[SUCTF2018]babyre

刚开始下载下来是个bin文件

查看发现就是exe文件

改过来就是

main函数

这里就有chkeck debug

直接进入她的身体

oh 不,它的函数

 

现在进来这个函数就退出了

过!

回到main函数

看下面就知道

这两个其实是一体的

对着V7按y

改到216(两个的和)

现在所有都是V7了

下面就是加密函数

没什么加密

CTF逆向-[SUCTF2018]babyre-WP-cpp简单迭代并按表输出值的爆破_ctf babyre-优快云博客

懒狗直接找脚本

#include <stdio.h>
#include <string.h>
int __cdecl main(int argc, const char** argv, const char** envp)
{
    char* v3; // rdi
    __int64 i; // rcx
    char v6; // [rsp+0h] [rbp-20h] BYREF
    char v7[216]; // [rsp+30h] [rbp+10h] BYREF
    char v8[60]; // [rsp+108h] [rbp+E8h] BYREF
    int v9[8]; // [rsp+144h] [rbp+124h] BYREF
    int j; // [rsp+164h] [rbp+144h]
    int v11; // [rsp+234h] [rbp+214h]
    int v_temp; // [rsp+238h] [rbp+218h]

    /*v3 = &v6;
    for (i = 150i64; i; --i)
    {
        *(_DWORD*)v3 = -858993460;
        v3 += 4;
    }
    j___CheckForDebuggerJustMyCode(byte_7FF68A963035);*/
    v7[0] = 2;
    v7[1] = 3;
    v7[2] = 2;
    v7[3] = 1;
    v7[4] = 4;
    v7[5] = 7;
    v7[6] = 4;
    v7[7] = 5;
    v7[8] = 10;
    v7[9] = 11;
    v7[10] = 10;
    v7[11] = 9;
    v7[12] = 14;
    v7[13] = 15;
    v7[14] = 12;
    v7[15] = 13;
    v7[16] = 16;
    v7[17] = 19;
    v7[18] = 16;
    v7[19] = 17;
    v7[20] = 20;
    v7[21] = 23;
    v7[22] = 22;
    v7[23] = 19;
    v7[24] = 28;
    v7[25] = 25;
    v7[26] = 30;
    v7[27] = 31;
    v7[28] = 28;
    v7[29] = 25;
    v7[30] = 26;
    v7[31] = 31;
    memcpy(
        &v7[32],
        "$!\"'$!\"#().+$-&/81:;4=>7092;<567HIBBDDFGHIJJMMONPPRSUTVWYYZ[\\]^^``ccdeggiikklmnnpprstuwwxy{{}}",
        94);
    v7[126] = 0x7F;
    v7[127] = 0x7F;
    v7[128] = 0x81;
    v7[129] = 0x81;
    v7[130] = 0x83;
    v7[131] = 0x83;
    v7[132] = 0x8C;
    v7[133] = 0x8D;
    v7[134] = 0x8E;
    v7[135] = 0x8F;
    v7[136] = 0x88;
    v7[137] = 0x89;
    v7[138] = 0x8A;
    v7[139] = 0x8B;
    v7[140] = 0x8C;
    v7[141] = 0x8D;
    v7[142] = 0x8E;
    v7[143] = 0x87;
    v7[144] = 152;
    v7[145] = -111;
    v7[146] = 0x92;
    v7[147] = 147;
    v7[148] = 0x94;
    v7[149] = 0x95;
    v7[150] = 0x96;
    v7[151] = -105;
    v7[152] = -104;
    v7[153] = -103;
    v7[154] = -102;
    v7[155] = -102;
    v7[156] = -100;
    v7[157] = -100;
    v7[158] = -98;
    v7[159] = -98;
    v7[160] = -96;
    v7[161] = -96;
    v7[162] = -94;
    v7[163] = -94;
    v7[164] = -92;
    v7[165] = -92;
    v7[166] = -90;
    v7[167] = -90;
    v7[168] = -88;
    v7[169] = -88;
    v7[170] = -86;
    v7[171] = -86;
    v7[172] = -84;
    v7[173] = -84;
    v7[174] = -82;
    v7[175] = -82;
    v7[176] = 0xB0;
    v7[177] = 0xB1;
    v7[178] = 178;
    v7[179] = 179;
    for (int i = 0; i < 0x10000; i++) {
        v9[0] = i; // 看到最多是v9[0] %= 0x10000u; 则 枚举迭代v9[0]


        memset(v8, 0, 0x1Fui64);
        //sub_7FF68A951159(std::cout, "flag format: SUCTF{xxxxxxxxxxxxxxx}\n");
        //sub_7FF68A951159(std::cout, "Please Input Key:");
        //std::istream::operator>>(std::cin, v9);
        v9[0] %= 0x10000u;
        v8[30] = 8;
        while (v8[30])
        {
            --v8[30];
            for (j = 22; j; v8[j] |= v_temp << v8[30])
            {
                v11 = v7[22 * v8[30] + --j];
                v_temp = (v11 >> (((unsigned int)v9[0] >> (2 * v8[30])) & 3)) & 1;
            }
        }
        if (strstr(v8, "SUCTF{")!=NULL) {
            for (int vi = 0; vi < 22; vi++) {
                printf("%c", v8[vi]);
            }
            printf("\n");
        }
    }
    //sub_7FF68A951159(std::cout, v8);
    //system("pause");
    return 0;
    // SUCTF{Flag_8i7244980f}
}

代码原理就是因为这里主要加密就是这点,

而且只检测我们输入的第一个

所以我们就爆破就OK了

后面也可以爆破出

检查的就是12345

和弱口令爆破一个道理吧