发现是MIPS,ida7.5支持直接反编译
进入主函数
int __fastcall main(int a1, char **a2, char **a3)
{
int result; // $v0
int i; // [sp+18h] [+18h] BYREF
char v5[36]; // [sp+1Ch] [+1Ch] BYREF
setbuf((FILE *)stdout, 0);
setbuf((FILE *)stdin, 0);
printf("Give me your flag:");
scanf("%32s", v5);
for ( i = 0; i < 32; ++i )
*((_BYTE *)&i + i + 4) ^= 32 - (_BYTE)i;
if ( !strncmp(v5, fdata, 5u) )
result = sub_4007F0(v5);
else
result = puts("Wrong");
return result;
}
看需输入32位
看汇编
int __fastcall sub_4007F0(const char *a1)
{
char v1; // $v1
int result; // $v0
size_t i; // [sp+18h] [+18h]
for ( i = 5; i < strlen(a1); ++i )
{
if ( (i & 1) != 0 )
v1 = (a1[i] >> 2) | (a1[i] << 6); //把低二位和高六位进行交换
else
v1 = (4 * a1[i]) | (a1[i] >> 6);
a1[i] = v1;
}
if ( !strncmp(a1 + 5, (const char *)off_410D04, 0x1Bu) )
result = puts("Right!");
else
result = puts("Wrong!");
return result;
}
python脚本
part1=b'Q|j{g'
part2='52 fd 16 a4 89 bd 92 80 13 41 54 a0 8d 45 18 81 de fc 95 f0 16 79 1a 15 5b 75 1f'
part2=list(bytes.fromhex(part2))
for i in range(5,len(part2)+5):
t = part2[i-5]
if i&1==0: #偶数时&1 为0
part2[i-5]=(t&0x3)<<6|(t&0xfc)>>2 #低2位左移6位,高6位右移2位 相当于循环右移2位
else:
part2[i-5]=(t&0x3f)<<2|(t&0xc0)>>6 #低6位左移2位,高2位右移6位 相当于循环左移2位
temp=list(part1)+part2
flag=''
for i in range(len(temp)):
flag+=chr(temp[i]^0x20 -i)
print(flag)
flag:qctf{ReA11y_4_B@89_mlp5_4_XmAn_}