BUUCTF逆向的一些WP（4）

最新推荐文章于 2024-07-14 15:46:23 发布

∪v

最新推荐文章于 2024-07-14 15:46:23 发布

阅读量709

点赞数 1

分类专栏： CTF 文章标签：网络安全

本文链接：https://blog.youkuaiyun.com/qq_62188797/article/details/125289131

版权

[GWCTF 2019]pyre

是pyc文件，可以用反编译工具，我这里是在线反编译，地址。

#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
# Version: Python 2.7

print "Welcome to Re World!"
print "Your input1 is your flag~"
l = len(input1)
for i in range(l):
    num = ((input1[i] + i) % 128 + 128) % 128
    code += num
for i in range(l - 1):
    code[i] = code[i] ^ code[i + 1]
print code
code = [
    "\x1f",
    "\x12",
    "\x1d",
    "(",
    "0",
    "4",
    "\x01",
    "\x06",
    "\x14",
    "4",
    ",",
    "\x1b",
    "U",
    "?",
    "o",
    "6",
    "*",
    ":",
    "\x01",
    "D",
    ";",
    "%",
    "\x13",
]

直接写脚本：

code = ["\x1f", "\x12", "\x1d", "(", "0", "4", "\x01", "\x06", "\x14", "4", ",", "\x1b", "U",
        "?", "o", "6", "*", ":", "\x01", "D", ";", "%", "\x13"]
le = len(code)
for i in range(-2, -le, -1):
    code[i] = chr(ord(code[i]) ^ ord(code[i + 1]))
# print(code)
flag = ''
for i in range(le):
    for j in range(128):
	    if((j + i) % 128 == ord(code[i])):
            flag += chr(j)
print(flag)
"""
第二个循环的另一种方式
for i in range(le):
        code[i] = chr((ord(code[i]) - i) % 128)
        flag += code[i]
"""

[ACTF新生赛2020]easyre

upx壳

脱掉后

int __cdecl main(int argc, const char **argv, const char **envp)
{
  _BYTE v4[12]; // [esp+12h] [ebp-2Eh] BYREF
  _DWORD v5[3]; // [esp+1Eh] [ebp-22h]
  _BYTE v6[5]; // [esp+2Ah] [ebp-16h] BYREF
  int v7; // [esp+2Fh] [ebp-11h]
  int v8; // [esp+33h] [ebp-Dh]
  int v9; // [esp+37h] [ebp-9h]
  char v10; // [esp+3Bh] [ebp-5h]
  int i; // [esp+3Ch] [ebp-4h]

  __main();
  qmemcpy(v4, "*F'\"N,\"(I?+@", sizeof(v4));
  printf("Please input:");
  scanf("%s", v6);
  if ( v6[0] != 'A' || v6[1] != 'C' || v6[2] != 'T' || v6[3] != 'F' || v6[4] != '{' || v10 != '}' )
    return 0;
  v5[0] = v7;
  v5[1] = v8;
  v5[2] = v9;
  for ( i = 0; i <= 11; ++i )
  {
    if ( v4[i] != _data_start__[*((char *)v5 + i) - 1] )
      return 0;
  }
  printf("You are correct!");
  return 0;
}

v6 = "ACTF{}",v5为括号中的内容，至于为什么是，我认为是靠猜和经验，伪代码本身不难。_data_start是字符串（这样伪代码才合理），其中有几个十六进制数要转为字符

脚本

v4 = "*F'\"N,\"(I?+@"
_data_start_ = "~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)(\'&%$# !\""
v5 = ''
for i in v:
    v5 += chr(_data_start_.find(i) + 1)  # find字符查找，可规定范围
#    print(v5)
print(v5)

[ACTF新生赛2020]rome

关键在func()函数，v1为flag

int func()
{
  int result; // eax
  int v1[4]; // [esp+14h] [ebp-44h]
  unsigned __int8 v2; // [esp+24h] [ebp-34h] BYREF
  unsigned __int8 v3; // [esp+25h] [ebp-33h]
  unsigned __int8 v4; // [esp+