把文件下载,用010 Editor打开,看到:
自然就知道这是个elf文件,而且是64位的,拖进ida看看:
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
int v3; // eax
char v4; // [rsp+Fh] [rbp-1h]
while ( 1 )
{
while ( 1 )
{
printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ");
v4 = getchar();
if ( v4 != 100 && v4 != 68 )
break;
Decry("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv);
}
if ( v4 == 113 || v4 == 0x51 )
Exit();
puts("Input fault format!");
v3 = getchar();
putchar(v3);
}
}
观察得到dercy是重要的函数(或者通过shift+f12找到Congratulation的位置)
unsigned __int64 Decry()
{
char v1; // [rsp+Fh] [rbp-51h]
int v2; // [rsp+10h] [rbp-50h]
int v3; // [rsp+14h] [rbp-4Ch]
int i; // [rsp+18h] [rbp-48h]
int v5; // [rsp+1Ch] [rbp-44h]
char src[8]; // [rsp+20h] [rbp-40h] BYREF
__int64 v7; // [rsp+28h] [rbp-38h]
int v8; // [rsp+30h] [rbp-30h]
__int64 v9[2]; // [rsp+40h] [rbp-20h] BYREF
int v10; // [rsp+50h] [rbp-10h]
unsigned __int64 v11; // [rsp+58h] [rbp-8h]
v11 = __readfsqword(0x28u);
*(_QWORD *)src = 'SLCDN';
v7 = 0LL;
v8 = 0;
v9[0] = 'wodah';
v9[1] = 0LL;
v10 = 0;
text = join(key3, (const char *)v9);//text[]="killshadow"
strcpy(key, key1);
strcat(key, src);//key[]={"adsfkndcls"}
v2 = 0;
v3 = 0;
getchar();
v5 = strlen(key);
for ( i = 0; i < v5; ++i )
{
if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )
key[i] = key[v3 % v5] + 32;
++v3;
}//可以知道这个是个大写变小写.
printf("Please input your flag:");
while ( 1 )
{
v1 = getchar();
if ( v1 == 10 )
break;
if ( v1 == 32 )
{
++v2;
}
else
{
if ( v1 <= 96 || v1 > 122 )
{
if ( v1 > 64 && v1 <= 90 )
{
str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;
++v3;
}
}
else
{
str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;
++v3;
}
if ( !(v3 % v5) )
putchar(32);
++v2;
}
}//就是将字母进行变化.
if ( !strcmp(text, str2) )
puts("Congratulation!\n");
else
puts("Try again!\n");
return __readfsqword(0x28u) ^ v11;
}
因为在加密里面取模了,就难以反向运算出来,不过加密仅限于对字母加密,我们可以通过暴力的方法求得。
#include <stdio.h>
#include <string.h>
int main() {
char text[]={"killshadow"};
char key[]={"adsfkndcls"};
int i;
int v3=10;
int len;
len= strlen(text);
for ( i = 0; i < len; i++){
for (int j = 0; j <= 'z'; j++){
if (j < 'A' || j > 'z' || j > 'Z' && j < 'a'){
continue;
}
if ((j - 39 - key[v3 % 10] + 97) % 26 + 97 == text[i]){
printf("%c",j);
v3++;
break;
}
}
}
return 0;
}