BUUCTF--reverse3

测试文件：https://buuoj.cn/files/aa4f6c7e8d5171d520b95420ee570e79/a9d22a0e-928d-4bb4-8525-e38c9481469e.rar?token=eyJ0ZWFtX2lkIjpudWxsLCJ1c2VyX2lkIjoxOTAzLCJmaWxlX2lkIjoxNTl9.XXCjMA.QBNzEL8Ujfk_QRbQYa6XZ3dYjQ4

1.准备

获得信息

1. 32位文件

2.IDA打开

将main函数反编译为C语言代码

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // ebx
  int v4; // edi
  int v5; // esi

  return main_0(v3, v4, v5);
}

打开main_0函数

 __int64 __usercall main_0@<edx:eax>(int a1@<ebx>, int a2@<edi>, int a3@<esi>)
 {
   int v3; // eax
   const char *v4; // eax
   size_t v5; // eax
   int v6; // edx
   __int64 v7; // ST08_8
   signed int j; // [esp+DCh] [ebp-ACh]
   signed int i; // [esp+E8h] [ebp-A0h]
   signed int v11; // [esp+E8h] [ebp-A0h]
   char Dest[]; // [esp+F4h] [ebp-94h]
   char Str; // [esp+160h] [ebp-28h]
   char v14; // [esp+17Ch] [ebp-Ch]

   for ( i = ; i < ; ++i )
   {
     if ( (unsigned int)i >= 0x64 )
       j____report_rangecheckfailure(a1, a2, a3);
     Dest[i] = ;
   }
   sub_41132F("please enter the flag:");
   sub_411375("%20s", &Str);
   v3 = j_strlen(&Str);
   v4 = (const char *)sub_4110BE((int)&Str, v3, (int)&v14);
   strncpy(Dest, v4, 0x28u);
   v11 = j_strlen(Dest);
   for ( j = ; j < v11; ++j )
     Dest[j] += j;
   v5 = j_strlen(Dest);
   if ( !strncmp(Dest, Str2, v5) )
     sub_41132F("rigth flag!\n");
   else
     sub_41132F("wrong flag!\n");
   HIDWORD(v7) = v6;
   LODWORD(v7) = ;
   return v7;
 }

2.1代码分析

第24行代码，第27~28行代码在对Dest进行一些列变换

从第30行代码分析得到，Str2中存储的就是flag变换过后的字符串，打开Str2

.data:0041A034 ; char Str2[]
.data:0041A034 Str2            db 'e3nifIH9b_C@n@dH', ; DATA XREF: _main_0+142↑o

因此，我们只需要将Str2反向变换即可得到flag。

第27~28行代码的变换没有难度，再来看看第24行代码的函数。

 void *__cdecl sub_411AB0(char *a1, unsigned int a2, int *a3)
 {
   int v4; // STE0_4
   int v5; // STE0_4
   int v6; // STE0_4
   int v7; // [esp+D4h] [ebp-38h]
   signed int i; // [esp+E0h] [ebp-2Ch]
   unsigned int v9; // [esp+ECh] [ebp-20h]
   int v10; // [esp+ECh] [ebp-20h]
   signed int v11; // [esp+ECh] [ebp-20h]
   void *Dst; // [esp+F8h] [ebp-14h]
   char *v13; // [esp+104h] [ebp-8h]

   if ( !a1 || !a2 )
     return ;
   v9 = a2 / ;
   if ( (signed int)(a2 / ) %  )
     ++v9;
   v10 =  * v9;
   *a3 = v10;
   Dst = malloc(v10 + );
   if ( !Dst )
     return ;
   j_memset(Dst, , v10 + );
   v13 = a1;
   v11 = a2;
   v7 = ;
   while ( v11 >  )
   {
     byte_41A144[] = ;
     byte_41A144[] = ;
     byte_41A144[] = ;
     for ( i = ; i <  && v11 >= ; ++i )
     {
       byte_41A144[i] = *v13;
       --v11;
       ++v13;
     }
     if ( !i )
       break;
     switch ( i )
     {
       case :
         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];
         v4 = v7 + ;
         *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];
         *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[];
         *((_BYTE *)Dst + v4) = aAbcdefghijklmn[];
         v7 = v4 + ;
         break;
       case :
         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];
         v5 = v7 + ;
         *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];
         *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[] & 0xC0) >> ) |  * (byte_41A144[] & 0xF)];
         *((_BYTE *)Dst + v5) = aAbcdefghijklmn[];
         v7 = v5 + ;
         break;
       case :
         *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(signed int)(unsigned __int8)byte_41A144[] >> ];
         v6 = v7 + ;
         *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[] & 0xF0) >> ) |  * (byte_41A144[] & )];
         *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[] & 0xC0) >> ) |  * (byte_41A144[] & 0xF)];
         *((_BYTE *)Dst + v6) = aAbcdefghijklmn[byte_41A144[] & 0x3F];
         v7 = v6 + ;
         break;
     }
   }
   *((_BYTE *)Dst + v7) = ;
   return Dst;
 }

在代码的下部分，可以看到Dst会经过aAbcdefghijklmn[]数组的变换，打开此处

.rdata:00417B30 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='
.rdata:00417B30                                         ; DATA XREF: .text:004117E8↑o
.rdata:00417B30                                         ; .text:↑o ...
.rdata:00417B30                 db
.rdata:00417B72                 align 

从'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='可以看出，这个函数应该是base64的加密函数，因此只需要解密即可。

3.脚本获取flag

import base64

str1 = 'e3nifIH9b_C@n@dH'
x = ''
flag = ''

for j in range(0, len(str1)):
    x += chr(ord(str1[j]) - j)

flag = base64.b64decode(x)
flag = flag.decode('ASCII')
print(flag)

4.get flag！

flag{i_l0ve_you}