[ctf.show.reverse] 卷王杯 简单的re，sigin_keys，逆向签到

简单的re

一道rc4题，没有复杂的操作，每次处理两个字符

unsigned __int64 __fastcall sub_400C9D(unsigned int *a1)
{
  unsigned __int64 result; // rax
  int v2; // [rsp+18h] [rbp-38h]
  unsigned int v3; // [rsp+1Ch] [rbp-34h]
  unsigned int v4; // [rsp+20h] [rbp-30h]
  int i; // [rsp+24h] [rbp-2Ch]
  unsigned __int64 v6; // [rsp+48h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  v2 = 0;
  v3 = *a1;
  v4 = a1[1];
  for ( i = 0; i <= 31; ++i )
  {
    v2 += 1865817980;
    v3 += (v4 + v2) ^ (16 * v4 + 111) ^ ((v4 >> 5) + 54);
    v4 += (v3 + v2) ^ (16 * v3 + 31) ^ ((v3 >> 5) + 124);
  }
  *a1 = v3;
  a1[1] = v4;
  result = __readfsqword(0x28u) ^ v6;
  if ( result )
    exit();
  return result;
}

这些天净作RC4了

直接弄个改吧改吧就行了

chk = [1350288828,731421218,1671728960,2831241988,1951471770,2319350991,1657444641,236674178,
       3281411241,3592850081,581718275,2597100926,575307203,3582510352,3410176996,3064018193,
	   1278546908,1875831745,2741062944,2277786060,2717472665,1047384394,1864926511,1387033695,
	   2442177625,383659259]

v2 = 0
tab = [0]*32
for i in range(32):
    v2 += 1865817980
    v2 &= 0xffffffff
    tab[i] = v2 

def enc(v3,v4):
    for i in range(31,-1,-1):
        v4 -= (v3+tab[i])^(16*v3 + 31)^((v3>>5)+124)
        v4 &= 0xffffffff
        v3 -= (v4+tab[i])^(16*v4 + 111)^((v4>>5)+54)
        v3 &= 0xffffffff
    print(chr(v3&0xff)+chr(v4&0xff),end='')

for i in range(0,26,2):
    enc(chk[i],chk[i+1]) 
#ctfshow{just_a_simple_re}

sigin_keys

需要输入8次，每次取个小串(+10)作个加法然后与序号异或，然后跟输入比较，这个居然都是正向而不是逆向的

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char *v3; // edi
  int v4; // ebx
  size_t v5; // eax
  char *v6; // eax
  char v8[16]; // [esp+10h] [ebp-FCh] BYREF
  char v9[16]; // [esp+20h] [ebp-ECh] BYREF
  char v10[16]; // [esp+30h] [ebp-DCh] BYREF
  char Src[16]; // [esp+40h] [ebp-CCh] BYREF
  _DWORD v12[22]; // [esp+50h] [ebp-BCh] BYREF
  _DWORD v13[25]; // [esp+A8h] [ebp-64h] BYREF

  v3 = ch;                                      // 12/4-.
  v4 = 0;
  __main();
  v12[5] = 0;
  v12[4] = 0;
  v12[0] = 0x67452301;
  v12[1] = 0xEFCDAB89;
  v12[2] = 0x98BADCFE;
  v12[3] = 0x10325476;
  v13[5] = 0;
  v13[4] = 0;
  v13[0] = 0x67452301;
  v13[1] = 0xEFCDAB89;
  v13[2] = 0x98BADCFE;
  v13[3] = 0x10325476;
  puts("input the keys and then I will give you flag:");
  while ( 1 )
  {
    v5 = strlen(v3);
    if ( v5 )
    {
      Src[0] = *v3 - v4;
      if ( v5 != 1 )
      {
        Src[1] = (v3[1] + 1 - v4) ^ 1;
        if ( v5 != 2 )
        {
          Src[2] = (v3[2] + 2 - v4) ^ 2;
          if ( v5 != 3 )
          {
            Src[3] = (v3[3] + 3 - v4) ^ 3;
            if ( v5 != 4 )
            {
              Src[4] = (v3[4] + 4 - v4) ^ 4;
              if ( v5 != 5 )
              {
                Src[5] = (v3[5] + 5 - v4) ^ 5;
                if ( v5 != 6 )
                {
                  Src[6] = (v3[6] + 6 - v4) ^ 6;
                  if ( v5 != 7 )
                  {
                    Src[7] = (v3[7] + 7 - v4) ^ 7;
                    if ( v5 == 9 )
                      Src[8] = (v3[8] + 8 - v4) ^ 8;
                  }
                }
              }
            }
          }
        }
      }
      v6 = &Src[v5];
    }
    else
    {
      v6 = Src;
    }
    *v6 = 0;
    ++v4;
    MD5Update(v12, Src, strlen(Src));
    MD5Final((int)v10, v12);
    printf("input the %dth key: ", v4);
    scanf("%s", v8);
    MD5Update(v13, v8, strlen(v8));
    MD5Final((int)v9, v13);                     // 123456
    if ( v9[0] != v10[0]
      || v9[1] != v10[1]
      || v9[2] != v10[2]
      || v9[3] != v10[3]
      || v9[4] != v10[4]
      || v9[5] != v10[5]
      || v9[6] != v10[6]
      || v9[7] != v10[7]
      || v9[8] != v10[8]
      || v9[9] != v10[9]
      || v9[10] != v10[10]
      || v9[11] != v10[11]
      || v9[12] != v10[12]
      || v9[13] != v10[13]
      || v9[14] != v10[14]
      || v9[15] != v10[15] )
    {
      break;
    }
    v3 += 10;
    if ( v4 == 8 )
    {
      puts("the keys is right, your flag is: flag{md5(your input)}");
      system("pause");
      return 0;
    }
  }
  puts("no no no, the key is wrong!");
  system("pause");
  return 0;
}

只需要把给定的串用这个方法处理一下就是输入内容，然后md5即可

flag = []
b  = [b'12/4-.', b'745.30', b'cdaf_`', b'42764/', b'uyirp{', b'fvigdm', b'\x80~exhl', b'xzv{zbf']
for v4,ch in enumerate(b):
    flag += [(v+i-v4)^i for i,v in enumerate( ch )]

print(bytes(flag))
from hashlib import md5
print(md5(bytes(flag)).hexdigest())
#123456654321abcdef114514qwertyasdfghzxcvbnqustsec
#61970f40f232b7d9dd1f0da5be56a124
#ctfshow{61970f40f232b7d9dd1f0da5be56a124}

逆向签到

这个真是个签到ida打开就看到了，两段拼一起

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v4[2]; // [rsp+10h] [rbp-50h] BYREF
  char v5[24]; // [rsp+20h] [rbp-40h] BYREF
  char v6[24]; // [rsp+40h] [rbp-20h] BYREF
  unsigned __int64 v7; // [rsp+58h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  v4[1] = 1865817980LL;
  v4[0] = 0LL;
  strcpy(v5, "cfhwcfhwja_igi_o}");
  strcpy(v6, "tso{tso_unkn_syu}");
  puts(&s);
  __isoc99_scanf(&unk_917, v4);
  puts(&byte_920);
  return 0;
}
#ctfshow{tcfshow_juan_king_is_you}