xor

看名字能看出来 xxxorrr 应该是多层xor 要么就是有隐藏

main函数

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int i; // [rsp+Ch] [rbp-34h]
  char s[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v6; // [rsp+38h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  sub_A90(sub_916, a2, a3);
  fgets(s, 35, stdin);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= s[i];
  return 0;
}

这个比较函数居然在上面 这让我不得不找一找了

unsigned __int64 sub_916()
{
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = __readfsqword(0x28u);
  if ( !strcmp(s1, s2) )
    puts("Congratulations!");
  else
    puts("Wrong!");
  return __readfsqword(0x28u) ^ v1;
}

在这里还执行了一次 s1 操作

unsigned __int64 sub_84A()
{
  int i; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= 2 * i + 65;
  return __readfsqword(0x28u) ^ v2;
}

那就提取数据来解密吧

数据

s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn'
s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,0x17, 0x46, 0x54,0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00]

exp

s1 = b'qasxcytgsasxcvrefghnrfghnjedfgbhn'
s2 = bytearray([0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,0x17, 0x46, 0x54,0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00])
s = bytearray([])
for i in range(len(s1)):
    s.append(s1[i] ^  (2 * i + 65))
for j in range(len(s1)):
    print(chr(s[j] ^ s2[j]), end='')

flag

flag{c0n5truct0r5_functi0n_in_41f}