BUUCTF-RE-刮开有奖

一、查壳

二、IDA分析

1 int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
2 {
3   DialogBoxParamA(hInstance, (LPCSTR)0x67, 0, DialogFunc, 0);
4   return 0;
5 }

关键函数为DialogFunc，进入该函数分析

 1 BOOL __stdcall DialogFunc(HWND hDlg, UINT a2, WPARAM a3, LPARAM a4)
 2 {
 3   const char *v4; // esi
 4   const char *v5; // edi
 5   int v7; // [esp+8h] [ebp-20030h]
 6   int v8; // [esp+Ch] [ebp-2002Ch]
 7   int v9; // [esp+10h] [ebp-20028h]
 8   int v10; // [esp+14h] [ebp-20024h]
 9   int v11; // [esp+18h] [ebp-20020h]
10   int v12; // [esp+1Ch] [ebp-2001Ch]
11   int v13; // [esp+20h] [ebp-20018h]
12   int v14; // [esp+24h] [ebp-20014h]
13   int v15; // [esp+28h] [ebp-20010h]
14   int v16; // [esp+2Ch] [ebp-2000Ch]
15   int v17; // [esp+30h] [ebp-20008h]
16   CHAR String; // [esp+34h] [ebp-20004h]
17   char v19; // [esp+35h] [ebp-20003h]
18   char v20; // [esp+36h] [ebp-20002h]
19   char v21; // [esp+37h] [ebp-20001h]
20   char v22; // [esp+38h] [ebp-20000h]
21   char v23; // [esp+39h] [ebp-1FFFFh]
22   char v24; // [esp+3Ah] [ebp-1FFFEh]
23   char v25; // [esp+3Bh] [ebp-1FFFDh]
24   char v26; // [esp+10034h] [ebp-10004h]
25   char v27; // [esp+10035h] [ebp-10003h]
26   char v28; // [esp+10036h] [ebp-10002h]
27 
28   if ( a2 == 272 )
29     return 1;
30   if ( a2 != 273 )
31     return 0;
32   if ( (_WORD)a3 == 1001 )
33   {
34     memset(&String, 0, 0xFFFFu);
35     GetDlgItemTextA(hDlg, 1000, &String, 0xFFFF);
36     if ( strlen(&String) == 8 )
37     {
38       v7 = 90;
39       v8 = 74;
40       v9 = 83;
41       v10 = 69;
42       v11 = 67;
43       v12 = 97;
44       v13 = 78;
45       v14 = 72;
46       v15 = 51;
47       v16 = 110;
48       v17 = 103;
49       sub_4010F0((int)&v7, 0, 10);
50       memset(&v26, 0, 0xFFFFu);
51       v26 = v23;
52       v28 = v25;
53       v27 = v24;
54       v4 = sub_401000((int)&v26, strlen(&v26));
55       memset(&v26, 0, 0xFFFFu);
56       v27 = v21;
57       v26 = v20;
58       v28 = v22;
59       v5 = sub_401000((int)&v26, strlen(&v26));
60       if ( String == v7 + 34
61         && v19 == v11
62         && 4 * v20 - 141 == 3 * v9
63         && v21 / 4 == 2 * (v14 / 9)
64         && !strcmp(v4, "ak1w")
65         && !strcmp(v5, "V1Ax") )
66       {
67         MessageBoxA(hDlg, "U g3t 1T!", "@_@", 0);
68       }
69     }
70     return 0;
71   }
72   if ( (_WORD)a3 != 1 && (_WORD)a3 != 2 )
73     return 0;
74   EndDialog(hDlg, (unsigned __int16)a3);
75   return 1;
76 }

通过第36行代码知道String是我们输入的flag，长度应该是8。

第49行函数sub_4010F0在对v9~v19操作，进入sub_4010F0函数再次分析，把该函数的操作写成C，将数组代入后输出数值。基本上就是将该函数之间复制，再令其输出。

 1 #include <iostream>
 2 #include<stdio.h>
 3 #include<stdlib.h>
 4 
 5 using namespace std;
 6 
 7 int __cdecl sub_4010F0(char *a1, int a2, int a3)
 8 {
 9     int result; // eax
10     int i; // esi
11     int v5; // ecx
12     int v6; // edx
13 
14     result = a3;
15     for (i = a2; i <= a3; a2 = i)
16     {
17         v5 =  i;
18         v6 = a1[i];
19         if (a2 < result && i < result)
20         {
21             do
22             {
23                 if (v6 > a1[result])
24                 {
25                     if (i >= result)
26                         break;
27                     ++i;
28                     a1[v5] = a1[result];
29                     if (i >= result)
30                         break;
31                     while (a1[i] <= v6)
32                     {
33                         if (++i >= result)
34                             goto LABEL_13;
35                     }
36                     if (i >= result)
37                         break;
38                     v5 = i;
39                     a1[result] = a1[i];
40                 }
41                 --result;
42             } while (i < result);
43         }
44     LABEL_13:
45         a1[result] = v6;
46         sub_4010F0(a1, a2, i - 1);
47         result = a3;
48         ++i;
49     }
50     return result;
51 }
52 int main(){
53     char a[20] = {90, 74, 83, 69, 67, 97, 78, 72, 51, 110, 103};
54     cout << a << endl;
55     sub_4010F0(a, 0, 10);
56     cout << a << endl;
57     return 0;
58 }

输出为：

第54、56行代码对v23、v25、v24 ， v21、v20、v22的字符串进行了函数 sub_401000的操作

v23对应的是var_1FFFF,v25是var_1FFFD,v24是var_1FFFE

v21对应的是var_20001，v20对应的是var_20002,v22对应的是var_20000

进入sub_401000分析这六个字符对应的是v2-v4,v5-v7

 1 _BYTE *__cdecl sub_401000(int a1, int a2)
 2 {
 3   int v2; // eax
 4   int v3; // esi
 5   size_t v4; // ebx
 6   _BYTE *v5; // eax
 7   _BYTE *v6; // edi
 8   int v7; // eax
 9   _BYTE *v8; // ebx
10   int v9; // edi
11   signed int v10; // edx
12   int v11; // edi
13   signed int v12; // eax
14   signed int v13; // esi
15   _BYTE *result; // eax
16   _BYTE *v15; // [esp+Ch] [ebp-10h]
17   _BYTE *v16; // [esp+10h] [ebp-Ch]
18   int v17; // [esp+14h] [ebp-8h]
19   int v18; // [esp+18h] [ebp-4h]
20 
21   v2 = a2 / 3;
22   v3 = 0;
23   if ( a2 % 3 > 0 )
24     ++v2;
25   v4 = 4 * v2 + 1;
26   v5 = malloc(v4);
27   v6 = v5;
28   v15 = v5;
29   if ( !v5 )
30     exit(0);
31   memset(v5, 0, v4);
32   v7 = a2;
33   v8 = v6;
34   v16 = v6;
35   if ( a2 > 0 )
36   {
37     while ( 1 )
38     {
39       v9 = 0;
40       v10 = 0;
41       v18 = 0;
42       do
43       {
44         if ( v3 >= v7 )
45           break;
46         ++v10;
47         v9 = *(unsigned __int8 *)(v3++ + a1) | (v9 << 8);
48       }
49       while ( v10 < 3 );
50       v11 = v9 << 8 * (3 - v10);
51       v12 = 0;
52       v17 = v3;
53       v13 = 18;
54       do
55       {
56         if ( v10 >= v12 )
57         {
58           *((_BYTE *)&v18 + v12) = (v11 >> v13) & 0x3F;
59           v8 = v16;
60         }
61         else
62         {
63           *((_BYTE *)&v18 + v12) = 64;
64         }
65         *v8++ = byte_407830[*((char *)&v18 + v12)];
66         v13 -= 6;
67         ++v12;
68         v16 = v8;
69       }
70       while ( v13 > -6 );
71       v3 = v17;
72       if ( v17 >= a2 )
73         break;
74       v7 = a2;
75     }
76     v6 = v15;
77   }
78   result = v6;
79   *v8 = 0;
80   return result;
81 }

发现有 byte_407830数组，

.rdata:00407830 ; char byte_407830[]
.rdata:00407830 byte_407830     db 41h                  ; DATA XREF: sub_401000+C0↑r
.rdata:00407831 aBcdefghijklmno db 'BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',0

查看该数组认定该函数是在做base64加密

再结合正确flag的条件可知，v5,v6,v7 base64之后，等于'ak1w'，v2,v3,v4加密之后等于'V1Ax'

分析正确flag的条件

if ( String == v7 + 34    //String == '3'+34  为'U'

&& v19 == v11    //v11为‘J’

&& 4 * v20 - 141 == 3 * v9 && v21 / 4 == 2 * (v14 / 9)    //('E'*3+141)/4 为'W'

&& !strcmp(v4, "ak1w")  //'ak1w'解码为jMp

&& !strcmp(v5, "V1Ax") )  //'V1Ax'解码为WP1

拼一下即

三、flag

flag{UJWP1jMp}