Reverse Learning - Day3

BUUCTF

不一样的flag

IDA分析一下main函数，有一串字符串，还有上下左右四个方向

再接着分析代码，发现遇到1退出，遇到#获得flag，猜测是5*5的迷宫

1
2
3
4
5
*1111
01000
01010
00010
1111#

flag{222441144222}

SimpleRev

看一下main函数

主要分析一下Decry()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
v11 = __readfsqword(0x28u);
 *(_QWORD *)src = 0x534C43444ELL; //转为字符为'NDCLS'
 v7 = 0LL;
 v8 = 0;
 v9[0] = 0x776F646168LL; //转为字符为'hadow'
 v9[1] = 0LL;
 v10 = 0;
 text = (char *)join(key3, v9); //jion连接字符串'killshadow'
 strcpy(key, key1); //key1 = 'ADSFK'
 strcat(key, src); //相连为'ADSFKNDCLS'
 v2 = 0;
 v3 = 0;
 getchar();
 v5 = strlen(key); //v5 = 10
 for ( i = 0; i < v5; ++i )
 {
   if ( key[v3 % v5] > '@' && key[v3 % v5] <= 'Z' ) //转为小写
     key[i] = key[v3 % v5] + ' ';
   ++v3;
 }
 printf("Please input your flag:");
 while ( 1 )
 {
   v1 = getchar();
   if ( v1 == 10 )
     break;
   if ( v1 == 32 )
   {
     ++v2;
   }
   else
   {
      if ( v1 <= 96 || v1 > 122 )
     {
       if ( v1 > 64 && v1 <= 90 )
       {
         str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;// 加密算法
         ++v3;
       }
     }
     else
     {
        str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;
       ++v3;
     }
     if ( !(v3 % v5) )
       putchar(' ');
     ++v2;
   }
 }
 if ( !strcmp(text, str2) )
   puts("Congratulation!\n");
 else
   puts("Try again!\n");
 return __readfsqword(0x28u) ^ v11;

str2是我们需要的flag，str2和text进行比较，二者相等即成功

重要的只是str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97这个式子，直接写脚本逆推

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
text = 'killshadow'
key = 'adsfkndcls'
v3 = 0
v5 = 10
n = 0
flag = [0,0,0,0,0,0,0,0,0,0]
for i in range(0,10):
    for j in range(0,10):
        v1=(ord(text[j])-97)+26*i+ord(key[v3%v5])-58
        if(v1>65 and v1<=90) or (v1>=97 and v5<=122):
            flag[j]=chr(v1)
            n = n+1
            if(n==10):
                print(flag)
                break
        v3=v3+1

flag{KLDQCUDFZO}

此题中数据转为16进制在内存中是小端顺序，所以高位在高地址，故顺序需要颠倒

  • 大端顺序：高字节保存在内存的低地址
  • 小端顺序：高字节保存在内存的高地址

如何记忆？

自大的人眼高手低 - 其中，自大代表大端序，眼高代表高地址，手低代表低字节

小端顺序则相反

Java逆向解密

jadx打开java文件，直接分析加密过程

是将输入的字符+‘@’再与32异或，直接写脚本

1
2
3
4
5
6
key = [180, 136, 137, 147, 191, 137, 147, 191, 148, 
       136, 133, 191, 134, 140, 129, 135, 191, 65]
flag = ''
for i in key:
    flag+=chr((i^32)-64)
print(flag)

flag{This_is_the_flag_!}

luck_guy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
for ( i = 0; i <= 4; ++i )
  {
    switch ( rand() % 200 )
    {
      case 1:
        puts("OK, it's flag:");
        memset(&s, 0, 0x28uLL);
        strcat((char *)&s, f1); //f1 = 'GXY{do_not_'
        strcat((char *)&s, &f2);
        printf("%s", (const char *)&s);
        break;
      case 2:
        printf("Solar not like you");
        break;
      case 3:
        printf("Solar want a girlfriend");
        break;
      case 4:
        s = '\x7Ffo`guci';
        v5 = 0;
        strcat(&f2, (const char *)&s);
        break;
      case 5:
        for ( j = 0; j <= 7; ++j )
        {
          if ( j % 2 == 1 )
            *(&f2 + j) -= 2;
          else
            --*(&f2 + j);
        }
        break;
      default:
        puts("emmm,you can't find flag 23333");
        break;

case 1是将f1和f2合并输出flag

case 4 是f2和字符串s合并，前面说过小端顺序，s = ‘ icug‘of ’

case 5 是对f2进行一些运算

顺序应为case 4 > case 5 > case 1

写脚本

1
2
3
4
5
6
7
8
9
s = 'icug`of'
str = list(s)
flag = 'GXY{do_not_'
for j in range(len(str)):
		if  j % 2 == 1:
        flag += chr(ord(str[j]) - 2)
    else:
        flag += chr(ord(str[j]) - 1)
print(flag)

GXY{do_not_hate_me}

Day3 - 数据存储特性，多段算法分析，关键函数查看，脚本编写