zoukankan      html  css  js  c++  java
  • buuctf re [GWCTF 2019]xxor

    __int64 __fastcall main(int a1, char **a2, char **a3)
    {
      int i; // [rsp+8h] [rbp-68h]
      int j; // [rsp+Ch] [rbp-64h]
      __int64 v6[6]; // [rsp+10h] [rbp-60h] BYREF
      __int64 v7[6]; // [rsp+40h] [rbp-30h] BYREF
    
      v7[5] = __readfsqword(0x28u);
      puts("Let us play a game?");
      puts("you have six chances to input");
      puts("Come on!");
      memset(v6, 0, 40);
      for ( i = 0; i <= 5; ++i )
      {
        printf("%s", "input: ");
        a2 = (char **)((char *)v6 + 4 * i);
        __isoc99_scanf("%d", a2);
      }
      memset(v7, 0, 40);
      for ( j = 0; j <= 2; ++j )
      {
        dword_601078 = v6[j];
        dword_60107C = HIDWORD(v6[j]);
        a2 = (char **)&unk_601060;
        sub_400686(&dword_601078, &unk_601060);
        LODWORD(v7[j]) = dword_601078;
        HIDWORD(v7[j]) = dword_60107C;
      }
      if ( (unsigned int)sub_400770(v7, a2) != 1 )
      {
        puts("NO NO NO~ ");
        exit(0);
      }
      puts("Congratulation!\n");
      puts("You seccess half\n");
      puts("Do not forget to change input to hex and combine~\n");
      puts("ByeBye");
      return 0LL;
    }
    

    查看 sub_400770

    __int64 __fastcall sub_400770(_DWORD *a1)
    {
      if ( a1[2] - a1[3] == 2225223423LL
        && a1[3] + a1[4] == 4201428739LL
        && a1[2] - a1[4] == 1121399208LL
        && *a1 == -548868226
        && a1[5] == -2064448480
        && a1[1] == 550153460 )
      {
        puts("good!");
        return 1LL;
      }
      else
      {
        puts("Wrong!");
        return 0LL;
      }
    }
    

    计算出 __int64 a[6] = { 3746099070, 550153460, 3774025685, 1548802262, 2652626477, 2230518816 };

    打开sub_400686函数

    __int64 __fastcall sub_400686(unsigned int *a1, _DWORD *a2)
    {
      __int64 result; // rax
      unsigned int v3; // [rsp+1Ch] [rbp-24h]
      unsigned int v4; // [rsp+20h] [rbp-20h]
      int v5; // [rsp+24h] [rbp-1Ch]
      unsigned int i; // [rsp+28h] [rbp-18h]
    
      v3 = *a1;
      v4 = a1[1];
      v5 = 0;
      for ( i = 0; i <= 0x3F; ++i )
      {
        v5 += 1166789954;
        v3 += (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
        v4 += (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
      }
      *a1 = v3;
      result = v4;
      a1[1] = v4;
      return result;
    }
    

    这段是加密函数
    这就是一个利用已知数组unk_601060对我们输入的整型数组进行异或操作
    因此我们只需要将整个过程逆过来,for循环那段,你将异或过程看成一个整体就行,最后就能得到输入的整型数组。
    &unk_601060的值其实就是{2,2,3,4}

    #include <iostream>
    
    #pragma warning(disable:4996)
    using namespace std;
    
    int main()
    {
        __int64 a[6] = { 3746099070, 550153460, 3774025685, 1548802262, 2652626477, 2230518816 };
        unsigned int a2[4] = { 2,2,3,4 };
        unsigned int v3, v4;
        int v5;
        for (int j = 0; j <= 4; j += 2) {
            v3 = a[j];
            v4 = a[j + 1];
            v5 = 1166789954*0x40;
            for (int i = 0; i <= 0x3F; ++i) {
                v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
                v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
                v5 -= 1166789954;
            }
            a[j] = v3;
            a[j + 1] = v4;
        }
    
        /*将整型数组作为字符输出,注意计算机小端排序*/
        for (int i = 0; i < 6; ++i) {
            cout << *((char*)&a[i] + 2) << *((char*)&a[i] + 1) <<  * ((char*)&a[i]);
        }
    
        system("PAUSE");
        return 0;
    }
    
  • 相关阅读:
    Maven关于web.xml中Servlet和Servlet映射的问题
    intellij idea的Maven项目运行报程序包找不到的错误
    修改Maven项目默认JDK版本
    刷题15. 3Sum
    刷题11. Container With Most Water
    刷题10. Regular Expression Matching
    刷题5. Longest Palindromic Substring
    刷题4. Median of Two Sorted Arrays
    刷题3. Longest Substring Without Repeating Characters
    刷题2. Add Two Numbers
  • 原文地址:https://www.cnblogs.com/socialbiao/p/15702566.html
Copyright © 2011-2022 走看看