BUUCTF Reverse/[NPUCTF2020]你好sao啊

里面就一个加密函数，分析后发现这是一段变表的base解密，将四个字符替换成三个字符

void *__fastcall RxEncode(const char *a1, int a2)
{
  int v3; // [rsp+18h] [rbp-38h]
  int v4; // [rsp+1Ch] [rbp-34h]
  int v5; // [rsp+20h] [rbp-30h]
  int v6; // [rsp+24h] [rbp-2Ch]
  int v7; // [rsp+28h] [rbp-28h]
  int v8; // [rsp+28h] [rbp-28h]
  int i; // [rsp+2Ch] [rbp-24h]
  _BYTE *v10; // [rsp+30h] [rbp-20h]
  void *s; // [rsp+38h] [rbp-18h]

  v3 = 3 * (a2 / 4);
  v4 = 0;
  v5 = 0;
  if ( a1[a2 - 1] == 61 )
    v4 = 1;
  if ( a1[a2 - 2] == 61 )
    ++v4;
  if ( a1[a2 - 3] == 61 )
    ++v4;
  if ( v4 == 3 )
  {
    v3 += 2;
  }
  else if ( v4 <= 3 )
  {
    if ( v4 == 2 )
    {
      v3 += 3;
    }
    else if ( v4 )
    {
      if ( v4 == 1 )
        v3 += 4;
    }
    else
    {
      v3 += 4;
    }
  }
  s = malloc(v3);
  if ( s )
  {
    memset(s, 0, v3);
    v10 = s;
    while ( v5 < a2 - v4 )
    {
      v6 = 0;
      v7 = 0;
      while ( v6 <= 3 && v5 < a2 - v4 )
      {
        v7 = (v7 << 6) | (char)find_pos(a1[v5]);
        ++v6;
        ++v5;
      }
      v8 = v7 << (6 * (4 - v6));
      for ( i = 0; i <= 2 && i != v6; ++i )
        *v10++ = v8 >> (8 * (2 - i));
    }
    *v10 = 0;
    return s;
  }
  else
  {
    puts("No enough memory.");
    return 0LL;
  }
}

base表： "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234{}789+/="

写个爆破脚本来爆破

s = [  0x9E, 0x9B, 0x9C, 0xB5, 0xFE, 0x70, 0xD3, 0x0F, 0xB2, 0xD1, 
  0x4F, 0x9C, 0x02, 0x7F, 0xAB, 0xDE, 0x59, 0x65, 0x63, 0xE7, 
  0x40, 0x9D, 0xCD, 0xFA]
flag = []

base = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234{}789+/='
v5 = 0

for i in range(0,24,3):
    v7 = 0
    for j1 in range(len(base)):
        tmp = 0
        v8 = (v7 << 6) | j1
        for j2 in range(len(base)):
            v9 = (v8 << 6) | j2
            for j3 in range(len(base)):
                v10 = (v9 << 6) | j3
                for j4 in range(len(base)):
                    v11 = (v10 << 6) | j4
                    #print(v10)
                    if (s[i] == (v11 >> 16) % 256 ) and (s[i + 1] == (v11 >> 8) % 256 ) and (s[i + 2] == v11 % 256):
                        flag.append(j1)
                        flag.append(j2)
                        flag.append(j3)
                        flag.append(j4)
               
                        print(i,"{}{}{}{}".format(base[j1],base[j2],base[j3],base[j4]))
                       
print(flag)
print(len(flag))

由于这个爆破的结果有几个都满足条件所以我都输出出来了，爆破结果：

0 npuc
3 tf{w
6 0w+y
9 0U+c
12 An+r
12 =n+r
15 3lll
18 Y+c=
18 Y+dA
18 Y+d=
21 nc3}
[39, 41, 46, 28, 45, 31, 57, 48, 52, 48, 62, 50, 52, 20, 62, 28, 0, 39, 62, 43, 64, 39, 62, 43, 55, 37, 37, 37, 24, 62, 28, 64, 24, 62, 29, 0, 24, 62, 29, 64, 39, 28, 55, 58]
44

尝试拼了下前面几段，猜测中间应该是没有等于号（‘=’）的，肯定是拿加号（‘+’）拼接

最终flag：npuctf{w0w+y0U+cAn+r3lllY+dAnc3}