【Reverse】每日必逆0x01

附件：https://files.buuoj.cn/files/7458c5c0ce999ac491df13cf7a7ed9f1/SimpleRev

题解

• 查壳
  
  

64位ELF文件，无壳

• IDApro处理，f5

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char v4; // [rsp+Fh] [rbp-1h]

  while ( 1 )
  {
    while ( 1 )
    {
      printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ");
      v4 = getchar();
      if ( v4 != 100 && v4 != 68 )
        break;
      Decry();
    }
    if ( v4 == 113 || v4 == 81 )
      Exit("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv);
    puts("Input fault format!");
    v3 = getchar();
    putchar(v3);
  }
}

分析代码，重点在Decry函数

• 跟进去，进行分析

unsigned __int64 Decry()
{
  char v1; // [rsp+Fh] [rbp-51h]
  int v2; // [rsp+10h] [rbp-50h]
  int v3; // [rsp+14h] [rbp-4Ch]
  int i; // [rsp+18h] [rbp-48h]
  int v5; // [rsp+1Ch] [rbp-44h]
  char src[8]; // [rsp+20h] [rbp-40h] BYREF
  __int64 v7; // [rsp+28h] [rbp-38h]
  int v8; // [rsp+30h] [rbp-30h]
  __int64 v9[2]; // [rsp+40h] [rbp-20h] BYREF
  int v10; // [rsp+50h] [rbp-10h]
  unsigned __int64 v11; // [rsp+58h] [rbp-8h]

  v11 = __readfsqword('(');
  *(_QWORD *)src = 'SLCDN';
  v7 = 0LL;
  v8 = 0;
  v9[0] = 'wodah';
  v9[1] = 0LL;
  v10 = 0;
  text = join(key3, (const char *)v9);          // text = "killshadow"
  strcpy(key, key1);
  strcat(key, src);
  v2 = 0;
  v3 = 0;
  getchar();
  v5 = strlen(key);//v5==>10
  for ( i = 0; i < v5; ++i )
  {
    if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )
      key[i] = key[v3 % v5] + 32;
    ++v3;
  }											//key = "ADSFKNDCLS" ==>"adsfkndcls"
  /*
  		将key中的大写字母转换为小写字母
   */
  printf("Please input your flag:");
  while ( 1 )
  {
    v1 = getchar();
    if ( v1 == 10 )  		//0x0a 结束输入
      break;
    if ( v1 == 32 )	 		//0x20 v2加1
    {
      ++v2;
    }
    else
    {
      if ( v1 <= 96 || v1 > 122 )
      {
        if ( v1 > 64 && v1 <= 90 )	//大写
        {
          str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;
          ++v3;
        }
      }
      else				// (97,122]  小写字母
      {
        str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97; //[65-90]
        ++v3;
      }
      					//对str2中的字母最后转换为小写
      if ( !(v3 % v5) )	//判断str2的长度是否是key的整数倍，整数倍就输出空格
        putchar(32);
      ++v2; 			//v2统计输入的字符个数、指向下一个字符位置
    }
  }
  if ( !strcmp(text, str2) )
    puts("Congratulation!\n");
  else
    puts("Try again!\n");
  return __readfsqword(0x28u) ^ v11;
}

• 分析结果
  
  读取输入的字符串(以回车符结束)》对每个字母进行处理(v1 - 39 - key[v3 % v5] + 97) % 26 + 97》和"killshadow"进行比较

• 逆向分析
  
  将整个流程反推即可

》payload

lt='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
key=list('ADSFKNDCLS'.lower())
klens=len(key)

text='killshadow'
flag=''
for i in range(len(text)):
    str2=text[i]
    for c in lt:
        if str2== chr((ord(c) - 39 - ord(key[i  % klens]) + 97) % 26 + 97):
            flag+=c
print('flag{'+flag+'}')

小结

个人代码分析能力比较弱，分析程序意图的能力还有待提高