GFSJ0123-【simple-check-100】

动调

题目給了三个附件两个elf 一个exe 能看到main函数就一个赋值一个判断进入函数

int __fastcall main(int argc, const char **argv, const char **envp)
{
  void *v3; // rsp
  const char **v5; // [rsp+0h] [rbp-60h] BYREF
  int v6; // [rsp+Ch] [rbp-54h]
  _BYTE v7[28]; // [rsp+1Ch] [rbp-44h] BYREF
  __int64 v8; // [rsp+38h] [rbp-28h]
  const char ***v9; // [rsp+40h] [rbp-20h]
  unsigned __int64 v10; // [rsp+48h] [rbp-18h]

  v6 = argc;
  v5 = argv;
  v10 = __readfsqword(0x28u);
  v7[0] = 84;
  v7[1] = -56;
  v7[2] = 126;
  v7[3] = -29;
  v7[4] = 100;
  v7[5] = -57;
  v7[6] = 22;
  v7[7] = -102;
  v7[8] = -51;
  v7[9] = 17;
  v7[10] = 101;
  v7[11] = 50;
  v7[12] = 45;
  v7[13] = -29;
  v7[14] = -45;
  v7[15] = 67;
  v7[16] = -110;
  v7[17] = -87;
  v7[18] = -99;
  v7[19] = -46;
  v7[20] = -26;
  v7[21] = 109;
  v7[22] = 44;
  v7[23] = -45;
  v7[24] = -74;
  v7[25] = -67;
  v7[26] = -2;
  v7[27] = 106;
  v8 = 19;
  v3 = alloca(32);
  v9 = &v5;
  printf("Key: ");
  __isoc99_scanf("%s", v9);
  if ( (unsigned int)check_key(v9) )
    interesting_function(v7);
  else
    puts("Wrong");
  return 0;
}

check_key 函数获取key 然后进行操作但是不影响下面函数

_BOOL8 __fastcall check_key(__int64 a1)
{
  int v2; // [rsp+8h] [rbp-10h]
  int i; // [rsp+Ch] [rbp-Ch]

  v2 = 0;
  for ( i = 0; i <= 4; ++i )
    v2 += *(_DWORD *)(4LL * i + a1);
  return v2 == -559038737;
}

interesting_function 能看到上面check_key函数的操作对下面的没有影响我输入什么都不影响我们只需要进去然后他自动会输出

int __fastcall interesting_function(__int64 a1)
{
  unsigned int *v1; // rax
  unsigned int v3; // [rsp+1Ch] [rbp-24h] BYREF
  int i; // [rsp+20h] [rbp-20h]
  int j; // [rsp+24h] [rbp-1Ch]
  __int64 v6; // [rsp+28h] [rbp-18h]
  unsigned int *v7; // [rsp+30h] [rbp-10h]
  unsigned __int64 v8; // [rsp+38h] [rbp-8h]

  v8 = __readfsqword(0x28u);
  LODWORD(v1) = a1;
  v6 = a1;
  for ( i = 0; i <= 6; ++i )
  {
    v3 = *(_DWORD *)(4LL * i + v6) ^ 0xDEADBEEF;
    v1 = &v3;
    v7 = &v3;
    for ( j = 3; j >= 0; --j )
      LODWORD(v1) = putchar((char)(*((_BYTE *)v7 + j) ^ flag_data[4 * i + j]));
  }
  return (int)v1;
}

exe输出有问题所以我们换成elf

我们只需要修改这个eax值就可以了

同样我们也可以提取数据来解密flag

数据

fd = [0xdc,0x17,0xbf,0x5b,0xd4,0x0a,0xd2,0x1b,0x7d,0xda,0xa7,0x95,0xb5,0x32,0x10,0xf6,0x1c,0x65,0x53,0x53,0x67,0xba,0xea,0x6e,0x78,0x22,0x72,0xd3]
d = [84,-56,126,-29,100,-57,22,-102,-51,17,101,50,45,-29,-45,67,-110,-87,-99,-46,-26,109,44,-45,-74,-67,-2,106]

exp

fd = [0xdc,0x17,0xbf,0x5b,0xd4,0x0a,0xd2,0x1b,0x7d,0xda,0xa7,0x95,0xb5,0x32,0x10,0xf6,0x1c,0x65,0x53,0x53,0x67,0xba,0xea,0x6e,0x78,0x22,0x72,0xd3]
d = [84,-56,126,-29,100,-57,22,-102,-51,17,101,50,45,-29,-45,67,-110,-87,-99,-46,-26,109,44,-45,-74,-67,-2,106]

d = bytes(x & 0xff for x in d)

for i in range(7):
    x = int.from_bytes(d[i*4:i*4+4], "little") ^ 0xDEADBEEF
    b = x.to_bytes(4, "little")

    for j in range(3, -1, -1):
        print(chr(b[j] ^ fd[4*i+j]), end="")

flag

flag_is_you_know_cracking!!!

GFSJ0123-【simple-check-100】

评论