xor

mian函数 能看到只有一个简单的xor 然后v11是我们输入的 byte_6B4270应该是密文 那密文中的v17就是一个一个的下标

__int64 __fastcall sub_400F8E(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  int v6; // edx
  int v7; // ecx
  int v8; // r8d
  int v9; // r9d
  _BYTE v11[136]; // [rsp+10h] [rbp-B0h] BYREF
  int v12; // [rsp+98h] [rbp-28h]
  char v13; // [rsp+9Fh] [rbp-21h]
  int v14; // [rsp+A0h] [rbp-20h]
  unsigned __int8 v15; // [rsp+A6h] [rbp-1Ah]
  char v16; // [rsp+A7h] [rbp-19h]
  int v17; // [rsp+A8h] [rbp-18h]
  int v18; // [rsp+ACh] [rbp-14h]
  int v19; // [rsp+B0h] [rbp-10h]
  int v20; // [rsp+B4h] [rbp-Ch]
  _BOOL4 v21; // [rsp+B8h] [rbp-8h]
  int i; // [rsp+BCh] [rbp-4h]

  sub_407470((__int64)"Give me the password: ", a2, a3, a4, a5, a6);
  sub_4075A0((unsigned int)"%s", (unsigned int)v11, v6, v7, v8, v9, a2);
  for ( i = 0; v11[i]; ++i )
    ;
  v21 = i == 22;
  v20 = 10;
  do
  {
    v17 = (int)sub_406D90() % 22;
    v19 = 0;
    v16 = byte_6B4270[v17];
    v15 = v11[v17];
    v14 = v17 + 1;
    v18 = 0;
    while ( v18 < v14 )
    {
      ++v18;
      v19 = 1828812941 * v19 + 12345;
    }
    v13 = v19 ^ v15;
    if ( v16 != ((unsigned __int8)v19 ^ v15) )
      v21 = 0;
    --v20;
  }
  while ( v20 );
  if ( v21 )
    v12 = sub_407470((__int64)"Congras\n");
  else
    v12 = sub_407470((__int64)"Oh no!\n");
  return 0;
}

所以 密文 操作 数据都找到了

exp

byte_6B4270 = [0x5F,0xF2,0x5E,0x8B,0x4E,0x0E,0xA3,0xAA,0xC7,0x93,0x81,0x3D,0x5F,0x74,0xA3,0x09,0x91,0x2B,0x49,0x28,0x93,0x67]

v = 0
for x in byte_6B4270:
    v = (1828812941 * v + 12345) & 0xff
    print(chr(x ^ v), end="")

flag

flag{d826e6926098ef46}