1
section .data
2
    c db 74, 69, 67, 79, 71, 89, 99, 113, 111, 125, 107, 81, 125, 107, 79, 82, 18, 80, 86, 22, 76, 86, 125, 22, 125, 112, 71, 84, 17, 80, 81, 17, 95, 34
3
    flag db 33 dup(0)
4
    format db "plz input your flag: ", 0
5
    success db "Congratulations!", 0
6
    failure db "Sry, plz try again", 0
7

8
section .text
9
    global _start
10

11
_start:
12
    ; Print prompt
13
    mov eax, 4
14
    mov ebx, 1
15
    mov ecx, format
16
    mov edx, 20
17
    int 0x80
18

19
    ; Read user input
20
    mov eax, 3
21
    mov ebx, 0
22
    mov ecx, flag
23
    mov edx, 33
24
    int 0x80
25

26
    ; Check flag
27
    xor esi, esi
28
check_flag:
29
    mov al, byte [flag + esi]
30
    xor al, 0x22
31
    cmp al, byte [c + esi]
32
    jne failure_check
33

34
    inc esi
35
    cmp esi, 33
36
    jne check_flag
37

38
    ; Print success message
39
    mov eax, 4
40
    mov ebx, 1
41
    mov ecx, success
42
    mov edx, 14
43
    int 0x80
44

45
    ; Exit
46
    mov eax, 1
47
    xor ebx, ebx
48
    int 0x80
49

50
failure_check:
51
    ; Print failure message
52
    mov eax, 4
53
    mov ebx, 1
54
    mov ecx, failure
55
    mov edx, 18
56
    int 0x80
57

58
    ; Exit
59
    mov eax, 1
60
    xor ebx, ebx
61
    int 0x80

1
#include <stdio.h>
2

3
int main()
4
{
5
    unsigned char c[] = {
6
        74, 69, 67, 79, 71, 89, 99, 113, 111, 125, 107, 81, 125, 107, 79, 82,
7
        18, 80, 86, 22, 76, 86, 125, 22, 125, 112, 71, 84, 17, 80, 81, 17, 95, 34};
8
    int length = sizeof(c) / sizeof(c[0]);
9

10
    printf("Flag: ");
11
    for (int i = 0; i < length; i++)
12
    {
13
        printf("%c", c[i] ^ 0x22);
14
    }
15
    printf("\n");
16

17
    return 0;
18
}

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  int v3; // edx
4
  __int64 i; // rax
5
  __int128 v6[2]; // [rsp+20h] [rbp-38h] BYREF
6
  int v7; // [rsp+40h] [rbp-18h]
7

8
  memset(v6, 0, sizeof(v6));
9
  v7 = 0;
10
  sub_140001020("plz input your flag:\n");
11
  sub_140001080("%36s");
12
  v3 = 0;
13
  for ( i = 0i64; (*((_BYTE *)v6 + i) ^ 0x32) == byte_1400022A0[i]; ++i )
14
  {
15
    if ( (unsigned int)++v3 >= 0x25 )
16
    {
17
      sub_140001020("Cooool!You really know a little of UPX!");
18
      return 0;
19
    }
20
  }
21
  sub_140001020("Sry,try again plz...");
22
  return 0;
23
}

1
# include<stdio.h>
2

3
int main()
4
{
5
    unsigned char c[] = {
6
    0x64, 0x7B, 0x76, 0x73, 0x60, 0x49, 0x65, 0x5D, 0x45, 0x13, 0x6B, 0x02, 0x47, 0x6D, 0x59, 0x5C,
7
    0x02, 0x45, 0x6D, 0x06, 0x6D, 0x5E, 0x03, 0x46, 0x46, 0x5E, 0x01, 0x6D, 0x02, 0x54, 0x6D, 0x67,
8
    0x62, 0x6A, 0x13, 0x4F, 0x32};
9

10
    printf("Flag: ");
11
    for (int i = 0; i < sizeof(c); i++)
12
    {
13
        printf("%c", c[i] ^ 0x32);
14
    }
15
    printf("\n");
16

17
    return 0;
18
}

1
flag = [
2
 87, 75, 71, 69, 83, 121, 83, 125, 117, 106, 108, 106, 94, 80, 48,
3
 114, 100, 112, 112, 55, 94, 51, 112, 91, 48, 108, 119, 97, 115,
4
 49, 112, 112, 48, 108, 100, 37, 124, 2]
5
c = [1, 2, 3, 4]
6
result = ''
7
for i in range(len(flag)):
8
    result += chr(flag[i] ^ c[i % len(c)])
9

10
print(f"Flag: {result}")

1
unsigned int cipher[32] = { 0x00002F14, 0x0000004E, 0x00004FF3, 0x0000006D, 0x000032D8, 0x0000006D, 0x00006B4B, 0xFFFFFF92, 0x0000264F, 0x0000005B, 0x000052FB, 0xFFFFFF9C, 0x00002B71, 0x00000014, 0x00002A6F, 0xFFFFFF95, 0x000028FA, 0x0000001D, 0x00002989, 0xFFFFFF9B, 0x000028B4, 0x0000004E, 0x00004506, 0xFFFFFFDA, 0x0000177B, 0xFFFFFFFC, 0x000040CE, 0x0000007D, 0x000029E3, 0x0000000F, 0x00001F11, 0x000000FF };

1
#include <stdio.h>
2
#include <string.h>
3
__int32 enc[33] = {12052, 78, 20467, 109, 13016, 109, 27467, -110,
4
                   9807, 91, 21243, -100, 11121, 20, 10863, -107, 10490, 29, 10633, -101,
5
                   10420, 78, 17670, -38, 6011, -4, 16590, 125, 10723,
6
                   15, 7953, 255, 250};
7
__int32 key[6] = {0x77, 0x74, 0x78, 0x66, 0x65, 0x69};
8
int main()
9
{
10
    int i = 31;
11
    while (i >= 0)
12
    {
13
        enc[i] ^= (enc[i + 1] - key[(i + 1) % 6]);
14
        i--;
15
        enc[i] /= (enc[i + 1] + key[(i + 1) % 6]);
16
        i--;
17
        enc[i] += (key[(i + 1) % 6] ^ enc[i + 1]);
18
        i--;
19
        enc[i] -= (key[(i + 1) % 6] * enc[i + 1]);
20
        i--;
21
    }
22
    for (int j = 0; j < 32; j++)
23
    {
24
        printf("%c", enc[j]);
25
    }
26
    return 0;
27
}

1
key1 = 2341, key2 = 1234, key3 = 4123, key4 = 3412, delta = -559038737

1
unsigned char byte_1400032F8[32] = {
2
    0x88, 0x6A, 0xB0, 0xC9, 0xAD, 0xF1, 0x33, 0x33, 0x94, 0x74, 0xB5, 0x69, 0x73, 0x5F, 0x30, 0x62,
3
    0x4A, 0x33, 0x63, 0x54, 0x5F, 0x30, 0x72, 0x31, 0x65, 0x6E, 0x54, 0x65, 0x44, 0x3F, 0x21, 0x7D
4
};

1
#include<iostream>
2
#include<string.h>
3
//密文flag
4
int flag[32] = {0x88, 0x6A, 0xB0, 0xC9, 0xAD, 0xF1, 0x33, 0x33, 0x94, 0x74,
5
                0xB5, 0x69, 0x73, 0x5F, 0x30, 0x62, 0x4A, 0x33, 0x63, 0x54,
6
                0x5F, 0x30, 0x72, 0x31, 0x65, 0x6E, 0x54, 0x65, 0x44, 0x3F,
7
                0x21, 0x7D};
8
int v20,v21,v18,v19,v10,v9,v5,v6,sum,delta;
9
//四个密钥
10
int key1 = 2341, key2 = 1234, key3 = 4123, key4 = 3412;
11
//将int类型拆分成字符的函数
12
void trans(int v,int i){
13
    flag[i] = v & 0xff;
14
    flag[i+1] = (v>>8) & 0xff;
15
    flag[i+2] = (v>>16) & 0xff;
16
    flag[i+3] = (v>>24) & 0xff;
17
}
18
int main(){
19
    //按照原加密的顺序逆过来
20
    delta = -559038737;
21
    //first
22
    sum = delta * 32;
23
    //将字符拼合成int的整数
24
    v20 = flag[3]|(flag[4]<<8)|(flag[5]<<16)|(flag[6]<<24);
25
    v21 = flag[7]|(flag[8]<<8)|(flag[9]<<16)|(flag[10]<<24);
26
    //TEA加密的部分
27
    for(int i = 0;i < 32;i++){
28
        v21 -= (sum + v20) ^ (key3 + 32 * v20) ^ (key4 + 16 * v20);
29
        v20 -= (sum + v21) ^ (key1 + 32 * v21) ^ (key2 + 16 * v21);
30
        sum -= delta;
31
    }
32
    //调用函数将int拆分成原来的字符
33
    trans(v20,3);
34
    trans(v21,7);
35
    //second
36
    sum = delta * 32;
37
    v18 = flag[2]|(flag[3]<<8)|(flag[4]<<16)|(flag[5]<<24);
38
    v19 = flag[6]|(flag[7]<<8)|(flag[8]<<16)|(flag[9]<<24);
39
    for(int i = 0;i < 32;i++){
40
        v19 -= (sum + v18) ^ (key3 + 32 * v18) ^ (key4 + 16 * v18);
41
        v18 -= (sum + v19) ^ (key1 + 32 * v19) ^ (key2 + 16 * v19);
42
        sum -= delta;
43
    }
44
    trans(v18,2);
45
    trans(v19,6);
46
    //third
47
    sum = delta * 32;
48
    v9 = flag[1]|(flag[2]<<8)|(flag[3]<<16)|(flag[4]<<24);
49
    v10 = flag[5]|(flag[6]<<8)|(flag[7]<<16)|(flag[8]<<24);
50
    for(int i = 0;i < 32;i++){
51
        v10 -= (sum + v9) ^ (key3 + 32 * v9) ^ (key4 + 16 * v9);
52
        v9 -= (sum + v10) ^ (key1 + 32 * v10) ^ (key2 + 16 * v10);
53
        sum -= delta;
54
    }
55
    trans(v9,1);
56
    trans(v10,5);
57
    //forth
58
    sum = delta * 32;
59
    v5 = flag[0]|(flag[1]<<8)|(flag[2]<<16)|(flag[3]<<24);
60
    v6 = flag[4]|(flag[5]<<8)|(flag[6]<<16)|(flag[7]<<24);
61
    for(int i = 0;i < 32;i++){
62
        v6 -= (sum + v5) ^ (16 * v5 + key4) ^ (32 * v5 + key3);
63
        v5 -= (sum + v6) ^ (16 * v6 + key2) ^ (32 * v6 + key1);
64
        sum -= delta;
65
    }
66
    trans(v5,0);
67
    trans(v6,4);
68
    //print
69
    for(int i = 0;i < 32;i++){
70
        printf("%c",flag[i]);
71
    }
72
    return 0;
73
}

1
package com.feifei.babyandroid;
2

3
import java.util.Arrays;
4

5
/* loaded from: classes.dex */
6
public class Check1 {
7
    private byte[] S = new byte[256];
8
    private int i;
9
    private int j;
10

11
    public Check1(byte[] bArr) {
12
        for (int i = 0; i < 256; i++) {
13
            this.S[i] = (byte) i;
14
        }
15
        int i2 = 0;
16
        for (int i3 = 0; i3 < 256; i3++) {
17
            byte[] bArr2 = this.S;
18
            i2 = (i2 + bArr2[i3] + bArr[i3 % bArr.length]) & 255;
19
            swap(bArr2, i3, i2);
20
        }
21
        this.i = 0;
22
        this.j = 0;
23
    }
24

25
    private void swap(byte[] bArr, int i, int i2) {
26
        byte b = bArr[i];
27
        bArr[i] = bArr[i2];
28
        bArr[i2] = b;
29
    }
30

31
    public byte[] encrypt(byte[] bArr) {
32
        byte[] bArr2 = new byte[bArr.length];
33
        for (int i = 0; i < bArr.length; i++) {
34
            int i2 = (this.i + 1) & 255;
35
            this.i = i2;
36
            int i3 = this.j;
37
            byte[] bArr3 = this.S;
38
            int i4 = (i3 + bArr3[i2]) & 255;
39
            this.j = i4;
40
            swap(bArr3, i2, i4);
41
            byte[] bArr4 = this.S;
42
            bArr2[i] = (byte) (bArr4[(bArr4[this.i] + bArr4[this.j]) & 255] ^ bArr[i]);
43
        }
44
        return bArr2;
45
    }
46

47
    public boolean check(byte[] bArr) {
48
        return Arrays.equals(new byte[]{-75, 80, 80, 48, -88, 75, 103, 45, -91, 89, -60, 91, -54, 5, 6, -72}, encrypt(bArr));
49
    }
50
}

1
unsigned char byte_6E3[32] = {
2
    0x64, 0xA2, 0x80, 0xFD, 0x1B, 0x20, 0xD2, 0x8E, 0xFC, 0x52, 0x9E, 0x13, 0xEE, 0xA1, 0xFD, 0x1E,
3
    0x66, 0x0B, 0x7A, 0x72, 0xA3, 0x1B, 0xD8, 0x36, 0x6F, 0xDC, 0x3D, 0xEE, 0x3C, 0x01, 0x57, 0x63
4
};

1
#define _CRT_SECURE_NO_WARNINGS
2
#include <bits/stdc++.h>
3
#include <time.h>
4
#define MAX 6752833
5

6
using namespace std;
7

8
long a[500][500], f[510][510], last[510][510], lis[510];
9
int path[510];
10

11
int main() {
12
    srand(time(NULL));
13
    int x = 1, y = 1;
14
    FILE *fp = fopen("out", "rb");
15
    while (fscanf(fp, "%d", &a[x][y]) != EOF) {
16
        if (x == y) {
17
            y = 1;
18
            x++;
19
            continue;
20
        }
21
        y++;
22
    }
23
    x--;
24

25
    f[1][1] = a[1][1];
26
    for (int i = 2; i <= x; i++) {
27
        for (int j = 1; j <= i; j++) {
28
            f[i][j] = f[i - 1][j] + a[i][j];
29
            last[i][j] = j;
30
            if (f[i - 1][j - 1] + a[i][j] >= f[i][j]) {
31
                f[i][j] = f[i - 1][j - 1] + a[i][j];
32
                last[i][j] = j - 1;
33
            }
34
        }
35
    }
36

37
    for (int i = 1; i <= x; i++) {
38
        if (f[x][i] == MAX) {
39
            x = 500, y = i;
40
            while (x > 1) {
41
                lis[x] = a[x][y];
42
                if (last[x][y] == y - 1) {
43
                    path[x] = 2;
44
                    y = y - 1;
45
                } else {
46
                    path[x] = 1;
47
                }
48
                x--;
49
            }
50
        }
51
    }
52

53
    for (int i = 2; i <= 500; i++) {
54
        printf("%d", path[i]);
55
    }
56

57
    return 0;
58
}

1
unsigned char cipher[29] = {
2
    0x50, 0x42, 0x38, 0x4D, 0x4C, 0x54, 0x90, 0x6F, 0xFE, 0x6F, 0xBC, 0x69, 0xB9, 0x22, 0x7C, 0x16,
3
    0x8F, 0x44, 0x38, 0x4A, 0xEF, 0x37, 0x43, 0xC0, 0xA2, 0xB6, 0x34, 0x2C, 0x00
4
};

1
unsigned char key[] = {0x18, 0x25, 0x29, 0x20, 0x19, 0x27, 0xb9, 0xc9, 0x34, 0xc7, 0x71, 0xc9, 0xac, 0x17, 0xb4, 0x1e, 0xe5, 0xe9, 0xfc,
2
                           0x2a, 0x4a, 0x01, 0xea, 0x79, 0xc7, 0x82, 0xfe, 0x51, 0xe7, 0xb1, 0xae, 0x28, 0x15};

1
#include <stdio.h>
2

3
int main()
4
{
5
    unsigned char cipher[] = {0x50, 0x42, 0x38, 0x4D, 0x4C, 0x54, 0x90, 0x6F, 0xFE, 0x6F, 0xBC, 0x69, 0xB9, 0x22, 0x7C, 0x16, 0x8F, 0x44,
6
                              0x38, 0x4A, 0xEF, 0x37, 0x43, 0xC0, 0xA2, 0xB6, 0x34, 0x2C, 0x00};
7

8
    unsigned char key[] = {0x18, 0x25, 0x29, 0x20, 0x19, 0x27, 0xb9, 0xc9, 0x34, 0xc7, 0x71, 0xc9, 0xac, 0x17, 0xb4, 0x1e, 0xe5, 0xe9, 0xfc,
9
                           0x2a, 0x4a, 0x01, 0xea, 0x79, 0xc7, 0x82, 0xfe, 0x51, 0xe7, 0xb1, 0xae, 0x28, 0x15};
10

11
    for (int i = 0; i < sizeof(cipher); i++)
12
    {
13
        cipher[i] += key[i];
14
        printf("%c", cipher[i]);
15
    }
16

17
    return 0;
18
}
19
# hgame{I826-2e904t-4t98-9i82}

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  void *v3; // rdi
4
  void *v4; // r14
5
  UCHAR *v5; // r15
6
  UCHAR *v6; // rsi
7
  unsigned int v7; // ebx
8
  HANDLE ProcessHeap; // rax
9
  unsigned int v9; // ebx
10
  HANDLE v10; // rax
11
  UCHAR *v11; // rax
12
  __int64 v12; // rax
13
  ULONG v13; // ebx
14
  HANDLE v14; // rax
15
  UCHAR *v15; // r9
16
  HANDLE v16; // rax
17
  _OWORD *v17; // rax
18
  ULONG v18; // ebx
19
  HANDLE v19; // rax
20
  HANDLE v20; // rax
21
  HANDLE v21; // rax
22
  HANDLE v22; // rax
23
  HANDLE v23; // rax
24
  HANDLE v24; // rax
25
  UCHAR v26[4]; // [rsp+58h] [rbp-19h] BYREF
26
  ULONG cbOutput; // [rsp+5Ch] [rbp-15h] BYREF
27
  ULONG v28; // [rsp+60h] [rbp-11h] BYREF
28
  BCRYPT_KEY_HANDLE phKey; // [rsp+68h] [rbp-9h] BYREF
29
  UCHAR pbOutput[4]; // [rsp+70h] [rbp-1h] BYREF
30
  BCRYPT_ALG_HANDLE phAlgorithm; // [rsp+78h] [rbp+7h] BYREF
31
  ULONG pcbResult; // [rsp+80h] [rbp+Fh] BYREF
32
  WCHAR pszAlgId[2]; // [rsp+88h] [rbp+17h] BYREF
33
  int v34; // [rsp+8Ch] [rbp+1Bh]
34
  UCHAR pbInput[16]; // [rsp+90h] [rbp+1Fh] BYREF
35
  __m128i si128; // [rsp+A0h] [rbp+2Fh]
36

37
  v3 = 0i64;
38
  v4 = 0i64;
39
  phAlgorithm = 0i64;
40
  v5 = 0i64;
41
  phKey = 0i64;
42
  v6 = 0i64;
43
  v28 = 0;
44
  pcbResult = 0;
45
  *(_DWORD *)pbOutput = 0;
46
  *(_DWORD *)v26 = 0;
47
  cbOutput = 0;
48
  sub_140001770(std::cin, argv, envp);
49
  v34 = 83;
50
  *(_DWORD *)pszAlgId = 4522049;
51
  *(__m128i *)pbInput = _mm_load_si128((const __m128i *)&xmmword_1400034F0);
52
  si128 = _mm_load_si128((const __m128i *)&xmmword_1400034E0);
53
  if ( BCryptOpenAlgorithmProvider(&phAlgorithm, pszAlgId, 0i64, 0) >= 0
54
    && BCryptGetProperty(phAlgorithm, L"ObjectLength", pbOutput, 4u, &pcbResult, 0) >= 0 )
55
  {
56
    v7 = *(_DWORD *)pbOutput;
57
    ProcessHeap = GetProcessHeap();
58
    v5 = (UCHAR *)HeapAlloc(ProcessHeap, 0, v7);
59
    if ( v5 )
60
    {
61
      if ( BCryptGetProperty(phAlgorithm, L"BlockLength", v26, 4u, &pcbResult, 0) >= 0 )
62
      {
63
        v9 = *(_DWORD *)v26;
64
        v10 = GetProcessHeap();
65
        v11 = (UCHAR *)HeapAlloc(v10, 0, v9);
66
        v6 = v11;
67
        if ( v11 )
68
        {
69
          memcpy(v11, &unk_1400034A0, *(unsigned int *)v26);
70
          v12 = 8i64;
71
          *(__m128i *)pbInput = _mm_xor_si128(
72
                                  _mm_load_si128((const __m128i *)&xmmword_140003500),
73
                                  _mm_loadu_si128((const __m128i *)pbInput));
74
          do
75
            *(_WORD *)&pbInput[2 * v12++] ^= 0x55u;
76
          while ( v12 < 15 );
77
          if ( BCryptSetProperty(phAlgorithm, L"ChainingMode", pbInput, 0x20u, 0) >= 0
78
            && BCryptGenerateSymmetricKey(phAlgorithm, &phKey, v5, *(ULONG *)pbOutput, (PUCHAR)&pbSecret, 0x10u, 0) >= 0
79
            && BCryptExportKey(phKey, 0i64, L"OpaqueKeyBlob", 0i64, 0, &cbOutput, 0) >= 0 )
80
          {
81
            v13 = cbOutput;
82
            v14 = GetProcessHeap();
83
            v15 = (UCHAR *)HeapAlloc(v14, 0, v13);
84
            if ( v15 )
85
            {
86
              if ( BCryptExportKey(phKey, 0i64, L"OpaqueKeyBlob", v15, cbOutput, &cbOutput, 0) >= 0 )
87
              {
88
                v16 = GetProcessHeap();
89
                v17 = HeapAlloc(v16, 0, 0x32ui64);
90
                v3 = v17;
91
                if ( v17 )
92
                {
93
                  *v17 = xmmword_140005750;
94
                  v17[1] = xmmword_140005760;
95
                  v17[2] = xmmword_140005770;
96
                  *((_WORD *)v17 + 24) = word_140005780;
97
                  if ( BCryptEncrypt(phKey, (PUCHAR)v17, 0x32u, 0i64, v6, *(ULONG *)v26, 0i64, 0, &v28, 1u) >= 0 )
98
                  {
99
                    v18 = v28;
100
                    v19 = GetProcessHeap();
101
                    v4 = HeapAlloc(v19, 0, v18);
102
                    if ( v4 )
103
                    {
104
                      if ( BCryptEncrypt(
105
                             phKey,
106
                             (PUCHAR)v3,
107
                             0x32u,
108
                             0i64,
109
                             v6,
110
                             *(ULONG *)v26,
111
                             (PUCHAR)v4,
112
                             v28,
113
                             &pcbResult,
114
                             1u) >= 0
115
                        && BCryptDestroyKey(phKey) >= 0 )
116
                      {
117
                        phKey = 0i64;
118
                        v20 = GetProcessHeap();
119
                        HeapFree(v20, 0, v3);
120
                        v3 = 0i64;
121
                        if ( !memcmp(v4, &unk_140005050, v28) )
122
                          puts("right flag!");
123
                      }
124
                    }
125
                  }
126
                }
127
              }
128
            }
129
          }
130
        }
131
      }
132
    }
133
  }
134
  if ( phAlgorithm )
135
    BCryptCloseAlgorithmProvider(phAlgorithm, 0);
136
  if ( phKey )
137
    BCryptDestroyKey(phKey);
138
  if ( v4 )
139
  {
140
    v21 = GetProcessHeap();
141
    HeapFree(v21, 0, v4);
142
  }
143
  if ( v3 )
144
  {
145
    v22 = GetProcessHeap();
146
    HeapFree(v22, 0, v3);
147
  }
148
  if ( v5 )
149
  {
150
    v23 = GetProcessHeap();
151
    HeapFree(v23, 0, v5);
152
  }
153
  if ( v6 )
154
  {
155
    v24 = GetProcessHeap();
156
    HeapFree(v24, 0, v6);
157
  }
158
  return 0;
159
}

1
key = 4C9D7B3EECD0661FA034DC863F5F1FE2

1
cipher = A4E10F1C53BC42CD8E7154B7F175E35097207197A83B7761406968C1B47B88549F19034470782425F0A96535913A049C4E66BED28B8B2073CEA0CBE939BD6D83

1
iv = 936AF225FA6810B8D07C3E5E9EE8EE0D

1
# hgame{rever5e_wind0ws_4P1_is_1nter3sting}

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  sub_140001010("hgame{It_is_a_fake_flag!HaHaHa}\n");
4
  sub_140001010("you should try to decrypt it:\n");
5
  sub_140001010("aGdhbWV7SXRfaXNfYWxzb19hX2Zha2VfZmxhZyFIYUhhSGFIYX0=");
6
  puts(Buffer);
7
  return 0;
8
}

1
with open("findme.exe", "rb") as fp:
2
    with open("real.exe", "wb") as v5:
3
        n = 0
4
        while True:
5
            byte = fp.read(1)
6
            if not byte:
7
                break
8
            n += 1
9
            if n > 0x2440 and n % 4 == 1:
10
                v5.write(byte)

1
import idautils
2
import idc
3
import ida_bytes
4

5
# 查找.text段
6
code_start = 0
7
code_end = 0
8

9
for seg_ea in idautils.Segments():
10
    if idc.get_segm_name(seg_ea) == ".text":
11
        code_start = idc.get_segm_start(seg_ea)
12
        code_end = idc.get_segm_end(seg_ea)
13
        break
14

15
print(hex(code_start), hex(code_end))
16

17
# 在.text段中查找并替换指令
18
for ea in range(code_start, code_end):
19
    # 查找指令序列 0x74 0x03
20
    if ida_bytes.get_byte(ea) == 0x74 and ida_bytes.get_byte(ea + 1) == 0x03:
21
        # 将指令替换为5个nop（0x90）
22
        ida_bytes.patch_bytes(ea, b"\x90"*5)

1
cipher = [0x7D, 0x2B, 0x43, 0xA9, 0xB9, 0x6B, 0x93, 0x2D, 0x9A, 0xD0,
2
        0x48, 0xC8, 0xEB, 0x51, 0x59, 0xE9, 0x74, 0x68, 0x8A, 0x45,
3
        0x6B, 0xBA, 0xA7, 0x16, 0xF1, 0x10, 0x74, 0xD5, 0x41, 0x3C,
4
        0x67, 0x7D]

1
key = [0x15, 0xc4, 0xe2, 0x3c, 0x54, 0xf0, 0x4d, 0xc1, 0x4b, 0x59,       0x15, 0x56, 0x78, 0xf2, 0x18, 0x77, 0x41, 0x9, 0x34, 0xe0,       0xf9, 0x41, 0x48, 0xb0, 0x7f, 0xdc, 0xd, 0x63, 0xe0, 0xce,       0xf3, 0x0]