攻防世界 reverse 进阶 1-4

1.dmd-50 suctf-2016

 md5后比较，在线解md5得到：

 md5(md5($pass)),所以将grape再进行MD5

b781cbb29054db12f88f08c6e161c199

---

2.Shuffle SECCON-CTF-2014

 硬编码：

SECCON{Welcome to the SECCON 2014 CTF!}

---

3.re2-cpp-is-awesome alexctf-2017

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  char *v3; // rbx
  __int64 v4; // rax
  __int64 v5; // rdx
  __int64 v6; // rax
  __int64 v7; // rdx
  __int64 v8; // rdx
  __int64 char_1; // rdx
  __int64 s_char; // [rsp+10h] [rbp-60h]
  char v12; // [rsp+20h] [rbp-50h]
  char v13; // [rsp+4Fh] [rbp-21h]
  __int64 v14; // [rsp+50h] [rbp-20h]
  int k; // [rsp+5Ch] [rbp-14h]

  if ( a1 != 2 )
  {
    v3 = *a2;
    v4 = std::operator<<<std::char_traits<char>>(&std::cout, "Usage: ", a3);
    v6 = std::operator<<<std::char_traits<char>>(v4, v3, v5);
    std::operator<<<std::char_traits<char>>(v6, " flag
", v7);
    exit(0);
  }
  std::allocator<char>::allocator(&v13, a2, a3);
  std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(&v12, a2[1], &v13);
  std::allocator<char>::~allocator(&v13);
  k = 0;
  for ( s_char = std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::begin(&v12);
        ;
        sub_400D7A(&s_char) )
  {
    v14 = std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::end(&v12);
    if ( !cmp_400D3D((__int64)&s_char, (__int64)&v14) )
      break;
    char_1 = *(unsigned __int8 *)sub_400D9A((__int64)&s_char);
    if ( (_BYTE)char_1 != str_6020A0[dword_6020C0[k]] )// 关键比较处
      error_400B56((__int64)&s_char, (__int64)&v14, char_1);// 输出失败
    ++k;
  }
  success_400B73((__int64)&s_char, (__int64)&v14, v8);// 成功
  std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v12);
  return 0LL;
}

关键处，在一个字符串中取特定顺序的字符进行与输入比较

x='L3t_ME_T3ll_Y0u_S0m3th1ng_1mp0rtant_A_{FL4G}_W0nt_b3_3X4ctly_th4t_345y_t0_c4ptur3_H0wev3r_1T_w1ll_b3_C00l_1F_Y0u_g0t_1t'
x=list(x)
y=[ 36,
  0,
  5,
  54,
  101,
  7,
  39,
  38,
  45,
  1,
  3,
  0,
  13,
  86,
  1,
  3,
  101,
  3,
  45,
  22,
  2,
  21,
  3,
  101,
  0,
  41,
  68,
  68,
  1,
  68,
  43]
t=[]
for i in range(len(y)):
    t.append(x[y[i]])

print(''.join(t))

ALEXCTF{W3_L0v3_C_W1th_CL45535}

---

4.crackme SHCTF-2017

查壳：

 脱壳：

esp脱壳法：

单步执行pushfd后，转到esp

 运行，断在一jmp处，单步来到一call，来到oep，在此处脱壳

 

 脱壳成功，可以在ida中直接分析，这里我直接在od中跟一下程序，通过定位提示字符串，发现程序流程很简单，就是一个简单的异或

 脚本：

x=[18,
  4,
  8,
  20,
  36,
  92,
  74,
  61,
  86,
  10,
  16,
  103,
  0,
  65,
  0,
  1,
  70,
  90,
  68,
  66,
  110,
  12,
  68,
  114,
  12,
  13,
  64,
  62,
  75,
  95,
  2,
  1,
  76,
  94,
  91,
  23,
  110,
  12,
  22,
  104,
  91,
  18]
s=list('this_is_not_flag')
t=[]
for i in range(42):
    t.append(chr(ord(s[i%16])^x[i]))
print(''.join(t))

flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}