攻防世界 reverse BabyXor

BabyXor     2019_UNCTF

查壳

脱壳

dump

脱壳后

IDA静态分析

int main_0()
{
  void *v0; // eax
  int v1; // ST5C_4
  char *v2; // ST6C_4
  const char *v3; // ST68_4
  void *v4; // ST64_4
  size_t v5; // eax
  char *v6; // ST60_4

  v0 = (void *)sub_4010B4((int)&unk_4395F0, "世界上最简单的Xor");
  sub_40107D(v0, (int)sub_40102D);
  if ( --stru_436270._cnt < 0 )
  {
    _filbuf(&stru_436270);
  }
  else
  {
    v1 = (unsigned __int8)*stru_436270._ptr;
    ++stru_436270._ptr;
  }
  v2 = first_xor_40108C((int)dword_435DC0, 56); //   for ( i = 0; i < (signed int)(a2 >> 2); ++i )
                                                //     sprintf(&v3[i], "%c", i ^ *(_DWORD *)(a1 + 4 * i));
                                                //   return v3;
                                                //
                                                //
  v3 = second_xor_401041((int)dword_435DC0, (int)dword_435DF8, 56u);//   sprintf(v5, "%c", *(_DWORD *)a2);
                                                //   for ( i = 1; i < (signed int)(a3 >> 2); ++i )
                                                //     sprintf(&v5[i], "%c", *(_DWORD *)(a1 + 4 * i) ^ *(_DWORD *)(a2 + 4 * i) ^ *(_DWORD *)(a1 + 4 * i - 4));
                                                //   return v5;
                                                //
                                                //
  v4 = malloc(0x64u);
  v5 = strlen(v3);
  memcpy(v4, v3, v5);
  v6 = third_xor_4010C3((int)dword_435DC0, (int)v3, (int)dword_435E30, 56);//  v7 = (char *)malloc(a4 - 1);
                                                //   v6 = (char *)malloc(4 * a4 - 1);
                                                //   for ( i = 0; i < (signed int)((a4 >> 2) - 1); ++i )
                                                //   {
                                                //     sprintf(&v6[i], "%c", *(_DWORD *)(a3 + 4 * i + 4) ^ *(char *)(i + a2));
                                                //     sprintf(&v7[i], "%c", i ^ v6[i]);
                                                //   }
                                                //   sprintf(&byte_439558, "%c", dword_435E30[0] ^ dword_435DF8[0]);
                                                //   strcat(&byte_439558, v7);
                                                //   return &byte_439558;
                                                //
                                                //
  sub_40101E((int)v2, (int)v3, (int)v6);
  return 0;
}

动态调试

在401712处下断就可得到flag

wp：

#!/usr/bin/python
dword_435DC0=[102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
dword_435DF8=[55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
dword_435E30=[26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
temp=[]
flag=''
for i in range(14):
    flag+=chr(dword_435DC0[i]^i)

flag+=chr(dword_435DF8[0])
temp.append(dword_435DF8[0])
for i in range(1,14):
    x=dword_435DC0[i]^dword_435DF8[i]^dword_435DC0[i-1]
    flag+=chr(x)
    temp.append(x)

x=''
for i in range(13):
    x+=chr(dword_435E30[i+1]^(temp[i])^i)
flag+=chr(dword_435E30[0] ^ dword_435DF8[0])+x
print(flag)

flag{2378b077-7d6e-4564-bdca-7eec8eede9a2}