[攻防世界][Reverse]xxxorrr

将目标文件拖入IDA

反汇编main函数

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int i; // [rsp+Ch] [rbp-34h]
  char s[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v6; // [rsp+38h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  sub_A90((void (__fastcall *)(void *))sub_916);
  fgets(s, 35, stdin);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= s[i];
  return 0LL;
}

这里有一个sub_A90和sub_916，怀疑是main执行完后的回调，看一下sub_916

unsigned __int64 sub_916()
{
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = __readfsqword(0x28u);
  if ( !strcmp(s1, s2) )
    puts("Congratulations!");
  else
    puts("Wrong!");
  return __readfsqword(0x28u) ^ v1;
}

从这里可以看出确实是；这里有在对比 s1 和 s2, 二者一样就ok

从main中可以看出s1对输入的字符串做了一个异或操作，那就是异或后再比较

找到s1 和 s2对应的字符串的值

    s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn'
    s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,
          0x17, 0x46, 0x54,
          0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,
          0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,
          0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00]

发现sub_84A也有去操作s1，应该是在main函数执行之前执行的

unsigned __int64 sub_84A()
{
  int i; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= 2 * i + 65;
  return __readfsqword(0x28u) ^ v2;
}

可以反推出执行后的值，反推python代码为

def decode():
    s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn'
    s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,
          0x17, 0x46, 0x54,
          0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,
          0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,
          0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE, 0x00]

    t_s1 = []
    for i in range(33):
        t_s1.append(ord(s1[i]) ^ (2*i + 65))

    for j in range(33):
        t_val = t_s1[j] ^ s2[j]
        print(chr(t_val), end="")
    print("====")

    flag = ''
    for x in range(33):
        flag += chr(ord(s1[x])^ (2 * x + 65)^s2[x])

    print(flag)

if __name__ == '__main__':
    print('hello')
    decode()

得到 flag{c0n5truct0r5_functi0n_in_41f}