IDA 打开

将main函数反编译为C代码

 1 int __cdecl __noreturn main(int argc, const char **argv, const char **envp)

 2 {

 3   int v3; // eax

 4   char v4; // [rsp+Fh] [rbp-1h]

 5

 6   while ( 1 )

 7   {

 8     while ( 1 )

 9     {

10       printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv, envp);

11       v4 = getchar();

12       if ( v4 != 'd' && v4 != 'D' )

13         break;

14       Decry();

15     }

16     if ( v4 == 'q' || v4 == 'Q' )

17       Exit();

18     puts("Input fault format!");

19     v3 = getchar();

20     putchar(v3);

21   }

22 }

代码分析

这道题的关键在于Decry()

1 unsigned __int64 Decry()

2 {

3 char v1; // [rsp+Fh] [rbp-51h]

4 int v2; // [rsp+10h] [rbp-50h]

5 int v3; // [rsp+14h] [rbp-4Ch]

6 int i; // [rsp+18h] [rbp-48h]

7 int v5; // [rsp+1Ch] [rbp-44h]

8 char src[8]; // [rsp+20h] [rbp-40h]

9 __int64 v7; // [rsp+28h] [rbp-38h]

10 int v8; // [rsp+30h] [rbp-30h]

11 __int64 v9; // [rsp+40h] [rbp-20h]

12 __int64 v10; // [rsp+48h] [rbp-18h]

13 int v11; // [rsp+50h] [rbp-10h]

14 unsigned __int64 v12; // [rsp+58h] [rbp-8h]

15

16 v12 = __readfsqword(0x28u);

17 *(_QWORD *)src = 'SLCDN';

18 v7 = 0LL;

19 v8 = 0;

20 v9 = 'wodah';

21 v10 = 0LL;

22 v11 = 0;

23 text = join(key3, (const char *)&v9); // text = 'killshadow'

24 strcpy(key, key1);

25 strcat(key, src); // key = 'ADSFKNDCLS'

26 v2 = 0;

27 v3 = 0;

28 getchar();

29 v5 = strlen(key); // v5 = 10

30 for ( i = 0; i < v5; ++i )

31 {

32 if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )// key = 'adsfkndcls'

33 key[i] = key[v3 % v5] + 32;

34 ++v3;

35 }

36 printf("Please input your flag:", src);

37 while ( 1 )

38 {

39 v1 = getchar();

40 if ( v1 == 10 )

41 break;

42 if ( v1 == 32 )

43 {

44 ++v2;

45 }

46 else

47 {

48 if ( v1 <= 96 || v1 > 122 )

49 {

50 if ( v1 > 64 && v1 <= 90 ) // 大写字母

51 str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;

52 }

53 else // 小写字母

54 {

55 str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;

56 }

57 if ( !(v3 % v5) )

58 putchar(' ');

59 ++v2;

60 }

61 }

62 if ( !strcmp(text, str2) )

63 puts("Congratulation!\n");

64 else

65 puts("Try again!\n");

66 return __readfsqword(0x28u) ^ v12;

67 }

转为C语言逆向解出结果

#include<stdio.h>

int main()

{

	char key[] = "adsfkndcls";

	char text[] = "killshadow";

	int i;

	int v3=10;//长度

	for (int i = 0; i < 10; i++)

	{

		for (int j = 0; j < 128; j++)

		{

			if (j < 'A' || j > 'z' || j > 'Z' && j < 'a')

			{

				continue;

			}

			if ((j - 39 - key[v3 % 10] + 97) % 26 + 97 == text[i])

			{

				printf("%c",j);

				v3++;

				break;

			}

		}

	}

}

得到flag

buuctf-RE-SimpleRev的相关教程结束。