作者:劲吻2502877607 | 来源:互联网 | 2024-10-10 15:17
篇首语:本文由编程笔记#小编为大家整理,主要介绍了攻防世界 reverse BabyXor相关的知识,希望对你有一定的参考价值。
BabyXor 2019_UNCTF
查壳
脱壳
dump
脱壳后
IDA静态分析
int main_0()
{
void *v0; // eax
int v1; // ST5C_4
char *v2; // ST6C_4
const char *v3; // ST68_4
void *v4; // ST64_4
size_t v5; // eax
char *v6; // ST60_4
v0 = (void *)sub_4010B4((int)&unk_4395F0, "世界上最简单的Xor");
sub_40107D(v0, (int)sub_40102D);
if ( --stru_436270._cnt <0 )
{
_filbuf(&stru_436270);
}
else
{
v1 = (unsigned __int8)*stru_436270._ptr;
++stru_436270._ptr;
}
v2 = first_xor_40108C((int)dword_435DC0, 56); // for ( i = 0; i <(signed int)(a2 >> 2); ++i )
// sprintf(&v3[i], "%c", i ^ *(_DWORD *)(a1 + 4 * i));
// return v3;
//
//
v3 = second_xor_401041((int)dword_435DC0, (int)dword_435DF8, 56u);// sprintf(v5, "%c", *(_DWORD *)a2);
// for ( i = 1; i <(signed int)(a3 >> 2); ++i )
// sprintf(&v5[i], "%c", *(_DWORD *)(a1 + 4 * i) ^ *(_DWORD *)(a2 + 4 * i) ^ *(_DWORD *)(a1 + 4 * i - 4));
// return v5;
//
//
v4 = malloc(0x64u);
v5 = strlen(v3);
memcpy(v4, v3, v5);
v6 = third_xor_4010C3((int)dword_435DC0, (int)v3, (int)dword_435E30, 56);// v7 = (char *)malloc(a4 - 1);
// v6 = (char *)malloc(4 * a4 - 1);
// for ( i = 0; i <(signed int)((a4 >> 2) - 1); ++i )
// {
// sprintf(&v6[i], "%c", *(_DWORD *)(a3 + 4 * i + 4) ^ *(char *)(i + a2));
// sprintf(&v7[i], "%c", i ^ v6[i]);
// }
// sprintf(&byte_439558, "%c", dword_435E30[0] ^ dword_435DF8[0]);
// strcat(&byte_439558, v7);
// return &byte_439558;
//
//
sub_40101E((int)v2, (int)v3, (int)v6);
return 0;
}
动态调试
在401712处下断就可得到flag
wp:
#!/usr/bin/python
dword_435DC0=[102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
dword_435DF8=[55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
dword_435E30=[26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
temp=[]
flag=‘‘
for i in range(14):
flag+=chr(dword_435DC0[i]^i)
flag+=chr(dword_435DF8[0])
temp.append(dword_435DF8[0])
for i in range(1,14):
x=dword_435DC0[i]^dword_435DF8[i]^dword_435DC0[i-1]
flag+=chr(x)
temp.append(x)
x=‘‘
for i in range(13):
x+=chr(dword_435E30[i+1]^(temp[i])^i)
flag+=chr(dword_435E30[0] ^ dword_435DF8[0])+x
print(flag)
flag{2378b077-7d6e-4564-bdca-7eec8eede9a2}