攻防世界 Reverse高手进阶区 2分题 BABYRE

Posted 2022-07-29 思源湖的鱼

前言

继续ctf的旅程
攻防世界Reverse高手进阶区的2分题
本篇是BABYRE的writeup

发现攻防世界的题目分数是动态的
就仅以做题时的分数为准了

解题过程

PE查壳

扔进IDA

显然关键是judge
但是直接反编译失败
因为judge被加密了

根据7-11行，
可以解密

然后得到judge

signed __int64 __fastcall judge(__int64 a1)

  char v2; // [rsp+8h] [rbp-20h]
  char v3; // [rsp+9h] [rbp-1Fh]
  char v4; // [rsp+Ah] [rbp-1Eh]
  char v5; // [rsp+Bh] [rbp-1Dh]
  char v6; // [rsp+Ch] [rbp-1Ch]
  char v7; // [rsp+Dh] [rbp-1Bh]
  char v8; // [rsp+Eh] [rbp-1Ah]
  char v9; // [rsp+Fh] [rbp-19h]
  char v10; // [rsp+10h] [rbp-18h]
  char v11; // [rsp+11h] [rbp-17h]
  char v12; // [rsp+12h] [rbp-16h]
  char v13; // [rsp+13h] [rbp-15h]
  char v14; // [rsp+14h] [rbp-14h]
  char v15; // [rsp+15h] [rbp-13h]
  int i; // [rsp+24h] [rbp-4h]

  v2 = 102;
  v3 = 109;
  v4 = 99;
  v5 = 100;
  v6 = 127;
  v7 = 107;
  v8 = 55;
  v9 = 100;
  v10 = 59;
  v11 = 86;
  v12 = 96;
  v13 = 59;
  v14 = 110;
  v15 = 112;
  for ( i = 0; i <= 13; ++i )
    *(_BYTE *)(i + a1) ^= i;
  for ( i = 0; i <= 13; ++i )
  
    if ( *(_BYTE *)(i + a1) != *(&v2 + i) )
      return 0LL;
  
  return 1LL;

简单

v2 = 102
v3 = 109
v4 = 99
v5 = 100
v6 = 127
v7 = 107
v8 = 55
v9 = 100
v10 = 59
v11 = 86
v12 = 96
v13 = 59
v14 = 110
v15 = 112

data=[]
for i in range(2,16):
  data.append(locals()['v'+str(i)])

flag=''
for i in range(14):
  flag+=chr(data[i]^i)

print(flag)

得到flag：flagn1c3_j0b

结语

关键是解密