将目标文件拖入IDA
反汇编main函数
__int64 __fastcall main(int a1, char **a2, char **a3)
{
int i; // [rsp+Ch] [rbp-34h]
char s[40]; // [rsp+10h] [rbp-30h] BYREF
unsigned __int64 v6; // [rsp+38h] [rbp-8h]
v6 = __readfsqword(0x28u);
sub_A90((void (__fastcall *)(void *))sub_916);
fgets(s, 35, stdin);
for ( i = 0; i <= 33; ++i )
s1[i] ^= s[i];
return 0LL;
}
这里有一个sub_A90
和sub_916
,怀疑是main执行完后的回调,看一下sub_916
unsigned __int64 sub_916()
{
unsigned __int64 v1; // [rsp+8h] [rbp-8h]
v1 = __readfsqword(0x28u);
if ( !strcmp(s1, s2) )
puts("Congratulations!");
else
puts("Wrong!");
return __readfsqword(0x28u) ^ v1;
}
从这里可以看出确实是;这里有在对比 s1
和 s2
, 二者一样就ok
从main中可以看出s1对输入的字符串做了一个异或操作,那就是异或后再比较
找到s1 和 s2对应的字符串的值
s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn'
s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,
0x17, 0x46, 0x54,
0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,
0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,
0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00]
发现sub_84A
也有去操作s1,应该是在main函数执行之前执行的
unsigned __int64 sub_84A()
{
int i; // [rsp+Ch] [rbp-14h]
unsigned __int64 v2; // [rsp+18h] [rbp-8h]
v2 = __readfsqword(0x28u);
for ( i = 0; i <= 33; ++i )
s1[i] ^= 2 * i + 65;
return __readfsqword(0x28u) ^ v2;
}
可以反推出执行后的值,反推python代码为
def decode():
s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn'
s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,
0x17, 0x46, 0x54,
0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,
0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,
0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00]
t_s1 = []
for i in range(33):
t_s1.append(ord(s1[i]) ^ (2*i + 65))
for j in range(33):
t_val = t_s1[j] ^ s2[j]
print(chr(t_val), end="")
print("====")
flag = ''
for x in range(33):
flag += chr(ord(s1[x])^ (2 * x + 65)^s2[x])
print(flag)
if __name__ == '__main__':
print('hello')
decode()
得到 flag{c0n5truct0r5_functi0n_in_41f}
标签:__,攻防,Reverse,s2,s1,xxxorrr,main,rsp,sub From: https://www.cnblogs.com/gradyblog/p/17015802.html