GFSJ0212-【catch-me】

基础类型 xor

main函数能看到getenv 获取了环境变量 ASIS && CTF ^ v3 的值最后等于 0xFEEBFEEB

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int v3; // ebx
  __int64 i; // rax
  __m128i si128; // xmm0
  __m128i v6; // xmm1
  __m128i v7; // xmm3
  __m128i v8; // xmm0
  __m128i v9; // xmm3
  __m128i v10; // xmm1
  __m128i v11; // xmm4
  __m128i v12; // xmm0
  __m128i v13; // xmm0

  v3 = sub_400820((unsigned int)dword_6012B4, a2, a3);
  byte_6012A8[0] = HIBYTE(v3);
  byte_6012A9 = BYTE2(v3) & 0xFD;
  byte_6012AA = BYTE1(v3) & 0xDF;
  byte_6012AB = v3 & 0xBF;
  if ( getenv("ASIS") && (*(_DWORD *)getenv("CTF") ^ v3) == 0xFEEBFEEB )
    dword_6012AC = *(_DWORD *)getenv("ASIS");
  for ( i = 0; i != 33; ++i )
    haystack[i] ^= byte_6012A8[i & 7];
  si128 = _mm_load_si128((const __m128i *)haystack);
  v6 = _mm_unpacklo_epi8(si128, (__m128i)0LL);
  v7 = _mm_unpackhi_epi8(si128, (__m128i)0LL);
  v8 = _mm_add_epi32(
         _mm_unpackhi_epi16(v7, (__m128i)0LL),
         _mm_add_epi32(
           _mm_add_epi32(_mm_unpackhi_epi16(v6, (__m128i)0LL), _mm_unpacklo_epi16(v6, (__m128i)0LL)),
           _mm_unpacklo_epi16(v7, (__m128i)0LL)));
  v9 = _mm_load_si128((const __m128i *)&xmmword_601290);
  v10 = _mm_unpackhi_epi8(v9, (__m128i)0LL);
  v11 = _mm_unpacklo_epi8(v9, (__m128i)0LL);
  v12 = _mm_add_epi32(
          _mm_add_epi32(
            _mm_add_epi32(
              _mm_add_epi32(v8, _mm_unpacklo_epi16(v11, (__m128i)0LL)),
              _mm_unpackhi_epi16(v11, (__m128i)0LL)),
            _mm_unpacklo_epi16(v10, (__m128i)0LL)),
          _mm_unpackhi_epi16(v10, (__m128i)0LL));
  v13 = _mm_add_epi32(v12, _mm_srli_si128(v12, 8));
  if ( _mm_cvtsi128_si32(_mm_add_epi32(v13, _mm_srli_si128(v13, 4))) != 2388 )
    strcpy(haystack, "bad_bad_bad_bad_bad_bad");
  printf("Flag: ASIS{%s}\n", haystack);
  if ( strstr(haystack, "bad_") )
    puts("this flag is absolutely fake ");
  return 0;
}

动调获取v3 也就是 0xB11924E1 我们xor一下获得 0x4ff2da0a

我们设置一下环境变量至于ASIS这个只要不为0好像都行

在虚拟机里面运行

ASIS=$'\x0a\xda\xf2\x4f' CTF=$'\x0a\xda\xf2\x4f' gdb -q ./Catch_Me

也可以

export ASIS=$'\x0a\xda\xf2\x4f'
export CTF=$'\x0a\xda\xf2\x4f'

运行完成后删除

unset ASIS
unset CTF

查看是否删除

echo "$ASIS"
echo "$CTF"

flag

ASIS{600d_j0b_y0u_4r3_63771n6_574r73d}

评论