攻防世界 Replace Reverse二星题

解题过程中，虽然解出来了，但是磕磕绊绊犯了一些错误，记录一下

---

分析过程

PE查壳

有一个upx壳，最下面给了脱壳提示： upx.exe -d Replace.exe

脱壳结束，丢到IDA里，SHIF+F12，查看字符串，看到一个可疑的”Well Done!\n“，点进去看看，发现就是主函数，反汇编主函数

• Buffer很明显是输入，且长度要<=37
• 判断函数==1就成功，显然这就是关键

sub_401090函数（改了一点名称）

 1 // 最后要输出1
 2 // a1是输入，a2是输入的长度且为35
 3 int __fastcall sub_401090(int a1, int a2)
 4 {
 5   int v4; // edx
 6   char char_v5; // al
 7   int high4; // esi
 8   int low4; // edi
 9   char char_v8; // al
10   int v9; // eax
11   char char_v10; // cl
12   int v11; // eax
13   int v12; // ecx
14
15   if ( a2 != 35 )
16     return -1;
17   v4 = 0;
18   while ( 1 )
19   {
20     char_v5 = *(_BYTE *)(v4 + a1);
21     high4 = (char_v5 >> 4) % 16;                // 先右移4位，相当于把原来8位的高4位数移动到低4位，新高4位全都置零——再%16，相当于取出变换后新8位的低4位——也就是取出原来数的高4位
22     low4 = ((16 * char_v5) >> 4) % 16;          // 先*16，相当于左移4位，原来的低4位移动到高4位，新的低4位置零——再右移4位，相当于移回来了，不过高4位都是0——再%16，取出低4位——原就是取出原来数的低4位
23     char_v8 = byte_402150[2 * v4];
24     if ( char_v8 < 48 || char_v8 > 57 )
25       v9 = char_v8 - 87;
26     else
27       v9 = char_v8 - 48;
28     char_v10 = byte_402151[2 * v4];
29     v11 = 16 * v9;                              // v9*16，相当于左移4位————为后面组成新的8位做准备，作为新数的高4位
30     if ( char_v10 < 48 || char_v10 > 57 )
31       v12 = char_v10 - 87;
32     else
33       v12 = char_v10 - 48;                      // 作为新数的低4位
34     if ( (unsigned __int8)byte_4021A0[16 * high4 + low4] != ((v11 + v12) ^ 25) )// 16 * high4 + low4——操作的目的是组成新的8位数——其实就是原来输入的数
35                                                 // ((v11 + v12) ^ 25)——将上面获得v11与v12组成新的数，与25异或
36                                                 // 最后进行比较，相等才能return 1
37       break;
38     if ( ++v4 >= 35 )
39       return 1;
40   }
41   return -1;
42 }

总而言之，从byte_402150取一个元素作为char_v8，变换后获得组成高位的v11；从byte_402151取一个元素作为char_v10，变换后获得组成低位的v12，最后组成一个新的数去异或

【异或后得到的值】要与 【将输入作为下标，从byte_4021A0中取出的数】 相等

byte_402150与byte_402151

！！在这里我就犯了一个错误，我还以为是我IDA又出现问题了....byte_402150数组的32h后面没有 0 表示结束，所以要继续往下读取，一直到出现 0 ，即byte_402150是50+byte_402151

unsigned char ida_chars[] =
{
   50，97,  52,  57, 102,  54,  57,  99,  51,  56,  51,
   57,  53,  99, 100, 101,  57,  54, 100,  54, 100,
  101,  57,  54, 100,  54, 102,  52, 101,  48,  50,
   53,  52,  56,  52,  57,  53,  52, 100,  54,  49,
   57,  53,  52,  52,  56, 100, 101, 102,  54, 101,
   50, 100,  97, 100,  54,  55,  55,  56,  54, 101,
   50,  49, 100,  53,  97, 100,  97, 101,  54,   0,
    0,   0,   0,   0,   0,   0,   0,   0,   0
};
unsigned char ida_chars[] =
{
   97,  52,  57, 102,  54,  57,  99,  51,  56,  51,
   57,  53,  99, 100, 101,  57,  54, 100,  54, 100,
  101,  57,  54, 100,  54, 102,  52, 101,  48,  50,
   53,  52,  56,  52,  57,  53,  52, 100,  54,  49,
   57,  53,  52,  52,  56, 100, 101, 102,  54, 101,
   50, 100,  97, 100,  54,  55,  55,  56,  54, 101,
   50,  49, 100,  53,  97, 100,  97, 101,  54,   0,
    0,   0,   0,   0,   0,   0,   0,   0,   0
};

byte_4021A0

选中全部，SHIF+E-->选中‘C unsigned char array (decimal)’，得到数组的值（上面也是这么得到的）

unsigned char ida_chars[] =
{
   99, 124, 119, 123, 242, 107, 111, 197,  48,   1,
  103,  43, 254, 215, 171, 118, 202, 130, 201, 125,
  250,  89,  71, 240, 173, 212, 162, 175, 156, 164,
  114, 192, 183, 253, 147,  38,  54,  63, 247, 204,
   52, 165, 229, 241, 113, 216,  49,  21,   4, 199,
   35, 195,  24, 150,   5, 154,   7,  18, 128, 226,
  235,  39, 178, 117,   9, 131,  44,  26,  27, 110,
   90, 160,  82,  59, 214, 179,  41, 227,  47, 132,
   83, 209,   0, 237,  32, 252, 177,  91, 106, 203,
  190,  57,  74,  76,  88, 207, 208, 239, 170, 251,
   67,  77,  51, 133,  69, 249,   2, 127,  80,  60,
  159, 168,  81, 163,  64, 143, 146, 157,  56, 245,
  188, 182, 218,  33,  16, 255, 243, 210, 205,  12,
   19, 236,  95, 151,  68,  23, 196, 167, 126,  61,
  100,  93,  25, 115,  96, 129,  79, 220,  34,  42,
  144, 136,  70, 238, 184,  20, 222,  94,  11, 219,
  224,  50,  58,  10,  73,   6,  36,  92, 194, 211,
  172,  98, 145, 149, 228, 121, 231, 200,  55, 109,
  141, 213,  78, 169, 108,  86, 244, 234, 101, 122,
  174,   8, 186, 120,  37,  46,  28, 166, 180, 198,
  232, 221, 116,  31,  75, 189, 139, 138, 112,  62,
  181, 102,  72,   3, 246,  14,  97,  53,  87, 185,
  134, 193,  29, 158, 225, 248, 152,  17, 105, 217,
  142, 148, 155,  30, 135, 233, 206,  85,  40, 223,
  140, 161, 137,  13, 191, 230,  66, 104,  65, 153,
   45,  15, 176,  84, 187,  22
};

解题脚本（自己写的常规版本）

 1 key1=[
 2     50,97,  52,  57, 102,  54,  57,  99,  51,  56,  51,
 3    57,  53,  99, 100, 101,  57,  54, 100,  54, 100,
 4   101,  57,  54, 100,  54, 102,  52, 101,  48,  50,
 5    53,  52,  56,  52,  57,  53,  52, 100,  54,  49,
 6    57,  53,  52,  52,  56, 100, 101, 102,  54, 101,
 7    50, 100,  97, 100,  54,  55,  55,  56,  54, 101,
 8    50,  49, 100,  53,  97, 100,  97, 101,  54
 9 ]
10 key2=[
11 97,  52,  57, 102,  54,  57,  99,  51,  56,  51,
12    57,  53,  99, 100, 101,  57,  54, 100,  54, 100,
13   101,  57,  54, 100,  54, 102,  52, 101,  48,  50,
14    53,  52,  56,  52,  57,  53,  52, 100,  54,  49,
15    57,  53,  52,  52,  56, 100, 101, 102,  54, 101,
16    50, 100,  97, 100,  54,  55,  55,  56,  54, 101,
17    50,  49, 100,  53,  97, 100,  97, 101,  54
18 ]
19 str=[
20 99, 124, 119, 123, 242, 107, 111, 197,  48,   1,
21   103,  43, 254, 215, 171, 118, 202, 130, 201, 125,
22   250,  89,  71, 240, 173, 212, 162, 175, 156, 164,
23   114, 192, 183, 253, 147,  38,  54,  63, 247, 204,
24    52, 165, 229, 241, 113, 216,  49,  21,   4, 199,
25    35, 195,  24, 150,   5, 154,   7,  18, 128, 226,
26   235,  39, 178, 117,   9, 131,  44,  26,  27, 110,
27    90, 160,  82,  59, 214, 179,  41, 227,  47, 132,
28    83, 209,   0, 237,  32, 252, 177,  91, 106, 203,
29   190,  57,  74,  76,  88, 207, 208, 239, 170, 251,
30    67,  77,  51, 133,  69, 249,   2, 127,  80,  60,
31   159, 168,  81, 163,  64, 143, 146, 157,  56, 245,
32   188, 182, 218,  33,  16, 255, 243, 210, 205,  12,
33    19, 236,  95, 151,  68,  23, 196, 167, 126,  61,
34   100,  93,  25, 115,  96, 129,  79, 220,  34,  42,
35   144, 136,  70, 238, 184,  20, 222,  94,  11, 219,
36   224,  50,  58,  10,  73,   6,  36,  92, 194, 211,
37   172,  98, 145, 149, 228, 121, 231, 200,  55, 109,
38   141, 213,  78, 169, 108,  86, 244, 234, 101, 122,
39   174,   8, 186, 120,  37,  46,  28, 166, 180, 198,
40   232, 221, 116,  31,  75, 189, 139, 138, 112,  62,
41   181, 102,  72,   3, 246,  14,  97,  53,  87, 185,
42   134, 193,  29, 158, 225, 248, 152,  17, 105, 217,
43   142, 148, 155,  30, 135, 233, 206,  85,  40, 223,
44   140, 161, 137,  13, 191, 230,  66, 104,  65, 153,
45    45,  15, 176,  84, 187,  22
46 ]
47 flag = ""
48 for i in range(35):
49     v8 = key1[2*i]
50     if v8 < 48 or v8 > 57:
51         v11 = 16 * (v8 - 87)
52     else:
53         v11 = 16 * (v8 - 48)
54     v10 = key2[2 * i]
55     if v10 < 48 or v10 > 57:
56         v12 = v10 - 87
57     else:
58         v12 = v10 - 48
59     v4=((v11 + v12) ^ 25)
60     flag += chr(str.index(v4))
61
62 print(flag)

这里我犯了一个弱智错误

• 最初写脚本的时候，想照着反汇编代码的思路去写，在后面写了一个 for j in range(len(str_data)): if str[i]==((v11 + v12) ^ 25):v4=((v11 + v12) ^ 25)
• 结果导致运行没有报错，也没有结果

• str[i]==((v11 + v12) ^ 25)这一行代码在每次循环中都会遍历str列表来查找是否存在相等的值，这会导致程序在执行时花费很长时间，因为它的时间复杂度是 O(n)，其中 n 是str列表的长度。由于列表长度非常大，因此这种线性搜索的方法会非常慢，尤其是在内层循环中还嵌套了一个循环。这也解释了为什么代码没有输出也没有报错，因为它可能需要很长时间才能完成运行

解题脚本（枚举正向爆破）

这个版本是我参考别的大佬的wp时候学到的，记录一下

由于用了取余 % 运算，所以采用枚举正向爆破的方法，让flag中的每一个字符遍历常用的字符（ascii码表中32-126），带入加密算法，如果成功，就把这个flag存入

list1=[50, 97, 52, 57, 102, 54, 57, 99, 51, 56, 51, 57, 53, 99, 100, 101, 57, 54, 100, 54, 100, 101, 57, 54, 100, 54, 102, 52, 101, 48, 50, 53, 52, 56, 52, 57, 53, 52, 100, 54, 49, 57, 53, 52, 52, 56, 100, 101, 102, 54, 101, 50, 100, 97, 100, 54, 55, 55, 56, 54, 101, 50, 49, 100, 53, 97, 100, 97, 101, 54]
list2=[97, 52, 57, 102, 54, 57, 99, 51, 56, 51, 57, 53, 99, 100, 101, 57, 54, 100, 54, 100, 101, 57, 54, 100, 54, 102, 52, 101, 48, 50, 53, 52, 56, 52, 57, 53, 52, 100, 54, 49, 57, 53, 52, 52, 56, 100, 101, 102, 54, 101, 50, 100, 97, 100, 54, 55, 55, 56, 54, 101, 50, 49, 100, 53, 97, 100, 97, 101, 54]
list3=[99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156, 164, 114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241, 113, 216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226, 235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214, 179, 41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203, 190, 57, 74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69, 249, 2, 127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245, 188, 182, 218, 33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68, 23, 196, 167, 126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42, 144, 136, 70, 238, 184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36, 92, 194, 211, 172, 98, 145, 149, 228, 121, 231, 200, 55, 109, 141, 213, 78, 169, 108, 86, 244, 234, 101, 122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198, 232, 221, 116, 31, 75, 189, 139, 138, 112, 62, 181, 102, 72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158, 225, 248, 152, 17, 105, 217, 142, 148, 155, 30, 135, 233, 206, 85, 40, 223, 140, 161, 137, 13, 191, 230, 66, 104, 65, 153, 45, 15, 176, 84, 187, 22, 72, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
v4=0
flag=""
for i in range(35):
    v8=list1[2*i]
    if v8 < 48 or v8 > 57:
        v9=v8 - 87
    else:
        v9=v8 - 48
    v10=list2[2*i]
    v11=16*v9
    if v10 <48 or v10 > 57:
        v12=v10-87
    else:
        v12=v10-48
    v4=((v11+v12)^25)
    for a in range(32,127):
        v5=a
        v6=(v5>>4)%16
        v7=((16*v5)>>4)%16
        if list3[16*v6+v7] == v4:
            flag+=chr(a)
print(flag)

flag

flag{Th1s_1s_Simple_Rep1ac3_Enc0d3}