] = 1404511500/14479500 ;
 a1[23] = 316139670 / 6451830;
  a1[24] = 619005024 /6252576;
 a1[25] = 372641472 /7763364;
    a1[26] = 373693320 /7327320;
  a1[27] = 498266640 /8741520;
   a1[28] = 452465676/8871876 ;
  a1[29] = 208422720 /4086720;
  a1[30] = 515592000/9374400 ;
  a1[31] = 719890500/5759124;
  for(int i = 0 ; i < 32; i++)
  {
      printf("%c",a1[i]);
  }
   return 0;

}

运行得到结果

中间有一位数缺了，暴力破解得到这位数为1

得到最终flag：flag{e165421110ba03099a1c039337}