GFSJ0270-【2ex1】
base64换表
Mips架构
main函数
int sub_400788()
{
_BYTE v1[20]; // [sp+18h] [+18h] BYREF
_BYTE v2[28]; // [sp+2Ch] [+2Ch] BYREF
sub_400840(v1);
sub_4010F0(v2, 25);
sub_400430(v1, 17, v2);
sub_4009C0(v2);
return 0;
}
进去看看 没几个看得懂的 但是一眼丁真了
int __fastcall sub_400430(int a1, unsigned int a2, int a3)
{
unsigned int v3; // $v0
int v4; // $v0
int v5; // $v0
int v6; // $v0
unsigned int i; // [sp+8h] [+8h]
unsigned int v9; // [sp+8h] [+8h]
int v10; // [sp+Ch] [+Ch]
v10 = 0;
for ( i = 0; i < a2; ++i )
{
v3 = i % 3;
if ( i % 3 == 1 )
{
v5 = v10++;
*(_BYTE *)(a3 + v5) = a1fgvw2ehux3dit[16 * (*(_BYTE *)(a1 + i - 1) & 3)
+ ((*(unsigned __int8 *)(a1 + i) >> 4) & 0xF)];
}
else if ( v3 == 2 )
{
*(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[4 * (*(_BYTE *)(a1 + i - 1) & 0xF)
+ ((*(unsigned __int8 *)(a1 + i) >> 6) & 3)];
v6 = v10 + 1;
v10 += 2;
*(_BYTE *)(a3 + v6) = a1fgvw2ehux3dit[*(_BYTE *)(a1 + i) & 0x3F];
}
else if ( !v3 )
{
v4 = v10++;
*(_BYTE *)(a3 + v4) = a1fgvw2ehux3dit[(*(unsigned __int8 *)(a1 + i) >> 2) & 0x3F];
}
}
v9 = i - 1;
if ( v9 % 3 )
{
if ( v9 % 3 == 1 )
{
*(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[4 * (*(_BYTE *)(a1 + v9) & 0xF)];
*(_BYTE *)(a3 + v10 + 1) = 61;
}
}
else
{
*(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[16 * (*(_BYTE *)(a1 + v9) & 3)];
*(_BYTE *)(a3 + v10 + 1) = 61;
*(_BYTE *)(a3 + v10 + 2) = 61;
}
return 0;
}
提取出来
@,.1fgvw#`/2ehux$~"3dity%_;4cjsz^+{5bkrA&=}6alqB*-[70mpC()]89noD
密文
│_r-+_Cl5;vgq_pdme7#7eC0=
exp
import base64
enc = "_r-+_Cl5;vgq_pdme7#7eC0="
tab = '@,.1fgvw#`/2ehux$~"3dity%_;4cjsz^+{5bkrA&=}6alqB*-[70mpC()]89noD'
std = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
pad = len(enc) - len(enc.rstrip("="))
body = enc.rstrip("=")
s = body.translate(str.maketrans(tab, std)) + "=" * pad
print(base64.b64decode(s).decode())
flag
flag{change53233}
评论