GFSJ0294-【hackme】
xor
mian函数 能看到只有一个简单的xor 然后v11是我们输入的 byte_6B4270应该是密文 那密文中的v17就是一个一个的下标
__int64 __fastcall sub_400F8E(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
int v6; // edx
int v7; // ecx
int v8; // r8d
int v9; // r9d
_BYTE v11[136]; // [rsp+10h] [rbp-B0h] BYREF
int v12; // [rsp+98h] [rbp-28h]
char v13; // [rsp+9Fh] [rbp-21h]
int v14; // [rsp+A0h] [rbp-20h]
unsigned __int8 v15; // [rsp+A6h] [rbp-1Ah]
char v16; // [rsp+A7h] [rbp-19h]
int v17; // [rsp+A8h] [rbp-18h]
int v18; // [rsp+ACh] [rbp-14h]
int v19; // [rsp+B0h] [rbp-10h]
int v20; // [rsp+B4h] [rbp-Ch]
_BOOL4 v21; // [rsp+B8h] [rbp-8h]
int i; // [rsp+BCh] [rbp-4h]
sub_407470((__int64)"Give me the password: ", a2, a3, a4, a5, a6);
sub_4075A0((unsigned int)"%s", (unsigned int)v11, v6, v7, v8, v9, a2);
for ( i = 0; v11[i]; ++i )
;
v21 = i == 22;
v20 = 10;
do
{
v17 = (int)sub_406D90() % 22;
v19 = 0;
v16 = byte_6B4270[v17];
v15 = v11[v17];
v14 = v17 + 1;
v18 = 0;
while ( v18 < v14 )
{
++v18;
v19 = 1828812941 * v19 + 12345;
}
v13 = v19 ^ v15;
if ( v16 != ((unsigned __int8)v19 ^ v15) )
v21 = 0;
--v20;
}
while ( v20 );
if ( v21 )
v12 = sub_407470((__int64)"Congras\n");
else
v12 = sub_407470((__int64)"Oh no!\n");
return 0;
}
所以 密文 操作 数据都找到了
exp
byte_6B4270 = [0x5F,0xF2,0x5E,0x8B,0x4E,0x0E,0xA3,0xAA,0xC7,0x93,0x81,0x3D,0x5F,0x74,0xA3,0x09,0x91,0x2B,0x49,0x28,0x93,0x67]
v = 0
for x in byte_6B4270:
v = (1828812941 * v + 12345) & 0xff
print(chr(x ^ v), end="")
flag
flag{d826e6926098ef46}
评论