buuctf-RE-SimpleRev

最新推荐文章于 2025-07-25 09:48:47 发布

原创最新推荐文章于 2025-07-25 09:48:47 发布 · 309 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#反编译 #python #tkinter #app #strcpy

本文详细解析了一个CTF游戏挑战中的关键函数Decry()，通过逆向工程揭示了其加密逻辑，并提供了完整的C语言实现来破解该加密算法，获取flag。

IDA 打开

将main函数反编译为C代码

1 int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
 2 {
 3   int v3; // eax
 4   char v4; // [rsp+Fh] [rbp-1h]
 5 
 6   while ( 1 )
 7   {
 8     while ( 1 )
 9     {
10       printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv, envp);
11       v4 = getchar();
12       if ( v4 != 'd' && v4 != 'D' )
13         break;
14       Decry();
15     }
16     if ( v4 == 'q' || v4 == 'Q' )
17       Exit();
18     puts("Input fault format!");
19     v3 = getchar();
20     putchar(v3);
21   }
22 }

代码分析

这道题的关键在于Decry()

1 unsigned __int64 Decry()
2 {
3 char v1; // [rsp+Fh] [rbp-51h]
4 int v2; // [rsp+10h] [rbp-50h]
5 int v3; // [rsp+14h] [rbp-4Ch]
6 int i; // [rsp+18h] [rbp-48h]
7 int v5; // [rsp+1Ch] [rbp-44h]
8 char src[8]; // [rsp+20h] [rbp-40h]
9 __int64 v7; // [rsp+28h] [rbp-38h]
10 int v8; // [rsp+30h] [rbp-30h]
11 __int64 v9; // [rsp+40h] [rbp-20h]
12 __int64 v10; // [rsp+48h] [rbp-18h]
13 int v11; // [rsp+50h] [rbp-10h]
14 unsigned __int64 v12; // [rsp+58h] [rbp-8h]
15
16 v12 = __readfsqword(0x28u);
17 *(_QWORD *)src = 'SLCDN';
18 v7 = 0LL;
19 v8 = 0;
20 v9 = 'wodah';
21 v10 = 0LL;
22 v11 = 0;
23 text = join(key3, (const char *)&v9); // text = 'killshadow'
24 strcpy(key, key1);
25 strcat(key, src); // key = 'ADSFKNDCLS'
26 v2 = 0;
27 v3 = 0;
28 getchar();
29 v5 = strlen(key); // v5 = 10
30 for ( i = 0; i < v5; ++i )
31 {
32 if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )// key = 'adsfkndcls'
33 key[i] = key[v3 % v5] + 32;
34 ++v3;
35 }
36 printf("Please input your flag:", src);
37 while ( 1 )
38 {
39 v1 = getchar();
40 if ( v1 == 10 )
41 break;
42 if ( v1 == 32 )
43 {
44 ++v2;
45 }
46 else
47 {
48 if ( v1 <= 96 || v1 > 122 )
49 {
50 if ( v1 > 64 && v1 <= 90 ) // 大写字母
51 str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;
52 }
53 else // 小写字母
54 {
55 str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;
56 }
57 if ( !(v3 % v5) )
58 putchar(' ');
59 ++v2;
60 }
61 }
62 if ( !strcmp(text, str2) )
63 puts("Congratulation!\n");
64 else
65 puts("Try again!\n");
66 return __readfsqword(0x28u) ^ v12;
67 }

转为C语言逆向解出结果

#include<stdio.h> 
int main()
{
	char key[] = "adsfkndcls";
	char text[] = "killshadow";
	int i;
	int v3=10;//长度 
	for (int i = 0; i < 10; i++)
	{
		for (int j = 0; j < 128; j++)
		{
			if (j < 'A' || j > 'z' || j > 'Z' && j < 'a')
			{
				continue;
			}
			if ((j - 39 - key[v3 % 10] + 97) % 26 + 97 == text[i])
			{
				printf("%c",j);
				v3++;
				break;
			}
		}
	}
}

得到flag