REVERSE-PRACTICE-BUUCTF-22
[SCTF2019]Who is he
unity游戏,运行后输入,点击按钮检验输入
dnSpy打开Who is he\Who is he_Data\Managed\Assembly-CSharp.dll
在TestClick类中找到OnClick方法,将输入与Decrypt方法返回的字符串比较
Decrypt方法,标准的DES.CBC解密,iv=key
已知密钥"1234",密文"1Tsy0ZGotyMinSpxqYzVBWnfMdUcqCMLu0MA+22Jnp+MNwLHvYuFToxRQr0c+ONZc6Q7L0EAmzbycqobZHh4H23U4WDTNmmXwusW4E+SZjygsntGkO2sGA==",解DES.CBC,注意,在C#中,字符串转成字节数组,在每个字符字节后都要加一个"\x00",然而提交明文失败
from Crypto.Cipher import DES
import base64
key=''.join(['1','\x00','2','\x00','3','\x00','4','\x00'])
cipher=base64.b64decode("1Tsy0ZGotyMinSpxqYzVBWnfMdUcqCMLu0MA+22Jnp+MNwLHvYuFToxRQr0c+ONZc6Q7L0EAmzbycqobZHh4H23U4WDTNmmXwusW4E+SZjygsntGkO2sGA==")
iv=key
des=DES.new(key,DES.MODE_CBC,iv)
plaintext=des.decrypt(cipher)
print(plaintext.decode('utf-16'))
#He_P1ay_Basketball_Very_We11!Hahahahaha!
看了别的师傅的wp,使用ce,搜索字符串"Emmmmm",在内存中发现完全不同的密文和密钥
解DES.CBC得到flag,提交成功
from Crypto.Cipher import DES
import base64
key=''.join(['t','\x00','e','\x00','s','\x00','t','\x00'])
data="78 00 5A 00 57 00 44 00 5A 00 61 00 4B 00 45 00 68 00 57 00 4E 00 4D 00 43 00 62 00 69 00 47 00 59 00 50 00 42 00 49 00 6C 00 59 00 33 00 2B 00 61 00 72 00 6F 00 7A 00 4F 00 39 00 7A 00 6F 00 6E 00 77 00 72 00 59 00 4C 00 69 00 56 00 4C 00 34 00 6E 00 6A 00 53 00 65 00 7A 00 32 00 52 00 59 00 4D 00 32 00 57 00 77 00 73 00 47 00 6E 00 73 00 6E 00 6A 00 43 00 44 00 6E 00 48 00 73 00 37 00 4E 00 34 00 33 00 61 00 46 00 76 00 4E 00 45 00 35 00 34 00 6E 00 6F 00 53 00 61 00 64 00 50 00 39 00 46 00 38 00 65 00 45 00 70 00 76 00 54 00 73 00 35 00 51 00 50 00 47 00 2B 00 4B 00 4C 00 30 00 54 00 44 00 45 00 2F 00 34 00 30 00 6E 00 62 00 55 00 3D"
cipher=[]
for i in range(0,len(data),6):
cipher.append(int('0x'+data[i:i+2],16))
iv=key
des=DES.new(key,DES.MODE_CBC,iv)
plaintext=des.decrypt(base64.b64decode(''.join(chr(i) for i in cipher)))
print(plaintext.decode('utf-16'))
#She_P1ay_Black_Hole_Very_Wel1!LOL!XD!
[FlareOn2]very_success
exe程序,运行后输入password,无壳,ida分析
sub_401000函数修改栈指针平衡栈后,F5反编译
读取输入,进入sub_401084函数进行验证,返回非0验证成功
进入sub_401084函数,检验输入的长度是否大于等于37,输入input参与的只是8位的异或运算,v14为0xc7,v10在运算过程中始终为1,v4初始为0,每次都要加一个字节参与运算后的结果
v7可通过动调得到,只有32个字节可见,不过影响不大,写逆脚本即可得到flag,缺的5个字符按照Description文本文件提示补齐
v7=[0xAA, 0xEC, 0xA4, 0xBA, 0xAF, 0xAE, 0xAA, 0x8A, 0xC0, 0xA7,
0xB0, 0xBC, 0x9A, 0xBA, 0xA5, 0xA5, 0xBA, 0xAF, 0xB8, 0x9D,
0xB8, 0xF9, 0xAE, 0x9D, 0xAB, 0xB4, 0xBC, 0xB6, 0xB3, 0x90,
0x9A, 0xA8]
v7=v7[::-1]
flag=""
v4=0
for i in range(len(v7)):
tmp=(1<<(v4&0x3))
flag+=chr((v7[i]-tmp-1)^0xc7)
v4+=v7[i]
print(flag)
#a_Little_b1t_harder_plez@flare-o(n.com})
[NPUCTF2020]Baby Obfuscation
exe程序,运行后输入,无壳,ida分析
main函数,输入后紧接的for循环,有4个if语句,其中第1和第3个if语句永真,第2和第4个if语句永假,于是,与输入相关的运算有两处,"v33[j]=input[j-1]-v39[(j-1)%len(v39)]"给v33赋值,"v33[j]^=v39[(j-1)%len(v39)]"是v33的变换,v33的元素乘10后再与已知比较
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v3; // eax
int v4; // ebx
int v5; // esi
int v6; // ebx
int v7; // ebx
int v8; // esi
int v9; // edi
int v10; // ebx
int v11; // ebx
int v12; // ebx
int v13; // esi
int v14; // eax
int v15; // ebx
int v16; // esi
int v17; // ebx
int v18; // eax
bool v19; // bl
int v20; // eax
int v21; // esi
int v22; // ebx
int v23; // ebx
int v24; // eax
int v25; // eax
int v26; // eax
int v27; // eax
int v28; // ebx
int a[64]; // [rsp+20h] [rbp-60h]
int v31; // [rsp+120h] [rbp+A0h]
char input[1008]; // [rsp+130h] [rbp+B0h]
int v33[1000]; // [rsp+520h] [rbp+4A0h]
int v34; // [rsp+14C0h] [rbp+1440h]
int v35; // [rsp+14D0h] [rbp+1450h]
int v36; // [rsp+14D4h] [rbp+1454h]
int v37; // [rsp+14D8h] [rbp+1458h]
int v38; // [rsp+14DCh] [rbp+145Ch]
int v39; // [rsp+14E0h] [rbp+1460h]
int v40; // [rsp+14E4h] [rbp+1464h]
int v41; // [rsp+14E8h] [rbp+1468h]
int v42; // [rsp+14ECh] [rbp+146Ch]
int input_len; // [rsp+14F0h] [rbp+1470h]
int k; // [rsp+14F4h] [rbp+1474h]
int j; // [rsp+14F8h] [rbp+1478h]
int i; // [rsp+14FCh] [rbp+147Ch]
_main();
memset(v33, 0, sizeof(v33));
v34 = 0;
memset(a, 0, sizeof(a));
v31 = 0;
for ( i = 0; i <= 64; ++i ) // a的元素都是固定的值,a[0]==1,a[1]==2
a[i] = i + 1;
v39 = 2;
v40 = 3;
v41 = 4;
v42 = 5;
v35 = 2;
v36 = 3;
v37 = 4;
v38 = 5;
puts("WHERE IS MY KEY!?");
scanf("%32s", input);
input_len = strlen(input);
v3 = gcd(a[j], a[j]); // v3==a[0]==1
for ( j = v3 / a[j]; j <= input_len; ++j ) // j从1开始,到input_len,双闭合
{
v4 = (a[j] + a[j + 1]) * (a[j] + a[j + 1]); // v4==(a[j]+a[j+1])**2
if ( v4 >= axxb(2, 2) * a[j] * a[j + 1] ) // axxb函数指a**b,a的b次方,(a+b)**2>=4ab,永真
{
v5 = ~input[a_sub_b(j, 1)];
v6 = a_sub_b(j, 1);
v33[j] = ~(v5 + *(&v39 + v6 % axxb(2, 2)));// v33[j]=input[j-1]-v39[(j-1)%len(v39)]
}
v7 = gcd(a[j], a[j + 1]); // 永为1
if ( v7 > gcd(a[j + 1], ~(~a[j + 1] + a[j])) )// gcd(a[j+1],a[j+1]-a[j])==1,永假
{
v8 = v33[j];
v9 = ~v33[j];
v10 = a_sub_b(j, 1);
v33[j] = ~(v9 + a[v10 % axxb(2, 2)]) * v8;
}
v11 = a[j + 1];
v12 = axxb(2, 1) * v11; // 2*a[j+1]
v13 = a[j];
v14 = axxb(2, 1);
v15 = gcd(v13 * v14, v12); // gcd(2*a[j],2*a[j+1])
v16 = axxb(2, 1);
if ( v15 == v16 * gcd(a[j], a[j + 1]) ) // 永真
{
v17 = a_sub_b(j, 1); // j-1
v33[j] ^= *(&v39 + v17 % axxb(2, 2)); // v33[j]^=v39[(j-1)%len(v39)]
}
v18 = axxb(V0X3, a[j]);
v19 = v18 < a[j] + 1; // 3**a[j]<a[j]+1
v20 = axxb(2, 4); // 16
if ( aeqbeq1(v20 >= j, v19) ) // 永假
{
v21 = ~input[a_sub_b(j, 1)];
v22 = a_sub_b(j, 1);
v33[j] ^= ~(v21 + *(&v39 + v22 % axxb(2, 2)));
}
v23 = axxb(2, 3); // 8
v24 = gcd(a[j], a[j]); // a[j]
v33[j] *= v23 + axxb(2, v24 / a[j]); // v33[j]*=10
}
v25 = axxb(2, 4); // 16
v26 = a_sub_b(v25, 1); // 15
if ( v26 == input_len ) // input_len==15
{
v27 = gcd(a[k], a[k]); // 1
for ( k = v27 / a[k]; k <= input_len; ++k ) // k从1开始,到input_len,双闭合
{
v28 = v33[k]; // 从v33取值
if ( v28 == a_sub_b(A0X6[k], 1) / 10 ) // 比较
++V0X2;
}
if ( V0X2 == input_len )
puts("\nPASS");
else
puts("\nDENIED");
}
else
{
puts("\nDENIED");
}
return 0;
}
写逆运算脚本即可得到flag
A0X6=[0,7801,7801,8501, 5901, 8001, 6401, 11501,4601, 9801, 9601,
11701, 5301, 9701, 10801, 12501]
v39=[2,3,4,5]
for i in range(1,len(A0X6)):
A0X6[i]=(A0X6[i]-1)//10//10
A0X6[i]^=v39[(i-1)%len(v39)]
A0X6[i]+=v39[(i-1)%len(v39)]
print(''.join(chr(i) for i in A0X6))
# NPUCTF{0bfu5er}
[HDCTF2019]MFC
MFC程序,加了vmp壳,用xspy扫一下
发现一个没有系统库名的OnMsg:0464
写C代码发送一条有关0x0464的信息
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
int main()
{
HWND handler = ::FindWindowA(NULL, "Flag就在控件里");
if (handler)
{
SendMessage(handler, 0x0464, NULL, NULL);
}
else {
printf("no window");
}
system("pause");
return 0;
}
看到一个DES的密钥
在这个地方看到密文
用一个飘云阁的加解密工具解des即可得到flag