xor

main

int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char v4; // al
  int v5; // eax
  char v7; // [rsp+33h] [rbp-Dh]
  char v8; // [rsp+33h] [rbp-Dh]
  int v9; // [rsp+34h] [rbp-Ch]
  int i; // [rsp+38h] [rbp-8h]
  int v11; // [rsp+3Ch] [rbp-4h]

  _main();
  v11 = 0;
  v9 = 0;
  puts_0("Please input your flag:");
  while ( 1 )
  {
    v8 = getchar_0();
    if ( v8 == 10 )
      break;
    v7 = key[v9 % 4] ^ v8;
    while ( 1 )
    {
      v4 = v7--;
      if ( v4 <= 0 )
        break;
      v3 = v11++;
      s[v3] = 1;
    }
    v5 = v11++;
    s[v5] = 0;
    ++v9;
  }
  while ( v11 <= 2559 )
    s[v11++] = -1;
  for ( i = 0; i <= 2559; ++i )
  {
    if ( r[i] != s[i] )
    {
      puts_0("Lose lose lose!");
      break;
    }
  }
  if ( i == 2560 )
    puts_0("Win win win!");
  system_0("pause");
  return 0;
}

就只有一个xor

输入字符 = 连续 1 的数量 XOR key[i % 4]

结果如下

0x35 ^ 'S' = 0x35 ^ 0x53 = 'f'
0x2F ^ 'C' = 0x2F ^ 0x43 = 'l'
0x2F ^ 'N' = 0x2F ^ 0x4E = 'a'
0x32 ^ 'U' = 0x32 ^ 0x55 = 'g'

exp

data = [
    0x35, 0x2F, 0x2F, 0x32,
    0x28, 0x14, 0x27, 0x3B,
    0x3D, 0x70, 0x3C, 0x0A,
    0x3D, 0x73, 0x3A, 0x0A,
    0x1F, 0x73, 0x3D, 0x66,
    0x21, 0x1C, 0x6D, 0x28
]

key = b"SCNU"

print(bytes(data[i] ^ key[i % 4] for i in range(len(data))).decode())

flag

flag{Winn3r_n0t_L0s3r_#}