BUUCTF Reverse/[GWCTF 2019]xxor
查看文件信息发现没有加壳
直接IDA查看代码
__int64 __fastcall main(int a1, char **a2, char **a3)
{
int i; // [rsp+8h] [rbp-68h]
int j; // [rsp+Ch] [rbp-64h]
__int64 v6[6]; // [rsp+10h] [rbp-60h]
__int64 v7[6]; // [rsp+40h] [rbp-30h] BYREF
v7[5] = __readfsqword(0x28u);
puts("Let us play a game?");
puts("you have six chances to input");
puts("Come on!");
v6[0] = 0LL;
v6[1] = 0LL;
v6[2] = 0LL;
v6[3] = 0LL;
v6[4] = 0LL;
for ( i = 0; i <= 5; ++i )
{
printf("%s", "input: ");
__isoc99_scanf("%d");
}
v7[0] = 0LL;
v7[1] = 0LL;
v7[2] = 0LL;
v7[3] = 0LL;
v7[4] = 0LL;
for ( j = 0; j <= 2; ++j )
{
dword_601078 = v6[j];
dword_60107C = HIDWORD(v6[j]);
sub_400686((unsigned int *)&dword_601078, dword_601060);
LODWORD(v7[j]) = dword_601078;
HIDWORD(v7[j]) = dword_60107C;
}
if ( (unsigned int)sub_400770(v7) != 1 )
{
puts("NO NO NO~ ");
exit(0);
}
puts("Congratulation!\n");
puts("You seccess half\n");
puts("Do not forget to change input to hex and combine~\n");
puts("ByeBye");
return 0LL;
}
又是字符串比较的题
要输出flag正确就要让if中的条件不成立
dup是重复的意思,意思就是重复了两个2 , 相当于dd 2,2,3,4
根据这个可以推出v7中的值
__int64 __fastcall sub_400770(_DWORD *a1)
{
__int64 result; // rax
if ( a1[2] - a1[3] == 2225223423LL
&& a1[3] + a1[4] == 4201428739LL
&& a1[2] - a1[4] == 1121399208LL
&& *a1 == 3746099070
&& a1[5] == 2230518816
&& a1[1] == 550153460 )
{
puts("good!");
result = 1LL;
}
else
{
puts("Wrong!");
result = 0LL;
}
return result;
}
得到:
v7[0] = 3746099070;
v7[1] = 550153460;
v7[2] = 3774025685;
v7[3] = 1548802262;
v7[4] = 2652626477;
v7[5] = 2230518816;
再根据这个变换函数写出相应脚本
__int64 __fastcall sub_400686(unsigned int *a1, _DWORD *a2)
{
__int64 result; // rax
unsigned int v3; // [rsp+1Ch] [rbp-24h]
unsigned int v4; // [rsp+20h] [rbp-20h]
int v5; // [rsp+24h] [rbp-1Ch]
unsigned int i; // [rsp+28h] [rbp-18h]
v3 = *a1;
v4 = a1[1];
v5 = 0;
for ( i = 0; i <= 63; ++i )
{
v5 += 1166789954;
v3 += (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
v4 += (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
}
*a1 = v3;
result = v4;
a1[1] = v4;
return result;
}
脚本
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main()
{
int i,j;
int a2[] = {2,2,3,4};
unsigned int v7[7];
v7[0] = 3746099070;
v7[1] = 550153460;
v7[2] = 3774025685;
v7[3] = 1548802262;
v7[4] = 2652626477;
v7[5] = 2230518816;
for(i = 0; i < 6 ; i += 2)
{
unsigned int v3 = v7[i];
unsigned int v4 = v7[i + 1];
long long int v5 = 64 * 1166789954;
for(j = 0 ; j < 64; j++)
{
v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + a2[0]) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
v5 -= 1166789954;
}
v7[i] = v3;
v7[i + 1] = v4;
}
for(i = 0 ; i < 6; i++)
{
printf("%c",v7[i]);
}
return 0;
}
运行结果
得到了错误的答案,搞得我在这里耗了很多时间,然后才看到这个有句提示
然后将输出改为16进制
printf("%x",v7[i]);
最终脚本
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main()
{
int i,j;
int a2[] = {2,2,3,4};
unsigned int v7[7];
v7[0] = 3746099070;
v7[1] = 550153460;
v7[2] = 3774025685;
v7[3] = 1548802262;
v7[4] = 2652626477;
v7[5] = 2230518816;
for(i = 0; i < 6 ; i += 2)
{
unsigned int v3 = v7[i];
unsigned int v4 = v7[i + 1];
long long int v5 = 64 * 1166789954;
for(j = 0 ; j < 64; j++)
{
v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + a2[0]) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
v5 -= 1166789954;
}
v7[i] = v3;
v7[i + 1] = v4;
}
for(i = 0 ; i < 6; i++)
{
printf("%x",v7[i]);
}
return 0;
}
运行结果
得到flag : flag{re_is_great!}