[ctf.show.reverse] flag白给，签退

flag白给：

window题，UPX壳，去壳后找到“成功了”串，向前找引用到TForm1_Button1Click函数，这个函数里对字符串没有加密而直接比较，找到对应的串加上flag{}包裹即可

int __fastcall TForm1_Button1Click(int a1)
{
  int v1; // edx
  unsigned int v3[2]; // [esp-10h] [ebp-14h] BYREF
  int *v4; // [esp-8h] [ebp-Ch]
  int v5; // [esp+0h] [ebp-4h] BYREF
  int savedregs; // [esp+4h] [ebp+0h] BYREF

  v5 = 0;
  v4 = &savedregs;
  v3[1] = (unsigned int)&loc_454799;
  v3[0] = (unsigned int)NtCurrentTeb()->NtTib.ExceptionList;
  __writefsdword(0, (unsigned int)v3);
  Controls::TControl::GetText(*(Controls::TControl **)(a1 + 764));
  if ( Sysutils::CompareStr(v5, &str_HackAv[1]) )
    Dialogs::ShowMessage((Dialogs *)&str_____[1], v1);
  else
    Dialogs::ShowMessage((Dialogs *)&str______[1], v1);
  __writefsdword(0, v3[0]);
  v4 = (int *)&loc_4547A0;
  return System::__linkproc__ LStrClr(&v5);
}

#flag{HackAv}

签退：

一个pyc的程序，反编译后似乎看不大明白先从后向前猜

#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
import string
c_charset = string.ascii_uppercase + string.ascii_lowercase + string.digits + '()'
flag = 'BozjB3vlZ3ThBn9bZ2jhOH93ZaH9'

def encode(origin_bytes):
    c_bytes = [ '{:0>8}'.format(str(bin(b)).replace('0b', '')) for b in origin_bytes ]
    resp = ''
    nums = len(c_bytes) // 3
    remain = len(c_bytes) % 3
    integral_part = c_bytes[0:3 * nums]
    for x in [0,6,12,18]:     #这一段直接continue了，没用
        continue
        tmp_unit = [][int(tmp_unit[x:x + 6], 2)]
        resp += ''.join([ c_charset[i] for i in tmp_unit ])
        integral_part = integral_part[3:]
    if remain:
        remain_part = ''.join(c_bytes[3 * nums:]) + (3 - remain) * '0' * 8
        tmp_unit = [ int(remain_part[x:x + 6], 2) for x in [0,6,12,18] ][:remain + 1]
        resp += ''.join([ c_charset[i] for i in tmp_unit ]) + (3 - remain) * '.'
    return rend(resp)


def rend(s):
    
    def encodeCh(ch):
        
        f = lambda x: chr(((ord(ch) - x) + 2) % 26 + x)
        if ch.islower():
            return f(97)
        if (None,).isupper():
            return f(65)

    return (''.join,)((lambda .0: pass)(s))

有两个函数，先是一个XXX处理，没看明白，后边是把字母移两位。先把这块恢复回来

import string
c_charset = string.ascii_uppercase + string.ascii_lowercase + string.digits + '()'
flag = 'BozjB3vlZ3ThBn9bZ2jhOH93ZaH9'

def decodeCH(ch):
    f = lambda x: chr(((ord(ch) - x) + 24) % 26 + x)
    if ch.islower():
        return f(97)
    if ch.isupper():
        return f(65)
    return ch 

tmp = ''
for ch in flag:
    tmp +=decodeCH(ch)   

print(tmp)
#ZmxhZ3tjX3RfZl9zX2hfMF93XyF9

发现前边头就是base64的flag(经常见太熟悉了)，于是得到flag

from base64 import b64decode
print(b64decode(tmp))
#flag{c_t_f_s_h_0_w_!}