GeekChal 2019 - RE4（千反田和冰窠） - WriteUp

Posted 2020-11-23 travelr

程序提示使用dnSpy。

 

通过上述工具打开，发现类EncryptStr里自有玄机：

 

// Bingo.EncryptStr
// Token: 0x06000013 RID: 19 RVA: 0x00002424 File Offset: 0x00000624
public bool CheckStr(string text)
{
    if (text.Length != 20)
    {
        return false;
    }
    byte[] bytes = Encoding.ASCII.GetBytes(text);
    byte[] array = new byte[]
    {
        119,
        77,
        103,
        79,
        21,
        115,
        133,
        97,
        115,
        87,
        22,
        115,
        103,
        89,
        88,
        93,
        22,
        89,
        119,
        81
    };
    byte[] array2 = new byte[]
    {
        57,
        13
    };
    for (int i = 0; i < array.Length; i++)
    {
        bytes[i] = Convert.ToByte((int)((bytes[i] ^ array2[0]) + array2[1]));
        if (bytes[i] != array[i])
        {
            return false;
        }
    }
    return true;
}

 

　

 

想必就是存放flag的地方了。

 

---

 

这个函数定义了三个数组， 然后以array数组的长度为循环次数，将byte[i] 跟array[2] 异或在加上array2[1] 的结果赋给bytes[i]

 

再检查bytes[i] 跟array[i] 相不相等，不相等就返回false

 

---

 

然后写个c脚本完事。

 

#include <stdio.h>
#include <string.h>
int main() {
        int arr1[] = { 119,
               77,
               103,
               79,
               21,
               115,
               133,
               97,
               115,
               87,
               22,
               115,
               103,
               89,
               88,
               93,
               22,
               89,
               119,
               81 };
        int arr2[] = {57,13};
        int flag[20];
        int length = 24 - 4;
        for (int i = 0; i < length; i++)
               flag[i] = ((arr1[i] - arr2[1]) ^ arr2[0]);
        for (int k = 0; k < length; k++)
               printf("%c", flag[k]);
        return 0;
}

 

 

 

得出flag

 

Syc{1_Am_s0_curi0uS}