字符判断 + ^

题目简介

Download file(rev300.zip)

main函数很干净

int __cdecl main(int a1, char **a2)
{
  if ( a1 > 1 && sub_8048414(a2[1], 0) )
  {
    puts("Access granted");
    sub_8048538(a2[1]);
  }
  else
  {
    puts("Access denied");
  }
  return 0;
}

字符判断 结果 isengard

int __cdecl sub_8048414(_BYTE *a1, int a2)
{
  int result; // eax

  switch ( a2 )
  {
    case 0:
      if ( *a1 == 105 )
        goto LABEL_19;
      result = 0;
      break;
    case 1:
      if ( *a1 == 101 )
        goto LABEL_19;
      result = 0;
      break;
    case 3:
      if ( *a1 == 110 )
        goto LABEL_19;
      result = 0;
      break;
    case 4:
      if ( *a1 == 100 )
        goto LABEL_19;
      result = 0;
      break;
    case 5:
      if ( *a1 == 97 )
        goto LABEL_19;
      result = 0;
      break;
    case 6:
      if ( *a1 == 103 )
        goto LABEL_19;
      result = 0;
      break;
    case 7:
      if ( *a1 == 115 )
        goto LABEL_19;
      result = 0;
      break;
    case 9:
      if ( *a1 == 114 )
LABEL_19:
        result = sub_8048414(a1 + 1, 7 * (a2 + 1) % 11);
      else
        result = 0;
      break;
    default:
      result = 1;
      break;
  }
  return result;
}

^

int __cdecl sub_8048538(int a1)
{
  _DWORD v2[33]; // [esp+18h] [ebp-A0h] BYREF
  int i; // [esp+9Ch] [ebp-1Ch]

  qmemcpy(v2, &unk_8048760, sizeof(v2));
  for ( i = 0; i <= 32; ++i )
    putchar(v2[i] ^ *(char *)(a1 + i % 8));
  return putchar(10);
}

数据

unk_8048760 = [0xF, 0x1F, 0x4, 0x9, 0x1C, 0x12, 0x42, 0x9, 0xC, 0x44, 0xD, 0x7, 0x9, 0x6, 0x2D, 0x37, 0x59, 0x1E, 0x0, 0x59, 0xF, 0x8, 0x1C, 0x23, 0x36, 0x7, 0x55, 0x2, 0xC, 0x8, 0x41, 0xA, 0x14]

exp

b = bytearray([0xF, 0x1F, 0x4, 0x9, 0x1C, 0x12, 0x42, 0x9, 0xC, 0x44, 0xD, 0x7, 0x9, 0x6, 0x2D, 0x37, 0x59, 0x1E, 0x0, 0x59, 0xF, 0x8, 0x1C, 0x23, 0x36, 0x7, 0x55, 0x2, 0xC, 0x8, 0x41, 0xA, 0x14])
c = b'isengard'
for i in range(len(b)):
    print(chr(b[i] ^ c[i % 8]),end = '')

flag

flag{s0me7hing_S0me7hinG_t0lki3n}