Reverse#

聪明的信使#

逻辑清晰，密文已知，加密只有encrypt函数

exp:

1
cipher = 'oujp{H0d_TwXf_Lahyc0_14_e3ah_Rvy0ac@wc!}'
2
flag = ''
3

4
def encode(j):
5
    if 65 <= j <= 90:
6
        j = (j + 9 - 65) % 26 + 65
7
    elif 97 <= j <= 122:
8
        j = (j + 9 - 97) % 26 + 97
9
    return chr(j)
10
for i in range(len(cipher)):
11
    found = False
12
    for j in range(128):
13
        if encode(j) == cipher[i]:
14
            flag += chr(j)
15
            found = True
16
            break
17
    if not found:
18
        flag += cipher[i]
19

20
print(flag)
21

22
# flag{Y0u_KnOw_Crypt0_14_v3ry_Imp0rt@nt!}

喵喵喵的flag碎了一地#

main函数给我提示去获得flag

第三段让我找交叉引用

1
 # flag{My_fl@g_h4s_br0ken_4parT_Bu7_Y0u_c@n_f1x_1t!}

你真的是大学生吗？#

1
dseg:0000 0D                            unk_10000 db  0Dh                       ; DATA XREF: start+5↓o
2
dseg:0001 0A                            db  0Ah
3
dseg:0002 69                            db  69h ; i
4
dseg:0003 6E                            db  6Eh ; n
5
dseg:0004 70                            db  70h ; p
6
dseg:0005 75                            db  75h ; u
7
dseg:0006 74                            db  74h ; t
8
dseg:0007 20                            db  20h
9
dseg:0008 73                            db  73h ; s
10
dseg:0009 74                            db  74h ; t
11
dseg:000A 72                            db  72h ; r
12
dseg:000B 69                            db  69h ; i
13
dseg:000C 6E                            db  6Eh ; n
14
dseg:000D 67                            db  67h ; g
15
dseg:000E 3A                            db  3Ah ; :
16
dseg:000F 24                            db  24h ; $
17
dseg:0010 0D                            unk_10010 db  0Dh                       ; DATA XREF: start+15↓o
18
dseg:0011 0A                            db  0Ah
19
dseg:0012 24                            db  24h ; $
20
dseg:0013 0D                            unk_10013 db  0Dh                       ; DATA XREF: start+52↓o
21
dseg:0014 0A                            db  0Ah
22
dseg:0015 59                            db  59h ; Y
23
dseg:0016 65                            db  65h ; e
24
dseg:0017 73                            db  73h ; s
25
dseg:0018 24                            db  24h ; $
26
dseg:0019 76                            unk_10019 db  76h ; v                   ; DATA XREF: start+3D↓o
27
dseg:001A 0E                            db  0Eh
28
dseg:001B 77                            db  77h ; w
29
dseg:001C 14                            db  14h
30
dseg:001D 60                            db  60h ; `
31
dseg:001E 06                            db    6
32
dseg:001F 7D                            db  7Dh ; }
33
dseg:0020 04                            db    4
34
dseg:0021 6B                            db  6Bh ; k
35
dseg:0022 1E                            db  1Eh
36
dseg:0023 41                            db  41h ; A
37
dseg:0024 2A                            db  2Ah ; *
38
dseg:0025 44                            db  44h ; D
39
dseg:0026 2B                            db  2Bh ; +
40
dseg:0027 5C                            db  5Ch ; \
41
dseg:0028 03                            db    3
42
dseg:0029 3B                            db  3Bh ; ;
43
dseg:002A 0B                            db  0Bh
44
dseg:002B 33                            db  33h ; 3
45
dseg:002C 05                            db    5
46
dseg:002D 15                            unk_1002D db  15h                       ; DATA XREF: start+D↓o
47
dseg:002E 00                            byte_1002E db 0                         ; DATA XREF: start+21↓r
48
dseg:002F 00                            unk_1002F db    0                       ; DATA XREF: start+39↓o
49
dseg:0030 00                            db    0
50
dseg:0031 00                            db    0
51
dseg:0032 00                            db    0
52
dseg:0033 00                            db    0
53
dseg:0034 00                            db    0
54
dseg:0035 00                            db    0
55
dseg:0036 00                            db    0
56
dseg:0037 00                            db    0
57
dseg:0038 00                            db    0
58
dseg:0039 00                            db    0
59
dseg:003A 00                            db    0
60
dseg:003B 00                            db    0
61
dseg:003C 00                            db    0
62
dseg:003D 00                            db    0
63
dseg:003E 00                            db    0
64
dseg:003F 00                            db    0
65
dseg:0040 00                            db    0
66
dseg:0041 00                            db    0
67
dseg:0042 00                            db    0
68
dseg:0043 00                            db    0
69
dseg:0044 00                            db    0
70
dseg:0045 00                            db    0
71
dseg:0046 00                            db    0
72
dseg:0047 00                            db    0
73
dseg:0048 00                            db    0
74
dseg:0049 00                            db    0
75
dseg:004A 00                            db    0
76
dseg:004B 00                            db    0
77
dseg:004C 00                            db    0
78
dseg:004D 00                            db    0
79
dseg:004E 00                            db    0
80
dseg:004F 00                            db    0
81
dseg:004F                               dseg ends
82
dseg:004F
83
seg001:0000                               ; ===========================================================================
84
seg001:0000
85
seg001:0000                               ; Segment type: Pure code
86
seg001:0000                               seg001 segment byte public 'CODE' use16
87
seg001:0000                               assume cs:seg001
88
seg001:0000                               assume es:nothing, ss:dseg, ds:nothing, fs:nothing, gs:nothing
89
seg001:0000
90
seg001:0000                               ; =============== S U B R O U T I N E =======================================
91
seg001:0000
92
seg001:0000                               ; Attributes: noreturn
93
seg001:0000
94
seg001:0000                               public start
95
seg001:0000                               start proc near
96
seg001:0000 B8 00 10                      mov     ax, seg dseg
97
seg001:0003 8E D8                         mov     ds, ax
98
seg001:0005                               assume ds:dseg
99
seg001:0005 8D 16 00 00                   lea     dx, unk_10000
100
seg001:0009 B4 09                         mov     ah, 9
101
seg001:000B CD 21                         int     21h                             ; DOS - PRINT STRING
102
seg001:000B                                                                       ; DS:DX -> string terminated by "$"
103
seg001:000B
104
seg001:000D 8D 16 2D 00                   lea     dx, unk_1002D
105
seg001:0011 B4 0A                         mov     ah, 0Ah
106
seg001:0013 CD 21                         int     21h                             ; DOS - BUFFERED KEYBOARD INPUT
107
seg001:0013                                                                       ; DS:DX -> buffer
108
seg001:0013
109
seg001:0015 8D 16 10 00                   lea     dx, unk_10010
110
seg001:0019 B4 09                         mov     ah, 9
111
seg001:001B CD 21                         int     21h                             ; DOS - PRINT STRING
112
seg001:001B                                                                       ; DS:DX -> string terminated by "$"
113
seg001:001B
114
seg001:001D 33 C9                         xor     cx, cx
115
seg001:001F 33 C0                         xor     ax, ax
116
seg001:0021 8A 0E 2E 00                   mov     cl, byte_1002E
117
seg001:0025 BE 2F 00                      mov     si, 2Fh ; '/'
118
seg001:0028 8A 04                         mov     al, [si]
119
seg001:002A 03 F1                         add     si, cx
120
seg001:002A
121
seg001:002C
122
seg001:002C                               loc_1007C:                              ; CODE XREF: start+37↓j
123
seg001:002C 83 EE 01                      sub     si, 1
124
seg001:002F 30 04                         xor     [si], al
125
seg001:0031 8A 04                         mov     al, [si]
126
seg001:0033 49                            dec     cx
127
seg001:0034 83 F9 00                      cmp     cx, 0
128
seg001:0037 75 F3                         jnz     short loc_1007C
129
seg001:0037
130
seg001:0039 8D 36 2F 00                   lea     si, unk_1002F
131
seg001:003D 8D 3E 19 00                   lea     di, unk_10019
132
seg001:003D
133
seg001:0041
134
seg001:0041                               loc_10091:                              ; CODE XREF: start+50↓j
135
seg001:0041 8A 04                         mov     al, [si]
136
seg001:0043 8A 1D                         mov     bl, [di]
137
seg001:0045 83 C6 01                      add     si, 1
138
seg001:0048 47                            inc     di
139
seg001:0049 3A C3                         cmp     al, bl
140
seg001:004B 75 0D                         jnz     short loc_100AA
141
seg001:004B
142
seg001:004D 83 F9 00                      cmp     cx, 0
143
seg001:0050 75 EF                         jnz     short loc_10091
144
seg001:0050
145
seg001:0052 8D 16 13 00                   lea     dx, unk_10013
146
seg001:0056 B4 09                         mov     ah, 9
147
seg001:0058 CD 21                         int     21h                             ; DOS - PRINT STRING
148
seg001:0058                                                                       ; DS:DX -> string terminated by "$"
149
seg001:0058
150
seg001:005A
151
seg001:005A                               loc_100AA:                              ; CODE XREF: start+4B↑j
152
seg001:005A B4 4C                         mov     ah, 4Ch
153
seg001:005C CD 21                         int     21h                             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
154
seg001:005C                                                                       ; AL = exit code
155
seg001:005C
156
seg001:005C                               start endp
157
seg001:005C
158
seg001:005C                               seg001 ends
159
seg001:005C
160
seg001:005C
161
seg001:005C                               end start

没有找到其他方法，硬读汇编

start是获取input，对其加密(发生在loc_1007c)，通过将每一个字节与后一个字节进行异或运算来加密

1
cipher = [0x76, 0x0E, 0x77, 0x14, 0x60, 0x06, 0x7D, 0x04, 0x6B, 0x1E, 0x41, 0x2A, 0x44, 0x2B, 0x5C, 0x03, 0x3B, 0x0B, 0x33, 0x05]
2
for i in range(len(cipher) - 1):
3
    cipher[i] = cipher[i] ^ cipher[i + 1]
4
flag = ''
5
for i in range(len(cipher)):
6
    if i != (len(cipher) - 1):
7
        flag += chr(cipher[i])
8
    else:
9
        flag += chr(cipher[i] ^ 0x15)
10
print(flag)
11
# xyctf{you_know_8086}

DebugMe#

只告诉要动态调试，回显“flag呢”

添加debug

找到包名

找到类名

进行adb调试

jeb运行到调试结束处，得到flag

trustme#

参考文章：adb连接MuMu、逍遥、夜神、雷电模拟器以及腾讯手游助手以及断开连接_雷电adb连接地址-CSDN博客

1
package com.swdd.trustme;
2

3
import android.os.Bundle;
4
import android.view.View;
5
import android.widget.TextView;
6
import android.widget.Toast;
7
import androidx.appcompat.app.AppCompatActivity;
8
import kotlin.UByte;
9

10
/* loaded from: classes.dex */
11
public class MainActivity extends AppCompatActivity {
12
    /* JADX INFO: Access modifiers changed from: protected */
13
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
14
    public void onCreate(Bundle bundle) {
15
        super.onCreate(bundle);
16
        setContentView(R.layout.activity_main);
17
    }
18

19
    public void onClick(View view) {
20
        ((TextView) findViewById(R.id.username)).getText().toString();
21
        if (bytesToHex(RC4(((TextView) findViewById(R.id.password)).getText().toString().getBytes(), "XYCTF".getBytes())).equals("5a3c46e0228b444decc7651c8a7ca93ba4cb35a46f7eb589bef4")) {
22
            Toast.makeText(this, "成功!", 0);
23
        }
24
    }
25

26
    public static byte[] RC4(byte[] bArr, byte[] bArr2) {
27
        int[] iArr = new int[256];
28
        byte[] bArr3 = new byte[256];
29
        byte[] bArr4 = new byte[bArr.length];
30
        for (int i = 0; i < 256; i++) {
31
            iArr[i] = i;
32
            bArr3[i] = bArr2[i % bArr2.length];
33
        }
34
        int i2 = 0;
35
        for (int i3 = 0; i3 < 256; i3++) {
36
            int i4 = iArr[i3];
37
            i2 = (i2 + i4 + bArr3[i3]) & 255;
38
            iArr[i3] = iArr[i2];
39
            iArr[i2] = i4;
40
        }
41
        int i5 = 0;
42
        for (int i6 = 0; i6 < bArr.length; i6++) {
43
            i5 = (i5 + 1) & 255;
44
            int i7 = iArr[i5];
45
            i2 = (i2 + i7) & 255;
46
            iArr[i5] = iArr[i2];
47
            iArr[i2] = i7;
48
            bArr4[i6] = (byte) (iArr[(iArr[i5] + i7) & 255] ^ bArr[i6]);
49
        }
50
        return bArr4;
51
    }
52

53
    public static String bytesToHex(byte[] bArr) {
54
        StringBuilder sb = new StringBuilder();
55
        for (byte b : bArr) {
56
            String hexString = Integer.toHexString(b & UByte.MAX_VALUE);
57
            if (hexString.length() == 1) {
58
                sb.append('0');
59
            }
60
            sb.append(hexString);
61
        }
62
        return sb.toString();
63
    }
64
}

MainActivity告诉了用户名的计算

用户名：admin

ProxyApplication方法则是利用java反射，将密文藏在shell.apk里

这里有藏着真正的方法路径

提shell.apk大概有两种思路：

MT管理器找
连上手机，adb pull出来（没有测试机所以没搞）

数据是放在数据库的，直接找

安装下来，丢进jadx分析，找到真正的“密文”

这里的意思是密码和flag数据在database数据库里，账号密码输入正确则回显flag出来有两种解法：

(一)连接手机，利用**“SELECT password FROM User WHERE username = ‘flag’“**frida提出flag exp：

1
function hookFunctionWithWihit(className, allowFunction) {
2
    Java.perform(function () {
3
        // 指定要hook的类名
4
        var targetClassName = className;
5
        if (allowFunction == null) {
6
            return;
7
        }
8
        console.log(targetClassName)
9
        // 获取类的引用
10
        var targetClass = Java.use(targetClassName);
11
        // 获取目标类的构造函数
12
        // var constructors = targetClass.$init.overloads;
13
        // 遍历类的所有声明方法
14
        var methods = targetClass.class.getDeclaredMethods();
15
        for (var i = 0; i < methods.length; i++) {
16
            var method = methods[i];
17

18
            // console.log(method)
19
            if (!allowFunction.includes(method.getName())) {
20
                continue;
21
            }
22
            // 对每个方法进行hook
23
            hookMethod(targetClass, method);
24
            // console.log("hook targetClass", targetClass, "的方法:", method)
25
        }
26
    });
27
}
28
// 函数用于hook一个方法
29
function hookMethod(targetClass, method, arg) {
30
    // 获取方法名和参数类型
31
    var methodName = method.getName();
32
    // Hook方法
33
    var overloadCount = targetClass[methodName].overloads.length;
34

35

36
    // 对每个重载进行Hook
37
    for (var k = 0; k < overloadCount; k++) {
38
        targetClass[methodName].overloads[k].implementation = function () {
39
            var result = this[methodName].apply(this, arguments);
40
            if (("" + targetClass).includes("android.database.sqlite.SQLiteOpenHelper")) {
41
                var rawQuery2 = result.rawQuery("SELECT password FROM User WHERE username = 'flag'", null)
42
                rawQuery2.moveToFirst()
43
                console.log(rawQuery2.getString(0))
44
            }
45
            return result;
46
        };
47
    }
48
}
49

50
var delayTime = 500;
51
// 延迟执行hook操作
52
setTimeout(function () {
53
    hookFunctionWithWihit("android.database.sqlite.SQLiteOpenHelper", ["getReadableDatabase"])
54

55
}, 500);
56
setTimeout(function () {
57

58
    // hookFunctionWithWihit("android.util.Base64", ["encode"]);
59
}, 30000)

（二）MT管理器直接找

下面的方法有提供找数据库的路径，直接MT管理器一把梭：

同时也得到密码：qweradmin

ez_cube#

1
__int64 sub_7FF629032930()
2
{
3
  int i; // [rsp+44h] [rbp+24h]
4
  char input_steps; // [rsp+64h] [rbp+44h]
5
  int v3; // [rsp+84h] [rbp+64h]
6

7
  sub_7FF629031384((__int64)&unk_7FF6290440A2);
8
  for ( i = 0; i < 9; ++i )                     // 初始化cube
9
  {
10
    surface1[i] = &Red;
11
    surface2[i] = "Blue";
12
    surface3[i] = "Green";
13
    surface4[i] = "Orange";
14
    surface5[i] = "Yellow";
15
    surface6[i] = "White";
16
  }
17
  surface2[1] = &Red;
18
  surface1[1] = "Green";
19
  surface3[1] = "Blue";
20
  while ( 1 )
21
  {
22
    do
23
      input_steps = getchar();
24
    while ( input_steps == 10 );                // 读取回车就下一步
25
    switch ( input_steps )
26
    {
27
      case 'R':
28
        sub_7FF629031375();
29
        break;
30
      case 'U':
31
        sub_7FF6290313BB();
32
        break;
33
      case 'r':
34
        sub_7FF629031366();
35
        break;
36
      case 'u':
37
        sub_7FF62903115E();
38
        break;
39
    }
40
    ++steps;
41
    v3 = cmp();
42
    if ( v3 == 1 )
43
      break;
44
    if ( v3 == 2 )
45
      goto LABEL_19;
46
  }
47
  printf(aGreatYouAreAGo);
48
LABEL_19:
49
  system("pause");
50
  return 0i64;
51
}

魔方题，先找线索：（每一面的数字代表每一块颜色）

1
7FF62903CC24h 红色   1(正面)
2

3
7FF62903CC28h 蓝色   2
4

5
7FF62903CC30h 绿色   3
6

7
7FF62903CC38h 橙色   4
8

9
7FF62903CC40h 黄色   5
10

11
7FF62903CC48h 白色   6

进行魔方打乱：蓝色（2）面第一排第二个变成红色红色（1）面第一排第二个变成绿色绿色（3）面第一排第二个变成蓝色

分析RUru步骤：

cmp函数是验证是否复原，以及复原步骤是否<=12

拿魔方手操：RuRURURuruRR

今夕是何年#

这道题没什么难点，就是先认出是龙芯架构下运行的文件，用qemu配置龙芯系统

用die查了是ELF文件，然后ubuntu运行

Untitled

配置龙芯架构，跑一遍就出小白也能懂之如何在自己的Windows电脑上使用QEMU虚拟机启动龙芯Loongnix系统的操作办法_龙芯qemu-CSDN博客

baby unity#

不一样的unity引擎，正常是moon架构，找得到Assembly-Csharp直接逆，这题是il2cpp架构，根据提示

通过https://github.com/Perfare/Il2CppDumper/下载工具

说明里面提到的命令行格式为：

1
Il2CppDumper.exe executable-file  global-metadata  output-directory

but dump失败

发现三个dll文件都有upx壳，将GameAssembly.dll脱壳

直接使用下载好的工具里面的Il2CppDumper.exe打开在下载的题目的路径里面依次选中GameAssembly.dll以及”\baby unity_Data\il2cpp_data\Metadata\global-metadata.dat”

运行成功

dump出Dummydll文件和output文件

使用dnspy打开Dummydll / Assembly-Csharp

找到关键函数名称 IDA打开GameAssembly.dll 使用script file 导入文件，导入工具里的ida_py3 和 output的script.json

找到对应的两个函数，分析

其实只进行了这两段加密

exp:

1
import base64
2

3
cipher = "XIcKYJU8Buh:UeV:BKN{U[JvUL??VuZ?CXJ;AX^{Ae]gA[]gUecb@K]ei^22"
4

5
decoded_bytes = bytes([char ^ 0xF for char in cipher.encode()])
6

7
decoded_string = base64.b64decode(decoded_bytes).decode()
8

9
print(decoded_string)
10
# XYCTF{389f6900-e12d-4c54-a85d-64a54af9f84c}

ez_rand#

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  unsigned __int64 v3; // rbx
4
  unsigned __int16 v4; // ax
5
  int v5; // edi
6
  __int64 v6; // rsi
7
  int v7; // eax
8
  int cipher[7]; // [rsp+20h] [rbp-50h]
9
  char cipher7; // [rsp+3Ch] [rbp-34h]
10
  __int16 v11; // [rsp+3Dh] [rbp-33h]
11
  __int128 input; // [rsp+40h] [rbp-30h]
12
  __int64 v13; // [rsp+50h] [rbp-20h]
13
  int v14; // [rsp+58h] [rbp-18h]
14
  __int16 v15; // [rsp+5Ch] [rbp-14h]
15
  char v16; // [rsp+5Eh] [rbp-12h]
16

17
  v13 = 0i64;
18
  input = 0i64;
19
  v14 = 0;
20
  v15 = 0;
21
  v16 = 0;
22
  printf((char *)&Flag_);
23
  scanf("%s");
24
  cipher[0] = 0xEA6C0C5D;
25
  v11 = 0;
26
  v3 = -1i64;
27
  cipher[1] = 0x34FC1946;
28
  cipher[2] = 0x72362B2;
29
  cipher[3] = 0xFB6E2262;
30
  cipher[4] = 0xA9F2E8B4;
31
  cipher[5] = 0x86211291;
32
  cipher[6] = 0x43E98EDB;
33
  cipher7 = 0x4D;
34
  do
35
    ++v3;
36
  while ( *((_BYTE *)&input + v3) );
37
  v4 = time64(0i64);
38
  srand(v4);
39
  v5 = 0;
40
  if ( v3 )
41
  {
42
    v6 = 0i64;
43
    do
44
    {
45
      v7 = rand();
46
      if ( (*((_BYTE *)&input + v6) ^ (unsigned __int8)(v7
47
                                                      + ((((unsigned __int64)(2155905153i64 * v7) >> 32) & 0x80000000) != 0i64)
48
                                                      + ((int)((unsigned __int64)(2155905153i64 * v7) >> 32) >> 7))) != *((_BYTE *)cipher + v6) )
49
      {
50
        printf("Error???\n");
51
        exit(0);
52
      }
53
      ++v5;
54
      ++v6;
55
    }
56
    while ( v5 < v3 );
57
  }
58
  printf("Right???\n");
59
  system("pause");
60
  return 0;
61
}

v4是种子，srand函数和rand函数根据种子来生成随机数，input加密逻辑使用v7 那么首先想到的是爆破种子，来推flag

再看v4，unsigned __int16 v4无符号16位整数型，v4范围为0~2**16-1(65535)，结合flag固定格式XYCTF{}

exp：

1
#include <stdio.h>
2
#include <string.h>
3
#include <stdlib.h>
4
#include <time.h>
5

6
int containsXYCTF(const char *str)
7
{
8
    if (strstr(str, "XYCTF") != NULL)
9
    {
10
        return 1; // 包含"XYCTF"
11
    }
12
    else
13
    {
14
        return 0; // 不包含"XYCTF"
15
    }
16
}
17

18
int main()
19
{
20
    unsigned char cipher[29] = {0x5D, 0x0C, 0x6C, 0xEA, 0x46, 0x19, 0xFC, 0x34, 0xB2, 0x62, 0x23, 0x07, 0x62, 0x22, 0x6E, 0xFB, 0xB4, 0xE8, 0xF2, 0xA9, 0x91, 0x12, 0x21, 0x86, 0xDB, 0x8E, 0xE9, 0x43, 0x4D};
21
    unsigned int v7;
22
    char flag[29] = {0};
23

24
    for (unsigned int seed = 0; seed < 65536; seed++)
25
    {
26
        srand(seed);
27
        for (int i = 0; i < 29; i++)
28
        {
29
            v7 = rand();
30
            int num = (int)((unsigned __int64)(2155905153 * v7) >> 32);
31
            unsigned __int8 data = (unsigned __int8)(v7 + ((num & 0x80000000) != 0) + (num >> 7));
32
            flag[i] = cipher[i] ^ data;
33
        }
34
        if (containsXYCTF(flag))
35
        {
36
            printf("success\n");
37
            printf("seed = %d\n", seed);
38
            puts(flag);
39
        }
40
    }
41
}
42
// seed = 21308
43
// XYCTF{R@nd_1s_S0_S0_S0_easy!}

何须相思煮余年#

打开是一堆十六进制数据和cipher

写个脚本将十六进制数据转化为二进制数据，然后写入二进制文件再将输出的文件丢进IDA

1
hex_data = "0x55 0x8b 0xec 0x81 0xec 0xa8 0x0 0x0 0x0 0xa1 0x0 0x40 0x41 0x0 0x33 0xc5 0x89 0x45 0xfc 0x68 0x9c 0x0 0x0 0x0 0x6a 0x0 0x8d 0x85 0x60 0xff 0xff 0xff 0x50 0xe8 0x7a 0xc 0x0 0x0 0x83 0xc4 0xc 0xc7 0x85 0x58 0xff 0xff 0xff 0x27 0x0 0x0 0x0 0xc7 0x85 0x5c 0xff 0xff 0xff 0x0 0x0 0x0 0x0 0xeb 0xf 0x8b 0x8d 0x5c 0xff 0xff 0xff 0x83 0xc1 0x1 0x89 0x8d 0x5c 0xff 0xff 0xff 0x83 0xbd 0x5c 0xff 0xff 0xff 0x27 0xf 0x8d 0xed 0x0 0x0 0x0 0x8b 0x95 0x5c 0xff 0xff 0xff 0x81 0xe2 0x3 0x0 0x0 0x80 0x79 0x5 0x4a 0x83 0xca 0xfc 0x42 0x85 0xd2 0x75 0x25 0x8b 0x85 0x5c 0xff 0xff 0xff 0x8b 0x8c 0x85 0x60 0xff 0xff 0xff 0x3 0x8d 0x5c 0xff 0xff 0xff 0x8b 0x95 0x5c 0xff 0xff 0xff 0x89 0x8c 0x95 0x60 0xff 0xff 0xff 0xe9 0xac 0x0 0x0 0x0 0x8b 0x85 0x5c 0xff 0xff 0xff 0x25 0x3 0x0 0x0 0x80 0x79 0x5 0x48 0x83 0xc8 0xfc 0x40 0x83 0xf8 0x1 0x75 0x22 0x8b 0x8d 0x5c 0xff 0xff 0xff 0x8b 0x94 0x8d 0x60 0xff 0xff 0xff 0x2b 0x95 0x5c 0xff 0xff 0xff 0x8b 0x85 0x5c 0xff 0xff 0xff 0x89 0x94 0x85 0x60 0xff 0xff 0xff 0xeb 0x73 0x8b 0x8d 0x5c 0xff 0xff 0xff 0x81 0xe1 0x3 0x0 0x0 0x80 0x79 0x5 0x49 0x83 0xc9 0xfc 0x41 0x83 0xf9 0x2 0x75 0x23 0x8b 0x95 0x5c 0xff 0xff 0xff 0x8b 0x84 0x95 0x60 0xff 0xff 0xff 0xf 0xaf 0x85 0x5c 0xff 0xff 0xff 0x8b 0x8d 0x5c 0xff 0xff 0xff 0x89 0x84 0x8d 0x60 0xff 0xff 0xff 0xeb 0x38 0x8b 0x95 0x5c 0xff 0xff 0xff 0x81 0xe2 0x3 0x0 0x0 0x80 0x79 0x5 0x4a 0x83 0xca 0xfc 0x42 0x83 0xfa 0x3 0x75 0x20 0x8b 0x85 0x5c 0xff 0xff 0xff 0x8b 0x8c 0x85 0x60 0xff 0xff 0xff 0x33 0x8d 0x5c 0xff 0xff 0xff 0x8b 0x95 0x5c 0xff 0xff 0xff 0x89 0x8c 0x95 0x60 0xff 0xff 0xff 0xe9 0xf7 0xfe 0xff 0xff 0x33 0xc0 0x8b 0x4d 0xfc 0x33 0xcd 0xe8 0x4 0x0 0x0 0x0 0x8b 0xe5 0x5d 0xc3"
2
# 去除空格并将十六进制数据字符串分割成十六进制值的列表
3
hex_values = hex_data.split()
4
# 将每个十六进制值转换为相应的整数值
5
int_values = [int(value, 16) for value in hex_values]
6
# 将整数值列表转换为字节
7
binary_data = bytes(int_values)
8
# 将二进制数据写入文件
9
with open("output", "wb") as f:
10
    f.write(binary_data)

得到汇编指令

这里的call和下面的call的地址一眼假，当作花指令nop掉 u、p操作复原函数

1
int sub_0()
2
{
3
  int i; // [esp+4h] [ebp-A4h]
4
  int v2[39]; // [esp+8h] [ebp-A0h]
5

6
  for ( i = 0; i < 39; ++i )
7
  {
8
    if ( i % 4 )
9
    {
10
      switch ( i % 4 )
11
      {
12
        case 1:
13
          v2[i] -= i;
14
          break;
15
        case 2:
16
          v2[i] *= i;
17
          break;
18
        case 3:
19
          v2[i] ^= i;
20
          break;
21
      }
22
    }
23
    else
24
    {
25
      v2[i] += i;
26
    }
27
  }
28
  return 0;
29
}

加密逻辑清晰 exp：

1
cipher = [88, 88, 134, 87, 74, 118, 318, 101, 59, 92, 480, 60, 65, 41, 770, 110, 73, 31, 918, 39, 120, 27, 1188, 47, 77,
2
          24, 1352, 44, 81, 23, 1680, 46, 85, 15, 1870, 66, 91, 16, 4750]
3
flag = ''
4
for i in range(len(cipher)):
5
    if i % 4 == 0:
6
        flag += chr(cipher[i] - i)
7
    elif i % 4 == 1:
8
        flag += chr(cipher[i] + i)
9
    elif i % 4 == 2:
10
        flag += chr(int(cipher[i] / i))
11
    elif i % 4 == 3:
12
        flag += chr(cipher[i] ^ i)
13

14
print(flag)
15

16
# XYCTF{5b3e07567a9034d06851475481507a75}

砸核桃#

北斗兄弟3.X壳，网上找文章[原创]NsPack 3.7 浅析（7.3更新脱壳机和源码）-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

下载对应工具后

IDA打开：

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  int v4; // eax
4
  char input[52]; // [esp+4h] [ebp-38h] BYREF
5

6
  memset(input, 0, 50);
7
  printf("Please Input Flag:");
8
  gets_s(input, 0x2Cu);
9
  if ( strlen(input) == 42 )
10
  {
11
    v4 = 0;
12
    while ( (input[v4] ^ byte_402130[v4 % 16]) == cipher[v4] )
13
    {
14
      if ( ++v4 >= 42 )
15
      {
16
        printf("right!\n");
17
        return 0;
18
      }
19
    }
20
    printf("error!\n");
21
    return 0;
22
  }
23
  else
24
  {
25
    printf("error!\n");
26
    return -1;
27
  }
28
}

提取cipher和byte_402130 exp:

1
true_cipher = [0x00000012, 0x00000004, 0x00000008, 0x00000014, 0x00000024, 0x0000005C, 0x0000004A, 0x0000003D,
2
               0x00000056, 0x0000000A, 0x00000010, 0x00000067, 0x00000000, 0x00000041, 0x00000000, 0x00000001,
3
               0x00000046, 0x0000005A, 0x00000044, 0x00000042, 0x0000006E, 0x0000000C, 0x00000044, 0x00000072,
4
               0x0000000C, 0x0000000D, 0x00000040, 0x0000003E, 0x0000004B, 0x0000005F, 0x00000002, 0x00000001,
5
               0x0000004C, 0x0000005E, 0x0000005B, 0x00000017, 0x0000006E, 0x0000000C, 0x00000016, 0x00000068,
6
               0x0000005B, 0x00000012, 0x00000000, 0x00000000, 0x00000048]
7

8
XOR = [0x74, 0x68, 0x69, 0x73, 0x5F, 0x69, 0x73, 0x5F, 0x6E, 0x6F, 0x74, 0x5F, 0x66, 0x6C, 0x61, 0x67, 0x00]
9
flag = ''
10
for j in range(len(true_cipher)):
11
    flag += chr(true_cipher[j] ^ XOR[j % 16])
12
print(flag)
13

14
# flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}

ez_enc#

1
__int64 sub_7FF6BCD11960()
2
{
3
  signed int i; // [rsp+44h] [rbp+24h]
4
  int j; // [rsp+64h] [rbp+44h]
5

6
  sub_7FF6BCD1137F((__int64)&unk_7FF6BCD23008);
7
  printf(Format);
8
  printf(asc_7FF6BCD1AE60);
9
  printf(asc_7FF6BCD1AF20);
10
  printf(asc_7FF6BCD1B1A0);
11
  printf(asc_7FF6BCD1B290);
12
  printf(asc_7FF6BCD1B640);
13
  printf(asc_7FF6BCD1AE18);
14
  scanf((__int64)&s_, (__int64)flag);
15
  for ( i = 0; i < (int)(j_strlen(flag) - 1); ++i )
16
    flag[i] = key[i % 6] ^ (flag[i + 1] + (unsigned __int8)flag[i] % 20);
17
  for ( j = 0; j < (int)j_strlen(flag); ++j )
18
  {
19
    if ( flag[j] != cipher[j] )
20
    {
21
      printf("Wrong");
22
      return 0i64;
23
    }
24
  }
25
  printf("Right,but where is my Imouto?\n");
26
  return 0i64;
27
}

根据分析进行修改，得到以上内容，前几个printf打印德国骨科相关内容，真正的加密只有第一个for循环

因为不好逆，所以采用正向爆破，但是这里有一定特殊性，爆破后的数据一定在0~19范围内。为了得到正确的flag，将cipher的值+20的倍数进行计算，对应爆破的flag数据也对应+20的倍数，得到正确合理数据为止 exp:

1
cipher = [0x27, 0x24, 0x17, 0x0B, 0x50, 0x03, 0xC8, 0x0C, 0x1F, 0x17, 0x36, 0x55, 0xCB, 0x2D, 0xE9, 0x32, 0x0E, 0x11,
2
          0x26, 0x02, 0x0C, 0x07, 0xFC, 0x27, 0x3D, 0x2D, 0xED, 0x35, 0x59, 0xEB, 0x3C, 0x3E, 0xE4, 0x7D]
3
key = "IMouto"
4
i = len(cipher) - 2
5
while i >= 0:
6
    for j in range(20):
7
        if cipher[i] == ord(key[i % 6]) ^ cipher[i + 1] + (j % 20):
8
            cipher[i] = j
9
            print(j)
10
            break
11
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 20) + (j % 20):
12
            cipher[i] = j
13
            print(cipher[i + 1] + 20)
14
            break
15
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 40) + (j % 20):
16
            cipher[i] = j
17
            print(cipher[i + 1] + 40)
18
            break
19
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 60) + (j % 20):
20
            cipher[i] = j
21
            print(cipher[i + 1] + 60)
22
            break
23
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 80) + (j % 20):
24
            cipher[i] = j
25
            print(cipher[i + 1] + 80)
26
            break
27
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 100) + (j % 20):
28
            cipher[i] = j
29
            print(cipher[i + 1] + 100)
30
            break
31
        elif cipher[i] == ord(key[i % 6]) ^ (cipher[i + 1] + 120) + (j % 20):
32
            cipher[i] = j
33
            print(cipher[i + 1] + 120)
34
            break
35
    i -= 1
36
# 14  不用管这个数据，为了得到114而生成的错误数据
37
# 114
38
# 101
39
# 116
40
# 36
41
# 49
42
# 115
43
# 95
44
# 101
45
# 55
46
# 117
47
# 99
48
# 95
49
# 64
50
# 95
51
# 116
52
# 110
53
# 52
54
# 119
55
# 95
56
# 121
57
# 49
58
# 49
59
# 97
60
# 101
61
# 51
62
# 114
63
# 95
64
# 33
65
# 123
66
# 103
67
# 97
68
# 108

再对爆破出的数据处理

1
a = [114, 101, 116, 36, 49, 115, 95, 101, 55, 117, 99, 95, 64, 95, 116, 110, 52, 119, 95, 121, 49, 49, 97, 101, 51, 114,
2
     95, 33, 123, 103, 97, 108]
3

4
print("长度为:" + str(len(a)))
5
flag = ""
6
for i in a:
7
    flag += chr(i)
8
print(flag[::-1] + '}')
9

10
# flag{!_r3ea11y_w4nt_@_cu7e_s1$ter}

ezmath#

python解释器编译的exe文件，解包出pyc，再反编译成py文件

1
# uncompyle6 version 3.9.0
2
# Python bytecode version base 3.8.0 (3413)
3
# Decompiled from: Python 3.9.0 (tags/v3.9.0:9cf6752, Oct  5 2020, 15:23:07) [MSC v.1927 32 bit (Intel)]
4
flag = [ord(i) for i in input('flag:')]
5
if len(flag) == 32:
6
    if sum([flag[23] for _ in range(flag[23])]) + sum([flag[12] for _ in range(flag[12])]) + sum([flag[1] for _ in range(flag[1])]) - sum([flag[24] for _ in range(222)]) + sum([flag[22] for _ in range(flag[22])]) + sum([flag[31] for _ in range(flag[31])]) + sum([flag[26] for _ in range(flag[26])]) - sum([flag[9] for _ in range(178)]) - sum([flag[29] for _ in range(232)]) + sum([flag[17] for _ in range(flag[17])]) - sum([flag[23] for _ in range(150)]) - sum([flag[6] for _ in range(226)]) - sum([flag[7] for _ in range(110)]) + sum([flag[19] for _ in range(flag[19])]) + sum([flag[2] for _ in range(flag[2])]) - sum([flag[0] for _ in range(176)]) + sum([flag[10] for _ in range(flag[10])]) - sum([flag[12] for _ in range(198)]) + sum([flag[24] for _ in range(flag[24])]) + sum([flag[9] for _ in range(flag[9])]) - sum([flag[3] for _ in range(168)]) + sum([flag[8] for _ in range(flag[8])]) - sum([flag[2] for _ in range(134)]) + sum([flag[14] for _ in range(flag[14])]) - sum([flag[13] for _ in range(170)]) + sum([flag[4] for _ in range(flag[4])]) - sum([flag[10] for _ in range(142)]) + sum([flag[27] for _ in range(flag[27])]) + sum([flag[15] for _ in range(flag[15])]) - sum([flag[15] for _ in range(224)]) + sum([flag[16] for _ in range(flag[16])]) - sum([flag[11] for _ in range(230)]) - sum([flag[1] for _ in range(178)]) + sum([flag[28] for _ in range(flag[28])]) - sum([flag[5] for _ in range(246)]) - sum([flag[17] for _ in range(168)]) + sum([flag[30] for _ in range(flag[30])]) - sum([flag[21] for _ in range(220)]) - sum([flag[22] for _ in range(212)]) - sum([flag[16] for _ in range(232)]) + sum([flag[25] for _ in range(flag[25])]) - sum([flag[4] for _ in range(140)]) - sum([flag[31] for _ in range(250)]) - sum([flag[28] for _ in range(150)]) + sum([flag[11] for _ in range(flag[11])]) + sum([flag[13] for _ in range(flag[13])]) - sum([flag[14] for _ in range(234)]) + sum([flag[7] for _ in range(flag[7])]) - sum([flag[8] for _ in range(174)]) + sum([flag[3] for _ in range(flag[3])]) - sum([flag[25] for _ in range(242)]) + sum([flag[29] for _ in range(flag[29])]) + sum([flag[5] for _ in range(flag[5])]) - sum([flag[30] for _ in range(142)]) - sum([flag[26] for _ in range(170)]) - sum([flag[19] for _ in range(176)]) + sum([flag[0] for _ in range(flag[0])]) - sum([flag[27] for _ in range(168)]) + sum([flag[20] for _ in range(flag[20])]) - sum([flag[20] for _ in range(212)]) + sum([flag[21] for _ in range(flag[21])]) + sum([flag[6] for _ in range(flag[6])]) + sum([flag[18] for _ in range(flag[18])]) - sum([flag[18] for _ in range(178)]) + 297412 == 0:
7
        print('yes')
8
# okay decompiling ezmath.pyc

多元一次方程，z3脚本一把梭

1
from z3.z3 import Int, Solver, sat
2

3
flag = [Int(f"flag[{i}]") for i in range(32)]
4
solver = Solver()
5

6
solver.add(
7
    flag[23] * (flag[23]) +
8
    flag[12] * (flag[12]) +
9
    flag[1] * (flag[1]) -
10
    flag[24] * 222 +
11
    flag[22] * (flag[22]) +
12
    flag[31] * (flag[31]) +
13
    flag[26] * (flag[26]) -
14
    flag[9] * 178 -
15
    flag[29] * 232 +
16
    flag[17] * (flag[17]) -
17
    flag[23] * 150 -
18
    flag[6] * 226 -
19
    flag[7] * 110 +
20
    flag[19] * (flag[19]) +
21
    flag[2] * (flag[2]) -
22
    flag[0] * 176 +
23
    flag[10] * (flag[10]) -
24
    flag[12] * 198 +
25
    flag[24] * (flag[24]) +
26
    flag[9] * (flag[9]) -
27
    flag[3] * 168 +
28
    flag[8] * (flag[8]) -
29
    flag[2] * 134 +
30
    flag[14] * (flag[14]) -
31
    flag[13] * 170 +
32
    flag[4] * (flag[4]) -
33
    flag[10] * 142 +
34
    flag[27] * (flag[27]) +
35
    flag[15] * (flag[15]) -
36
    flag[15] * 224 +
37
    flag[16] * (flag[16]) -
38
    flag[11] * 230 -
39
    flag[1] * 178 +
40
    flag[28] * (flag[28]) -
41
    flag[5] * 246 -
42
    flag[17] * 168 +
43
    flag[30] * (flag[30]) -
44
    flag[21] * 220 -
45
    flag[22] * 212 -
46
    flag[16] * 232 +
47
    flag[25] * (flag[25]) -
48
    flag[4] * 140 -
49
    flag[31] * 250 -
50
    flag[28] * 150 +
51
    flag[11] * (flag[11]) +
52
    flag[13] * (flag[13]) -
53
    flag[14] * 234 +
54
    flag[7] * (flag[7]) -
55
    flag[8] * 174 +
56
    flag[3] * (flag[3]) -
57
    flag[25] * 242 +
58
    flag[29] * (flag[29]) +
59
    flag[5] * (flag[5]) -
60
    flag[30] * 142 -
61
    flag[26] * 170 -
62
    flag[19] * 176 +
63
    flag[0] * (flag[0]) -
64
    flag[27] * 168 +
65
    flag[20] * (flag[20]) -
66
    flag[20] * 212 +
67
    flag[21] * (flag[21]) +
68
    flag[6] * (flag[6]) +
69
    flag[18] * (flag[18]) -
70
    flag[18] * 178 +
71
    297412 == 0
72
)
73

74
if solver.check() == sat:
75
    model = solver.model()
76
    print(model)
77
    solution = [model.evaluate(flag[i] for i in range(32))]
78
    print("Solution found:")
79
    print(solution)
80
    for i in range(32):
81
        print(chr(int(str(model[flag[i]]))), end="")
82
else:
83
    print("No solution found.")
84

85
# flag[18] = 89,
86
# flag[6] = 113,
87
# flag[10] = 71,
88
# flag[17] = 84,
89
# flag[5] = 123,
90
# flag[21] = 110,
91
# flag[12] = 99,
92
# flag[20] = 106,
93
# flag[7] = 55,
94
# flag[24] = 111,
95
# flag[2] = 67,
96
# flag[26] = 85,
97
# flag[23] = 75,
98
# flag[1] = 89,
99
# flag[16] = 116,
100
# flag[25] = 121,
101
# flag[30] = 71,
102
# flag[14] = 117,
103
# flag[4] = 70,
104
# flag[11] = 115,
105
# flag[3] = 84,
106
# flag[28] = 75,
107
# flag[9] = 89,
108
# flag[15] = 112,
109
# flag[22] = 106,
110
# flag[8] = 87,
111
# flag[13] = 85,
112
# flag[29] = 116,
113
# flag[31] = 125,
114
# flag[0] = 88,
115
# flag[27] = 84,
116
# flag[19] = 88

整理得到flag

1
flag = {
2
    0: 88, 1: 89, 2: 67, 3: 84, 4: 70, 5: 123, 6: 113, 7: 55, 8: 87, 9: 89,
3
    10: 71, 11: 115, 12: 99, 13: 85, 14: 117, 15: 112, 16: 116, 17: 84, 18: 89,
4
    19: 88, 20: 106, 21: 110, 22: 106, 23: 75, 24: 111, 25: 121, 26: 85, 27: 84,
5
    28: 75, 29: 116, 30: 71, 31: 125
6
}
7
end = ''
8
for i in range(32):
9
    end += chr(flag[i])
10
print(end)
11

12
# XYCTF{q7WYGscUuptTYXjnjKoyUTKtG}

给阿姨倒一杯卡布奇诺#

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  uint32_t temp[2]; // [rsp+28h] [rbp-78h] BYREF
4
  char input[33]; // [rsp+30h] [rbp-70h] BYREF
5
  uint32_t key[4]; // [rsp+60h] [rbp-40h] BYREF
6
  uint32_t array[8]; // [rsp+70h] [rbp-30h]
7
  int i; // [rsp+9Ch] [rbp-4h]
8

9
  _main();
10
  array[0] = -1691816635;
11
  array[1] = 341755625;
12
  array[2] = 1529325251;
13
  array[3] = -442599979;
14
  array[4] = -399760128;
15
  array[5] = -1541333614;
16
  array[6] = -846574750;
17
  array[7] = -1503071168;
18
  key[0] = 1702259047;
19
  key[1] = 1970239839;
20
  key[2] = 1886741343;
21
  key[3] = 1634038879;
22
  memset(input, 0, sizeof(input));
23
  puts("please input your flag: ");
24
  scanf("%s", input);
25
  if ( strlen(input) != 32 )
26
  {
27
    puts("length error!!");
28
    exit(0);
29
  }
30
  for ( i = 0; i <= 7; i += 2 )
31
  {
32
    temp[0] = *(_DWORD *)&input[4 * i];
33
    temp[1] = *(_DWORD *)&input[4 * i + 4];
34
    encrypt(temp, key);                         // tea加密
35
    if ( temp[0] != array[i] || temp[1] != array[i + 1] )
36
    {
37
      printf("sorry, your flag is wrong!");
38
      exit(0);
39
    }
40
  }
41
  printf("success!!your flag is flag{your input}");
42
  return 0;
43
}

tea加密，多了一点异或，直接搓解密

1
#include <stdio.h>
2

3
unsigned int data1 = 0x5F797274;
4
unsigned int data2 = 0x64726168;
5

6
void decrypto(unsigned int *cipher, unsigned int *key)
7
{
8
    unsigned int v0, v1;
9
    unsigned int t0, t1;
10
    unsigned long long int sum = 0x6E75316CULL * 32;
11

12
    v0 = *cipher;
13
    v1 = cipher[1];
14
    t0 = v0;
15
    t1 = v1;
16
    for (int i = 31; i >= 0; --i)
17
    {
18
        v1 -= ((v0 >> 5) + key[3]) ^ (v0 + sum) ^ (key[2] + 16 * v0) ^ (sum + i);
19
        v0 -= ((v1 >> 5) + key[1]) ^ (v1 + sum) ^ (*key + 16 * v1) ^ (sum + i);
20
        sum -= 0x6E75316C;
21
    }
22
    *cipher = v0 ^ data1;
23
    cipher[1] = v1 ^ data2;
24
    data1 = t0;
25
    data2 = t1;
26
}
27

28
int main()
29
{
30
    unsigned int cipher[8];
31
    unsigned int key[4];
32
    int length, i;
33
    cipher[0] = 2603150661;
34
    cipher[1] = 0x145EC6E9;
35
    cipher[2] = 0x5B27A6C3;
36
    cipher[3] = 0xE59E75D5;
37
    cipher[4] = 0xE82C2500;
38
    cipher[5] = 0xA4211D92;
39
    cipher[6] = 0xCD8A4B62;
40
    cipher[7] = 0xA668F440;
41

42
    key[0] = 0x65766967;
43
    key[1] = 0x756F795F;
44
    key[2] = 0x7075635F;
45
    key[3] = 0x6165745F;
46

47
    length = sizeof(cipher);
48
    unsigned int *in = (unsigned int *)cipher;
49
    unsigned char *out = (unsigned char *)cipher;
50

51
    for (i = 0; i < 8; i += 2)
52
        decrypto(in + i, key);
53
    printf("flag{");
54
    for (i = 0; i < length; i++)
55
        printf("%c", out[i]);
56
    printf("}");
57
    return 0;
58
}
59

60
// flag{133bffe401d223a02385d90c5f1ca377}

what’s this#

DIE查询发现是lua编译的，网上搜lua在线反编译得到源码

一千多行代码，实际有用的只有最后那段

1
function Xor(num1, num2)
2
  local tmp1 = num1
3
  local tmp2 = num2
4
  local str = ""
5
  repeat
6
    local s1 = tmp1 % 2
7
    local s2 = tmp2 % 2
8
    if s1 == s2 then
9
      str = "0" .. str
10
    else
11
      str = "1" .. str
12
    end
13
    tmp1 = math.modf(tmp1 / 2)
14
    tmp2 = math.modf(tmp2 / 2)
15
  until tmp1 == 0 and tmp2 == 0
16
  return tonumber(str, 2)
17
end
18
value = ""
19
output = ""
20
i = 1
21
while true do
22
  local temp = string.byte(flag, i)
23
  temp = string.char(Xor(temp, 8) % 256)
24
  value = value .. temp
25
  i = i + 1
26
  if i > string.len(flag) then
27
    break
28
  end
29
end
30
for _ = 1, 1000 do
31
  x = 3
32
  y = x * 3
33
  z = y / 4
34
  w = z - 5
35
  if w == 0 then
36
    print("This line will never be executed")
37
  end
38
end
39
for i = 1, string.len(flag) do
40
  temp = string.byte(value, i)
41
  temp = string.char(temp + 3)
42
  output = output .. temp
43
end
44
result = output:rep(10)
45
invalid_list = {
46
  1,
47
  2,
48
  3
49
}
50
for _ = 1, 20 do
51
  table.insert(invalid_list, 4)
52
end
53
for _ = 1, 50 do
54
  result = result .. "A"
55
  table.insert(invalid_list, 4)
56
end
57
for i = 1, string.len(output) do
58
  temp = string.byte(output, i)
59
  temp = string.char(temp - 1)
60
end
61
for _ = 1, 30 do
62
  result = result .. string.lower(output)
63
end
64
for _ = 1, 950 do
65
  x = 3
66
  y = x * 3
67
  z = y / 4
68
  w = z - 5
69
  if w == 0 then
70
    print("This line will never be executed")
71
  end
72
end
73
for _ = 1, 50 do
74
  x = -1
75
  y = x * 4
76
  z = y / 2
77
  w = z - 3
78
  if w == 0 then
79
    print("This line will also never be executed")
80
  end
81
end
82
require("base64")
83
obfuscated_output = to_base64(output)
84
obfuscated_output = string.reverse(obfuscated_output)
85
obfuscated_output = string.gsub(obfuscated_output, "g", "3")
86
obfuscated_output = string.gsub(obfuscated_output, "H", "4")
87
obfuscated_output = string.gsub(obfuscated_output, "W", "6")
88
invalid_variable = obfuscated_output:rep(5)
89
if obfuscated_output == "==AeuFEcwxGPuJ0PBNzbC16ctFnPB5DPzI0bwx6bu9GQ2F1XOR1U" then
90
  print("You get the flag.")
91
else
92
  print("F**k!")
93
end

使用XOR函数将字符与数字8进行异或操作，再加上3，base64加密，再进行字符替换直接逆向逻辑，exp：

1
import base64
2

3
cipher = "==AeuFEcwxGPuJ0PBNzbC16ctFnPB5DPzI0bwx6bu9GQ2F1XOR1U"
4

5
new_cipher = cipher[::-1]
6
new_cipher = new_cipher.replace("3", "g")
7
new_cipher = new_cipher.replace("4", "H")
8
new_cipher = new_cipher.replace("6", "W")
9

10

11
def Xor(num1, num2):
12
    tmp1 = num1
13
    tmp2 = num2
14
    str_result = ""
15
    while tmp1 != 0 or tmp2 != 0:
16
        s1 = tmp1 % 2
17
        s2 = tmp2 % 2
18
        if s1 == s2:
19
            str_result = "0" + str_result
20
        else:
21
            str_result = "1" + str_result
22
        tmp1 = tmp1 // 2
23
        tmp2 = tmp2 // 2
24
    return int(str_result, 2)
25

26

27
d_cipher = base64.b64decode(new_cipher)
28

29
flag = ""
30
for char in d_cipher:
31
    flag += chr(Xor(char - 3, 8))
32

33
print(flag)
34

35
# XYCTF{5dcbaed781363fbfb7d8647c1aee6c}

馒头#

哈夫曼树学习参考：哈夫曼树编码的实现+图解（含全部代码）-CSDN博客

直接再check_flag里找到密文，里面包含了最终哈夫曼树的部分检测点以及data

1
data = [0x000008DE, 0x00000395, 0x000001BE, 0x000000D9, 0x0000006A, 0x00000033, 0x00000014, 0x0000000F, 0x00000011,
2
        0x000000E5, 0x00000072, 0x00000010, 0x0000000B, 0x000001D7, 0x000000E9, 0x00000074, 0x0000000E, 0x0000000D,
3
        0x000000EE, 0x00000076, 0x0000000C, 0x00000007, 0x00000549, 0x0000022D, 0x000000F8, 0x0000007B, 0x00000006,
4
        0x00000018, 0x00000135, 0x00000089, 0x00000043, 0x00000003, 0x00000005, 0x000000AC, 0x00000054, 0x00000004,
5
        0x00000001, 0x0000031C, 0x0000017F, 0x000000BA, 0x00000059, 0x00000002, 0x00000008, 0x000000C5, 0x00000061,
6
        0x00000030, 0x00000017, 0x0000000A, 0x00000015, 0x0000019D, 0x000000CB, 0x00000065, 0x00000016, 0x00000009,
7
        0x000000D2, 0x00000068, 0x00000013, 0x00000012]
8
num = []
9
print(len(data))
10
for i in range(len(data)):
11
    num.append(data[i])
12
print(num)
13

14
#[2270, 917, 446, 217, 106, 51, 20, 15, 17, 229, 114, 16, 11, 471, 233, 116, 14, 13, 238, 118, 12, 7, 1353, 557, 248, 123, 6, 24, 309, 137, 67, 3, 5, 172, 84, 4, 1, 796, 383, 186, 89, 2, 8, 197, 97, 48, 23, 10, 21, 413, 203, 101, 22, 9, 210, 104, 19, 18]

这里使用sorted函数排列一遍，可以发现data从1~24完整，那么，我们可以根据ans1的数据，画出哈夫曼树来解决为了方便，可以简单处理下数据：

1
# [2270, 917,446,     217, 106(j), 51(3), 20, 15, 17,     229,114(r), 16,11,     471, 233, 116(t), 14,13,     238, 118(v), 12 , 7,       1353,      557,     248, 123({), 6, 24,     309,     137, 67(C), 3, 5,   172, 84(T), 4, 1,      796, 383, 186, 89(Y), 2, 8,   197, 97(a), 48(0), 23, 10, 21,   413, 203, 101(e), 22, 9,     210,104(h), 19, 18]

我们可以根据分析粗略得到部分flag数据，继续画出完整哈夫曼树：

手撕，整理一下得到flag：

1
1 ---- X
2
2 ---- Y
3
3 ---- C
4
4 ---- T
5
5 ---- F
6
6 ---- {
7
7 ---- x
8
8 ---- a
9
9 ---- f
10
10 --- 1
11
11 --- s
12
12 --- v
13
13 --- u
14
14 --- t
15
15 --- 7
16
16 --- r
17
17 --- o
18
18 --- j
19
19 --- h
20
20 --- 3
21
21 --- d
22
22 --- e
23
23 --- 0
24
24 --- }
25
// XYCTF{xaf1svut7rojh3de0}

舔狗四部曲-简爱#

一眼过去应该是tea和howtolove函数有用，分析逻辑可以知道，两个tea分别对input和cipher进行同样的加密，所以无意义

锁定howtolove函数，有opcode那味儿，仿照vm思路来写，打出操作步骤

1
#include<stdio.h>
2
#include<string.h>
3
#include <stdlib.h>
4
#include <time.h>
5
char box[512];
6
char FileNamein[40];
7
char Filenameout[40];
8

9
int howtolove(char *flag)
10
{
11
  int v2[1802]; // [rsp+10h] [rbp-1C30h] BYREF
12
  int v3; // [rsp+1C38h] [rbp-8h]
13
  int v4; // [rsp+1C3Ch] [rbp-4h]
14
  int count1,count2;
15
  memset(v2, 0, 0x1C20uLL);
16
  v2[32] = 2;
17
  v2[65] = 2;
18
  v2[66] = 4;
19
  v2[98] = 2;
20
  v2[99] = 5;
21
  v2[185] = 2;
22
  v2[186] = 2;
23
  v2[187] = 1;
24
  v2[188] = 1;
25
  v2[189] = 1;
26
  v2[190] = 1;
27
  v2[191] = 1;
28
  v2[192] = 1;
29
  v2[193] = 1;
30
  v2[194] = 1;
31
  v2[195] = 1;
32
  v2[196] = 1;
33
  v2[197] = 1;
34
  v2[198] = 1;
35
  v2[199] = 1;
36
  v2[200] = 1;
37
  v2[201] = 1;
38
  v2[202] = 1;
39
  v2[203] = 1;
40
  v2[204] = 1;
41
  v2[205] = 1;
42
  v2[206] = 1;
43
  v2[207] = 1;
44
  v2[208] = 1;
45
  v2[209] = 1;
46
  v2[210] = 1;
47
  v2[211] = 1;
48
  v2[212] = 1;
49
  v2[213] = 1;
50
  v2[214] = 1;
51
  v2[215] = 1;
52
  v2[216] = 1;
53
  v2[217] = 1;
54
  v2[218] = 1;
55
  v2[219] = 1;
56
  v2[220] = 1;
57
  v2[221] = 1;
58
  v2[222] = 1;
59
  v2[223] = 1;
60
  v2[224] = 1;
61
  v2[225] = 1;
62
  v2[226] = 1;
63
  v2[227] = 1;
64
  v2[228] = 1;
65
  v2[229] = 2;
66
  v2[232] = 2;
67
  v2[256] = 2;
68
  v2[257] = 5;
69
  v2[303] = 1;
70
  v2[304] = 1;
71
  v2[305] = 1;
72
  v2[306] = 1;
73
  v2[307] = 2;
74
  v2[308] = 5;
75
  v2[328] = 1;
76
  v2[329] = 1;
77
  v2[330] = 1;
78
  v2[331] = 1;
79
  v2[332] = 1;
80
  v2[333] = 1;
81
  v2[334] = 1;
82
  v2[335] = 1;
83
  v2[336] = 1;
84
  v2[337] = 1;
85
  v2[338] = 1;
86
  v2[339] = 1;
87
  v2[340] = 1;
88
  v2[341] = 1;
89
  v2[342] = 2;
90
  v2[353] = 2;
91
  v2[354] = 5;
92
  v2[430] = 2;
93
  v2[431] = 2;
94
  v2[432] = 5;
95
  v2[523] = 2;
96
  v2[524] = 5;
97
  v2[564] = 2;
98
  v2[565] = 5;
99
  v2[627] = 2;
100
  v2[628] = 1;
101
  v2[629] = 1;
102
  v2[630] = 1;
103
  v2[631] = 1;
104
  v2[632] = 1;
105
  v2[633] = 1;
106
  v2[634] = 1;
107
  v2[635] = 1;
108
  v2[636] = 1;
109
  v2[637] = 1;
110
  v2[638] = 1;
111
  v2[639] = 1;
112
  v2[640] = 1;
113
  v2[641] = 1;
114
  v2[642] = 1;
115
  v2[643] = 1;
116
  v2[644] = 1;
117
  v2[645] = 1;
118
  v2[646] = 1;
119
  v2[647] = 2;
120
  v2[648] = 4;
121
  v2[649] = 1;
122
  v2[650] = 1;
123
  v2[651] = 1;
124
  v2[652] = 1;
125
  v2[653] = 2;
126
  v2[680] = 2;
127
  v2[687] = 2;
128
  v2[688] = 4;
129
  v2[698] = 2;
130
  v2[766] = 2;
131
  v2[767] = 5;
132
  v2[818] = 2;
133
  v2[819] = 1;
134
  v2[820] = 2;
135
  v2[827] = 2;
136
  v2[828] = 5;
137
  v2[846] = 2;
138
  v2[847] = 5;
139
  v2[890] = 2;
140
  v2[891] = 1;
141
  v2[892] = 1;
142
  v2[893] = 1;
143
  v2[894] = 1;
144
  v2[895] = 1;
145
  v2[896] = 1;
146
  v2[897] = 1;
147
  v2[898] = 1;
148
  v2[899] = 1;
149
  v2[900] = 1;
150
  v2[901] = 1;
151
  v2[902] = 1;
152
  v2[903] = 1;
153
  v2[904] = 1;
154
  v2[905] = 1;
155
  v2[906] = 1;
156
  v2[907] = 1;
157
  v2[908] = 1;
158
  v2[909] = 1;
159
  v2[910] = 1;
160
  v2[911] = 1;
161
  v2[912] = 1;
162
  v2[913] = 1;
163
  v2[914] = 1;
164
  v2[915] = 1;
165
  v2[916] = 1;
166
  v2[917] = 1;
167
  v2[918] = 1;
168
  v2[919] = 1;
169
  v2[920] = 1;
170
  v2[921] = 1;
171
  v2[922] = 1;
172
  v2[923] = 1;
173
  v2[924] = 1;
174
  v2[925] = 1;
175
  v2[926] = 1;
176
  v2[927] = 1;
177
  v2[928] = 1;
178
  v2[929] = 1;
179
  v2[930] = 1;
180
  v2[931] = 1;
181
  v2[932] = 1;
182
  v2[933] = 2;
183
  v2[934] = 5;
184
  v2[989] = 2;
185
  v2[994] = 2;
186
  v2[995] = 1;
187
  v2[996] = 1;
188
  v2[997] = 1;
189
  v2[998] = 1;
190
  v2[999] = 1;
191
  v2[1000] = 1;
192
  v2[1001] = 1;
193
  v2[1002] = 1;
194
  v2[1003] = 1;
195
  v2[1013] = 1;
196
  v2[1014] = 1;
197
  v2[1015] = 1;
198
  v2[1016] = 1;
199
  v2[1017] = 1;
200
  v2[1018] = 1;
201
  v2[1019] = 1;
202
  v2[1020] = 1;
203
  v2[1021] = 1;
204
  v2[1022] = 1;
205
  v2[1023] = 1;
206
  v2[1024] = 1;
207
  v2[1025] = 1;
208
  v2[1026] = 1;
209
  v2[1027] = 2;
210
  v2[1028] = 3;
211
  v4 = 0;
212
  v3 = 0;
213
  while ( 1 )
214
  {
215
    while ( 1 )
216
    {
217
      count2 = 0;
218
      while ( 1 )
219
      {
220
        count1 = 0;
221
        while ( !v2[v3] )
222
        {
223
          ++v3;
224
          ++flag[v4];
225
          count1++;
226
        }
227
        if(count1 != 0)
228
            printf("flag[%d] -= %d;\n",v4,count1);
229
        if ( v2[v3] != 1 )
230
          break;
231
        ++v3;
232
        count2++;
233
        --flag[v4];
234
      }
235
        if(count2 != 0)
236
            printf("flag[%d] += %d;\n",v4,count2);
237
      if ( v2[v3] != 2 )
238
        break;
239
      ++v3;
240
      ++v4;
241
    }
242
    if ( v2[v3] == 3 )
243
      break;
244
    if ( v2[v3] == 4 )
245
    {
246
      flag[v4] = flag[v4] + flag[v4 + 1] - 70;
247
      printf("flag[%d] = flag[%d] + 70 - flag[%d];\n",v4,v4,v4+1);
248
      ++v3;
249
    }
250
    else if ( v2[v3] == 5 )
251
    {
252
      flag[v4] = flag[v4] - flag[v4 + 1] + 70;
253
      printf("flag[%d] = flag[%d] - 70 + flag[%d];\n",v4,v4,v4+1);
254
      ++v3;
255
    }
256
  }
257
  return 0;
258
}
259

260
int main(){
261
    char flag[33] = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
262
  howtolove(flag);
263
  return 0;
264
}

打印出来直接逆 exp：

1
#include <stdio.h>
2

3
int main()
4
{
5
    unsigned char flag[] = "flag{Love_is_not_one_sided_Love}";
6
    flag[28] -= 54;
7
    flag[29] -= 4;
8
    flag[30] -= 9;
9
    flag[30] += 23;
10
    flag[28] = flag[28] - 70 + flag[29];
11
    flag[26] -= 42;
12
    flag[27] += 42;
13
    flag[26] = flag[26] - 70 + flag[27];
14
    flag[25] -= 17;
15
    flag[25] = flag[25] - 70 + flag[26];
16
    flag[22] -= 50;
17
    flag[23] += 1;
18
    flag[24] -= 6;
19
    flag[22] = flag[22] - 70 + flag[23];
20
    flag[20] -= 9;
21
    flag[21] -= 67;
22
    flag[20] = flag[20] + 70 - flag[21];
23
    flag[17] += 4;
24
    flag[18] -= 26;
25
    flag[19] -= 6;
26
    flag[17] = flag[17] + 70 - flag[18];
27
    flag[15] -= 61;
28
    flag[16] += 19;
29
    flag[15] = flag[15] - 70 + flag[16];
30
    flag[14] -= 39;
31
    flag[14] = flag[14] - 70 + flag[15];
32
    flag[13] -= 90;
33
    flag[13] = (flag[13] + 256) % 256;
34
    flag[11] -= 75;
35
    flag[11] = flag[11] - 70 + flag[12];
36
    flag[9] -= 19;
37
    flag[9] += 14;
38
    flag[10] -= 10;
39
    flag[9] = flag[9] - 70 + flag[10];
40
    flag[8] -= 45;
41
    flag[8] += 4;
42
    flag[8] = flag[8] - 70 + flag[9];
43
    flag[3] -= 85;
44
    flag[5] += 42;
45
    flag[6] -= 2;
46
    flag[7] -= 23;
47
    flag[3] = flag[3] - 70 + flag[4];
48
    flag[2] -= 31;
49
    flag[2] = flag[2] + 70 - flag[3];
50
    flag[1] -= 32;
51
    flag[0] -= 32;
52
    int i = 0;
53
    for (; i < 32; i++)
54
        printf("%c", flag[i]);
55
    return 0;
56
}
57
// FLAG{vm_is_A_ecreT_l0Ve_revers}
58
// FLAG{vm_is_A_3ecreT_l0Ve_revers}

最后有个字节错了，脑洞一下就OK了

舔狗四部曲-相逢已是上上签#

.exe文件用DIE扫出来是MODOS文件，丢进010editor看看

e_lfanew段有明显的问题，未找到正确pe头位置

改掉，此时可以看的DIE扫出来是32PE文件

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  int d8; // [esp+8h] [ebp-50h]
4
  int i; // [esp+Ch] [ebp-4Ch]
5
  int v6[8]; // [esp+10h] [ebp-48h]
6
  char (*input)[33]; // [esp+30h] [ebp-28h] BYREF
7
  int v8; // [esp+34h] [ebp-24h]
8
  int v9; // [esp+38h] [ebp-20h]
9
  int v10; // [esp+3Ch] [ebp-1Ch]
10
  int v11; // [esp+40h] [ebp-18h]
11
  int v12; // [esp+44h] [ebp-14h]
12
  int v13; // [esp+48h] [ebp-10h]
13
  int v14; // [esp+4Ch] [ebp-Ch]
14
  char v15; // [esp+50h] [ebp-8h]
15

16
  input = 0;
17
  v8 = 0;
18
  v9 = 0;
19
  v10 = 0;
20
  v11 = 0;
21
  v12 = 0;
22
  v13 = 0;
23
  v14 = 0;
24
  v15 = 0;
25
  v6[0] = 0x66697271;
26
  v6[1] = 0x896E2285;
27
  v6[2] = 0xC5188C1B;
28
  v6[3] = 0x72BCFD03;
29
  v6[4] = 0x538011CA;
30
  v6[5] = 0x4DA146AC;
31
  v6[6] = 0x86630D6B;
32
  v6[7] = 0xF89797F0;
33
  printf("Please enter your key:");
34
  scanf("%s", key);
35
  if ( 532 * key[5] + 829 * key[4] + 258 * key[3] + 811 * key[2] + 997 * key[1] + 593 * key[0] == 292512
36
    && 576 * key[5] + 695 * key[4] + 602 * key[3] + 328 * key[2] + 686 * key[1] + 605 * key[0] == 254496
37
    && 580 * key[5] + 448 * key[4] + 756 * key[3] + 449 * key[2] + (key[1] << 9) + 373 * key[0] == 222479
38
    && 597 * key[5] + 855 * key[4] + 971 * key[3] + 422 * key[2] + 635 * key[1] + 560 * key[0] == 295184
39
    && 524 * key[5] + 324 * key[4] + 925 * key[3] + 388 * key[2] + 507 * key[1] + 717 * key[0] == 251887
40
    && 414 * key[5] + 495 * key[4] + 518 * key[3] + 884 * key[2] + 368 * key[1] + 312 * key[0] == 211260 )
41
  {
42
    printf(&unk_EAB19C);
43
  }
44
  else
45
  {
46
    _loaddll(0);
47
  }
48
  printf("Please enter your flag:");
49
  scanf("%s", (const char *)&input);
50
  if ( strlen((const char *)&input) != 32 )
51
  {
52
    printf("Wrong length\n");
53
    _loaddll(0);
54
  }
55
  d8 = (int)strlen((const char *)&input) / 4;
56
  xxtea(&input, d8);
57
  for ( i = 0; i < d8; ++i )
58
  {
59
    if ( (char (*)[33])v6[i] != *(&input + i) )
60
    {
61
      printf("Wrong!!!\n");
62
      _loaddll(0);
63
    }
64
  }
65
  printf("congratulations\n");
66
  sub_E9B48E("pause");
67
  return 0;
68
}

上面的key可以用z3求解

1
from z3.z3 import Int, Solver, sat
2

3
key = [Int(f'key{i}') for i in range(6)]
4
solver = Solver()
5
solver.add(
6
    532 * key[5] + 829 * key[4] + 258 * key[3] + 811 * key[2] + 997 * key[1] + 593 * key[0] == 292512,
7
    576 * key[5] + 695 * key[4] + 602 * key[3] + 328 * key[2] + 686 * key[1] + 605 * key[0] == 254496,
8
    580 * key[5] + 448 * key[4] + 756 * key[3] + 449 * key[2] + (key[1] * (2**9)) + 373 * key[0] == 222479,
9
    597 * key[5] + 855 * key[4] + 971 * key[3] + 422 * key[2] + 635 * key[1] + 560 * key[0] == 295184,
10
    524 * key[5] + 324 * key[4] + 925 * key[3] + 388 * key[2] + 507 * key[1] + 717 * key[0] == 251887,
11
    414 * key[5] + 495 * key[4] + 518 * key[3] + 884 * key[2] + 368 * key[1] + 312 * key[0] == 211260
12
)
13

14
if solver.check() == sat:
15
    m = solver.model()
16
    print("Solution:")
17
    for i in range(6):
18
        print(f"key[{i}] = {m[key[i]]}")
19
else:
20
    print("No solution found")
21
# key[0] = 88
22
# key[1] = 89
23
# key[2] = 67
24
# key[3] = 84
25
# key[4] = 70
26
# key[5] = 33
27
# XYCTF!

魔改的xxtea加密，先手动复刻一遍加密逻辑

1
void xxtea_encrypt(unsigned int *input, int n)
2
{
3
    int v2;
4
    int v3;
5
    int v4;
6
    int v5;
7
    int rounds;
8
    unsigned int sum;
9
    unsigned int z;
10
    unsigned int i;
11

12
    if (n > 1)
13
    {
14
        rounds = 52 / n + 6;
15
        sum = 0;
16
        z = input[n - 1];
17
        do
18
        {
19
            sum -= 0x61C88647;
20
            v5 = (sum >> 2) & 5;
21
            for (i = 0; i < n - 1; ++i)
22
            {
23
                v2 = ((z ^ key[v5 ^ i & 5]) + (input[i + 1] ^ sum)) ^ (((16 * z) ^ (input[i + 1] >> 3)) + ((4 * input[i + 1]) ^ (z >> 5)));
24
                v3 = input[i];
25
                input[i] = v2 + v3;
26
                z = v2 + v3;
27
            }
28
            v4 = (((z ^ key[v5 ^ i & 5]) + (*input ^ sum)) ^ (((16 * z) ^ (*input >> 3)) + ((4 * *input) ^ (z >> 5)))) + input[n - 1];
29
            input[n - 1] = v4;
30
            z = v4;
31
            --rounds;
32
        } while (rounds);
33
    }
34
}

动调验证加密逻辑正确之后，得到exp：

1
#include <stdio.h>
2

3
unsigned int key[] = {88, 89, 67, 84, 70, 33};
4

5
void xxtea_decrypt(unsigned int *cipher, int n)
6
{
7
    int v2;
8
    int v3;
9
    int v4 = cipher[7];
10
    int v5;
11
    int num;
12
    int i = 7;
13
    int rounds = 12;
14
    unsigned int sum = 0x6a99b4ac;
15
    unsigned int z = cipher[7];
16
    printf("\ndecrypt:\n");
17
    do
18
    {
19
        v5 = (sum >> 2) & 5;
20
        v4 = cipher[7];
21
        z = cipher[6];
22
        cipher[7] = v4 - (((z ^ key[v5 ^ i & 5]) + (cipher[0] ^ sum)) ^ (((16 * z) ^ (cipher[0] >> 3)) + ((4 * cipher[0]) ^ (z >> 5))));
23
        for (i = n - 2; i >= 0; i--)
24
        {
25
            num = (i + 6) % 7;
26
            if (i == 0)
27
            {
28
                num = 7;
29
            }
30
            z = cipher[num];
31
            v2 = ((z ^ key[v5 ^ i & 5]) + (cipher[i + 1] ^ sum)) ^ (((16 * z) ^ (cipher[i + 1] >> 3)) + ((4 * cipher[i + 1]) ^ (z >> 5)));
32
            v3 = cipher[i] - v2;
33
            cipher[i] = v3;
34
        }
35
        v4 = cipher[num];
36
        sum += 1640531527;
37
        --rounds;
38
    } while (rounds);
39
}
40

41
int main()
42
{
43
    unsigned int cipher[8];
44
    cipher[0] = 0x66697271;
45
    cipher[1] = 0x896E2285;
46
    cipher[2] = 0xC5188C1B;
47
    cipher[3] = 0x72BCFD03;
48
    cipher[4] = 0x538011CA;
49
    cipher[5] = 0x4DA146AC;
50
    cipher[6] = 0x86630D6B;
51
    cipher[7] = 0xF89797F0;
52

53
    xxtea_decrypt(cipher, 8);
54

55
    printf("Decrypted input:\n");
56
    for (int i = 0; i < 8; i++)
57
    {
58
        printf("%x ", cipher[i]);
59
    }
60
    printf("\n");
61

62
    return 0;
63
}
64
// 54435958 58587b46 5f414554 5f444e41 315f335a 30535f73 7361655f 7d212179

1
s = "TCYXXX{F_AET_DNA1_3Z0S_ssae_}!!y"
2
# 每四个一组，分割字符串
3
chunks = [s[i:i+4] for i in range(0, len(s), 4)]
4
# 反转
5
reversed_chunks = [''.join(reversed(chunk)) for chunk in chunks]
6
result = ''.join(reversed_chunks)
7
print(result)
8

9
# XYCTF{XXTEA_AND_Z3_1s_S0_easy!!}

easy language#

可以看到右下角有明显的图标

然后就没找到啥逆向逻辑了，全是脑洞，想了好久

这里找到四个数据，长度分别为44、16、64、16 数据长度结合

猜测是标准AES-ECB加密

shift+F12，第一个内容就像是在暗示base64加密

那么解密就是先进行base64解密，再AES-ECB解密

舔狗四部曲-我的白月光#

点击运行得到第一段flag：flag{L0v3_ ，并告诉还有两段flag

IDA找到main，前面全是winapi触发messagebox，触发弹框

最后这段明显感觉是base64解密，直接解发现是错的，点进base64看

原来是魔改的base64，把3 * 8改成了4 * 6拆分

修改base64解密得到

1
def change_base64_decode(cipher):
2
    table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
3
    plaintext = ""
4
    cipher = cipher.replace("=", "")
5

6
    # 将每四个字符解码为三个字节
7
    for i in range(0, len(cipher), 4):
8
        chunk = cipher[i:i + 4]
9
        binary = bin(table.index(chunk[1]) & 0b11)[2:].zfill(2) + bin(table.index(chunk[0]) & 0b111111)[2:].zfill(6)
10
        plaintext += int(binary, 2).to_bytes(1, byteorder='big').decode('utf-8')
11
        binary = bin(table.index(chunk[2]) & 0b1111)[2:].zfill(4) + bin(
12
            (table.index(chunk[1]) >> 2) & 0b1111)[2:].zfill(4)
13
        plaintext += int(binary, 2).to_bytes(1, byteorder='big').decode('utf-8')
14
        binary = bin(table.index(chunk[3]) & 0b111111)[2:].zfill(6) + bin(
15
            (table.index(chunk[2]) >> 4) & 0b11)[2:].zfill(2)
16
        plaintext += int(binary, 2).to_bytes(1, byteorder='big').decode('utf-8')
17

18
    return plaintext
19

20
cipher = '1YmNkZTN2QmNmdjM3kTNmZTZ2UzN2YTN3ITNmZzN2YWNmZDN2YmNlZTN1YmN2YTO2UmNxYzY2M2N5UjZ3QjN4YTM2UmNidTO2Y2N1UjZ3gjN5YTM2Y2N3YTM2UmN3cDN2YmNlZzN3gzN1YTN'
21
plaintext = change_base64_decode(cipher)
22
print(plaintext)
23

24
# 5f6d656d6f72795f6e657665725f676f5f646f6e655f66696e616c6c795f7468616e6b796f755f7869616f77616e67746f6e67787565
25
# hex to ascii:   _memory_never_go_done_finally_thankyou_xiaowangtongxue

与第一段连不上，拿到的应该是第三段flag

V11本来是VirtualProtect的messagebox，在这里hook了sub_7FF6B44B1470函数

在里面发现了messageboxW以及一段疑似加密逻辑：

原始数据在上面v11数组那里，为了方便，动调+IDApython打出内容

1
import idc
2
print(chr(idc.get_reg_value("ecx")),end="")

得到第二段flag

1
# flag{L0v3_i8_a_k3y_and_memory_never_go_done_finally_thankyou_xiaowangtongxue}

Welcome!