[XCTF-Reverse] 84 2019_Redhat_easyRE

估计很多人走不到这就被前边的一些题弄不会了，然后这后边的简单题没有作

先找到主函数

signed __int64 sub_4009C6()
{
  char *v0; // rsi
  char *v1; // rdi
  __int64 v2; // rax
  signed __int64 result; // rax
  unsigned __int64 v4; // rax
  __int64 v5; // rax
  const __m128i *v6; // ST10_8
  const __m128i *v7; // ST18_8
  const __m128i *v8; // ST20_8
  const __m128i *v9; // ST28_8
  const __m128i *v10; // ST30_8
  const __m128i *v11; // ST38_8
  const __m128i *v12; // ST40_8
  const __m128i *v13; // ST48_8
  const __m128i *v14; // ST50_8
  __int64 v15; // ST58_8
  int i; // [rsp+Ch] [rbp-114h]
  char v17; // [rsp+60h] [rbp-C0h]
  char v18; // [rsp+61h] [rbp-BFh]
  char v19; // [rsp+62h] [rbp-BEh]
  char v20; // [rsp+63h] [rbp-BDh]
  char v21; // [rsp+64h] [rbp-BCh]
  char v22; // [rsp+65h] [rbp-BBh]
  char v23; // [rsp+66h] [rbp-BAh]
  char v24; // [rsp+67h] [rbp-B9h]
  char v25; // [rsp+68h] [rbp-B8h]
  char v26; // [rsp+69h] [rbp-B7h]
  char v27; // [rsp+6Ah] [rbp-B6h]
  char v28; // [rsp+6Bh] [rbp-B5h]
  char v29; // [rsp+6Ch] [rbp-B4h]
  char v30; // [rsp+6Dh] [rbp-B3h]
  char v31; // [rsp+6Eh] [rbp-B2h]
  char v32; // [rsp+6Fh] [rbp-B1h]
  char v33; // [rsp+70h] [rbp-B0h]
  char v34; // [rsp+71h] [rbp-AFh]
  char v35; // [rsp+72h] [rbp-AEh]
  char v36; // [rsp+73h] [rbp-ADh]
  char v37; // [rsp+74h] [rbp-ACh]
  char v38; // [rsp+75h] [rbp-ABh]
  char v39; // [rsp+76h] [rbp-AAh]
  char v40; // [rsp+77h] [rbp-A9h]
  char v41; // [rsp+78h] [rbp-A8h]
  char v42; // [rsp+79h] [rbp-A7h]
  char v43; // [rsp+7Ah] [rbp-A6h]
  char v44; // [rsp+7Bh] [rbp-A5h]
  char v45; // [rsp+7Ch] [rbp-A4h]
  char v46; // [rsp+7Dh] [rbp-A3h]
  char v47; // [rsp+7Eh] [rbp-A2h]
  char v48; // [rsp+7Fh] [rbp-A1h]
  char v49; // [rsp+80h] [rbp-A0h]
  char v50; // [rsp+81h] [rbp-9Fh]
  char v51; // [rsp+82h] [rbp-9Eh]
  char v52; // [rsp+83h] [rbp-9Dh]
  char v53[32]; // [rsp+90h] [rbp-90h]
  int v54; // [rsp+B0h] [rbp-70h]
  char v55; // [rsp+B4h] [rbp-6Ch]
  char v56; // [rsp+C0h] [rbp-60h]
  char v57; // [rsp+E7h] [rbp-39h]
  char v58; // [rsp+100h] [rbp-20h]
  unsigned __int64 v59; // [rsp+108h] [rbp-18h]

  v59 = __readfsqword(0x28u);
  v17 = 73;
  v18 = 111;
  v19 = 100;
  v20 = 108;
  v21 = 62;
  v22 = 81;
  v23 = 110;
  v24 = 98;
  v25 = 40;
  v26 = 111;
  v27 = 99;
  v28 = 121;
  v29 = 127;
  v30 = 121;
  v31 = 46;
  v32 = 105;
  v33 = 127;
  v34 = 100;
  v35 = 96;
  v36 = 51;
  v37 = 119;
  v38 = 125;
  v39 = 119;
  v40 = 101;
  v41 = 107;
  v42 = 57;
  v43 = 123;
  v44 = 105;
  v45 = 121;
  v46 = 61;
  v47 = 126;
  v48 = 121;
  v49 = 76;
  v50 = 64;
  v51 = 69;
  v52 = 67;
  memset(v53, 0, sizeof(v53));
  v54 = 0;
  v55 = 0;
  v0 = v53;
  read(0LL, (__int64)v53);
  v55 = 0;
  v1 = v53;
  LODWORD(v2) = strlen((const __m128i *)v53);
  if ( v2 == 36 )
  {
    for ( i = 0; ; ++i )
    {
      v1 = v53;
      LODWORD(v4) = strlen((const __m128i *)v53);
      if ( i >= v4 )
        break;
      if ( (unsigned __int8)(v53[i] ^ i) != *(&v17 + i) )
      {
        result = 4294967294LL;
        goto LABEL_13;
      }
    }
    puts((const __m128i *)"continue!");
    memset(&v56, 0, 0x40uLL);
    v58 = 0;
    v0 = &v56;
    read(0LL, (__int64)&v56);
    v57 = 0;
    v1 = &v56;
    LODWORD(v5) = strlen((const __m128i *)&v56);
    if ( v5 == 39 )
    {
      v6 = (const __m128i *)b64encode((const __m128i *)&v56);
      v7 = (const __m128i *)b64encode(v6);
      v8 = (const __m128i *)b64encode(v7);
      v9 = (const __m128i *)b64encode(v8);
      v10 = (const __m128i *)b64encode(v9);
      v11 = (const __m128i *)b64encode(v10);
      v12 = (const __m128i *)b64encode(v11);
      v13 = (const __m128i *)b64encode(v12);
      v14 = (const __m128i *)b64encode(v13);
      v15 = b64encode(v14);
      v0 = off_6CC090;
      v1 = (char *)v15;
      if ( !(unsigned int)sub_400360(v15, (__int64)off_6CC090) )
      {
        puts((const __m128i *)"You found me!!!");
        v1 = "bye bye~";
        puts((const __m128i *)"bye bye~");
      }
      result = 0LL;
    }
    else
    {
      result = 4294967293LL;
    }
  }
  else
  {
    result = 0xFFFFFFFFLL;
  }
LABEL_13:
  if ( __readfsqword(0x28u) != v59 )
    sub_444020(v1, v0);
  return result;
}

前边一串数字是flag的特征，只是和i进行了异或，结果提示flag开头是flag

a = [73,111,100,108,62,81,110,98,40,111,99,121,127,121,46,105,127,100,96,51,119,125,119,101,107,57,123,105,121,61,126,121,76,64,69,67]
b = bytes([i^v for i,v in enumerate(a)])
print(b)
#b'Info:The first four chars are `flag`'

再往下看，后边这个加密函数运行了10次，从里边有几个特征看其实就是base64

c  ='Vm0wd2VHUXhTWGhpUm1SWVYwZDRWVll3Wkc5WFJsbDNXa1pPVlUxV2NIcFhhMk0xV'
c +='mpKS1NHVkdXbFpOYmtKVVZtcEtTMUl5VGtsaVJtUk9ZV3hhZVZadGVHdFRNVTVYVW'
c +='01T2FGSnRVbGhhVjNoaFZWWmtWMXBFVWxSTmJFcElWbTAxVDJGV1NuTlhia0pXWWx'
c +='ob1dGUnJXbXRXTVZaeVdrWm9hVlpyV1hwV1IzaGhXVmRHVjFOdVVsWmlhMHBZV1ZS'
c +='R1lWZEdVbFZTYlhSWFRWWndNRlZ0TVc5VWJGcFZWbXR3VjJKSFVYZFdha1pXWlZaT'
c +='2NtRkhhRk5pVjJoWVYxZDBhMVV3TlhOalJscFlZbGhTY1ZsclduZGxiR1J5VmxSR1'
c +='ZXSlZjRWhaTUZKaFZqSktWVkZZYUZkV1JWcFlWV3BHYTFkWFRrZFRiV3hvVFVoQ1d'
c +='sWXhaRFJpTWtsM1RVaG9hbEpYYUhOVmJUVkRZekZhY1ZKcmRGTk5Wa3A2VjJ0U1Ex'
c +='WlhTbFpqUldoYVRVWndkbFpxUmtwbGJVWklZVVprYUdFeGNHOVhXSEJIWkRGS2RGS'
c +='nJhR2hTYXpWdlZGVm9RMlJzV25STldHUlZUVlpXTlZadE5VOVdiVXBJVld4c1dtSl'
c +='lUWGhXTUZwell6RmFkRkpzVWxOaVNFSktWa1phVTFFeFduUlRhMlJxVWxad1YxWnR'
c +='lRXRXTVZaSFVsUnNVVlZVTURrPQ=='

from base64 import b64decode
for i in range(10):
    c = b64decode(c)

print(c)
#https://bbs.pediy.com/thread-254172.htm

得到一个链接，看回复（不大可能是自己写的带flag的帖子，最可能的就是比赛前在回复里写了个flag）里边有不少flag一个个试

#flag{Act1ve_Defen5e_Test}  回复里感觉最不像想跳过的一个