BUUCTF reverse wp 21 - 30

最新推荐文章于 2023-10-07 11:52:34 发布

fa1c4

最新推荐文章于 2023-10-07 11:52:34 发布

阅读量212

点赞数

分类专栏：逆向工程文章标签：逆向

本文链接：https://blog.csdn.net/qq_33976344/article/details/125123399

版权

逆向工程专栏收录该内容

78 篇文章 9 订阅

订阅专栏

[ACTF新生赛2020]rome

在这里插入图片描述

无壳, 直接拖进IDA32
y键把v2改成char[49], n键重命名为iuput

int func()
{
  int result; // eax
  int v1[4]; // [esp+14h] [ebp-44h]
  char input[49]; // [esp+24h] [ebp-34h] BYREF

  strcpy(&input[23], "Qsw3sj_lz4_Ujw@l");
  printf("Please input:");
  scanf("%s", input);
  result = (unsigned __int8)input[0];
  if ( input[0] == 65 )
  {
    result = (unsigned __int8)input[1];
    if ( input[1] == 67 )
    {
      result = (unsigned __int8)input[2];
      if ( input[2] == 84 )
      {
        result = (unsigned __int8)input[3];
        if ( input[3] == 70 )
        {
          result = (unsigned __int8)input[4];
          if ( input[4] == 123 )
          {
            result = (unsigned __int8)input[21];
            if ( input[21] == 125 )
            {
              v1[0] = *(_DWORD *)&input[5];
              v1[1] = *(_DWORD *)&input[9];
              v1[2] = *(_DWORD *)&input[13];
              v1[3] = *(_DWORD *)&input[17];
              *(_DWORD *)&input[40] = 0;
              while ( *(int *)&input[40] <= 15 )
              {
                if ( *((char *)v1 + *(_DWORD *)&input[40]) > 64 && *((char *)v1 + *(_DWORD *)&input[40]) <= 90 )
                  *((_BYTE *)v1 + *(_DWORD *)&input[40]) = (*((char *)v1 + *(_DWORD *)&input[40]) - 51) % 26 + 65;
                if ( *((char *)v1 + *(_DWORD *)&input[40]) > 96 && *((char *)v1 + *(_DWORD *)&input[40]) <= 122 )
                  *((_BYTE *)v1 + *(_DWORD *)&input[40]) = (*((char *)v1 + *(_DWORD *)&input[40]) - 79) % 26 + 97;
                ++*(_DWORD *)&input[40];
              }
              *(_DWORD *)&input[40] = 0;
              while ( *(int *)&input[40] <= 15 )
              {
                result = (unsigned __int8)input[*(_DWORD *)&input[40] + 23];
                if ( *((_BYTE *)v1 + *(_DWORD *)&input[40]) != (_BYTE)result )
                  return result;
                ++*(_DWORD *)&input[40];
              }
              return printf("You are correct!");
            }
          }
        }
      }
    }
  }
  return result;
}

0-4位是'ACTF{'最后1位是'}'直接爆破5-20位

s = 'Qsw3sj_lz4_Ujw@l'
print(len(s))
brutestr = ''

def transchar(num):
    if num > ord('@') and num <= ord('Z'):
        return (num - ord('3')) % 26 + ord('A')
    if num > ord('`') and num <= ord('z'):
        return (num - ord('O')) % 26 + ord('a')
    return num

for i in range(16):
    for n in range(128):
        if transchar(n) == ord(s[i]):
            print(i, n)
            brutestr += chr(n)
            break

flag = 'ACTF{' + brutestr + '}'
print(len(flag), flag)

[FlareOn4]login

html写的flag checker

<!DOCTYPE Html />
<html>
    <head>
        <title>FLARE On 2017</title>
    </head>
    <body>
        <input type="text" name="flag" id="flag" value="Enter the flag" />
        <input type="button" id="prompt" value="Click to check the flag" />
        <script type="text/javascript">
            document.getElementById("prompt").onclick = function () {
                var flag = document.getElementById("flag").value;
                var rotFlag = flag.replace(/[a-zA-Z]/g, function(c){return String.fromCharCode((c <= "Z" ? 90 : 122) >= (c = c.charCodeAt(0) + 13) ? c : c - 26);});
                if ("PyvragFvqrYbtvafNerRnfl@syner-ba.pbz" == rotFlag) {
                    alert("Correct flag!");
                } else {
                    alert("Incorrect flag, rot again");
                }
            }
        </script>
    </body>
</html>

看到rotFlag那行, 可以猜测是rot13加密, 因为对每个字母字符做+13处理
最后要等于PyvragFvqrYbtvafNerRnfl@syner-ba.pbz, 直接解密得到flag
在线网址https://rot13.com/

[2019红帽杯]easyRE

无壳, 直接分析, string定位到关键字符串

__int64 sub_4009C6()
{
  __int64 result; // rax
  int i; // [rsp+Ch] [rbp-114h]
  __int64 v2; // [rsp+10h] [rbp-110h]
  __int64 v3; // [rsp+18h] [rbp-108h]
  __int64 v4; // [rsp+20h] [rbp-100h]
  __int64 v5; // [rsp+28h] [rbp-F8h]
  __int64 v6; // [rsp+30h] [rbp-F0h]
  __int64 v7; // [rsp+38h] [rbp-E8h]
  __int64 v8; // [rsp+40h] [rbp-E0h]
  __int64 v9; // [rsp+48h] [rbp-D8h]
  __int64 v10; // [rsp+50h] [rbp-D0h]
  __int64 v11; // [rsp+58h] [rbp-C8h]
  char v12[13]; // [rsp+60h] [rbp-C0h] BYREF
  char v13[4]; // [rsp+6Dh] [rbp-B3h] BYREF
  char v14[19]; // [rsp+71h] [rbp-AFh] BYREF
  char v15[32]; // [rsp+90h] [rbp-90h] BYREF
  int v16; // [rsp+B0h] [rbp-70h]
  char v17; // [rsp+B4h] [rbp-6Ch]
  char v18[72]; // [rsp+C0h] [rbp-60h] BYREF
  unsigned __int64 v19; // [rsp+108h] [rbp-18h]

  v19 = __readfsqword(0x28u);
  qmemcpy(v12, "Iodl>Qnb(ocy", 12);
  v12[12] = 127;
  qmemcpy(v13, "y.i", 3);
  v13[3] = 127;
  qmemcpy(v14, "d`3w}wek9{iy=~yL@EC", sizeof(v14));
  memset(v15, 0, sizeof(v15));
  v16 = 0;
  v17 = 0;
  sub_4406E0(0LL, v15, 37LL);
  v17 = 0;
  if ( sub_424BA0(v15) == 36 )
  {
    for ( i = 0; i < (unsigned __int64)sub_424BA0(v15); ++i )
    {
      if ( (unsigned __int8)(v15[i] ^ i) != v12[i] )
      {
        result = 4294967294LL;
        goto LABEL_13;
      }
    }
    sub_410CC0("continue!");
    memset(v18, 0, 0x40uLL);
    v18[64] = 0;
    sub_4406E0(0LL, v18, 64LL);
    v18[39] = 0;
    if ( sub_424BA0(v18) == 39 )
    {
      v2 = sub_400E44(v18);
      v3 = sub_400E44(v2);
      v4 = sub_400E44(v3);
      v5 = sub_400E44(v4);
      v6 = sub_400E44(v5);
      v7 = sub_400E44(v6);
      v8 = sub_400E44(v7);
      v9 = sub_400E44(v8);
      v10 = sub_400E44(v9);
      v11 = sub_400E44(v10);
      if ( !(unsigned int)sub_400360(v11, off_6CC090) )
      {
        sub_410CC0("You found me!!!");
        sub_410CC0("bye bye~");
      }
      result = 0LL;
    }
    else
    {
      result = 4294967293LL;
    }
  }
  else
  {
    result = 0xFFFFFFFFLL;
  }
LABEL_13:
  if ( __readfsqword(0x28u) != v19 )
    sub_444020();
  return result;
}

盲猜base64, 提取数据

from idaapi import *

bytes_addr = 0x00000000004A23A8
bytes_size = 0x00000000004A2690 - 0x00000000004A23A8
data = get_bytes(bytes_addr,bytes_size) 
print(data)

连续base64解码10次得到一个地址https://bbs.pediy.com/thread-254172-3.htm
进去之后看评论区, 得到flag (= =

非预期解属于是, 正解是定位到下面的一串字符串的交叉引用函数sub_400D35

unsigned __int64 sub_400D35()
{
  unsigned __int64 result; // rax
  unsigned int v1; // [rsp+Ch] [rbp-24h]
  int i; // [rsp+10h] [rbp-20h]
  int j; // [rsp+14h] [rbp-1Ch]
  unsigned int v4; // [rsp+24h] [rbp-Ch]
  unsigned __int64 v5; // [rsp+28h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  v1 = sub_43FD20(0LL) - qword_6CEE38;
  for ( i = 0; i <= 1233; ++i )
  {
    sub_40F790(v1);
    sub_40FE60();
    sub_40FE60();
    v1 = sub_40FE60() ^ 0x98765432;
  }
  v4 = v1;
  if ( ((unsigned __int8)v1 ^ byte_6CC0A0[0]) == 102 && (HIBYTE(v4) ^ (unsigned __int8)byte_6CC0A3) == 103 )
  {
    for ( j = 0; j <= 24; ++j )
      sub_410E90((unsigned __int8)(byte_6CC0A0[j] ^ *((_BYTE *)&v4 + j % 4)));
  }
  result = __readfsqword(0x28u) ^ v5;
  if ( result )
    sub_444020();
  return result;
}

就是异或处理, 查看byte_6CC0A0的数据, 就是刚刚base 字符串幌子的下面的一串数据
在这里插入图片描述
就是用flag作为已知明文求出密钥, 然后用密钥与输入进行异或得到的值, 与这arr一串数据比较

from idaapi import *

addr = 0x00000000006CC0A0
sizes = 0x00000000006CC0C0 - 0x00000000006CC0A0
data = get_bytes(addr, sizes)
print(data)

arr = []
for i in data:
    arr.append(i)
print(arr)

解密

#include<iostream>
#include<stdlib.h>
#include<string>
using namespace std;

int main() {
    int arr[] = {64, 53, 32, 86, 93, 24, 34, 69, 23, 47, 36, 110, 98, 60, 39, 84, 72, 108, 36, 110, 114, 60, 50, 69, 91};
    string str0 = "flag";
    int key[5] = {0};
    cout << sizeof(arr) / sizeof(arr[0]) << endl;

    for (int i = 0; i < 4; ++i) {
        key[i] = str0[i] ^ arr[i];
    }

    for (int i = 0; i < sizeof(arr) / sizeof(arr[0]); ++i) {
        cout << char(arr[i] ^ key[i % 4]);
    }
    cout << endl;
}

[GUET-CTF2019]re

在这里插入图片描述

upx脱壳, 拖入IDA

_BOOL8 __fastcall sub_4009AE(char *a1)
{
  if ( 1629056 * *a1 != 166163712 )
    return 0LL;
  if ( 6771600 * a1[1] != 731332800 )
    return 0LL;
  if ( 3682944 * a1[2] != 357245568 )
    return 0LL;
  if ( 10431000 * a1[3] != 1074393000 )
    return 0LL;
  if ( 3977328 * a1[4] != 489211344 )
    return 0LL;
  if ( 5138336 * a1[5] != 518971936 )
    return 0LL;
  if ( 7532250 * a1[7] != 406741500 )
    return 0LL;
  if ( 5551632 * a1[8] != 294236496 )
    return 0LL;
  if ( 3409728 * a1[9] != 177305856 )
    return 0LL;
  if ( 13013670 * a1[10] != 650683500 )
    return 0LL;
  if ( 6088797 * a1[11] != 298351053 )
    return 0LL;
  if ( 7884663 * a1[12] != 386348487 )
    return 0LL;
  if ( 8944053 * a1[13] != 438258597 )
    return 0LL;
  if ( 5198490 * a1[14] != 249527520 )
    return 0LL;
  if ( 4544518 * a1[15] != 445362764 )
    return 0LL;
  if ( 3645600 * a1[17] != 174988800 )
    return 0LL;
  if ( 10115280 * a1[16] != 981182160 )
    return 0LL;
  if ( 9667504 * a1[18] != 493042704 )
    return 0LL;
  if ( 5364450 * a1[19] != 257493600 )
    return 0LL;
  if ( 13464540 * a1[20] != 767478780 )
    return 0LL;
  if ( 5488432 * a1[21] != 312840624 )
    return 0LL;
  if ( 14479500 * a1[22] != 1404511500 )
    return 0LL;
  if ( 6451830 * a1[23] != 316139670 )
    return 0LL;
  if ( 6252576 * a1[24] != 619005024 )
    return 0LL;
  if ( 7763364 * a1[25] != 372641472 )
    return 0LL;
  if ( 7327320 * a1[26] != 373693320 )
    return 0LL;
  if ( 8741520 * a1[27] != 498266640 )
    return 0LL;
  if ( 8871876 * a1[28] != 452465676 )
    return 0LL;
  if ( 4086720 * a1[29] != 208422720 )
    return 0LL;
  if ( 9374400 * a1[30] == 515592000 )
    return 5759124 * a1[31] == 719890500;
  return 0LL;
}

直接解就行

a1 = chr(166163712 // 1629056)
a2 = chr(731332800 // 6771600)
a3 = chr(357245568 // 3682944)
a4 = chr(1074393000 // 10431000)
a5 = chr(489211344 // 3977328)
a6 = chr(518971936 // 5138336)
a8 = chr(406741500 // 7532250)
a9 = chr(294236496 // 5551632)
a10 = chr(177305856 // 3409728)
a11 = chr(650683500 // 13013670)
a12 = chr(298351053 // 6088797)
a13 = chr(386348487 // 7884663)
a14 = chr(438258597 // 8944053)
a15 = chr(249527520 // 5198490)
a16 = chr(445362764 // 4544518)
a17 = chr(981182160 // 10115280)
a18 = chr(174988800 // 3645600)
a19 = chr(493042704 // 9667504)
a20 = chr(257493600 // 5364450)
a21 = chr(767478780 // 13464540)
a22 = chr(312840624 // 5488432)
a23 = chr(1404511500 // 14479500)
a24 = chr(316139670 // 6451830)
a25 = chr(619005024 // 6252576)
a26 = chr(372641472 // 7763364)
a27 = chr(373693320 // 7327320)
a28 = chr(498266640 // 8741520)
a29 = chr(452465676 // 8871876)
a30 = chr(208422720 // 4086720)
a31 = chr(515592000 // 9374400)
a32 = chr(719890500 // 5759124)

print (a1,a2,a3,a4,a5,a6,a8,a9,a10,a11,a12,a13,a14,a15,a16,a17,a18,a19,a20,a21,a22,a23,a24,a25,a26,a27,a28,a29,a30,a31,a32)

最后差个a7, 爆破服务器得到1

[WUSTCTF2020]level1

在这里插入图片描述

无壳直接分析

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int i; // [rsp+4h] [rbp-2Ch]
  FILE *stream; // [rsp+8h] [rbp-28h]
  char ptr[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v7; // [rsp+28h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  stream = fopen("flag", "r");
  fread(ptr, 1uLL, 0x14uLL, stream);
  fclose(stream);
  for ( i = 1; i <= 19; ++i )
  {
    if ( (i & 1) != 0 )
      printf("%ld\n", (unsigned int)(ptr[i] << i));
    else
      printf("%ld\n", (unsigned int)(i * ptr[i]));
  }
  return 0;
}

i = 1 ~ 19, 奇数时左移i位, 偶数时乘上i; 结合output.txt

写逆

#include<stdlib.h>

int main () {
    long long arr[] = {198, 232, 816, 200, 1536, 300,
                    6144, 984, 51200, 570, 92160,
                    1200, 565248, 756, 1474560,
                    800, 6291456, 1782, 65536000
                    };

    for (int i = 1; i <= 19; ++i) {
        if ( (i & 1) != 0 )
            printf("%c", (arr[i - 1] >> i));
        else
            printf("%c", (arr[i - 1] / i));
    }
}

[SUCTF2019]SignIn

直接逆

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  char v4[16]; // [rsp+0h] [rbp-4A0h] BYREF
  char v5[16]; // [rsp+10h] [rbp-490h] BYREF
  char v6[16]; // [rsp+20h] [rbp-480h] BYREF
  char v7[16]; // [rsp+30h] [rbp-470h] BYREF
  char v8[112]; // [rsp+40h] [rbp-460h] BYREF
  char v9[1000]; // [rsp+B0h] [rbp-3F0h] BYREF
  unsigned __int64 v10; // [rsp+498h] [rbp-8h]

  v10 = __readfsqword(0x28u);
  puts("[sign in]");
  printf("[input your flag]: ");
  __isoc99_scanf("%99s", v8);
  sub_96A(v8, v9);
  __gmpz_init_set_str(v7, "ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35", 16LL);
  __gmpz_init_set_str(v6, v9, 16LL);
  __gmpz_init_set_str(v4, "103461035900816914121390101299049044413950405173712170434161686539878160984549", 10LL);
  __gmpz_init_set_str(v5, "65537", 10LL);
  __gmpz_powm(v6, v6, v5, v4);
  if ( (unsigned int)__gmpz_cmp(v6, v7) )
    puts("GG!");
  else
    puts("TTTTTTTTTTql!");
  return 0LL;
}

输入的数经过sub_96A, 执行 $x^{65537} \% 103461035900816914121390101299049044413950405173712170434161686539878160984549$ 运算后与ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35比较
归约到RSA大数分解问题
M = ?
E = 65537
C = ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35
N = 103461035900816914121390101299049044413950405173712170434161686539878160984549
分解N得到
P = 282164587459512124844245113950593348271
Q = 366669102002966856876605669837014229419

可以写解密脚本

import gmpy2
import binascii

n = 103461035900816914121390101299049044413950405173712170434161686539878160984549
e = 65537
p = 282164587459512124844245113950593348271
q = 366669102002966856876605669837014229419
c = 0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35

d = gmpy2.invert(e,(p-1)*(q-1))
m = gmpy2.powmod(c,d,n)
print(binascii.unhexlify(hex(m)[2:]).decode(encoding="utf-8"))

[MRCTF2020]Transform

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Str[104]; // [rsp+20h] [rbp-70h] BYREF
  int j; // [rsp+88h] [rbp-8h]
  int i; // [rsp+8Ch] [rbp-4h]

  sub_402230(argc, argv, envp);
  sub_40E640("Give me your code:\n");
  sub_40E5F0("%s", Str);
  if ( strlen(Str) != 33 )                      // 32 bytes length
  {
    sub_40E640("Wrong!\n");
    system("pause");
    exit(0);
  }
  for ( i = 0; i <= 32; ++i )
  {
    byte_414040[i] = Str[dword_40F040[i]];
    byte_414040[i] ^= LOBYTE(dword_40F040[i]);  // byte_414040[i] = Str[dword_40F040[i]] ^ dword_40F040[i]
  }
  for ( j = 0; j <= 32; ++j )
  {
    if ( byte_40F0E0[j] != byte_414040[j] )
    {
      sub_40E640("Wrong!\n");
      system("pause");
      exit(0);
    }
  }
  sub_40E640("Right!Good Job!\n");
  sub_40E640("Here is your flag: %s\n", Str);
  system("pause");
  return 0;
}

rev

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

unsigned char indexs[] =
{
    9,   0,   0,   0,  10,   0,   0,   0,  15,   0, 
    0,   0,  23,   0,   0,   0,   7,   0,   0,   0, 
   24,   0,   0,   0,  12,   0,   0,   0,   6,   0, 
    0,   0,   1,   0,   0,   0,  16,   0,   0,   0, 
    3,   0,   0,   0,  17,   0,   0,   0,  32,   0, 
    0,   0,  29,   0,   0,   0,  11,   0,   0,   0, 
   30,   0,   0,   0,  27,   0,   0,   0,  22,   0, 
    0,   0,   4,   0,   0,   0,  13,   0,   0,   0, 
   19,   0,   0,   0,  20,   0,   0,   0,  21,   0, 
    0,   0,   2,   0,   0,   0,  25,   0,   0,   0, 
    5,   0,   0,   0,  31,   0,   0,   0,   8,   0, 
    0,   0,  18,   0,   0,   0,  26,   0,   0,   0, 
   28,   0,   0,   0,  14,   0,   0,   0,   0,   0
};

unsigned char testvalues[] =
{
  103, 121, 123, 127, 117,  43,  60,  82,  83, 121, 
   87,  94,  93,  66, 123,  45,  42, 102,  66, 126, 
   76,  87, 121,  65, 107, 126, 101,  60,  92,  69, 
  111,  98,  77,   0,   0,   0,   0,   0,   0,   0
};

int main(int argc, char **argv) 
{
    char flag[33] = "\x00";
    int i = 0;
    for (i = 0; i < 32; ++i) 
    {
        int pos = indexs[i*4];
        // printf("%d\n", indexs[i*4]);
        flag[pos] = indexs[i*4] ^ testvalues[i];  
        // printf("%d %c\n", flag[pos], flag[pos]); 
    }
    printf("flag: %s\n", flag + 1);
}

[WUSTCTF2020]level2

在这里插入图片描述

脱壳，拉进IDA, shift + f12
在这里插入图片描述

完事

[ACTF新生赛2020]usualCrypt

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // esi
  int v5[3]; // [esp+8h] [ebp-74h] BYREF
  __int16 v6; // [esp+14h] [ebp-68h]
  char v7; // [esp+16h] [ebp-66h]
  char v8[100]; // [esp+18h] [ebp-64h] BYREF

  sub_403CF8(&unk_40E140);
  scanf("%s", v8);
  memset(v5, 0, sizeof(v5));
  v6 = 0;
  v7 = 0;
  sub_401080(v8, strlen(v8), v5);
  v3 = 0;
  while ( *((_BYTE *)v5 + v3) == byte_40E0E4[v3] )
  {
    if ( ++v3 > strlen((const char *)v5) )
      goto LABEL_6;
  }
  sub_403CF8(aError);
LABEL_6:
  if ( v3 - 1 == strlen(byte_40E0E4) )
    return sub_403CF8(aAreYouHappyYes);
  else
    return sub_403CF8(aAreYouHappyNo);
}

int __cdecl sub_401080(int a1, int a2, int a3)
{
  int v3; // edi
  int v4; // esi
  int v5; // edx
  int v6; // eax
  int v7; // ecx
  int v8; // esi
  int v9; // esi
  int v10; // esi
  int v11; // esi
  _BYTE *v12; // ecx
  int v13; // esi
  int v15; // [esp+18h] [ebp+8h]

  v3 = 0;
  v4 = 0;
  sub_401000();
  v5 = a2 % 3;
  v6 = a1;
  v7 = a2 - a2 % 3;
  v15 = a2 % 3;
  if ( v7 > 0 )
  {
    do
    {
      LOBYTE(v5) = *(_BYTE *)(a1 + v3);
      v3 += 3;
      v8 = v4 + 1;
      *(_BYTE *)(v8 + a3 - 1) = byte_40E0A0[(v5 >> 2) & 0x3F];
      *(_BYTE *)(++v8 + a3 - 1) = byte_40E0A0[16 * (*(_BYTE *)(a1 + v3 - 3) & 3)
                                            + (((int)*(unsigned __int8 *)(a1 + v3 - 2) >> 4) & 0xF)];
      *(_BYTE *)(++v8 + a3 - 1) = byte_40E0A0[4 * (*(_BYTE *)(a1 + v3 - 2) & 0xF)
                                            + (((int)*(unsigned __int8 *)(a1 + v3 - 1) >> 6) & 3)];
      v5 = *(_BYTE *)(a1 + v3 - 1) & 0x3F;
      v4 = v8 + 1;
      *(_BYTE *)(v4 + a3 - 1) = byte_40E0A0[v5];
    }
    while ( v3 < v7 );
    v5 = v15;
  }
  if ( v5 == 1 )
  {
    LOBYTE(v7) = *(_BYTE *)(v3 + a1);
    v9 = v4 + 1;
    *(_BYTE *)(v9 + a3 - 1) = byte_40E0A0[(v7 >> 2) & 0x3F];
    v10 = v9 + 1;
    *(_BYTE *)(v10 + a3 - 1) = byte_40E0A0[16 * (*(_BYTE *)(v3 + a1) & 3)];
    *(_BYTE *)(v10 + a3) = 61;
LABEL_8:
    v13 = v10 + 1;
    *(_BYTE *)(v13 + a3) = 61;
    v4 = v13 + 1;
    goto LABEL_9;
  }
  if ( v5 == 2 )
  {
    v11 = v4 + 1;
    *(_BYTE *)(v11 + a3 - 1) = byte_40E0A0[((int)*(unsigned __int8 *)(v3 + a1) >> 2) & 0x3F];
    v12 = (_BYTE *)(v3 + a1 + 1);
    LOBYTE(v6) = *v12;
    v10 = v11 + 1;
    *(_BYTE *)(v10 + a3 - 1) = byte_40E0A0[16 * (*(_BYTE *)(v3 + a1) & 3) + ((v6 >> 4) & 0xF)];
    *(_BYTE *)(v10 + a3) = byte_40E0A0[4 * (*v12 & 0xF)];
    goto LABEL_8;
  }
LABEL_9:
  *(_BYTE *)(v4 + a3) = 0;
  return sub_401030(a3);
}

经过sub_401080处理后, 与硬编码数据比较

int sub_401000()
{
  int result; // eax
  char v1; // cl

  for ( result = 6; result < 15; ++result )
  {
    v1 = byte_40E0AA[result];
    byte_40E0AA[result] = byte_40E0A0[result];
    byte_40E0A0[result] = v1;
  }
  return result;
}

会进行base64变表, 然后base64编码, 再转换大小写

int __cdecl sub_401030(const char *a1)
{
  __int64 v1; // rax
  char v2; // al

  v1 = 0i64;
  if ( strlen(a1) )
  {
    do
    {
      v2 = a1[HIDWORD(v1)];
      if ( v2 < 97 || v2 > 122 )
      {
        if ( v2 < 65 || v2 > 90 )
          goto LABEL_9;
        LOBYTE(v1) = v2 + 32;
      }
      else
      {
        LOBYTE(v1) = v2 - 32;
      }
      a1[HIDWORD(v1)] = v1;
LABEL_9:
      LODWORD(v1) = 0;
      ++HIDWORD(v1);
    }
    while ( HIDWORD(v1) < strlen(a1) );
  }
  return v1;
}

REV

import base64
import string

changelist = list('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')
origintable = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
testValue = 'zMXHz3TIgnxLxJhFAdtZn2fFk3lYCrtPC2l9'

for i in range(6, 15):
    changelist[i], changelist[i+10] = changelist[i+10], changelist[i]

changetable = ''.join(changelist)
testValue = testValue.swapcase()
flag = base64.b64decode(testValue.translate(str.maketrans(changetable, origintable)))
print(flag)

Youngter-drive

在这里插入图片描述

如果运行时报错缺少dll, 或者0xc000007b错误, 去dll修复 / 检查system的dll文件版本(32bits / 64bits)解决
注意看文档, 32bit dll放在syswow64, 64bit dll放在system32, 不要想当然乱放
参考:
https://blog.csdn.net/VeryDelicious/article/details/119278996
https://blog.csdn.net/qq_16645423/article/details/83743220
https://www.dll-files.com/download/d57e2eda325bac8081fd054209d736ae/msvcr100d.dll.html?c=OWhmSFQ4MDZnTnpQQjE0Y2MyUHBqZz09

脱壳, 拖进IDA32

int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  void *v3; // ecx
  HANDLE Thread; // [esp+D0h] [ebp-14h]
  HANDLE hObject; // [esp+DCh] [ebp-8h]

  j_Inputs(v3);
  ::hObject = CreateMutexW(0, 0, 0);
  j_strcpy(Destination, Source);
  hObject = CreateThread(0, 0, StartAddress, 0, 0, 0);
  Thread = CreateThread(0, 0, sub_41119F, 0, 0, 0);
  CloseHandle(hObject);
  CloseHandle(Thread);
  while ( cnt != -1 )
    ;
  j_testfunc();
  CloseHandle(::hObject);
  return 0;
}

int sub_411880()
{
  int i; // [esp+D0h] [ebp-8h]

  for ( i = 0; i < 29; ++i )
  {
    if ( Source[i] != off_418004[i] )
      exit(0);
  }
  return printf("\nflag{%s}\n\n", Destination);
}

// positive sp value has been detected, the output may be wrong!
char *__cdecl sub_411940(int a1, int a2)
{
  char *result; // eax
  char v3; // [esp+D3h] [ebp-5h]

  v3 = *(_BYTE *)(a2 + a1);
  if ( (v3 < 'a' || v3 > 122) && (v3 < 65 || v3 > 90) )// check upper & lower chars
    exit(0);
  if ( v3 < 97 || v3 > 122 )                    // not lower chars
  {
    result = off_418000[0];
    *(_BYTE *)(a2 + a1) = off_418000[0][*(char *)(a2 + a1) - 38];
  }
  else                                          // lower chars
  {
    result = off_418000[0];
    *(_BYTE *)(a2 + a1) = off_418000[0][*(char *)(a2 + a1) - 96];
  }
  return result;
}

根据大小写字母相对QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm的位置进行置换, 输入串长度为30(坑点, 最后比较的串只有29长, 最后一位理论上是随意输入都可以通过, 不过BUU这里是E, 只能说程序写的有问题)
同时注意该程序是多线程编程, 两个线程一个有process函数, 一个没有, 单纯是cnt--, 所以是奇数序数处理, 偶数维持不变
REV

#include <stdlib.h>
#include <iostream>
#include <stdio.h>
#include <string>
using namespace std;

void revfunc(string source, int cnt, const string changetable, char *flag) {
    char v3 = source[cnt];
    if ( (v3 < 97 || v3 > 122) && (v3 < 65 || v3 > 90) ) {
        // check upper & lower chars
        cout << v3 << endl;
        cout << "invalid char" << endl;
        exit(0);
    }
    cout << v3 << changetable.find(v3) << endl;
    if ( v3 < 97 || v3 > 122 ) { // not lower chars
        flag[cnt] = changetable.find(v3) + 96;
    }
    else { // lower chars
        flag[cnt] = changetable.find(v3) + 38;
    }
}

int main() {
    string testValues = "TOiZiZtOrYaToUwPnToBsOaOapsySE"; // 29 length but 30 actually
    string changetable = "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm";
    char flag[31] = "TOiZiZtOrYaToUwPnToBsOaOapsySE"; // last char is E on BUUCTF = =
    cout << testValues.size() << endl;
    for (int i = 28; i >= 0; --i)
        if (i % 2 == 1)
            revfunc(testValues, i, changetable, flag);   

    cout << sizeof(flag) << ' ' << flag << endl;
}