攻防世界 reverse 新手练习区

　　

---

1.re1 DUTCTF

IDA shift+F12 查看字符串

DUTCTF{We1c0met0DUTCTF}

　　

---

2.game ZSCTF

zsctf{T9is_tOpic_1s_v5ry_int7resting_b6t_others_are_n0t}

---

3.Hello, CTF  Pediy CTF 2018

CrackMeJustForFun

将16进制字符串转ascii字符串得到flag

---

4.open-source HackYou CTF

参数 51966 25 h4cky0u

flag为:

c0ffee

---

5.open-source 9447 CTF 2014

IDA查看字符串

9447{This_is_a_flag}

---

6.simple-unpack

脱壳搜索字符串

flag{Upx_1s_n0t_a_d3liv3r_c0mp4ny}

---

7.logmein  RC3 CTF 2016

v8=":"AL_RT^L*.?+6/46"
v7 = 'ebmarah'[::-1]
s=''
for i in range(len(v8)):
    s+=chr(ord(v7[i%7])^ord(v8[i]))

print(s)

RC3-2016-XORISGUD

---

8. no-strings-attached 9447 CTF 2014

x=[58,  20,   0,   0,  54,  20,   0,   0,  55,  20,
    0,   0,  59,  20,   0,   0, 128,  20,   0,   0,
  122,  20,   0,   0, 113,  20,   0,   0, 120,  20,
    0,   0,  99,  20,   0,   0, 102,  20,   0,   0,
  115,  20,   0,   0, 103,  20,   0,   0,  98,  20,
    0,   0, 101,  20,   0,   0, 115,  20,   0,   0,
   96,  20,   0,   0, 107,  20,   0,   0, 113,  20,
    0,   0, 120,  20,   0,   0, 106,  20,   0,   0,
  115,  20,   0,   0, 112,  20,   0,   0, 100,  20,
    0,   0, 120,  20,   0,   0, 110,  20,   0,   0,
  112,  20,   0,   0, 112,  20,   0,   0, 100,  20,
    0,   0, 112,  20,   0,   0, 100,  20,   0,   0,
  110,  20,   0,   0, 123,  20,   0,   0, 118,  20,
    0,   0, 120,  20,   0,   0, 106,  20,   0,   0,
  115,  20,   0,   0, 123,  20,   0,   0, 128,  20,
    0,   0,   0,   0,   0,   0]
y=[]
for t in x:
    if t!=20 and t!=0:
        y.append(t)
i=0
while i<len(y):
    for j in range(1,6):
        y[i]-=j
        y[i]=chr(y[i])
        i+=1
        if i==len(y):
            break
print(''.join(y))

9447{you_are_an_international_mystery}

---

9.python-trade NJUPT CTF 2017

使用EasyPythonDecompiler.exe

import base64

buf = base64.b64decode('XlNkVmtUI1MgXWBZXCFeKY+AaXNt')
flag = ''
for i in buf:
    i -= 16
    i ^= 32
    flag += chr(i)
print(flag)

nctf{d3c0mpil1n9_PyC}

---

10.getit SharifCTF 2016

主要逻辑：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v3; // al
  __int64 v5; // [rsp+0h] [rbp-40h]
  int i; // [rsp+4h] [rbp-3Ch]
  FILE *stream; // [rsp+8h] [rbp-38h]
  char filename[8]; // [rsp+10h] [rbp-30h]
  unsigned __int64 v9; // [rsp+28h] [rbp-18h]

  v9 = __readfsqword(0x28u);
  LODWORD(v5) = 0;
  while ( (signed int)v5 < strlen(s) )          // s=c61b68366edeb7bdce3c6820314b7498
  {
    if ( v5 & 1 )
      v3 = 1;
    else
      v3 = -1;
    t[(signed int)v5 + 10] = s[(signed int)v5] + v3;
    LODWORD(v5) = v5 + 1;
  }
  strcpy(filename, "/tmp/flag.txt");
  stream = fopen(filename, "w");
  fprintf(stream, "%s
", u, v5);
  for ( i = 0; i < strlen(t); ++i )
  {
    fseek(stream, p[i], 0);
    fputc(t[p[i]], stream);
    fseek(stream, 0LL, 0);
    fprintf(stream, "%s
", u);
  }
  fclose(stream);
  remove(filename);
  return 0;
}

解题脚本：

s='c61b68366edeb7bdce3c6820314b7498'
t=list('SharifCTF{????????????????????????????????}')
v5 = 0;
while v5 < len(s):  #c61b68366edeb7bdce3c6820314b7498

    if (v5 & 1):
        v3 = 1;
    else:
        v3 = -1;

    t[v5 + 10] = chr(ord(s[v5])+ v3) ;
    v5= v5 + 1;

print(''.join(t))

SharifCTF{b70c59275fcfa8aebf2d5911223c6589}