攻防世界--IgniteMe

测试文件：https://adworld.xctf.org.cn/media/task/attachments/fac4d1290e604fdfacbbe06fd1a5ca39.exe

1.准备

获取信息：

• 32位文件

2.IDA打开

打开main函数

 int __cdecl main(int argc, const char **argv, const char **envp)
 {
   void *v3; // eax
   int v4; // edx
   void *v5; // eax
   int result; // eax
   void *v7; // eax
   void *v8; // eax
   void *v9; // eax
   size_t i; // [esp+4Ch] [ebp-8Ch]
   char v11[]; // [esp+50h] [ebp-88h]
   char v12[]; // [esp+58h] [ebp-80h]
   char v13; // [esp+74h] [ebp-64h]

   v3 = (void *)sub_402B30(&unk_446360, "Give me your flag:");// 这两段代码直接理解成printf即可。下面的代码同样如此
   sub_4013F0(v3, (int (__cdecl *)(void *))sub_403670);
   sub_401440((int)&dword_4463F0, v4, (int)v12, );
   if ( strlen(v12) <  && strlen(v12) >  )
   {
     strcpy(v11, "EIS{");
     for ( i = ; i < strlen(v11); ++i )
     {
       if ( v12[i] != v11[i] )                   // flag前四位为"ESI{"
       {
         v7 = (void *)sub_402B30(&unk_446360, "Sorry, keep trying! ");
         sub_4013F0(v7, (int (__cdecl *)(void *))sub_403670);
         return ;
       }
     }
     if ( v13 ==  )
     {
       if ( sub_4011C0(v12) )
         v9 = (void *)sub_402B30(&unk_446360, "Congratulations! ");
       else
         v9 = (void *)sub_402B30(&unk_446360, "Sorry, keep trying! ");
       sub_4013F0(v9, (int (__cdecl *)(void *))sub_403670);
       result = ;
     }
     else
     {
       v8 = (void *)sub_402B30(&unk_446360, "Sorry, keep trying! ");
       sub_4013F0(v8, (int (__cdecl *)(void *))sub_403670);
       result = ;
     }
   }
   else
   {
     v5 = (void *)sub_402B30(&unk_446360, "Sorry, keep trying!");
     sub_4013F0(v5, (int (__cdecl *)(void *))sub_403670);
     result = ;
   }
   return result;
 }

3.代码分析

看到第32行代码

if ( sub_4011C0(v12) )
    v9 = (void *)sub_402B30(&unk_446360, "Congratulations! ");

这里通过sub_4011C0(v12)传入输入的flag来判断真假，打开函数

 bool __cdecl sub_4011C0(char *a1)
 {
   size_t v2; // eax
   signed int v3; // [esp+50h] [ebp-B0h]
   char v4[]; // [esp+54h] [ebp-ACh]
   int v5; // [esp+74h] [ebp-8Ch]
   int v6; // [esp+78h] [ebp-88h]
   size_t i; // [esp+7Ch] [ebp-84h]
   char v8[]; // [esp+80h] [ebp-80h]

   if ( strlen(a1) <=  )
     return ;
   i = ;
   v6 = ;
   while ( i < strlen(a1) -  )
     v8[v6++] = a1[i++];
   v8[v6] = ;
   v5 = ;
   v3 = ;
   memset(v4, , 0x20u);
   for ( i = ; ; ++i )
   {
     v2 = strlen(v8);
     if ( i >= v2 )
       break;
     if ( v8[i] >=  && v8[i] <=  )
     {
       v8[i] -= ;
       v3 = ;
     }
     if ( !v3 && v8[i] >=  && v8[i] <=  )
       v8[i] += ;
     v4[i] = byte_4420B0[i] ^ sub_4013C0(v8[i]);
     v3 = ;
   }
   return strcmp("GONDPHyGjPEKruv{{pj]X@rF", v4) == ;
 }

这里i是从4开始即flag的第四位开始，对flag的操作分为了两部分：

1. 第26行代码~第32行代码，将flag中的大写字母转小写，小写字母转大写。
2. 第33行代码对每位字符进行异或操作。

第一步不必多说，第二步byte_4420B0数组从文件中提取出来

0D       1D  0C   2F  2B  1F
1E   0F      0A 2F 1E 1A 2D 0C  

sub_4013C0(v8[i])函数为

int __cdecl sub_4013C0(int a1)
{
  return (a1 ^ 0x55) + ;
}

最后得到的字符串V4为

GONDPHyGjPEKruv{{pj]X@rF

因此我们只需要逆向操作还原flag即可

4.脚本获取

n = 28
val1 = [0x0D,0x13,0x17,0x11,0x02,0x01,0x20,0x1D,0x0C,0x02,0x19,0x2F,0x17,0x2B,
        0x24,0x1F,0x1E,0x16,0x09,0x0F,0x15,0x27,0x13,0x26,0x0A,0x2F,0x1E,0x1A,
        0x2D,0x0C,0x22,0x04]
v4 = "GONDPHyGjPEKruv{{pj]X@rF"
v8 = ""
flag = ""

for i in range(len(v4)):
    v8 += chr(((ord(v4[i]) ^ val1[i]) - 72) ^ 0x55)

for i in range(len(v8)):
    if ord(v8[i]) >= 97 and ord(v8[i]) <= 122:
        flag += chr(ord(v8[i]) - 32)
    elif ord(v8[i]) >= 65 and ord(v8[i]) <= 90:
        flag += chr(ord(v8[i]) + 32)
    else:
        flag += v8[i]

print('EIS{'+flag+'}')

5.get flag！

EIS{wadx_tdgk_aihc_ihkn_pjlm}