一道精彩的re题

用ida打开查看

__int64 __fastcall sub_140001030(HWND hWnd)
{
  HBITMAP v2; // r14
  HDC hdcSrc; // r13
  HDC DC; // rsi
  HDC CompatibleDC; // r15
  int hSrc; // ebx
  int wSrc; // eax
  HBITMAP CompatibleBitmap; // rax
  signed int v9; // ebx
  HANDLE FileW; // rax
  void *v11; // r12
  signed int v12; // r10d
  _BYTE *v13; // r9
  int v14; // ecx
  int v15; // edx
  void *lpBuffer; // [rsp+60h] [rbp-59h]
  HGLOBAL hMem; // [rsp+68h] [rbp-51h]
  struct tagRECT Rect; // [rsp+70h] [rbp-49h] BYREF
  struct tagBITMAPINFO bmi; // [rsp+80h] [rbp-39h] BYREF
  char v21; // [rsp+ACh] [rbp-Dh]
  char v22; // [rsp+ADh] [rbp-Ch]
  char v23; // [rsp+AEh] [rbp-Bh]
  char v24; // [rsp+AFh] [rbp-Ah]
  char v25; // [rsp+B0h] [rbp-9h]
  char v26; // [rsp+B1h] [rbp-8h]
  int v27; // [rsp+B2h] [rbp-7h]
  DWORD NumberOfBytesWritten; // [rsp+B8h] [rbp-1h] BYREF
  char pv[4]; // [rsp+C0h] [rbp+7h] BYREF
  LONG v30; // [rsp+C4h] [rbp+Bh]
  UINT cLines; // [rsp+C8h] [rbp+Fh]

  NumberOfBytesWritten = 0;
  v2 = 0i64;
  hdcSrc = GetDC(0i64);
  DC = GetDC(hWnd);
  CompatibleDC = CreateCompatibleDC(DC);
  if ( CompatibleDC )
  {
    GetClientRect(hWnd, &Rect);
    SetStretchBltMode(DC, 4);
    hSrc = GetSystemMetrics(1);
    wSrc = GetSystemMetrics(0);
    if ( StretchBlt(DC, 0, 0, Rect.right, Rect.bottom, hdcSrc, 0, 0, wSrc, hSrc, 0xCC0020u) )
    {
      CompatibleBitmap = CreateCompatibleBitmap(DC, Rect.right - Rect.left, Rect.bottom - Rect.top);
      v2 = CompatibleBitmap;
      if ( CompatibleBitmap )
      {
        SelectObject(CompatibleDC, CompatibleBitmap);
        if ( BitBlt(CompatibleDC, 0, 0, Rect.right - Rect.left, Rect.bottom - Rect.top, DC, 0, 0, 0xCC0020u) )
        {
          GetObjectW(v2, 32, pv);
          bmi.bmiHeader.biWidth = v30;
          bmi.bmiHeader.biHeight = cLines;
          bmi.bmiHeader.biSize = 40;
          *(_QWORD *)&bmi.bmiHeader.biPlanes = ' \0\x01';
          memset(&bmi.bmiHeader.biSizeImage, 0, 20);
          v9 = 4 * cLines * ((32 * v30 + 31) / 32);
          hMem = GlobalAlloc(0x42u, (unsigned int)v9);
          lpBuffer = GlobalLock(hMem);
          GetDIBits(DC, v2, 0, cLines, lpBuffer, &bmi, 0);
          FileW = CreateFileW(L"cap.bin", 0x40000000u, 0, 0i64, 2u, 0x80u, 0i64);
          v23 ^= 0x64u;
          v24 ^= 0x61u;
          v11 = FileW;
          v25 ^= 0x73u;
          v26 ^= 0x63u;
          bmi.bmiHeader.biSize ^= 0x79625F63u;
          bmi.bmiHeader.biWidth ^= 0x7361645Fu;
          bmi.bmiHeader.biHeight ^= 0x65667463u;
          *(_QWORD *)&bmi.bmiHeader.biPlanes ^= 0x61645F79625F636Eui64;
          bmi.bmiColors[0].rgbReserved = ((unsigned __int16)(v9 + 54) >> 8) ^ 0x62;
          v21 = ((unsigned int)(v9 + 54) >> 16) ^ 0x79;
          v22 = ((unsigned int)(v9 + 54) >> 24) ^ 0x5F;
          v27 = 'nefB';
          bmi.bmiColors[0].rgbGreen = 46;
          bmi.bmiColors[0].rgbBlue = 44;
          bmi.bmiColors[0].rgbRed = (v9 + 54) ^ 0x5F;
          v12 = 0;
          bmi.bmiHeader.biSizeImage ^= 0x66746373u;
          bmi.bmiHeader.biXPelsPerMeter ^= 0x5F636E65u;
          bmi.bmiHeader.biYPelsPerMeter ^= 0x645F7962u;
          bmi.bmiHeader.biClrUsed ^= 0x74637361u;
          bmi.bmiHeader.biClrImportant ^= 0x636E6566u;
          if ( v9 > 0 )
          {
            v13 = lpBuffer;
            do
            {
              v14 = v12 + 3;
              v15 = (unsigned __int64)(1321528399i64 * (v12 + 3)) >> 32;
              ++v12;
              *v13++ ^= aEncByDasctf[v14 - 13 * (((unsigned int)v15 >> 31) + (v15 >> 2))];
            }
            while ( v12 < v9 );
          }
          WriteFile(FileW, bmi.bmiColors, 0xEu, &NumberOfBytesWritten, 0i64);
          WriteFile(v11, &bmi, 0x28u, &NumberOfBytesWritten, 0i64);
          WriteFile(v11, lpBuffer, v9, &NumberOfBytesWritten, 0i64);
          GlobalUnlock(hMem);
          GlobalFree(hMem);
          CloseHandle(v11);
        }
        else
        {
          MessageBoxW(hWnd, L"BitBlt has failed", L"Failed", 0);
        }
      }
      else
      {
        MessageBoxW(hWnd, L"CreateCompatibleBitmap Failed", L"Failed", 0);
      }
    }
    else
    {
      MessageBoxW(hWnd, L"StretchBlt has failed", L"Failed", 0);
    }
  }
  else
  {
    MessageBoxW(hWnd, L"CreateCompatibleDC has failed", L"Failed", 0);
  }
  DeleteObject(v2);
  DeleteObject(CompatibleDC);
  ReleaseDC(0i64, hdcSrc);
  ReleaseDC(hWnd, DC);
  return 0i64;
}

注意：前面创建了一个截屏，创建的时候就异或了

程序主要是打开文件对数据进行异或，我们把程序稍加修改可以得到异或的数据数组下标

这里我们v9取得小一点，然后便是v12的值通过动调发现不是0，是12，挺阴险的，最后将数据存在vv里面。

#include<stdio.h>
int main() {
    int v15;
    int vv;
    int v14, v12=11, v9 = 0x1f;
    int count = 10;
    if (v9 > 0)
    {
        //v13 = lpBuffer;
        do
        {
            v14 = v12 + 3;
            v15 = (unsigned __int64)(1321528399i64 * (v12 + 3)) >> 32;
            ++v12;
            vv=v14 - 13 * (((unsigned int)v15 >> 31) + (v15 >> 2));
            printf("%d\n",vv);
        } while (v12<v9);
    }
    return 0;
}

这里又有个坑，他的异或下标是从1开始的

最后写脚本

key = "enc_by_dasctf"
with open('./cap.bin','rb') as f:
    s = bytearray(f.read())
for i in range(len(s)):
    s[i] ^= ord(key[(i+1) % len(key)])
with open('flag.bmp','wb') as f:
    f.write(s)

打开得到flag

注意，不要直接运行文件，否则他会自动帮你执行截屏，没错，截你的屏，那么就没有flag了！！！