攻防世界 reverse EasyRE

EasyRE

主函数

int sub_401080()
{
  unsigned int lens; // kr00_4
  signed int i; // edx
  char *v2; // esi
  char v3; // al
  unsigned int j; // edx
  int v5; // eax
  __int128 myinput; // [esp+2h] [ebp-24h]
  __int64 v8; // [esp+12h] [ebp-14h]
  int v9; // [esp+1Ah] [ebp-Ch]
  __int16 v10; // [esp+1Eh] [ebp-8h]

  printf_401020((int)"input：");
  v9 = 0;
  v10 = 0;
  myinput = 0i64;
  v8 = 0i64;
  scanf_401050("%s", &myinput);
  lens = strlen((const char *)&myinput);
  if ( lens >= 0x10 && lens == 24 )             // 24位
  {
    i = 0;
    v2 = (char *)&v8 + 7;                       // 反汇编错误，其实是指向输入的字符串的最后一字符。
    do
    {
      v3 = *v2--;
      byte_40336C[i++] = v3;
    }
    while ( i < 24 );
    j = 0;
    do
    {
      byte_40336C[j] = (byte_40336C[j] + 1) ^ 6;// 倒序的输入字符，进行+1，再异或6。
      ++j;
    }
    while ( j < 0x18 );
    v5 = strcmp(byte_40336C, "xIrCj~<r|2tWsv3PtI\x7Fzndka");// 关键比较。
                                                // 还原输入，先-1，再异或6，然后逆序。完成。
    if ( v5 )
      v5 = -(v5 < 0) | 1;
    if ( !v5 )
    {
      printf_401020((int)"right\n");
      system("pause");
    }
  }
  return 0;
}

wp:

data=[ 0x78, 0x49, 0x72, 0x43, 0x6A, 0x7E, 0x3C, 0x72, 0x7C, 0x32,
  0x74, 0x57, 0x73, 0x76, 0x33, 0x50, 0x74, 0x49, 0x7F, 0x7A,
  0x6E, 0x64, 0x6B, 0x61]

for i in range(24):
    data[i]=chr((data[i]^6)-1)
print(''.join(data)[::-1])

flag{xNqU4otPq3ys9wkDsN}