1 int __cdecl main(int argc, const char **argv, const char **envp) 2 { 3 void *v3; // eax 4 int v4; // edx 5 void *v5; // eax 6 int result; // eax 7 void *v7; // eax 8 void *v8; // eax 9 void *v9; // eax 10 size_t i; // [esp+4Ch] [ebp-8Ch] 11 char s[4]; // [esp+50h] [ebp-88h] 12 char input[28]; // [esp+58h] [ebp-80h] 13 char v13; // [esp+74h] [ebp-64h] 14 15 v3 = (void *)print_402B30(&unk_446360, "Give me your flag:"); 16 sub_4013F0(v3, (int (__cdecl *)(void *))sub_403670); 17 scanf_401440((int)&dword_4463F0, v4, (int)input, 127); 18 if ( strlen(input) < 30 && strlen(input) > 4 ) 19 { 20 strcpy(s, "EIS{"); 21 for ( i = 0; i < strlen(s); ++i ) 22 { 23 if ( input[i] != s[i] ) // 输入前四位为：EIS{ 24 { 25 v7 = (void *)print_402B30(&unk_446360, "Sorry, keep trying! "); 26 sub_4013F0(v7, (int (__cdecl *)(void *))sub_403670); 27 return 0; 28 } 29 } 30 if ( v13 == '}' ) // 输入的最后一位 31 { 32 if ( sub_4011C0(input) ) // 关键函数 33 v9 = (void *)print_402B30(&unk_446360, "Congratulations! "); 34 else 35 v9 = (void *)print_402B30(&unk_446360, "Sorry, keep trying! "); 36 sub_4013F0(v9, (int (__cdecl *)(void *))sub_403670); 37 result = 0; 38 } 39 else 40 { 41 v8 = (void *)print_402B30(&unk_446360, "Sorry, keep trying! "); 42 sub_4013F0(v8, (int (__cdecl *)(void *))sub_403670); 43 result = 0; 44 } 45 } 46 else 47 { 48 v5 = (void *)print_402B30(&unk_446360, "Sorry, keep trying!"); 49 sub_4013F0(v5, (int (__cdecl *)(void *))sub_403670); 50 result = 0; 51 } 52 return result; 53 }
查看关键函数
1 bool __cdecl sub_4011C0(char *a1) 2 { 3 size_t v2; // eax 4 signed int v3; // [esp+50h] [ebp-B0h] 5 char str[32]; // [esp+54h] [ebp-ACh] 6 int v5; // [esp+74h] [ebp-8Ch] 7 int j; // [esp+78h] [ebp-88h] 8 size_t i; // [esp+7Ch] [ebp-84h] 9 char s_mid[128]; // [esp+80h] [ebp-80h] 10 11 if ( strlen(a1) <= 4 ) 12 return 0; 13 i = 4; 14 j = 0; 15 while ( i < strlen(a1) - 1 ) 16 s_mid[j++] = a1[i++]; 17 s_mid[j] = 0; 18 v5 = 0; 19 v3 = 0; 20 memset(str, 0, 0x20u); 21 for ( i = 0; ; ++i ) 22 { 23 v2 = strlen(s_mid); 24 if ( i >= v2 ) 25 break; 26 if ( s_mid[i] >= 'a' && s_mid[i] <= 'z' ) 27 { 28 s_mid[i] -= 32; // 小写转大写 29 v3 = 1; 30 } 31 if ( !v3 && s_mid[i] >= 'A' && s_mid[i] <= 'Z' ) 32 s_mid[i] += 32; // 大写转小写 33 str[i] = byte_4420B0[i] ^ sub_4013C0(s_mid[i]);// 异或 34 v3 = 0; 35 } 36 return strcmp("GONDPHyGjPEKruv{{pj]X@rF", str) == 0; 37 }
wp:
1 date1=[ 0x0D, 0x13, 0x17, 0x11, 0x02, 0x01, 0x20, 0x1D, 0x0C, 0x02, 2 0x19, 0x2F, 0x17, 0x2B, 0x24, 0x1F, 0x1E, 0x16, 0x09, 0x0F, 3 0x15, 0x27, 0x13, 0x26, 0x0A, 0x2F, 0x1E, 0x1A, 0x2D, 0x0C, 4 0x22, 0x04] 5 # s=inpt(a1 ^ 0x55) + 72 6 s='GONDPHyGjPEKruv{{pj]X@rF' 7 s=list(s) 8 t='' 9 for x in range(len(s)): 10 c=chr(((ord(s[x])^date1[x])-72)^0x55) 11 if c.islower(): 12 t+=c.upper() 13 else: 14 t+=c.lower() 15 16 print('EIS{'+t+'}')
EIS{wadx_tdgk_aihc_ihkn_pjlm}