题目描述如下:
根据题目描述可知此题的目的是让分析程序加密过程,然后根据密文和密钥还原出明文。
将得到的pe文件放入IDA,定位到关键处:
查看伪代码,很容易发现加密函数:
跟踪进去,发现加密过程的两个关键函数:
_BYTE *__cdecl sub_401240(char *a1, char *a2)
{
_BYTE *v3; // [esp+50h] [ebp-14h]
int v4; // [esp+54h] [ebp-10h]
signed int i; // [esp+58h] [ebp-Ch]
size_t v6; // [esp+5Ch] [ebp-8h]
signed int v7; // [esp+60h] [ebp-4h]
v7 = strlen(a1);
v6 = strlen(a2);
v4 = 0;
v3 = operator new(0xFFu);
for ( i = 0; i < v7; ++i )
{
if ( v4 == v6 )
v4 = 0;
v3[i] = sub_401005(a1[i], a2[v4++]);
}
v3[i] = 0;
return v3;
}
char __cdecl sub_401170(char a1, char a2)
{
char result; // al
int i; // [esp+4Ch] [ebp-8h]
char v4; // [esp+5Ch] [ebp+8h]
char v5; // [esp+60h] [ebp+Ch]
v4 = toupper(a1);
v5 = toupper(a2);
if ( v4 == 32 )
return v4;
for ( i = 0; i < v4 - 65; ++i )
++v5;
if ( v5 > 90 )
result = v5 - 25;
else
result = v5;
return result;
}
逻辑并不复杂,大致加密过程为单个字符处理明文,将明文字符转变为大写字母后根据ASCII码表结合密钥key对明文做移位变换得到密文;根据伪代码编写如下解密脚本得到flag:
ciphertext = 'QWDRILDWNTW'
key = 'ilovemoctf'
v4 = 0
plaintext = ''
for i in range(len(ciphertext)):
if v4 == len(key):
v4 = 0
a1 = ord(ciphertext[i].upper())
a2 = ord(key[v4].upper())
v4 += 1
if a1 == 32:
plaintext += chr(a1)
continue
if a1 < a2:
plaintext += chr(a1 + 25 - a2 + 65)
else:
plaintext += chr(a1 - a2 + 65)
print(plaintext)