BUUCTF--SimpleRev

测试文件：https://buuoj.cn/files/7458c5c0ce999ac491df13cf7a7ed9f1/SimpleRev?token=eyJ0ZWFtX2lkIjpudWxsLCJ1c2VyX2lkIjoxOTAzLCJmaWxlX2lkIjoyNDN9.XXnIgg.L-8ifBkOTka-7o-QXZDkKNm77x4

1.准备

获取信息

1. 64位文件

2.IDA打开

将main函数反编译为C代码

 int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
 {
   int v3; // eax
   char v4; // [rsp+Fh] [rbp-1h]

   while (  )
   {
     while (  )
     {
       printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv, envp);
       v4 = getchar();
       if ( v4 != 'd' && v4 != 'D' )
         break;
       Decry();
     }
     if ( v4 == 'q' || v4 == 'Q' )
       Exit();
     puts("Input fault format!");
     v3 = getchar();
     putchar(v3);
   }
 }

3.代码分析

很明显，这道题的关键在于Decry()

 unsigned __int64 Decry()
 {
   char v1; // [rsp+Fh] [rbp-51h]
   int v2; // [rsp+10h] [rbp-50h]
   int v3; // [rsp+14h] [rbp-4Ch]
   int i; // [rsp+18h] [rbp-48h]
   int v5; // [rsp+1Ch] [rbp-44h]
   char src[]; // [rsp+20h] [rbp-40h]
   __int64 v7; // [rsp+28h] [rbp-38h]
   int v8; // [rsp+30h] [rbp-30h]
   __int64 v9; // [rsp+40h] [rbp-20h]
   __int64 v10; // [rsp+48h] [rbp-18h]
   int v11; // [rsp+50h] [rbp-10h]
   unsigned __int64 v12; // [rsp+58h] [rbp-8h]

   v12 = __readfsqword(0x28u);
   *(_QWORD *)src = 'SLCDN';
   v7 = 0LL;
   v8 = ;
   v9 = 'wodah';
   v10 = 0LL;
   v11 = ;
   text = join(key3, (const char *)&v9);         // text = 'killshadow'
   strcpy(key, key1);
   strcat(key, src);                             // key = 'ADSFKNDCLS'
   v2 = ;
   v3 = ;
   getchar();
   v5 = strlen(key);                             // v5 = 10
   for ( i = ; i < v5; ++i )
   {
     if ( key[v3 % v5] >  && key[v3 % v5] <=  )// key = 'adsfkndcls'
       key[i] = key[v3 % v5] + ;
     ++v3;
   }
   printf("Please input your flag:", src);
   while (  )
   {
     v1 = getchar();
     if ( v1 ==  )
       break;
     if ( v1 ==  )
     {
       ++v2;
     }
     else
     {
       if ( v1 <=  || v1 >  )
       {
         if ( v1 >  && v1 <=  )              // 大写字母
           str2[v2] = (v1 -  - key[v3++ % v5] + ) %  + ;
       }
       else                                      // 小写字母
       {
         str2[v2] = (v1 -  - key[v3++ % v5] + ) %  + ;
       }
       if ( !(v3 % v5) )
         putchar(' ');
       ++v2;
     }
   }
   if ( !strcmp(text, str2) )
     puts("Congratulation!\n");
   else
     puts("Try again!\n");
   return __readfsqword(0x28u) ^ v12;
 }

转换成可以运行的C代码是

 #include <bits/stdc++.h>

 #pragma warning(disable:4996)

 int main(void)
 {
     int i, j, n = , v5 = , v3 = , v2 = ;
     char v1;
     char flag[] = {  };
     char str2[] = {  };
     char key[] = "ADSFKNDCLS";
     char text[] = "killshadow";

     for (i = ; i < v5; ++i)
     {
         if (key[v3 % v5] >  && key[v3 % v5] <= )
             key[i] = key[v3 % v5] + ;
         ++v3;
     }
     printf("Please input your flag:");
     while ()
     {
         v1 = getchar();
         printf("v1:%c\nv2:%d\n\n", v1, v2);
         if (v1 == ) {
             printf("进入1\n");
             break;
         }
         if (v1 == )
         {
             printf("进入2\n");
             ++v2;
         }
         else
         {
             if (v1 <=  || v1 > )
             {
                 if (v1 >  && v1 <= ) {
                     str2[v2] = (v1 -  - key[v3++ % v5] + ) %  + ;
                     printf("计算1\n");
                 }
             }
             else
             {
                 str2[v2] = (v1 -  - key[v3++ % v5] + ) %  + ;
                 printf("计算1\n");
             }
             if (!(v3 % v5))
                 putchar(' ');
             ++v2;
         }
     }
     if (!strcmp(text, str2))
         puts("Congratulation!\n");
     else {
         printf("str2:%s\n", str2);
         puts("Try again!\n");
     }

     system("PAUSE");
     return ;
 }

第30~35行代码的实际作用是将大写字母转换为小写。

第37~61行代码实际上就是遍历输入的字符（flag），进行str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;运算，最后与text比较。

因此我们只要反向就能求出输入的v1

4.程序获取flag

#include <bits/stdc++.h>

#pragma warning(disable:4996)

int main(void)
{
    int i, j, n = , v5 = , v3 = , v2 = ;
    char v1;
    char flag[] = {  };
    char str2[] = {  };
    char key[] = "ADSFKNDCLS";
    char text[] = "killshadow";

    for (i = ; i < v5; ++i)
    {
        if (key[v3 % v5] >  && key[v3 % v5] <= )
            key[i] = key[v3 % v5] + ;
        ++v3;
    }
    for (j = ; j < ; ++j) {
        for (v2 = ; v2 < ; ++v2) {
            v1 = text[v2] -  +  * j -  + key[v3++ % v5] + ;
            if ((v1 >=  && v1 <= ) || (v1 >=  && v1 <= )) {
                flag[v2] = v1;
                if (++n == ) {
                    printf("%s\n", flag);
                    system("PAUSE");
                    return ;
                }
            }
        }
    }

    system("PAUSE");
    return ;
}

5.get flag！

flag{KLDQCUDFZO}