reverse2021 极客大挑战（部分）

Posted 2021-12-24 woodwhale

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了reverse2021 极客大挑战（部分）相关的知识，希望对你有一定的参考价值。

【reverse】2021 极客大挑战（部分）

1、调试

0x1

什么？得安装linux虚拟机？像我这种直接用ubuntu系统的根本不虚！

0x2

尝试直接运行，未果

拖入ida中分析，先看main

上来就比较字符串，然后返回，v4是栈里的变量，初始化为0，必然不等于后面的字符串

看看汇编，发现了端倪

如果不相等就去loc_14A0这个函数，发现这个函数直接退出了，没啥用

我们看看如果想等跳转的函数loc_14551。怎么说都比上面退出的函数正常吧。

0x3

到这里我们想直接调用到loc_1455这个函数其实也可以，改汇编的jnz为jz就可以了

保存为ts1，退出，运行，一气呵成！

get flag

2、Re1

0x1

逆向人必备技能了属于是

0x2

拖入ida中分析

int __cdecl main(int argc, const char **argv, const char **envp)

  char v4[256]; // [rsp+20h] [rbp-60h] BYREF
  char Str[40]; // [rsp+120h] [rbp+A0h] BYREF
  int v6; // [rsp+148h] [rbp+C8h]
  char v7; // [rsp+14Ch] [rbp+CCh]
  char v8[58]; // [rsp+150h] [rbp+D0h]
  char v9[2]; // [rsp+18Ah] [rbp+10Ah] BYREF
  int v10; // [rsp+198h] [rbp+118h]
  int i; // [rsp+19Ch] [rbp+11Ch]

  _main(argc, argv, envp);
  v8[0] = 21;
  v8[1] = 113;
  v8[2] = 44;
  v8[3] = 4;
  v8[4] = 37;
  v8[5] = 113;
  v8[6] = 40;
  v8[7] = 16;
  v8[8] = 21;
  v8[9] = 44;
  v8[10] = 121;
  v8[11] = 40;
  v8[12] = 34;
  v8[13] = 45;
  v8[14] = 18;
  v8[15] = 38;
  v8[16] = 25;
  v8[17] = 45;
  v8[18] = 6;
  v8[19] = 58;
  v8[20] = 26;
  v8[21] = 20;
  v8[22] = 25;
  v8[23] = 112;
  v8[24] = 24;
  v8[25] = 114;
  v8[26] = 6;
  v8[27] = 57;
  v8[28] = 26;
  v8[29] = 22;
  v8[30] = 121;
  v8[31] = 112;
  v8[32] = 33;
  v8[33] = 7;
  v8[34] = 22;
  v8[35] = 38;
  v8[36] = 25;
  v8[37] = 45;
  v8[38] = 6;
  v8[39] = 58;
  v8[40] = 33;
  v8[41] = 24;
  v8[42] = 14;
  v8[43] = 38;
  v8[44] = 34;
  v8[45] = 114;
  v8[46] = 26;
  v8[47] = 38;
  v8[48] = 35;
  v8[49] = 45;
  v8[50] = 22;
  v8[51] = 114;
  v8[52] = 26;
  v8[53] = 24;
  v8[54] = 10;
  v8[55] = 58;
  v8[56] = 26;
  v8[57] = 24;
  qmemcpy(v9, "p", sizeof(v9));
  memset(Str, 0, sizeof(Str));
  v6 = 0;
  v7 = 0;
  memset(v4, 0, sizeof(v4));
  puts("please input your flag:");
  scanf("%s", Str);
  v10 = strlen(Str);
  if ( v10 != 44 )
  
    puts("flag length is wrong");
    exit(0);
  
  enc0(Str, v4, 44i64);
  enc1(v4);
  for ( i = 0; i < strlen(v4); ++i )
  
    if ( v8[i] != v4[i] )
    
      puts("sorry,your flag is incorrect");
      exit(0);
    
  
  printf("congradulations!your flag is: %s", Str);
  return 0;

直接给了flag加密后的数据，flag长度为44，经过两个加密

那么我们逆回去先dec1再dec0

0x3

enc1就是简单的异或，直接异或回去就好了

enc0就是base64，都没改表

那么我们直接写exp

#include<stdio.h>

int main() 
    int v8[100] = 0;
    v8[0] = 21;
    v8[1] = 113;
    v8[2] = 44;
    v8[3] = 4;
    v8[4] = 37;
    v8[5] = 113;
    v8[6] = 40;
    v8[7] = 16;
    v8[8] = 21;
    v8[9] = 44;
    v8[10] = 121;
    v8[11] = 40;
    v8[12] = 34;
    v8[13] = 45;
    v8[14] = 18;
    v8[15] = 38;
    v8[16] = 25;
    v8[17] = 45;
    v8[18] = 6;
    v8[19] = 58;
    v8[20] = 26;
    v8[21] = 20;
    v8[22] = 25;
    v8[23] = 112;
    v8[24] = 24;
    v8[25] = 114;
    v8[26] = 6;
    v8[27] = 57;
    v8[28] = 26;
    v8[29] = 22;
    v8[30] = 121;
    v8[31] = 112;
    v8[32] = 33;
    v8[33] = 7;
    v8[34] = 22;
    v8[35] = 38;
    v8[36] = 25;
    v8[37] = 45;
    v8[38] = 6;
    v8[39] = 58;
    v8[40] = 33;
    v8[41] = 24;
    v8[42] = 14;
    v8[43] = 38;
    v8[44] = 34;
    v8[45] = 114;
    v8[46] = 26;
    v8[47] = 38;
    v8[48] = 35;
    v8[49] = 45;
    v8[50] = 22;
    v8[51] = 114;
    v8[52] = 26;
    v8[53] = 24;
    v8[54] = 10;
    v8[55] = 58;
    v8[56] = 26;
    v8[57] = 24;
    for(int i = 0; i < 58; i++) 
        v8[i] ^= 0x40;
        printf("%c",(char)v8[i]);