攻防世界 reverse 流浪者

Posted 2021-03-13 dirwang

流浪者 

int __thiscall sub_401890(CWnd *this)
{
  struct CString *v1; // ST08_4
  CWnd *v2; // eax
  int v3; // eax
  int v5[26]; // [esp+4Ch] [ebp-74h]
  int i; // [esp+B4h] [ebp-Ch]
  char *Str; // [esp+B8h] [ebp-8h]
  CWnd *v8; // [esp+BCh] [ebp-4h]

  v8 = this;
  v1 = (CWnd *)((char *)this + 100);
  v2 = CWnd::GetDlgItem(this, 1002);
  CWnd::GetWindowTextA(v2, v1);
  v3 = sub_401A30((char *)v8 + 100);
  Str = CString::GetBuffer((CWnd *)((char *)v8 + 100), v3);
  if ( !strlen(Str) )
    return CWnd::MessageBoxA(v8, "请输入pass!", 0, 0);
  for ( i = 0; Str[i]; ++i )
  {
    if ( Str[i] > 57 || Str[i] < 48 )
    {
      if ( Str[i] > 122 || Str[i] < 97 )
      {
        if ( Str[i] > 90 || Str[i] < 65 )
          sub_4017B0();                         // 错误
        else                                    // 65-90  +29
          v5[i] = Str[i] - 29;                  // 大写
      }
      else
      {                                         // 97-122   +87
        v5[i] = Str[i] - 87;                    // 小写
      }
    }
    else
    {                                           // 48-57   +48
      v5[i] = Str[i] - 48;                      // 数字-‘0‘
    }
  }
  return sub_4017F0(v5);
}

sub_4017F0(v5)

BOOL __cdecl sub_4017F0(int *a1)
{
  BOOL result; // eax
  char Str1[28]; // [esp+D8h] [ebp-24h]
  int v3; // [esp+F4h] [ebp-8h]
  int i; // [esp+F8h] [ebp-4h]

  i = 0;
  v3 = 0;
  while ( a1[i] < 0x3E && a1[i] >= 0 )
  {
    Str1[i] = aAbcdefghiabcde[a1[i]];
    ++i;
  }
  Str1[i] = 0;
  if ( !strcmp(Str1, "KanXueCTF2019JustForhappy") )
    result = sub_401770();                      // 正确
  else
    result = sub_4017B0();                      // 错误
  return result;
}

wp

tab=‘abcdefghiABCDEFGHIJKLMNjklmn0123456789opqrstuvwxyzOPQRSTUVWXYZ‘
tg=‘KanXueCTF2019JustForhappy‘
temp=[]
for i in range(len(tg)):
    temp.append(tab.index(tg[i]))
flag=‘‘
for c in temp:
    if c>=65-29 and c<=90-29:
        c+=29
    elif c>=97-87 and c<=122-87:
        c+=87
    elif c>=48-48 and c<=57-48:
        c+=48
    flag+=chr(c)
print flag

j0rXI4bTeustBiIGHeCF70DDM

flag{j0rXI4bTeustBiIGHeCF70DDM}