GFSJ0366-【reverse-for-the-holy-grail-350】
爆破
main
int __fastcall main(int argc, const char **argv, const char **envp)
{
int valid; // ebx
int v4; // ebx
__int64 v5; // rbx
void *v7[2]; // [rsp+0h] [rbp-70h] BYREF
_BYTE v8[16]; // [rsp+10h] [rbp-60h] BYREF
void *v9[2]; // [rsp+20h] [rbp-50h] BYREF
_BYTE v10[16]; // [rsp+30h] [rbp-40h] BYREF
void *v11[2]; // [rsp+40h] [rbp-30h] BYREF
_BYTE v12[24]; // [rsp+50h] [rbp-20h] BYREF
v11[0] = v12;
v11[1] = nullptr;
v12[0] = 0;
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is your name?", 21);
std::endl<char,std::char_traits<char>>(&std::cout);
std::operator>><char>(&std::cin, v11);
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is your quest?", 22);
std::endl<char,std::char_traits<char>>(&std::cout);
std::istream::ignore((std::istream *)&std::cin);
std::getline<char,std::char_traits<char>,std::allocator<char>>(&std::cin, v11);
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is the secret password?", 32);
std::endl<char,std::char_traits<char>>(&std::cout);
std::operator>><char>(&std::cin, &userIn[abi:cxx11]);
v7[0] = v8;
std::string::_M_construct<char *>(v7, userIn[abi:cxx11], qword_601AE8 + userIn[abi:cxx11]);
valid = validChars(v7);
if ( v7[0] != v8 )
operator delete(v7[0]);
if ( valid < 0 )
goto LABEL_8;
v9[0] = v10;
std::string::_M_construct<char *>(v9, userIn[abi:cxx11], qword_601AE8 + userIn[abi:cxx11]);
v4 = stringMod(v9);
if ( v9[0] != v10 )
operator delete(v9[0]);
if ( v4 < 0 )
{
LABEL_8:
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "Auuuuuuuugh", 11);
std::endl<char,std::char_traits<char>>(&std::cout);
}
else
{
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "Go on. Off you go. tuctf{", 25);
v5 = std::__ostream_insert<char,std::char_traits<char>>(&std::cout, userIn[abi:cxx11], qword_601AE8);
std::__ostream_insert<char,std::char_traits<char>>(v5, "}", 1);
std::endl<char,std::char_traits<char>>(v5);
}
if ( v11[0] != v12 )
operator delete(v11[0]);
return 0;
}
整个函数只有一个关键函数
__int64 __fastcall stringMod(__int64 *a1)
{
__int64 v1; // r9
__int64 v2; // r10
__int64 v3; // rcx
int v4; // r8d
_DWORD *v5; // rdi
__int64 *v6; // rsi
int v7; // ecx
int v8; // r9d
int v9; // r10d
unsigned int v10; // eax
int v11; // esi
int v12; // esi
_DWORD v14[18]; // [rsp+0h] [rbp-60h] BYREF
__int64 v15; // [rsp+48h] [rbp-18h] BYREF
memset(v14, 0, sizeof(v14));
v1 = a1[1];
if ( v1 )
{
v2 = *a1;
v3 = 0;
v4 = 0;
do
{
v12 = *(char *)(v2 + v3);
v14[v3] = v12;
if ( 3 * ((unsigned int)v3 / 3) == (_DWORD)v3 && v12 != firstchar[(unsigned int)v3 / 3] )
v4 = -1;
++v3;
}
while ( v3 != v1 );
}
else
{
v4 = 0;
}
v5 = v14;
v6 = (__int64 *)v14;
v7 = 666;
do
{
*(_DWORD *)v6 = v7 ^ *(unsigned __int8 *)v6;
v7 += v7 % 5;
v6 = (__int64 *)((char *)v6 + 4);
}
while ( &v15 != v6 );
v8 = 1;
v9 = 0;
v10 = 1;
v11 = 0;
do
{
if ( v11 == 2 )
{
if ( *v5 != thirdchar[v9] )
v4 = -1;
if ( v10 % *v5 != masterArray[v9] )
v4 = -1;
++v9;
v10 = 1;
v11 = 0;
}
else
{
v10 *= *v5;
if ( ++v11 == 3 )
v11 = 0;
}
++v8;
++v5;
}
while ( v8 != 19 );
return (unsigned int)(v7 * v4);
}
整个函数可以还原成
password[3*i] = firstchar[i]
(password[3*i] ^ key[3*i]) * (password[3*i+1] ^ key[3*i+1])
% thirdchar[i] == masterArray[i]
password[3*i+2] ^ key[3*i+2] == thirdchar[i]
数据
firstchar = [65, 105, 110, 69, 111, 97]
thirdchar = [751, 708, 732, 711, 734, 764]
masterArray = [471, 12, 580, 606, 147, 108]
exp
first = [65, 105, 110, 69, 111, 97]
third = [751, 708, 732, 711, 734, 764]
master = [471, 12, 580, 606, 147, 108]
k = []
x = 666
for _ in range(18):
k.append(x)
x += x % 5
flag = ""
for i in range(6):
a = first[i]
c = k[i * 3 + 2] ^ third[i]
for b in range(32, 127):
if ((a ^ k[i * 3]) * (b ^ k[i * 3 + 1])) % third[i] == master[i]:
flag += chr(a) + chr(b) + chr(c)
break
print(f"tuctf{{{flag}}}")
flag
tuctf{AfricanOrEuropean?}
一把梭
评论