ida打开后:
根据aG00dJ0b与aN0tT00H0tRWe7r变量内容可以判断出sub_401050是关键函数,其return 1即可得到flag
稍稍分析一下:
v4的初始值看不懂,所以我用下断点动态调试去取值
下断点调试时发现显然call sub_401000下的汇编代码就是为v4的赋值操作
在该函数下方找到循环异或,可以看出v4的值
于是,就可以写脚本了:
a = [0x0D,0x26,0x49,0x45,0x2A,0x17,0x78,0x44,0x2B,0x6C,0x5D,0x5E,0x45,0x12,0x2F,0x17,0x2B,0x44,0x6F,0x6E,0x56,0x09,0x5F,0x45,0x47,0x73,0x26,0x0A,0x0D,0x13,0x17,0x48,0x42,0x01,0x40,0x4D,0x0C,0x02,0x69]
flag = ''
num = 4
b = a[::-1]
for i in range(len(a)):
flag += chr(b[i] ^ num)
num = b[i] ^ num
print(flag[::-1])