GFSJ0747-【EasyRE】
xor
main函数
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v3; // edx
char *v4; // esi
char v5; // al
unsigned int i; // edx
int v7; // eax
char Arglist[16]; // [esp+2h] [ebp-24h] BYREF
__int64 v10; // [esp+12h] [ebp-14h] BYREF
int v11; // [esp+1Ah] [ebp-Ch]
__int16 v12; // [esp+1Eh] [ebp-8h]
printf(Format);
v11 = 0;
v12 = 0;
*(_OWORD *)Arglist = 0;
v10 = 0;
scanf("%s", Arglist);
if ( strlen(Arglist) == 24 )
{
v3 = 0;
v4 = (char *)&v10 + 7;
do
{
v5 = *v4--;
byte_40336C[v3++] = v5;
}
while ( v3 < 24 );
for ( i = 0; i < 0x18; ++i )
byte_40336C[i] = (byte_40336C[i] + 1) ^ 6;
v7 = strcmp(byte_40336C, aXircjR2twsv3pt);
if ( v7 )
v7 = v7 < 0 ? -1 : 1;
if ( !v7 )
{
printf("right\n");
system("pause");
}
}
return 0;
}
可以看到就只有一个xor
for ( i = 0; i < 0x18; ++i )
byte_40336C[i] = (byte_40336C[i] + 1) ^ 6;
数据
aXircjR2twsv3pt = b'xIrCj~<r|2tWsv3PtI\x7fzndka'
exp
aXircjR2twsv3pt = b'xIrCj~<r|2tWsv3PtI\x7fzndka'
for i in range(len(aXircjR2twsv3pt)-1,-1,-1):
print(chr((aXircjR2twsv3pt[i]^6)-1),end='')
flag
flag{xNqU4otPq3ys9wkDsN}
评论