BUUCTF--reverse3

测试文件：https://buuoj.cn/files/aa4f6c7e8d5171d520b95420ee570e79/a9d22a0e-928d-4bb4-8525-e38c9481469e.rar?token=eyJ0ZWFtX2lkIjpudWxsLCJ1c2VyX2lkIjoxOTAzLCJmaWxlX2lkIjoxNTl9.XXCjMA.QBNzEL8Ujfk_QRbQYa6XZ3dYjQ4

1.准备

获得信息

32位文件

2.IDA打开

将main函数反编译为C语言代码

int __cdecl main(int argc, const char **argv, const char **envp)

{

  int v3; // ebx

  int v4; // edi

  int v5; // esi

  return main_0(v3, v4, v5);

}

打开main_0函数

 __int64 __usercall main_0@<edx:eax>(int a1@<ebx>, int a2@<edi>, int a3@<esi>)

 {

   int v3; // eax

   const char *v4; // eax

   size_t v5; // eax

   int v6; // edx

   __int64 v7; // ST08_8

   signed int j; // [esp+DCh] [ebp-ACh]

   signed int i; // [esp+E8h] [ebp-A0h]

   signed int v11; // [esp+E8h] [ebp-A0h]

   char Dest[]; // [esp+F4h] [ebp-94h]

   char Str; // [esp+160h] [ebp-28h]

   char v14; // [esp+17Ch] [ebp-Ch]

   for ( i = ; i < ; ++i )

   {

     if ( (unsigned int)i >= 0x64 )

       j____report_rangecheckfailure(a1, a2, a3);

     Dest[i] = ;

   }

   sub_41132F("please enter the flag:");

   sub_411375("%20s", &Str);

   v3 = j_strlen(&Str);

   v4 = (const char *)sub_4110BE((int)&Str, v3, (int)&v14);

   strncpy(Dest, v4, 0x28u);

   v11 = j_strlen(Dest);

   for ( j = ; j < v11; ++j )

     Dest[j] += j;

   v5 = j_strlen(Dest);

   if ( !strncmp(Dest, Str2, v5) )

     sub_41132F("rigth flag!\n");

   else

     sub_41132F("wrong flag!\n");

   HIDWORD(v7) = v6;

   LODWORD(v7) = ;

   return v7;

 }

2.1代码分析

第24行代码，第27~28行代码在对Dest进行一些列变换

从第30行代码分析得到，Str2中存储的就是flag变换过后的字符串，打开Str2

.data:0041A034 ; char Str2[]

.data:0041A034 Str2            db 'e3nifIH9b_C@n@dH', ; DATA XREF: _main_0+142↑o

因此，我们只需要将Str2反向变换即可得到flag。

第27~28行代码的变换没有难度，再来看看第24行代码的函数。

 void *__cdecl sub_411AB0(char *a1, unsigned int a2, int *a3)

 {

   int v4; // STE0_4

   int v5; // STE0_4

   int v6; // STE0_4

   int v7; // [esp+D4h] [ebp-38h]

   signed int i; // [esp+E0h] [ebp-2Ch]

   unsigned int v9; // [esp+ECh] [ebp-20h]

   int v10; // [esp+ECh] [ebp-20h]

   signed int v11; // [esp+ECh] [ebp-20h]

   void *Dst; // [esp+F8h] [ebp-14h]

   char *v13; // [esp+104h] [ebp-8h]

   if ( !a1 || !a2 )

     return ;

   v9 = a2 / ;

   if ( (signed int)(a2 / ) %  )

     ++v9;

   v10 =  * v9;

   *a3 = v10;

   Dst = malloc(v10 + );

   if ( !Dst )

     return ;

   j_memset(Dst, , v10 + );

   v13 = a1;

   v11 = a2;

   v7 = ;

   while ( v11 >  )

   {

     byte_41A144[] = ;

     byte_41A144[] = ;

     byte_41A144[] = ;

     for ( i = ; i <  && v11 >= ; ++i )

     {

       byte_41A144[i] = *v13;

       --v11;

       ++v13;

     }

     if ( !i )

       break;

     switch ( i )

     {

       case :

         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];

         v4 = v7 + ;

         *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];

         *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[];

         *((_BYTE *)Dst + v4) = aAbcdefghijklmn[];

         v7 = v4 + ;

         break;

       case :

         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];

         v5 = v7 + ;

         *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];

         *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[] & 0xC0) >> ) |  * (byte_41A144[] & 0xF)];

         *((_BYTE *)Dst + v5) = aAbcdefghijklmn[];

         v7 = v5 + ;

         break;

       case :

         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];

         v6 = v7 + ;

         *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];

         *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[] & 0xC0) >> ) |  * (byte_41A144[] & 0xF)];

         *((_BYTE *)Dst + v6) = aAbcdefghijklmn[byte_41A144[] & 0x3F];

         v7 = v6 + ;

         break;

     }

   }

   *((_BYTE *)Dst + v7) = ;

   return Dst;

 }

在代码的下部分，可以看到Dst会经过aAbcdefghijklmn[]数组的变换，打开此处

.rdata:00417B30 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='

.rdata:00417B30                                         ; DATA XREF: .text:004117E8↑o

.rdata:00417B30                                         ; .text:↑o ...

.rdata:00417B30                 db

.rdata:00417B72                 align

从'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='可以看出，这个函数应该是base64的加密函数，因此只需要解密即可。

3.脚本获取flag

import base64

str1 = 'e3nifIH9b_C@n@dH'

x = ''

flag = ''

for j in range(0, len(str1)):

    x += chr(ord(str1[j]) - j)

flag = base64.b64decode(x)

flag = flag.decode('ASCII')

print(flag)

4.get flag！

flag{i_l0ve_you}

巴特西