buuctf re [FlareOn3]Challenge1

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Buffer[128]; // [esp+0h] [ebp-94h] BYREF
  char *Str1; // [esp+80h] [ebp-14h]
  char *Str2; // [esp+84h] [ebp-10h]
  HANDLE StdHandle; // [esp+88h] [ebp-Ch]
  HANDLE hFile; // [esp+8Ch] [ebp-8h]
  DWORD NumberOfBytesWritten; // [esp+90h] [ebp-4h] BYREF

  hFile = GetStdHandle(0xFFFFFFF5);
  StdHandle = GetStdHandle(0xFFFFFFF6);
  Str2 = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q";
  WriteFile(hFile, "Enter password:\r\n", 0x12u, &NumberOfBytesWritten, 0);
  ReadFile(StdHandle, Buffer, 0x80u, &NumberOfBytesWritten, 0);
  Str1 = (char *)sub_401260(Buffer, NumberOfBytesWritten - 2);
  if ( !strcmp(Str1, Str2) )
    WriteFile(hFile, "Correct!\r\n", 0xBu, &NumberOfBytesWritten, 0);
  else
    WriteFile(hFile, "Wrong password\r\n", 0x11u, &NumberOfBytesWritten, 0);
  return 0;
}

查看sub_401260

_BYTE *__cdecl sub_401260(int a1, unsigned int a2)
{
  int v3; // [esp+Ch] [ebp-24h]
  int v4; // [esp+10h] [ebp-20h]
  int v5; // [esp+14h] [ebp-1Ch]
  int i; // [esp+1Ch] [ebp-14h]
  unsigned int v7; // [esp+20h] [ebp-10h]
  _BYTE *v8; // [esp+24h] [ebp-Ch]
  int v9; // [esp+28h] [ebp-8h]
  int v10; // [esp+28h] [ebp-8h]
  unsigned int v11; // [esp+2Ch] [ebp-4h]

  v8 = malloc(4 * ((a2 + 2) / 3) + 1);
  if ( !v8 )
    return 0;
  v11 = 0;
  v9 = 0;
  while ( v11 < a2 )
  {
    v5 = *(unsigned __int8 *)(v11 + a1);
    if ( ++v11 >= a2 )
    {
      v4 = 0;
    }
    else
    {
      v4 = *(unsigned __int8 *)(v11 + a1);
      ++v11;
    }
    if ( v11 >= a2 )
    {
      v3 = 0;
    }
    else
    {
      v3 = *(unsigned __int8 *)(v11 + a1);
      ++v11;
    }
    v7 = v3 + (v5 << 16) + (v4 << 8);
    v8[v9] = byte_413000[(v7 >> 18) & 0x3F];
    v10 = v9 + 1;
    v8[v10] = byte_413000[(v7 >> 12) & 0x3F];
    v8[++v10] = byte_413000[(v7 >> 6) & 0x3F];
    v8[++v10] = byte_413000[v3 & 0x3F];
    v9 = v10 + 1;
  }
  for ( i = 0; i < dword_413040[a2 % 3]; ++i )
    v8[4 * ((a2 + 2) / 3) - i - 1] = 61;
  v8[4 * ((a2 + 2) / 3)] = 0;
  return v8;
}

下面是base64加密 查看密钥

data:00413000 byte_413000     db 5Ah                  ; DATA XREF: sub_401260+FC↑r
.data:00413000                                         ; sub_401260+11C↑r ...
.data:00413001                 db  59h ; Y
.data:00413002                 db  58h ; X
.data:00413003                 db  41h ; A
.data:00413004                 db  42h ; B
.data:00413005                 db  43h ; C
.data:00413006                 db  44h ; D
.data:00413007                 db  45h ; E
.data:00413008                 db  46h ; F
.data:00413009                 db  47h ; G
.data:0041300A                 db  48h ; H
.data:0041300B                 db  49h ; I
.data:0041300C                 db  4Ah ; J
.data:0041300D                 db  4Bh ; K
.data:0041300E                 db  4Ch ; L
.data:0041300F                 db  4Dh ; M
.data:00413010                 db  4Eh ; N
.data:00413011                 db  4Fh ; O
.data:00413012                 db  50h ; P
.data:00413013                 db  51h ; Q
.data:00413014                 db  52h ; R
.data:00413015                 db  53h ; S
.data:00413016                 db  54h ; T
.data:00413017                 db  55h ; U
.data:00413018                 db  56h ; V
.data:00413019                 db  57h ; W
.data:0041301A                 db  7Ah ; z
.data:0041301B                 db  79h ; y
.data:0041301C                 db  78h ; x
.data:0041301D                 db  61h ; a
.data:0041301E                 db  62h ; b
.data:0041301F                 db  63h ; c
.data:00413020                 db  64h ; d
.data:00413021                 db  65h ; e
.data:00413022                 db  66h ; f
.data:00413023                 db  67h ; g
.data:00413024                 db  68h ; h
.data:00413025                 db  69h ; i
.data:00413026                 db  6Ah ; j
.data:00413027                 db  6Bh ; k
.data:00413028                 db  6Ch ; l
.data:00413029                 db  6Dh ; m
.data:0041302A                 db  6Eh ; n
.data:0041302B                 db  6Fh ; o
.data:0041302C                 db  70h ; p
.data:0041302D                 db  71h ; q
.data:0041302E                 db  72h ; r
.data:0041302F                 db  73h ; s
.data:00413030                 db  74h ; t
.data:00413031                 db  75h ; u
.data:00413032                 db  76h ; v
.data:00413033                 db  77h ; w
.data:00413034                 db  30h ; 0
.data:00413035                 db  31h ; 1
.data:00413036                 db  32h ; 2
.data:00413037                 db  33h ; 3
.data:00413038                 db  34h ; 4
.data:00413039                 db  35h ; 5
.data:0041303A                 db  36h ; 6
.data:0041303B                 db  37h ; 7
.data:0041303C                 db  38h ; 8
.data:0041303D                 db  39h ; 9
.data:0041303E                 db  2Bh ; +
.data:0041303F                 db  2Fh ; /

正常解密就行