buu_Transform

最新推荐文章于 2024-09-14 01:14:32 发布

FeiJiNcFan

最新推荐文章于 2024-09-14 01:14:32 发布

阅读量276

点赞数

文章标签： c语言

本文链接：https://blog.csdn.net/weixin_52118017/article/details/121720891

版权

IDA反编译程序逻辑异或操作字符串解密代码分析

关键词由CSDN通过智能技术生成

依然是依靠ida反编译
把几个地方修改一下，之后的main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Str[104]; // [rsp+20h] [rbp-70h] BYREF
  int j; // [rsp+88h] [rbp-8h]
  int i; // [rsp+8Ch] [rbp-4h]

  sub_402230(argc, argv, envp);
  printf("Give me your code:\n");
  scanf("%s", Str);
  if ( strlen(Str) != 33 )
  {
    printf("Wrong!\n");
    system("pause");
    exit(0);
  }
  for ( i = 0; i <= 32; ++i )
  {
    str0[i] = Str[str1[i]];
    str0[i] ^= LOBYTE(str1[i]);         // str1 就是0~32
  }
  for ( j = 0; j <= 32; ++j )
  {
    if ( str2[j] != str0[j] )
    {
      printf("Wrong!\n");
      system("pause");
      exit(0);
    }
  }
  printf("Right!Good Job!\n");
  printf("Here is your flag: %s\n", Str);
  system("pause");
  return 0;
}

程序的流程是
1.输入Str
2.str0 按str1的值存储Str
3.str0 与 str1异或
4.比较

                根据这个直接逆：

str2 =[0x67, 0x79, 0x7B, 0x7F, 0x75, 0x2B, 0x3C, 0x52, 0x53, 0x79,
  0x57, 0x5E, 0x5D, 0x42, 0x7B, 0x2D, 0x2A, 0x66, 0x42, 0x7E,
  0x4C, 0x57, 0x79, 0x41, 0x6B, 0x7E, 0x65, 0x3C, 0x5C, 0x45,
  0x6F, 0x62, 0x4D,0x3f]
str1 = [
    0x09,0x0A,0x0F, 0x17,0x07,0x18,0x0C,0x06,
    0x01,0x10,0x03,0x11,0x20, 0x1D,0x0B,0x1E,0x1B,0x16, 0x04,0x0D,
    0x13,0x14,0x15, 0x02,0x19,0x05,0x1F,0x08, 0x12,0x1A,
    0x1C,0x0E,0x08
]
str0 = [ str2[i]^str1[i] for i in range(33)]
Str = [0]*33
flag = ''
for i in range(33):
   Str[str1[i]] = str0[i]
print(Str)
print(''.join([chr(tmp) for tmp in Str]))

但是好像不对，先记录一下。

为啥32才是对的

str2 =[0x67, 0x79, 0x7B, 0x7F, 0x75, 0x2B, 0x3C, 0x52, 0x53, 0x79,
  0x57, 0x5E, 0x5D, 0x42, 0x7B, 0x2D, 0x2A, 0x66, 0x42, 0x7E,
  0x4C, 0x57, 0x79, 0x41, 0x6B, 0x7E, 0x65, 0x3C, 0x5C, 0x45,
  0x6F, 0x62, 0x4D,0x3f]

str1 = [
    0x09,0x0A,0x0F, 0x17,0x07,0x18,0x0C,0x06,
    0x01,0x10,0x03,0x11,0x20, 0x1D,0x0B,0x1E,0x1B,0x16, 0x04,0x0D,
    0x13,0x14,0x15, 0x02,0x19,0x05,0x1F,0x08, 0x12,0x1A,
    0x1C,0x0E,0x08
]
str0 = [ 0]*33
Str = [0]*33

for i in range(32):
    str0[i] = str2[i]^str1[i]
    Str[str1[i]] = str0[i]
print(Str)
print(''.join([chr(tmp) for tmp in Str]),len(Str))