base64换表

Mips架构

main函数

int sub_400788()
{
  _BYTE v1[20]; // [sp+18h] [+18h] BYREF
  _BYTE v2[28]; // [sp+2Ch] [+2Ch] BYREF

  sub_400840(v1);
  sub_4010F0(v2, 25);
  sub_400430(v1, 17, v2);
  sub_4009C0(v2);
  return 0;
}

进去看看 没几个看得懂的 但是一眼丁真了

int __fastcall sub_400430(int a1, unsigned int a2, int a3)
{
  unsigned int v3; // $v0
  int v4; // $v0
  int v5; // $v0
  int v6; // $v0
  unsigned int i; // [sp+8h] [+8h]
  unsigned int v9; // [sp+8h] [+8h]
  int v10; // [sp+Ch] [+Ch]

  v10 = 0;
  for ( i = 0; i < a2; ++i )
  {
    v3 = i % 3;
    if ( i % 3 == 1 )
    {
      v5 = v10++;
      *(_BYTE *)(a3 + v5) = a1fgvw2ehux3dit[16 * (*(_BYTE *)(a1 + i - 1) & 3)
                                          + ((*(unsigned __int8 *)(a1 + i) >> 4) & 0xF)];
    }
    else if ( v3 == 2 )
    {
      *(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[4 * (*(_BYTE *)(a1 + i - 1) & 0xF)
                                           + ((*(unsigned __int8 *)(a1 + i) >> 6) & 3)];
      v6 = v10 + 1;
      v10 += 2;
      *(_BYTE *)(a3 + v6) = a1fgvw2ehux3dit[*(_BYTE *)(a1 + i) & 0x3F];
    }
    else if ( !v3 )
    {
      v4 = v10++;
      *(_BYTE *)(a3 + v4) = a1fgvw2ehux3dit[(*(unsigned __int8 *)(a1 + i) >> 2) & 0x3F];
    }
  }
  v9 = i - 1;
  if ( v9 % 3 )
  {
    if ( v9 % 3 == 1 )
    {
      *(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[4 * (*(_BYTE *)(a1 + v9) & 0xF)];
      *(_BYTE *)(a3 + v10 + 1) = 61;
    }
  }
  else
  {
    *(_BYTE *)(a3 + v10) = a1fgvw2ehux3dit[16 * (*(_BYTE *)(a1 + v9) & 3)];
    *(_BYTE *)(a3 + v10 + 1) = 61;
    *(_BYTE *)(a3 + v10 + 2) = 61;
  }
  return 0;
}

提取出来

@,.1fgvw#`/2ehux$~"3dity%_;4cjsz^+{5bkrA&=}6alqB*-[70mpC()]89noD

密文

_r-+_Cl5;vgq_pdme7#7eC0=

exp

import base64

enc = "_r-+_Cl5;vgq_pdme7#7eC0="
tab = '@,.1fgvw#`/2ehux$~"3dity%_;4cjsz^+{5bkrA&=}6alqB*-[70mpC()]89noD'
std = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

pad = len(enc) - len(enc.rstrip("="))
body = enc.rstrip("=")

s = body.translate(str.maketrans(tab, std)) + "=" * pad
print(base64.b64decode(s).decode())

flag

flag{change53233}