BUU-jocker

fa放进IDA发现堆栈不平衡这里的调试技巧是：哪里有问题，就在哪里的上一行Alt+K 赋值为0

F5 main

对v4操作对一系列全是假的flag 靠

这里有对encyrpt函数异或写一个IDC脚本泡一下

#include <idc.idc>
 
static main()
{
    auto Address = 0x00401500;
    auto Value;
    
    for(;Address <= 0x00401500 + 186;Address++)
    {
        Value = Byte(Address);
        Value = Value ^ 0x41;
        PatchByte(Address, Value);
    }
}

View Code

然后正常反编译（用u和c乱搞以下）

这里还是异或不过只有19位我们发现main函数里面还有一个finally函数

这里v3到v7刚好5位加上前面对19位就是24位刚好

不过这里如果还用19位对异或字符串 "hahahaha_do_you_find_me?" 解出来是错误的

我们猜测最后五个还是异或的同一个数这个数可以通过flag最后以为是 '}' 反解出来最终得到flag

（被注释掉的是fakeflag）

'''
a = []
f = open('so.in')
for i in range(6):
    s = f.readline()
    for j in range(16):
        if(j%4==0):
            a.append(int(s[j*3:j*3+2],16))
print a
for i in range(len(a)):
    if i & 1:
        a[i] += i
    else:
        a[i] ^= i
Input = ''
for i in range(len(a)):
    Input += chr(a[i])
print Input
'''
a = []
b = 'hahahaha_do_you_find_me?'
f = open('so.in')
for i in range(5):
    s = f.readline()
    for j in range(16):
        if(j%4==0):
            a.append(int(s[j*3:j*3+2],16))
del a[len(a)-1]
a.append(37)
a.append(116)
a.append(112)
a.append(38)
a.append(58)
print a
for i in range(19):
    a[i] ^= ord(b[i])
k = ord('}') ^ 58
for i in range(19,24):
    a[i] ^= k
Input = ''
for i in range(len(a)):
    Input += chr(a[i])
print Input

View Code

so.in 两份（前面的是fakeflag 后面的是flag）

66 00 00 00 6B 00 00 00 63 00 00 00 64 00 00 00
7F 00 00 00 61 00 00 00 67 00 00 00 64 00 00 00
3B 00 00 00 56 00 00 00 6B 00 00 00 61 00 00 00
7B 00 00 00 26 00 00 00 3B 00 00 00 50 00 00 00
63 00 00 00 5F 00 00 00 4D 00 00 00 5A 00 00 00
71 00 00 00 0C 00 00 00 37 00 00 00 66 00 00 00







0E 00 00 00 0D 00 00 00 09 00 00 00 06 00 00 00
13 00 00 00 05 00 00 00 58 00 00 00 56 00 00 00
3E 00 00 00 06 00 00 00 0C 00 00 00 3C 00 00 00
1F 00 00 00 57 00 00 00 14 00 00 00 6B 00 00 00
57 00 00 00 59 00 00 00 0D 00 00 00 00 00 00 00

View Code