re -06 buuctf [FlareOn4]IgniteMe

IgniteMe

ida打开后：

根据aG00dJ0b与aN0tT00H0tRWe7r变量内容可以判断出sub_401050是关键函数，其return 1即可得到flag

稍稍分析一下：

v4的初始值看不懂，所以我用下断点动态调试去取值

下断点调试时发现显然call sub_401000下的汇编代码就是为v4的赋值操作

在该函数下方找到循环异或，可以看出v4的值

于是，就可以写脚本了：

a = [0x0D,0x26,0x49,0x45,0x2A,0x17,0x78,0x44,0x2B,0x6C,0x5D,0x5E,0x45,0x12,0x2F,0x17,0x2B,0x44,0x6F,0x6E,0x56,0x09,0x5F,0x45,0x47,0x73,0x26,0x0A,0x0D,0x13,0x17,0x48,0x42,0x01,0x40,0x4D,0x0C,0x02,0x69]
flag = ''
num = 4
b = a[::-1]

for i in range(len(a)):
    flag += chr(b[i] ^ num)
    num = b[i] ^ num
print(flag[::-1])