wantyou 5.5（tamu2023）

目录

nothing

nothing-2

---

nothing

64位，运行发现挺抽象的

ida打开主函数就一点点，看不明白动调试试，发现retn上一条push了000055A16F50A1AB的地址，执行retn后会直接跳转到cmp那一行

 

 jz第一次调试我是直接修改zf寄存器跳转的，后面发现只要有传参就满足跳转条件了

这里生成函数f5看看，结果挺乱的不如看汇编

 

 这个循环就是一个异或

 

 比较s1 s2是否相等，s2已知，直接写脚本

flag = [0x67, 0x68, 0x65, 0x66, 0x69, 0x7E, 0x6E, 0x62, 0x71, 0x56, 
  0x73, 0x64, 0x79, 0x52, 0x68, 0x60, 0x65, 0x7F, 0x76, 0x4C, 
  0x60, 0x7D, 0x73, 0x48, 0x68, 0x6B, 0x75, 0x7C, 0x6E, 0x7C, 
  0x73, 0x62]

for i in range(32):
    flag[i] ^= i
    print(chr(flag[i]), end="")

flag为 gigem{hey_you_found_the_program}

nothing-2

打开感觉与上一题异曲同工，但是main下断点这次没有跳转了，查字符串

 这个挺奇怪，看到函数就更熟悉了，跟上一题一模一样，x交叉引用一查发现是在init里调用的，给init下断点调试成功进入这个主要的函数

这里说明长度为0x23 ，后面也很好分析动调一下逻辑就清楚了，脚本如下

a = [0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 
  0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 
  0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x31, 0x32, 0x33, 0x34, 
  0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x7B, 0x7D, 0x5F]

b = [0x34, 0x70, 0x69, 0x71, 0x39, 0x7A, 0x6F, 0x76, 0x61, 0x66, 
  0x67, 0x38, 0x7B, 0x31, 0x68, 0x6B, 0x63, 0x6D, 0x37, 0x73, 
  0x74, 0x64, 0x30, 0x33, 0x78, 0x6C, 0x65, 0x7D, 0x72, 0x79, 
  0x36, 0x77, 0x5F, 0x75, 0x6A, 0x6E, 0x35, 0x32, 0x62]

c = [0x6F, 0x61, 0x6F, 0x39, 0x7B, 0x35, 0x69, 0x6E, 0x31, 0x37, 
  0x73, 0x6D, 0x74, 0x69, 0x73, 0x6E, 0x6D, 0x36, 0x62, 0x6D, 
  0x74, 0x31, 0x62, 0x70, 0x72, 0x7A, 0x6E, 0x6D, 0x72, 0x62, 
  0x7B, 0x79, 0x65, 0x31, 0x32]

flag = ''

for i in range(35):
    suoyin = b.index(c[i])
    flag += chr(a[suoyin])

print(flag)

解出flag为 gigem{c0nstruct0r5_run_b3f0r3_m41n}