攻防世界 reverse 666

666  2019_UNCTF

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char myen; // [rsp+0h] [rbp-1E0h]
  char myinput; // [rsp+F0h] [rbp-F0h]

  memset(&myen, 0, 0x1EuLL);
  printf("Please Input Key: ", 0LL);
  __isoc99_scanf("%s", &myinput);
  encode(&myinput, &myen);
  if ( strlen(&myinput) == key )
  {
    if ( !strcmp(&myen, enflag) )
      puts("You are Right");
    else
      puts("flag{This_1s_f4cker_flag}");
  }
  return 0;
}

关键函数

int __fastcall encode(const char *myinput, char *myen)
{
  char v3[32]; // [rsp+10h] [rbp-70h]
  char v4[32]; // [rsp+30h] [rbp-50h]
  char v5[40]; // [rsp+50h] [rbp-30h]
  int v6; // [rsp+78h] [rbp-8h]
  int i; // [rsp+7Ch] [rbp-4h]

  i = 0;
  v6 = 0;
  if ( strlen(myinput) != key )                 // 18位
    return puts("Your Length is Wrong");
  for ( i = 0; i < key; i += 3 )
  {
    v5[i] = key ^ (myinput[i] + 6);
    v4[i + 1] = (myinput[i + 1] - 6) ^ key;
    v3[i + 2] = myinput[i + 2] ^ 6 ^ key;
    myen[i] = v5[i];
    myen[i + 1] = v4[i + 1];
    myen[i + 2] = v3[i + 2];
  }
  return (signed int)myen;
}

wp:

#!/usr/bin/python
enflag=[105, 122, 119, 104, 114, 111, 122, 34, 34, 119,
  34, 118, 46, 75, 34, 46, 78, 105, 0]
flag=''
for i in range(0,18,3):
    flag+=chr((18^enflag[i])-6)
    flag+=chr((18^enflag[i+1])+6)
    flag+=chr(18^enflag[i+2]^6)
print(flag)

unctf{b66_6b6_66b}