记录一次有趣的逆向题

记录一次有趣的逆向题

查壳

无壳 32 c语言

逆向

原逆向

简单分析后

先看base64 是否换表

（base64加密算法有个坑

确实换表了

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/

分析这条语句

v7[i] += LOBYTE(key_table[((unsigned __int16)(((_WORD)i + 1) << 8) - Str[i]) >> 8]);

发现本质是

v7[i] += key_table[i];

Str[i]并未实质参加运算

原因：char型为8位

1<<8 = 100000000（2进制）减去任意一个char = 0xxxxxxxx >>8 = 0

v7[i] = Str[key_table[i]];

这个其实很简单 就是个字典 不过多赘述

enc = [0xcb,0x4b,0x5f,0xe4,0x6b,0xa5,0xd0,0x62,0x54,0xc3,0xaa,0x4d,0xc5,0x7d,0x60,0xb9,0x53,0x6b,0xd6,0x4f,0x79,0xe9,0x33,0x70,0xbc,0x67,0x1e,0xef,0x49,0x66,0xc5,0x52,0x77,0xf5,0x47,0x5f,0x00,0x81]
# cyberchef yyds
key_table = [0x00000019, 0x0000000D, 0x00000004, 0x00000000, 0x00000002, 0x0000001F, 0x00000020, 0x00000003, 0x00000013, 0x00000011, 0x00000025, 0x00000001, 0x00000012, 0x00000010, 0x0000000E, 0x0000000A, 0x00000023, 0x00000018, 0x00000021, 0x00000014, 0x00000024, 0x00000006, 0x00000007, 0x00000017, 0x00000008, 0x00000009, 0x00000005, 0x0000000B, 0x0000000C, 0x0000000F, 0x00000015, 0x00000022, 0x0000001E, 0x00000016, 0x0000001D, 0x0000001A, 0x0000001C, 0x0000001B]
dic = {}
flag=''

for i in range(38):
    enc[i]-=key_table[i]
for j in range(38):
    dic.setdefault(key_table[j],j)
dec = dict(sorted(dic.items(), key=lambda v: v[0]))
for k in range(38):
    flag+=chr(enc[dec[k]])
print(flag)

报错 原因 有一个是负的

（如果天真的 把负的+128/256 会发现 flag 乱码

这个时候就要留意之前的坑了

发现用表时有偏移

（不要问我怎么看出来的 去补习base64算法吧

对于小白来说 会有疑问 “这是不是还得重写base64解密啊”

其实不用 本质还是换表

GHIJKLMNOPQRSTUVWXYZ0123456789+/abcdefghijklmnopqrstuvwxyzABCDEF

能看出来这个和上面的有什么区别吧

重新cyberchef解密

enc = [0x49,0x43,0x7f,0x66,0x63,0x85,0x52,0x6a,0x74,0x41,0xa2,0x6d,0x47,0x75,0x40,0x3b,0x5b,0x4b,0x54,0x47,0x59,0x6b,0x3b,0x50,0x3e,0x6f,0x3e,0x6d,0x41,0x46,0x47,0x5a,0x57,0x77,0x4f,0x7f,0x82,0x89]
key_table = [0x00000019, 0x0000000D, 0x00000004, 0x00000000, 0x00000002, 0x0000001F, 0x00000020, 0x00000003, 0x00000013, 0x00000011, 0x00000025, 0x00000001, 0x00000012, 0x00000010, 0x0000000E, 0x0000000A, 0x00000023, 0x00000018, 0x00000021, 0x00000014, 0x00000024, 0x00000006, 0x00000007, 0x00000017, 0x00000008, 0x00000009, 0x00000005, 0x0000000B, 0x0000000C, 0x0000000F, 0x00000015, 0x00000022, 0x0000001E, 0x00000016, 0x0000001D, 0x0000001A, 0x0000001C, 0x0000001B]
dic = {}
flag=''

for i in range(38):
    enc[i]-=key_table[i]
for j in range(38):
    dic.setdefault(key_table[j],j)
dec = dict(sorted(dic.items(), key=lambda v: v[0]))
for k in range(38):
    flag+=chr(enc[dec[k]])
print(flag)

总结

三个坑

1.v7[i] += LOBYTE(key_table[((unsigned __int16)(((_WORD)i + 1) << 8) - Str[i]) >> 8]);考察基本类型

2.常规base64换表

3.非常规base64换表