XCTF----babyxor

1。拿到文件，进行查壳

未知壳，使用OD进行手动脱壳（ESP定律法脱壳---- (20条消息) 破解入门（五）-----实战"ESP定律法"脱壳_lelexin的博客-CSDN博客）

2.脱壳后，拖入IDA进行分析

代码并不复杂，直接上脚本

a1=[0x66,0x6d,0x63,0x64,0x7f,0x37,0x35,0x30,0x30,0x6b,0x3a,0x3c,0x3b,0x20]
a2=[0x37,0x6f,0x38,0x62,0x36,0x7c,0x37,0x33,0x34,0x76,0x33,0x62,0x64,0x7a]
a3=[0x1a,0,0,0x51,0x5,0x11,0x54,0x56,0x55,0x59,0x1d,0x9,0x5d,0x12,0,0]
s=''
s2=[]
for x in range(0,14):
    s+=chr(x ^ a1[x])
print(s)
s+=chr(a2[0])
s2.append(a2[0])
for  x in range(1,14):
    s+=chr(a1[x]^a2[x]^a1[x-1])
    s2.append(a1[x]^a2[x]^a1[x-1])
print(s2)
s+=chr(a3[0]^a2[0])
for x in range(0,13):
    s+=chr(x^(a3[x+1]^s2[x]))

print(s)

 

得到flag为 flag{2378b077-7d6e-4564-bdca-7eec8eede9a2}

总结：本题的难点主要在于OD脱壳