XYNU2024信安杯-REVERSE（复现）
前言
记录记录
1.Can_you_find_me?
签到题，秒了
2.ea_re
快速定位
int __cdecl main_0(int argc, const char **argv, const char **envp)
{int v4; // [esp+0h] [ebp-1A0h]const char **v5; // [esp+4h] [ebp-19Ch]const char **v6; // [esp+8h] [ebp-198h]char v7; // [esp+Ch] [ebp-194h]int i; // [esp+D4h] [ebp-CCh]int v9; // [esp+E0h] [ebp-C0h]int v10[24]; // [esp+ECh] [ebp-B4h]char v11; // [esp+14Fh] [ebp-51h]char v12[36]; // [esp+178h] [ebp-28h]v11 = 0;v10[0] = 1;v10[1] = 4;v10[2] = 14;v10[3] = 10;v10[4] = 5;v10[5] = 36;v10[6] = 23;v10[7] = 42;v10[8] = 13;v10[9] = 19;v10[10] = 28;v10[11] = 13;v10[12] = 27;v10[13] = 39;v10[14] = 48;v10[15] = 41;v10[16] = 42;v10[17] = 26;v10[18] = 20;v10[19] = 59;v10[20] = 4;v10[21] = 0;printf("plz enter the flag:");while ( 1 ){v7 = getch();v12[v11] = v7;if ( !v7 || v12[v11] == 13 )break;if ( v12[v11] == 8 ){printf("\b\b");--v11;}else{printf("%c", v12[v11++]);}}v9 = 0;for ( i = 0; i < 17; ++i ){if ( v12[i] != byte_415768[v10[i]] )v9 = 1;}if ( v12[17] != 49 || v12[18] != 48 || v12[19] != 50 || v12[20] != 52 || v12[21] != 125 )v9 = 1;v12[v11] = 0;printf("\r\n");if ( v9 ){printf("u r wrong\r\n\r\n");main(v4, v5, v6);}else{printf("u r right!\r\n");}system("pause");return 0;
}分析一波
ok，开始提取字符
写一个脚本
# 给定的字符串和v10数组
aSkfxeeftFGyryg = "sKfxEeft}f{gyrYgthtyhifsjei53UUrrr_t2cdsef66246087138\\0087138"
v10 = [1, 4, 14, 10, 5, 36, 23, 42, 13, 19, 28, 13, 27, 39, 48, 41, 42]
ending = "1024}"# 构建flag
flag = ""
for index in v10:if index < len(aSkfxeeftFGyryg):flag += aSkfxeeftFGyryg[index]else:print(f"Index {index} is out of range for the given string.")# 如果需要，可以在这里处理超出范围的情况# 添加已知的结尾字符
flag += endingprint("Possible flag:", flag)输出
完成
3.rere000
打开题目附件,发现是python2.x的字节码
0 LOAD_GLOBAL 0 (raw_input)3 LOAD_CONST 1 ('plz input your flag:')6 CALL_FUNCTION 19 STORE_FAST 0 (a)5 12 LOAD_CONST 2 (0)15 BUILD_LIST 118 LOAD_GLOBAL 1 (len)21 LOAD_FAST 0 (a)24 CALL_FUNCTION 127 BINARY_MULTIPLY 28 STORE_FAST 1 (b)6 31 LOAD_CONST 3 (68)34 LOAD_CONST 4 (5)37 LOAD_CONST 5 (164)40 LOAD_CONST 6 (100)43 LOAD_CONST 7 (231)46 LOAD_CONST 8 (228)49 LOAD_CONST 9 (175)52 LOAD_CONST 10 (36)55 LOAD_CONST 11 (142)58 LOAD_CONST 9 (175)61 LOAD_CONST 12 (78)64 LOAD_CONST 13 (206)67 LOAD_CONST 14 (4)70 LOAD_CONST 15 (45)73 LOAD_CONST 11 (142)76 LOAD_CONST 16 (174)79 LOAD_CONST 17 (238)82 LOAD_CONST 5 (164)85 LOAD_CONST 15 (45)88 LOAD_CONST 18 (14)91 LOAD_CONST 9 (175)94 LOAD_CONST 19 (46)97 LOAD_CONST 17 (238)100 LOAD_CONST 15 (45)103 LOAD_CONST 5 (164)106 LOAD_CONST 16 (174)109 LOAD_CONST 10 (36)112 LOAD_CONST 9 (175)115 LOAD_CONST 15 (45)118 LOAD_CONST 20 (196)121 LOAD_CONST 20 (196)124 LOAD_CONST 12 (78)127 LOAD_CONST 9 (175)130 LOAD_CONST 10 (36)133 LOAD_CONST 19 (46)136 LOAD_CONST 17 (238)139 LOAD_CONST 20 (196)142 LOAD_CONST 13 (206)145 LOAD_CONST 12 (78)148 LOAD_CONST 12 (78)151 LOAD_CONST 3 (68)154 LOAD_CONST 21 (39)157 BUILD_LIST 42160 STORE_FAST 2 (c)7 163 LOAD_GLOBAL 1 (len)166 LOAD_FAST 0 (a)169 CALL_FUNCTION 1172 LOAD_CONST 22 (42)175 COMPARE_OP 3 (!=)178 POP_JUMP_IF_FALSE 1908 181 LOAD_CONST 23 ('wrong length')184 PRINT_ITEM 185 PRINT_NEWLINE 9 186 LOAD_CONST 2 (0)189 RETURN_VALUE 10 >> 190 SETUP_LOOP 117 (to 310)193 LOAD_GLOBAL 2 (range)196 LOAD_GLOBAL 1 (len)199 LOAD_FAST 0 (a)202 CALL_FUNCTION 1205 CALL_FUNCTION 1208 GET_ITER >> 209 FOR_ITER 97 (to 309)212 STORE_FAST 3 (i)11 215 LOAD_GLOBAL 3 (ord)218 LOAD_FAST 0 (a)221 LOAD_FAST 3 (i)224 BINARY_SUBSCR 225 CALL_FUNCTION 1228 LOAD_CONST 24 (3)231 BINARY_RSHIFT 232 LOAD_GLOBAL 3 (ord)235 LOAD_FAST 0 (a)238 LOAD_FAST 3 (i)241 BINARY_SUBSCR 242 CALL_FUNCTION 1245 LOAD_CONST 4 (5)248 BINARY_LSHIFT 249 BINARY_XOR 250 LOAD_CONST 25 (255)253 BINARY_AND 254 LOAD_FAST 1 (b)257 LOAD_FAST 3 (i)260 STORE_SUBSCR 12 261 LOAD_FAST 1 (b)264 LOAD_FAST 3 (i)267 DUP_TOPX 2270 BINARY_SUBSCR 271 LOAD_CONST 26 (136)274 INPLACE_XOR 275 ROT_THREE 276 STORE_SUBSCR 13 277 LOAD_FAST 1 (b)280 LOAD_FAST 3 (i)283 BINARY_SUBSCR 284 LOAD_FAST 2 (c)287 LOAD_FAST 3 (i)290 BINARY_SUBSCR 291 COMPARE_OP 3 (!=)294 POP_JUMP_IF_FALSE 20914 297 LOAD_CONST 27 ('wrong')300 PRINT_ITEM 301 PRINT_NEWLINE 15 302 LOAD_CONST 2 (0)305 RETURN_VALUE 306 JUMP_ABSOLUTE 209>> 309 POP_BLOCK 16 >> 310 LOAD_CONST 28 ('win')313 PRINT_ITEM 314 PRINT_NEWLINE 315 LOAD_CONST 0 (None)318 RETURN_VALUE 然后转换一下
def decrypt_flag():# 加密后的数组c = [68, 5, 164, 100, 231, 228, 175, 36, 142, 175, 78, 206, 4, 45, 142, 174, 238, 164, 45, 14, 175, 46, 238, 45, 164, 174, 36, 175, 45, 196, 196, 78, 175, 36, 46, 238, 196, 206, 78, 78, 68, 39]flag = ''for val in c:# 第一步：反向异或136val ^= 136# 第二步：尝试所有可能的字符值（0-255）# 找到经过原始加密算法后能得到当前值的字符for x in range(256):if (x >> 3) ^ ((x << 5) & 255) == val:flag += chr(x)breakreturn flagif __name__ == "__main__":flag = decrypt_flag()print("解密后的flag是:", flag)输出一下，解密逻辑就是根据原来加密后数组进行变一个个的逆向暴力破解，然后才能得出正确答案
flag{c9e0962d-013a-4953-a1e9-bb69e53b266f}
4.神奇的小按钮(题目有点小问题)
查壳发现无壳进入ida64中查壳字符串
分析可知
那么对flag[15:]进行与7逐字符异或后提交
写个脚本
encrypted = 'KEYmd57e0cad17016b0>?45?f7c>0>4a>1c3a0'
result = encrypted[:15] # 保持前15位不变# 对第15位之后的字符进行异或运算
for c in encrypted[15:]:result += chr(ord(c) ^ 7) # 与7异或得到原始字符print(result) 输出
KEYmd57e0cad17061e798328a0d9793f96d4f7
然后提交即可