ADworld reverse wp - babymips

*(&i + i + 4) ^= 32 - i; 其实是对v5数组进行操作. &i + 4是v5起始地址, 观察栈帧得知. 之后对比fdata的5个字节数据

再进入sub_4007F0进行检查, 分别处理奇偶两种情况
奇数: v1 = (a1[i] >> 2) | (a1[i] << 6);
偶数: v1 = (4 * a1[i]) | (a1[i] >> 6);
a1[i] = v1
再和off_410D04的数据进行对比, 共0x1B = 27个字节数据

有位运算或, 不好直接逆向还原, 采用爆破形式, 出逆向脚本

data = [
    0x51, 0x7C, 0x6A, 0x7B, 0x67, 0x52, 0xFD, 0x16, 
    0xA4, 0x89, 0xBD, 0x92, 0x80, 0x13, 0x41, 0x54, 
    0xA0, 0x8D, 0x45, 0x18, 0x81, 0xDE, 0xFC, 0x95, 
    0xF0, 0x16, 0x79, 0x1A, 0x15, 0x5B, 0x75, 0x1F
]

flag = ""

for i in range(32):
    if i < 5:
        for j in range(1, 127):
            temp = j
            temp ^= 32 - i
            if temp == data[i]: 
                flag += chr(j)
                break
    else:
        for j in range(1, 127):
            temp = j
            temp ^= 32 - i
            if i % 2 == 1: 
                temp = (temp >> 2 | temp << 6) & 0xff
            else: temp = (4 * temp | temp >> 6) &0xff
            if temp == data[i]: 
                flag += chr(j)
                break

print(flag)

qctf{ReA11y_4_B@89_mlp5_4_XmAn_}