【攻防世界】逆向Reversingx64Elf100

4位程序性，无壳，拖进ida，分析关键函数

当面这个函数返回0时，得到flag

signed __int64 __fastcall sub_4006FD(__int64 a1)
{
  signed int i; // [rsp+14h] [rbp-24h]
  const char *v3; // [rsp+18h] [rbp-20h]
  const char *v4; // [rsp+20h] [rbp-18h]
  const char *v5; // [rsp+28h] [rbp-10h]

  v3 = "Dufhbmf";
  v4 = "pG`imos";
  v5 = "ewUglpt";
  for ( i = 0; i <= 11; ++i )
  {
    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )// 让这个等于1
      return 1LL;
  }
  return 0LL;
}

a1就是flag，写逆向脚本得到a1即可

s = ['Dufhbmf','pG`imos','ewUglpt']

flag = ''
for i in range(12):
    flag+=chr(ord(s[i%3][2*int(i//3)])-1)

print(flag)