攻防世界babymips

发现是MIPS，ida7.5支持直接反编译
进入主函数

int __fastcall main(int a1, char **a2, char **a3)
{
  int result; // $v0
  int i; // [sp+18h] [+18h] BYREF
  char v5[36]; // [sp+1Ch] [+1Ch] BYREF

  setbuf((FILE *)stdout, 0);
  setbuf((FILE *)stdin, 0);
  printf("Give me your flag:");
  scanf("%32s", v5);
  for ( i = 0; i < 32; ++i )
    *((_BYTE *)&i + i + 4) ^= 32 - (_BYTE)i;
  if ( !strncmp(v5, fdata, 5u) )
    result = sub_4007F0(v5);
  else
    result = puts("Wrong");
  return result;
}

看需输入32位
看汇编

int __fastcall sub_4007F0(const char *a1)
{
  char v1; // $v1
  int result; // $v0
  size_t i; // [sp+18h] [+18h]

  for ( i = 5; i < strlen(a1); ++i )
  {
    if ( (i & 1) != 0 )
      v1 = (a1[i] >> 2) | (a1[i] << 6);  //把低二位和高六位进行交换
    else
      v1 = (4 * a1[i]) | (a1[i] >> 6);
    a1[i] = v1;
  }
  if ( !strncmp(a1 + 5, (const char *)off_410D04, 0x1Bu) )
    result = puts("Right!");
  else
    result = puts("Wrong!");
  return result;
}

python脚本

part1=b'Q|j{g'
part2='52 fd 16 a4 89 bd 92 80 13 41 54 a0 8d 45 18 81 de fc 95 f0 16 79 1a 15 5b 75 1f'
part2=list(bytes.fromhex(part2))
for i in range(5,len(part2)+5):
    t = part2[i-5]
    if i&1==0:   #偶数时&1 为0
        part2[i-5]=(t&0x3)<<6|(t&0xfc)>>2   #低2位左移6位，高6位右移2位  相当于循环右移2位
    else:
        part2[i-5]=(t&0x3f)<<2|(t&0xc0)>>6  #低6位左移2位，高2位右移6位  相当于循环左移2位

temp=list(part1)+part2
flag=''
for i in range(len(temp)):
    flag+=chr(temp[i]^0x20 -i)
print(flag)

flag：qctf{ReA11y_4_B@89_mlp5_4_XmAn_}