reverse-for-the-holy-grail-350 tu-ctf-2016
程序流程很简单，就一个检验函数：
1 __int64 __fastcall stringMod(__int64 *a1) 2 { 3 __int64 length; // r9 4 char *c_str; // r10 5 __int64 i; // rcx 6 signed int v4; // er8 7 int *temp_2; // rdi 8 int *temp_3; // rsi 9 signed int t; // ecx 10 signed int j; // er9 11 int index; // er10 12 unsigned int tmp; // eax 13 int sign; // esi 14 int v12; // esi 15 int temp[24]; // [rsp+0h] [rbp-60h] 16 17 memset(temp, 0, 0x48uLL); 18 length = a1[1]; 19 if ( length ) 20 { 21 c_str = (char *)*a1; 22 i = 0LL; 23 v4 = 0; 24 do 25 { 26 v12 = c_str[i]; 27 temp[i] = v12; 28 if ( 3 * ((unsigned int)i / 3) == (_DWORD)i && v12 != firstchar[(unsigned int)i / 3] )// 当i是3的倍数时，str=first[i/3] 29 // { 65, 105, 110, 69, 111, 97} 30 v4 = -1; 31 ++i; 32 } 33 while ( i != length ); 34 } 35 else 36 { 37 v4 = 0; 38 } 39 temp_2 = temp; 40 temp_3 = temp; 41 t = 666; 42 do 43 { 44 *temp_3 = t ^ *(unsigned __int8 *)temp_3; 45 t += t % 5; 46 ++temp_3; 47 } 48 while ( &temp[18] != temp_3 ); // 异或操作 49 j = 1; 50 index = 0; 51 tmp = 1; 52 sign = 0; 53 do // 0,1,2 每三个数验证 54 { 55 if ( sign == 2 ) 56 { 57 if ( *temp_2 != thirdchar[index] ) // { 751, 708, 732, 711, 734, 764, 0, 0 } 58 // temp[2]= 59 v4 = -1; 60 if ( tmp % *temp_2 != masterArray[index] )// { 471, 12, 580, 606, 147, 108 } 61 // 62 // temp[0]*temp[1]%temp[2]= 63 v4 = -1; 64 ++index; 65 tmp = 1; 66 sign = 0; 67 } 68 else // sign 0,1, 69 { 70 tmp *= *temp_2; // 0 tmp=temp[0] 71 // 1 tmp=temp[0]*temp[1] 72 if ( ++sign == 3 ) 73 sign = 0; 74 } 75 ++j; 76 ++temp_2; 77 } 78 while ( j != 19 ); // 18循环 79 return (unsigned int)(t * v4); 80 }
wp:
1 firstchar=[65, 105, 110, 69, 111, 97] 2 thirdchar=[751, 708, 732, 711, 734, 764] 3 masterArray=[471, 12, 580, 606, 147, 108 ] 4 t=[] 5 x=666 6 for i in range(18): 7 t.append(x) 8 x+=x%5 9 flag=[0 for i in range(18)] 10 index=0 11 for i in range(0,18,3): 12 flag[i]=firstchar[index] #0,3,6 13 index+=1 14 index=0 15 for i in range(2,18,3): 16 flag[i]=thirdchar[index]^t[i] #2 5,8 17 index+=1 18 index=0 19 for i in range(1,18,3): 20 for f in range(32,126): #常用可输入字符 21 if (flag[i-1]^t[i-1])*(f^t[i])%(flag[i+1]^t[i+1])==masterArray[index]: 22 flag[i]=f 23 index+=1 24 break; 25 26 print('tuctf{'+''.join(map(chr,flag))+'}')
tuctf{AfricanOrEuropean?}