xor

main函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // edx
  char *v4; // esi
  char v5; // al
  unsigned int i; // edx
  int v7; // eax
  char Arglist[16]; // [esp+2h] [ebp-24h] BYREF
  __int64 v10; // [esp+12h] [ebp-14h] BYREF
  int v11; // [esp+1Ah] [ebp-Ch]
  __int16 v12; // [esp+1Eh] [ebp-8h]

  printf(Format);
  v11 = 0;
  v12 = 0;
  *(_OWORD *)Arglist = 0;
  v10 = 0;
  scanf("%s", Arglist);
  if ( strlen(Arglist) == 24 )
  {
    v3 = 0;
    v4 = (char *)&v10 + 7;
    do
    {
      v5 = *v4--;
      byte_40336C[v3++] = v5;
    }
    while ( v3 < 24 );
    for ( i = 0; i < 0x18; ++i )
      byte_40336C[i] = (byte_40336C[i] + 1) ^ 6;
    v7 = strcmp(byte_40336C, aXircjR2twsv3pt);
    if ( v7 )
      v7 = v7 < 0 ? -1 : 1;
    if ( !v7 )
    {
      printf("right\n");
      system("pause");
    }
  }
  return 0;
}

可以看到就只有一个xor

for ( i = 0; i < 0x18; ++i )
      byte_40336C[i] = (byte_40336C[i] + 1) ^ 6;

数据

aXircjR2twsv3pt = b'xIrCj~<r|2tWsv3PtI\x7fzndka'

exp

aXircjR2twsv3pt = b'xIrCj~<r|2tWsv3PtI\x7fzndka'
for i in range(len(aXircjR2twsv3pt)-1,-1,-1):
    print(chr((aXircjR2twsv3pt[i]^6)-1),end='')

flag

flag{xNqU4otPq3ys9wkDsN}