【CYBRICS】Polyglot WriteUp

最新推荐文章于 2024-07-15 18:47:37 发布

古月浪子

最新推荐文章于 2024-07-15 18:47:37 发布

阅读量350

点赞数

文章标签： CTF

本文链接：https://blog.youkuaiyun.com/tqydyqt/article/details/107584907

版权

这道题有毒。。。

附件是一个.c源代码

我们自己写一下代码跑一下，把key直接写死

int main() {
   
	char flagged[] = {
    ...... };
	char key[] = "mod3r0d!";
	unsigned long long val = *(unsigned long long*)key;
	unsigned long long *ptr = (unsigned long long*)flagged;
	while (*ptr != 0) {
   
		*ptr = *ptr ^ val;
		ptr += 1;
	}
	puts(flagged);
}

跑出来是另一段源码

#include <iostream>
template <unsigned int a, unsigned int b>
struct t1 {
   
        enum {
    value = b + t1<a-1, b>::value };
};
template <unsigned int b>
struct t1<0, b> {
   
        enum {
    value = 0 };
};
template <unsigned int a, unsigned int b>
struct t2 {
   
        enum {
    value = 1 + t2<a-1, b>::value };
};
template <unsigned int b>
struct t2<0, b> {
   
        enum {
    value = 1 + t2<0, b-1>::value };
};
template<>
struct t2<0, 0>{
   
    enum {
    value = 0};
};
void decode(unsigned char *data, unsigned int val){
   
    unsigned int *ptr = reinterpret_cast<unsigned int *>(data);
    while (*ptr != 0) {
   
        *ptr = *ptr ^ val;
        val = (val ^ (val << 1)) ^ 0xc2154216;
        ptr += 1;
    }
}
unsigned char flagged[] = {
    ...... };
int main(){
   
    decode(flagged, t2<0xcaca0000, t2<444, t1<t2<100, t1<4,3>