UPX

脱壳后打开

int __fastcall main(int argc, const char **argv, const char **envp)
{
  _main();
  puts_0("Very easy upx!");
  puts_0("Then flag?");
  system_0("pause");
  return 0;
}

查看字符串 能看到

d_0n3_4nd_tw0}

看到这个 是part2 那有2就有1

f_part2         db 'd_0n3_4nd_tw0}',0

__int64 __fastcall part1()
{
  return 6363680261978287206LL;
}

__int64 __fastcall part1()
{
  return 'XPU{galf';
}

看看汇编有没有落下的

.text:0000000000401530 ; =============== S U B R O U T I N E =======================================
.text:0000000000401530
.text:0000000000401530 ; Attributes: bp-based frame
.text:0000000000401530
.text:0000000000401530 ; __int64 __fastcall part1()
.text:0000000000401530                 public _Z5part1v
.text:0000000000401530 _Z5part1v       proc near
.text:0000000000401530
.text:0000000000401530 var_10          = qword ptr -10h
.text:0000000000401530 var_8           = dword ptr -8
.text:0000000000401530
.text:0000000000401530                 push    rbp
.text:0000000000401531                 mov     rbp, rsp
.text:0000000000401534                 sub     rsp, 10h
.text:0000000000401538                 mov     rax, 'XPU{galf'
.text:0000000000401542                 mov     [rbp+var_10], rax
.text:0000000000401546                 mov     [rbp+var_8], 'n4_'
.text:000000000040154D                 add     rsp, 10h
.text:0000000000401551                 pop     rbp
.text:0000000000401552                 retn
.text:0000000000401552 _Z5part1v       endp

能看到还真有但是提取出来的这个怎么感觉不太对

XPU{galfn4_d_0n3_4nd_tw0}

原来是被倒过来了 再倒过来就可以了

原理 x86架构 采用小端方式存储 最低有效字节放在低地址

flag

flag{UPX_4nd_0n3_4nd_tw0}