测试文件：https://adworld.xctf.org.cn/media/task/attachments/2543a3658d254c30a89e4ea7b8950c27.zip
这道题很坑了，exe文件研究了半天。
1.准备
获得信息
- 32位文件
2.IDA打开
用IDA看了三个文件，都差不多。
1 int __cdecl main(int argc, const char **argv, const char **envp) 2 { 3 void *v3; // esp 4 void *v4; // esp 5 char *v6; // [esp+4h] [ebp-44h] 6 char v7; // [esp+8h] [ebp-40h] 7 char v8; // [esp+1Bh] [ebp-2Dh] 8 char *v9; // [esp+1Ch] [ebp-2Ch] 9 int v10; // [esp+20h] [ebp-28h] 10 char v11; // [esp+25h] [ebp-23h] 11 char v12; // [esp+26h] [ebp-22h] 12 char v13; // [esp+27h] [ebp-21h] 13 char v14; // [esp+28h] [ebp-20h] 14 char v15; // [esp+29h] [ebp-1Fh] 15 char v16; // [esp+2Ah] [ebp-1Eh] 16 char v17; // [esp+2Bh] [ebp-1Dh] 17 char v18; // [esp+2Ch] [ebp-1Ch] 18 char v19; // [esp+2Dh] [ebp-1Bh] 19 char v20; // [esp+2Eh] [ebp-1Ah] 20 char v21; // [esp+2Fh] [ebp-19h] 21 char v22; // [esp+30h] [ebp-18h] 22 char v23; // [esp+31h] [ebp-17h] 23 char v24; // [esp+32h] [ebp-16h] 24 char v25; // [esp+33h] [ebp-15h] 25 char v26; // [esp+34h] [ebp-14h] 26 char v27; // [esp+35h] [ebp-13h] 27 char v28; // [esp+36h] [ebp-12h] 28 char v29; // [esp+37h] [ebp-11h] 29 char v30; // [esp+38h] [ebp-10h] 30 char v31; // [esp+39h] [ebp-Fh] 31 char v32; // [esp+3Ah] [ebp-Eh] 32 char v33; // [esp+3Bh] [ebp-Dh] 33 char v34; // [esp+3Ch] [ebp-Ch] 34 char v35; // [esp+3Dh] [ebp-Bh] 35 char v36; // [esp+3Eh] [ebp-Ah] 36 char v37; // [esp+3Fh] [ebp-9h] 37 int *v38; // [esp+40h] [ebp-8h] 38 39 v38 = &argc; 40 __main(); 41 v8 = 'T'; 42 v37 = -56; 43 v36 = 126; 44 v35 = -29; 45 v34 = 100; 46 v33 = -57; 47 v32 = 22; 48 v31 = -102; 49 v30 = -51; 50 v29 = 17; 51 v28 = 101; 52 v27 = 50; 53 v26 = 45; 54 v25 = -29; 55 v24 = -45; 56 v23 = 67; 57 v22 = -110; 58 v21 = -87; 59 v20 = -99; 60 v19 = -46; 61 v18 = -26; 62 v17 = 109; 63 v16 = 44; 64 v15 = -45; 65 v14 = -74; 66 v13 = -67; 67 v12 = -2; 68 v11 = 106; 69 v10 = 19; 70 v3 = alloca(32); 71 v4 = alloca(32); 72 v9 = &v7; 73 printf("Key: "); 74 v6 = v9; 75 scanf("%s", v9); 76 if ( check_key((int)v9) ) 77 interesting_function((int)&v8); 78 else 79 puts("Wrong"); 80 return 0; 81 }
3.代码分析
很明显只要绕过第76行代码，我们就能够获取我们需要的flag，而且v8还是已知的，
3.1 GDB调试
将Linux下的那个文件放入Linux调试。
task9_x86_64_46d01fe312d35ecf69c4ff8ab8ace75d080891dc
命令：
gdb
file task9_x86_64_46d01fe312d35ecf69c4ff8ab8ace75d080891dc
b main
r
然后一直执行命令next，运行到check_key函数处
3.2 跳过check_key
把test eax,eax改为真就行，也就是把eax改为1。
修改eax
set $eax=1
一直执行
4.get flag！
flag_is_you_know_cracking!!!