![\"image-20220210123506016\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350412.png\")
<\/div><\/p>\n\u6253\u5f00\u9644\u4ef6\u770b\u4e00\u4e0b\uff1a<\/p>\n
![\"image-20220210124242313\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350413.png\")
<\/div><\/p>\n\u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2a\u5c0f\u6e38\u620f\uff0c\u8f93\u5165\u4e00\u4e2a\u6570\u4f1a\u6539\u53d8\u8fd9\u4e2a\u6570\u5b57\u53ca\u76f8\u90bb\u4e24\u4e2a\u6570\u5b57\u5bf9\u5e94\u7684\u706f\u7b3c\uff0c<\/p>\n
\u5c1d\u8bd5\u4e00\u4e0b\u5f88\u5feb\u5c31\u80fd\u901a\u5173\uff0c\u6280\u5de7\u5728\u4e8e\u628a\u6ca1\u4eae\u7684\u706f\u7b3c\u4e09\u4e2a\u4e09\u4e2a\u805a\u5728\u4e00\u8d77\uff0c\u5f53\u5728\u4e00\u8d77\u7684\u706f\u7b3c\u6570\u4e3a3\u7684\u500d\u6570\u65f6\u81ea\u7136\u8fc7\u5173\u3002<\/p>\n
![\"image-20220210130220057\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350414.png\")
<\/div><\/p>\n\u5f53\u7136\u5982\u679c\u73a9\u4e0d\u4e86\u8fd9\u4e2a\u6e38\u620f\u4e5f\u4e0d\u5f71\u54cd\u6211\u4eec\u505a\u9898\u3002\u62ff \u7136\u540e\u7528IDA\u6253\u5f00\uff01<\/p>\n \u67e5\u770b\u4e00\u4e0bmain\u51fd\u6570\uff1a<\/p>\n \u5f88\u81ea\u7136\u5c31\u53ef\u4ee5\u60f3\u5230\u8fd9\u91cc\u7684 int sub_45E940() \u53d1\u73b0\u51fd\u6570\u8fdb\u884c\u4e86\u4e24\u6b21 xor \u8fd0\u7b97\uff0cxor \u7684\u9006\u8fd0\u7b97\u4e5f\u662f xor\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u53ef\u4ee5\u6839\u636e\u8fd9\u4e2a\u8fd0\u7b97\u6765\u5199\u811a\u672c\u5f97\u5230\u6700\u540e\u7684flag\uff1a<\/p>\n \u5f53\u7136\u8fd9\u91cc\u76f4\u63a5 patch \u7a0b\u5e8f\uff0c\u65e0\u6761\u4ef6\u8c03\u7528 \u9644\u4ef6\u662f\u4e00\u4e2ac\u6587\u4ef6\uff1a<\/p>\n \u7528 gcc \u7f16\u8bd1\u4e00\u4e0b\uff0c\u8f93\u51fa\u7684\u662f \u8fd9\u91cc\u62a5\u9519\u4e86\uff0c\u663e\u793a\u5c11\u4e86\u4e2a \u89c2\u5bdf\u4e00\u4e0b\u8fd9\u4e2ac\u4ee3\u7801\uff0c\u53d1\u73b0\u9700\u8981\u63d0\u4f9b\u4e09\u4e2a\u53c2\u6570\uff1a<\/p>\n ==0xcafe==<\/p>\n<\/li>\n \u6240\u4ee5 flag \u5c31\u662f\uff1ac0ffee<\/p>\n ==\uff01\u4e0d\u7528\u52a0\u683c\u5f0f \uff01==<\/p>\n \u5f53\u7136\u5927\u4f6c\u4eec\u7f16\u5199\u811a\u672c\u7684\u683c\u5f0f\u4e5f\u8db3\u591f\u4f18\u96c5\uff0c\u8fd9\u91cc\u4ec5\u5f15\u7528\u4e00\u4e2a Hk_Mayfly<\/a> \u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\n \u6253\u5f00 \u53ef\u4ee5\u770b\u5230\u662f64\u4f4d\u7684\u6587\u4ef6\uff0c\u4e14\u4e3aUPX\u52a0\u58f3\u3002<\/p>\n \u7528\u4e8c\u8fdb\u5236\u5f62\u5f0f\u6253\u5f00IDA\uff0c\u641c\u7d22\u5b57\u7b26\u4e32flag\u5f97\u5230\uff1a<\/p>\n \u5148\u8131\u58f3\uff1a<\/p>\n \u8131\u5b8c\u58f3\u518d\u7528IDA\u6253\u5f00\uff0c\u5148\u67e5\u770bmain\u51fd\u6570\uff1a<\/p>\n \u53ef\u4ee5\u770b\u5230\u6709flag\uff0c\u70b9\u51fb\u8ddf\u8fdb\u4e00\u4e0b\uff0c\u53ef\u4ee5\u53d1\u73b0flag\uff01<\/p>\n \u6253\u5f00 \u53ef\u4ee5\u770b\u5230\u662f64\u4f4d\u7684ELF\u6587\u4ef6\uff0c\u67e5\u770b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n \u7528IDA\u6253\u5f00\uff0c\u67e5\u770b\u4e00\u4e0b\u51e0\u4e2a\u53ef\u7591\u7684\u51fd\u6570\uff1a<\/p>\n \u53ef\u4ee5\u770b\u51fa\u51fd\u6570\u5b9e\u73b0\u903b\u8f91\u662f\u8981\u8f93\u5165\u4e00\u4e2a\u6570\u5b57\uff0c \u5f97\u5230flag\uff1a==RC3-2016-XORISGUD==<\/p>\n \u9996\u5148\u8fd8\u662f\u67e5\u58f3\u548c\u7a0b\u5e8f\u7684\u8be6\u7ec6\u4fe1\u606f\u3002<\/p>\n \u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2aELF\u768432\u4f4d\u6587\u4ef6\uff0c\u6253\u5f00\u865a\u62df\u673a\u770b\u4e00\u4e0b\u76f8\u5173\u4fe1\u606f\uff1a<\/p>\n \u6253\u5f00IDA \u8ddf\u8fdb\u4e00\u4e0b\u53d1\u73b0\u4e00\u4e2a\u5173\u952e\u7684\u5b57\u7b26\u4e32\uff0c&strs,\u53d1\u73b0\u662f\u53d6\u8fd9\u4e2a\u5b57\u7b26\u4e32\u8f93\u51fa\uff0c\u7136\u540e\uff0c\u8ddf\u8fdbstrs\u3002\u731c\u6d4b\u8fd9\u4e2a\u660e\u663e\u7684\u5c31\u662f\u6700\u7ec8 flag\uff0c\u8bd5\u4e00\u4e0b\u6b63\u786e\uff01\u8fd9\u91cc\u4e5f\u53ef\u4ee5\u5f88\u81ea\u7136\u60f3\u5230\u6253\u5f00string\u9875\u9762\u627e\u5230flag\uff01<\/p>\n flag\u5c31\u662f==9447{This_is_a_flag}==<\/p>\n \u76f4\u63a5\u7528\u6587\u672c\u5f62\u5f0f\u6253\u5f00\u6587\u6863\uff0c\u641c\u7d22flag\u5b57\u7b26\u4e5f\u53ef\u4ee5\u627e\u5230flag\uff01<\/p>\n \u4e4b\u524d\u505a\u8fc7\u7c7b\u4f3c\u7684\u9898\u76ee\uff0c \u5b89\u88c5==pip install uncompyle==<\/p>\n \u4f7f\u7528==uncompyle6 python-trade.pyc > python-trade.py==<\/p>\n<\/blockquote>\n \u5f97\u5230\u7684\u6587\u4ef6\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n \u3002\u3002\u3002\u3002\u3002\u4e0d\u652f\u6301\u3002\u3002\u3002\u3002\u597d\u5427\uff0c\u4e4b\u524d\u4e5f\u56e0\u4e3a\u8fd9\u4e2a\u5931\u8d25\u8fc7\uff0c\u770b\u4e00\u4e0b\u4e4b\u524d\u7684wp\uff0c\u597d\u5427\u6362\u4e00\u4e2a\u7248\u672c\u57283.8\u53ca\u4ee5\u4e0b\u7684python\u5c31\u884c\u4e86\u3002<\/p>\n \u89c2\u5bdf\u53ef\u4ee5\u770b\u5230flag\u52a0\u5bc6\u4ee5\u540e\u53ef\u4ee5\u5f97\u5230\u5b57\u7b26\u4e32==XlNkVmtUI1MgXWBZXCFeKY+AaXNt==<\/p>\n \u5199\u4e00\u4e2a\u811a\u672c\u53cd\u8fc7\u6765\u5c31\u884c\u4e86\u3002<\/p>\n \u8fd0\u884c\u4ee5\u540e\u5c31\u53ef\u4ee5\u5f97\u5230\uff1a<\/p>\n \u9644\u4ef6\u662f\u4e00\u4e2a \u62ff \u8fd9\u4e2a\u529e\u6cd5\u662f\u7f51\u4e0a\u5e08\u5085\u53d1\u7684\uff0c\u592atm\u725b\u903c\u4e86\uff1a<\/p>\n \u67e5\u9605\u8d44\u6599\u4e86\u89e3\u5230\uff0c\u53cd\u7f16\u8bd1\u7684\u7ed3\u679c\u4e0d\u662f\u4e00\u5b9a\u6b63\u786e\u7684\uff0cIDA\u91c7\u7528\u9012\u5f52\u4e0b\u964d\u6cd5\u8fdb\u884c\u53cd\u7f16\u8bd1\uff0c\u5b83\u7684\u4f18\u70b9\u5728\u4e8e\u5f88\u5c11\u4f1a\u5728\u53cd\u7f16\u8bd1\u65f6\u628a\u6570\u636e\u5f53\u4f5c\u4ee3\u7801\u6765\u5904\u7406\uff0c\u4e0d\u8fc7\u8fd9\u6b21IDA\u5f88\u660e\u663e\u628aflag\u5f53\u6210\u4ee3\u7801\uff0c\u8fdb\u884c\u4e86\u53cd\u7f16\u8bd1\uff0c\u56e0\u6b64\u5728string\u754c\u9762\u65e0\u6cd5\u627e\u5230flag<\/p>\n \u89e3\u51b3\u65b9\u6cd5\u662f\u5728IDA\u6253\u5f00\u6587\u4ef6\u65f6\u9009\u62e9binary file,\u5728\u6b64\u6a21\u5f0f\u4e0bIDA\u4e0d\u4f1a\u8fdb\u884c\u53cd\u7f16\u8bd1\uff0c\u6b64\u65f6\u518d\u6253\u5f00strings\u754c\u9762\u5c31\u53ef\u53d1\u73b0flag \u61c2\u4e86\uff0c\u6309\u7167\u5927\u4f6c\u8bf4\u7684\uff0c\u4ee5\u540e\u6bcf\u6b21\u90fd\u8bd5\u8bd5\uff0c\u563f\u563f\u3002<\/p>\n \u4f7f\u7528vim\u6253\u5f00\uff0c\u8f93\u5165\u2018\/\u2019\u53ef\u8fdb\u5165\u67e5\u627e\u6a21\u5f0f\u4e5f\u53ef\u4ee5\u3002<\/p>\n \u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2a32\u4f4d\u7684\uff0c\u752832\u4f4dIDA\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n \u6709\u4e2astrcmp\u51fd\u6570\uff0c\u6bd4\u8f83 v5 \u548c v9 ,\u7136\u540e\u5224\u65ad v3\uff0c\u6839\u636e v3 \u7ed9\u51fa\u76f8\u5e94\u7684\u7ed3\u679c\uff0c\u4f46\u662f\u8fd9\u91cc\u6709\u4e00\u4e2a printf(aFlag) \uff0c\u8d76\u7d27\u770b\u4e00\u4e0b\uff1a<\/p>\n \u7136\u800c\u5e76\u6ca1\u6709\u5f97\u5230 flag \uff0c\u8fd9\u4e2a\u548c\u4e0a\u9762\u90a3\u4e2a\u8f93\u51fa\u662f\u4e00\u6837\u7684\uff0c\u8fd9\u4e48\u4e00\u770b flag \u4f30\u8ba1\u662f else \u91cc\u7684\u4e1c\u897f\uff0c\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n \u8fd9\u91cc\u6709\u4e00\u4e2a \u6ca1\u6709\u4e1c\u897f\uff0c\u518d\u770b main \u51fd\u6570\uff0c\u91cc\u9762\u53ef\u770b\u5230:<\/p>\n \u8ddf\u8fdb\u4e00\u4e0b \u628a \u83dc\u9e1f-\u4f20\u5947<\/a>\u5e08\u5085\u7684wp\u91cc\u8bf4\u70b9\u51fb \u5148\u67e5\u770b\u4e00\u4e0b\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n \u7528IDA\u6253\u5f00\u770b\u4e00\u4e0b\uff0c\u5077\u5077\u8bd5\u4e86\u4e00\u4e0b\u4e8c\u8fdb\u5236\u6253\u5f00\uff0c\u65e0\u679c\uff0c\u54c8\u54c8\u54c8\u3002<\/p>\n \u53ef\u4ee5\u770b\u51fa\uff1a<\/p>\n \u5f97\u5230flag\uff01<\/p>\n \u67e5\u770b\u4e00\u4e0b\u7a0b\u5e8f\u57fa\u672c\u4fe1\u606f\uff0c\u5c1d\u8bd5\u8fd0\u884c\uff1a<\/p>\n \u8fd0\u884c\u5931\u8d25\u4e86\uff0c\u7528IDA\u6253\u5f00\u67e5\u770b\u4e00\u4e0b\u51e0\u4e2a\u51fd\u6570\u7684\u4f2a\u4ee3\u7801\u3002<\/p>\n \u53ef\u4ee5\u770b\u5230 \u672c\u9898\u9700\u8981\u52a8\u6001\u8c03\u8bd5\u3002<\/p>\n \u67e5\u770b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n \u5c1d\u8bd5\u8fd0\u884c\uff0c\u679c\u7136\u90fd\u662f\u4e71\u7801\u3002<\/p>\n IDA\u6253\u5f00\uff1a<\/p>\n \u82e5 \u67e5\u770b\u4e00\u4e0b \u8fd4\u56de\u503c\u6052\u4e3a 0\u3002<\/p>\n \u53cc\u51fb \u8fd4\u56de\u770b\u6c47\u7f16\uff1a<\/p>\n \u91cd\u590d\u4e0a\u8ff0\u64cd\u4f5c\uff0c\u4f9d\u6b21\u5c06 \u6700\u540e\uff0c\u4f9d\u6b21\u70b9\u51fb Edit -> Patch program -> Apply patches to input file\u2026<\/strong> \uff0c\u5907\u4efd\u8865\u4e01\u7a0b\u5e8f\u3002<\/p>\n \u518d\u6b21\u6267\u884c\uff0c\u5373\u53ef\u5f97\u5230 flag\uff01<\/p>\n \u53c2\u8003Secrypt Agency<\/a>\u5e08\u5085\u7684\u6587\u7ae0\uff1a\u3010XCTF \u653b\u9632\u4e16\u754c\u3011 Reverse \u2014\u2014 csaw2013reversing2<\/a><\/p>\n \u67e5\u770b\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n IDA\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n \u770b\u4e00\u4e0b\u6838\u5fc3\u4ee3\u7801\uff1a<\/p>\n \u53ef\u4ee5\u770b\u5230\uff1a<\/p>\n \u91cd\u5199\u4e0a\u8ff0\u4ee3\u7801\uff0c\u83b7\u5f97\u811a\u672c\uff1a<\/p>\n \u5f97\u5230 flag\uff1a==SharifCTF{b70c59275fcfa8aebf2d5911223c6589}==<\/p>\n \u67e5\u770b\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n \u67e5\u770b\u4e00\u4e0b\u91cd\u8981\u51fd\u6570\uff1a<\/p>\n \u53ef\u4ee5\u770b\u5230\u56db\u4e2a\u51fd\u6570\uff1a<\/p>\n \u6839\u636e\u4e8c\u7ef4\u6570\u7ec4\u7684\u6027\u8d28\uff0c\u53ef\u4ee5\u5224\u65ad\u51fa<\/p>\n \u770b\u5230\u8fd9\u8fb9\u6709\u4e00\u6bb5\u5b57\u7b26\uff0c\u5c06\u5b83\u6309\u6570\u7ec4\u5f62\u5f0f\u6392\u5217\u3002<\/p>\n *\u662f\u8fb9\u754c\uff0c\u7a7a\u683c\u662f\u901a\u8def\uff0c\uff03\u53f7\u662f\u7ec8\u70b9\u3002<\/p>\n \u7a0b\u5e8f\u5f00\u5934\uff1a<\/p>\n \u90a3\u4e48 flag \u5c31\u5e94\u8be5\u662f\uff1a==nctf{o0oo00O000oooo..OO}==<\/p>\n","protected":false},"excerpt":{"rendered":" game \u6253\u5f00\u9644\u4ef6\u770b\u4e00\u4e0b\uff1a \u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2a\u5c0f\u6e38\u620f\uff0c\u8f93\u5165\u4e00\u4e2a\u6570\u4f1a\u6539\u53d8\u8fd9\u4e2a\u6570\u5b57\u53ca\u76f8\u90bb\u4e24\u4e2a\u6570\u5b57\u5bf9\u5e94\u7684\u706f\u7b3c\uff0c \u5c1d\u8bd5\u4e00\u4e0b […]<\/p>\n","protected":false},"author":1,"featured_media":121,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,22],"tags":[],"class_list":["post-53","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-and-protest","category-reverse"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/53","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=53"}],"version-history":[{"count":3,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/53\/revisions"}],"predecessor-version":[{"id":134,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/53\/revisions\/134"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media\/121"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=53"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=53"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=53"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}exeinfo<\/code>\u67e5\u770b\u4e00\u4e0b\u3002<\/p>\n![\"image-20220210130851895\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350415.png\")
<\/div><\/p>\nvoid main_0()\n{\n signed int i; \/\/ [esp+DCh] [ebp-20h]\n int v1; \/\/ [esp+F4h] [ebp-8h]\n\n sub_45A7BE(&unk_50B110);\n sub_45A7BE(&unk_50B158);\n sub_45A7BE(&unk_50B1A0);\n sub_45A7BE(&unk_50B1E8);\n sub_45A7BE(&unk_50B230);\n sub_45A7BE(&unk_50B278);\n sub_45A7BE(&unk_50B2C0);\n sub_45A7BE(&unk_50B308);\n sub_45A7BE(&unk_50AFD0);\n sub_45A7BE("| by 0x61 |\\n");\n sub_45A7BE("| |\\n");\n sub_45A7BE("|------------------------------------------------------|\\n");\n sub_45A7BE(\n "Play a game\\n"\n "The n is the serial number of the lamp,and m is the state of the lamp\\n"\n "If m of the Nth lamp is 1,it's on ,if not it's off\\n"\n "At first all the lights were closed\\n");\n sub_45A7BE("Now you can input n to change its state\\n");\n sub_45A7BE(\n "But you should pay attention to one thing,if you change the state of the Nth lamp,the state of (N-1)th and (N+1)th w"\n "ill be changed too\\n");\n sub_45A7BE("When all lamps are on,flag will appear\\n");\n sub_45A7BE("Now,input n \\n");\n while ( 1 )\n {\n while ( 1 )\n {\n sub_45A7BE("input n,n(1-8)\\n");\n sub_459418();\n sub_45A7BE("n=");\n sub_4596D4("%d", &v1);\n sub_45A7BE("\\n");\n if ( v1 >= 0 && v1 <= 8 )\n break;\n sub_45A7BE("sorry,n error,try again\\n");\n }\n if ( v1 )\n {\n sub_4576D6(v1 - 1);\n }\n else\n {\n for ( i = 0; i < 8; ++i )\n {\n if ( (unsigned int)i >= 9 )\n j____report_rangecheckfailure();\n byte_532E28[i] = 0;\n }\n }\n j__system("CLS");\n sub_458054();\n if ( byte_532E28[0] == 1\n && byte_532E28[1] == 1\n && byte_532E28[2] == 1\n && byte_532E28[3] == 1\n && byte_532E28[4] == 1\n && byte_532E28[5] == 1\n && byte_532E28[6] == 1\n && byte_532E28[7] == 1 )\n {\n sub_457AB4();\n }\n }\n}<\/code><\/pre>\nsub_457AB4<\/code>\u5c31\u85cf\u7740\u672c\u9898\u7684 flag \uff0c\u6211\u4eec\u6211\u4eec\u8ddf\u8fdb\u4e00\u4e0b\u8fd9\u4e2a\u51fd\u6570\uff1a<\/p>\nint sub_457AB4(void)\n{\n return sub_45E940();\n}<\/code><\/pre>\n\u7ee7\u7eed\u8ddf\u8fdb\u53ef\u4ee5\u770b\u5230\u8fd9\u4e2a\u51fd\u6570\u662f\u8fd9\u6837\u7684(\u70b9\u51fb\u5c55\u5f00)<\/summary>\n
\n{
\n signed int i; \/\/ [esp+D0h] [ebp-94h]
\n char v2; \/\/ [esp+DCh] [ebp-88h]
\n char v3; \/\/ [esp+DDh] [ebp-87h]
\n char v4; \/\/ [esp+DEh] [ebp-86h]
\n char v5; \/\/ [esp+DFh] [ebp-85h]
\n char v6; \/\/ [esp+E0h] [ebp-84h]
\n char v7; \/\/ [esp+E1h] [ebp-83h]
\n char v8; \/\/ [esp+E2h] [ebp-82h]
\n char v9; \/\/ [esp+E3h] [ebp-81h]
\n char v10; \/\/ [esp+E4h] [ebp-80h]
\n char v11; \/\/ [esp+E5h] [ebp-7Fh]
\n char v12; \/\/ [esp+E6h] [ebp-7Eh]
\n char v13; \/\/ [esp+E7h] [ebp-7Dh]
\n char v14; \/\/ [esp+E8h] [ebp-7Ch]
\n char v15; \/\/ [esp+E9h] [ebp-7Bh]
\n char v16; \/\/ [esp+EAh] [ebp-7Ah]
\n char v17; \/\/ [esp+EBh] [ebp-79h]
\n char v18; \/\/ [esp+ECh] [ebp-78h]
\n char v19; \/\/ [esp+EDh] [ebp-77h]
\n char v20; \/\/ [esp+EEh] [ebp-76h]
\n char v21; \/\/ [esp+EFh] [ebp-75h]
\n char v22; \/\/ [esp+F0h] [ebp-74h]
\n char v23; \/\/ [esp+F1h] [ebp-73h]
\n char v24; \/\/ [esp+F2h] [ebp-72h]
\n char v25; \/\/ [esp+F3h] [ebp-71h]
\n char v26; \/\/ [esp+F4h] [ebp-70h]
\n char v27; \/\/ [esp+F5h] [ebp-6Fh]
\n char v28; \/\/ [esp+F6h] [ebp-6Eh]
\n char v29; \/\/ [esp+F7h] [ebp-6Dh]
\n char v30; \/\/ [esp+F8h] [ebp-6Ch]
\n char v31; \/\/ [esp+F9h] [ebp-6Bh]
\n char v32; \/\/ [esp+FAh] [ebp-6Ah]
\n char v33; \/\/ [esp+FBh] [ebp-69h]
\n char v34; \/\/ [esp+FCh] [ebp-68h]
\n char v35; \/\/ [esp+FDh] [ebp-67h]
\n char v36; \/\/ [esp+FEh] [ebp-66h]
\n char v37; \/\/ [esp+FFh] [ebp-65h]
\n char v38; \/\/ [esp+100h] [ebp-64h]
\n char v39; \/\/ [esp+101h] [ebp-63h]
\n char v40; \/\/ [esp+102h] [ebp-62h]
\n char v41; \/\/ [esp+103h] [ebp-61h]
\n char v42; \/\/ [esp+104h] [ebp-60h]
\n char v43; \/\/ [esp+105h] [ebp-5Fh]
\n char v44; \/\/ [esp+106h] [ebp-5Eh]
\n char v45; \/\/ [esp+107h] [ebp-5Dh]
\n char v46; \/\/ [esp+108h] [ebp-5Ch]
\n char v47; \/\/ [esp+109h] [ebp-5Bh]
\n char v48; \/\/ [esp+10Ah] [ebp-5Ah]
\n char v49; \/\/ [esp+10Bh] [ebp-59h]
\n char v50; \/\/ [esp+10Ch] [ebp-58h]
\n char v51; \/\/ [esp+10Dh] [ebp-57h]
\n char v52; \/\/ [esp+10Eh] [ebp-56h]
\n char v53; \/\/ [esp+10Fh] [ebp-55h]
\n char v54; \/\/ [esp+110h] [ebp-54h]
\n char v55; \/\/ [esp+111h] [ebp-53h]
\n char v56; \/\/ [esp+112h] [ebp-52h]
\n char v57; \/\/ [esp+113h] [ebp-51h]
\n char v58; \/\/ [esp+114h] [ebp-50h]
\n char v59; \/\/ [esp+120h] [ebp-44h]
\n char v60; \/\/ [esp+121h] [ebp-43h]
\n char v61; \/\/ [esp+122h] [ebp-42h]
\n char v62; \/\/ [esp+123h] [ebp-41h]
\n char v63; \/\/ [esp+124h] [ebp-40h]
\n char v64; \/\/ [esp+125h] [ebp-3Fh]
\n char v65; \/\/ [esp+126h] [ebp-3Eh]
\n char v66; \/\/ [esp+127h] [ebp-3Dh]
\n char v67; \/\/ [esp+128h] [ebp-3Ch]
\n char v68; \/\/ [esp+129h] [ebp-3Bh]
\n char v69; \/\/ [esp+12Ah] [ebp-3Ah]
\n char v70; \/\/ [esp+12Bh] [ebp-39h]
\n char v71; \/\/ [esp+12Ch] [ebp-38h]
\n char v72; \/\/ [esp+12Dh] [ebp-37h]
\n char v73; \/\/ [esp+12Eh] [ebp-36h]
\n char v74; \/\/ [esp+12Fh] [ebp-35h]
\n char v75; \/\/ [esp+130h] [ebp-34h]
\n char v76; \/\/ [esp+131h] [ebp-33h]
\n char v77; \/\/ [esp+132h] [ebp-32h]
\n char v78; \/\/ [esp+133h] [ebp-31h]
\n char v79; \/\/ [esp+134h] [ebp-30h]
\n char v80; \/\/ [esp+135h] [ebp-2Fh]
\n char v81; \/\/ [esp+136h] [ebp-2Eh]
\n char v82; \/\/ [esp+137h] [ebp-2Dh]
\n char v83; \/\/ [esp+138h] [ebp-2Ch]
\n char v84; \/\/ [esp+139h] [ebp-2Bh]
\n char v85; \/\/ [esp+13Ah] [ebp-2Ah]
\n char v86; \/\/ [esp+13Bh] [ebp-29h]
\n char v87; \/\/ [esp+13Ch] [ebp-28h]
\n char v88; \/\/ [esp+13Dh] [ebp-27h]
\n char v89; \/\/ [esp+13Eh] [ebp-26h]
\n char v90; \/\/ [esp+13Fh] [ebp-25h]
\n char v91; \/\/ [esp+140h] [ebp-24h]
\n char v92; \/\/ [esp+141h] [ebp-23h]
\n char v93; \/\/ [esp+142h] [ebp-22h]
\n char v94; \/\/ [esp+143h] [ebp-21h]
\n char v95; \/\/ [esp+144h] [ebp-20h]
\n char v96; \/\/ [esp+145h] [ebp-1Fh]
\n char v97; \/\/ [esp+146h] [ebp-1Eh]
\n char v98; \/\/ [esp+147h] [ebp-1Dh]
\n char v99; \/\/ [esp+148h] [ebp-1Ch]
\n char v100; \/\/ [esp+149h] [ebp-1Bh]
\n char v101; \/\/ [esp+14Ah] [ebp-1Ah]
\n char v102; \/\/ [esp+14Bh] [ebp-19h]
\n char v103; \/\/ [esp+14Ch] [ebp-18h]
\n char v104; \/\/ [esp+14Dh] [ebp-17h]
\n char v105; \/\/ [esp+14Eh] [ebp-16h]
\n char v106; \/\/ [esp+14Fh] [ebp-15h]
\n char v107; \/\/ [esp+150h] [ebp-14h]
\n char v108; \/\/ [esp+151h] [ebp-13h]
\n char v109; \/\/ [esp+152h] [ebp-12h]
\n char v110; \/\/ [esp+153h] [ebp-11h]
\n char v111; \/\/ [esp+154h] [ebp-10h]
\n char v112; \/\/ [esp+155h] [ebp-Fh]
\n char v113; \/\/ [esp+156h] [ebp-Eh]
\n char v114; \/\/ [esp+157h] [ebp-Dh]
\n char v115; \/\/ [esp+158h] [ebp-Ch]
\n sub_45A7BE(\"done!!! the flag is \");
\n v59 = 18;
\n v60 = 64;
\n v61 = 98;
\n v62 = 5;
\n v63 = 2;
\n v64 = 4;
\n v65 = 6;
\n v66 = 3;
\n v67 = 6;
\n v68 = 48;
\n v69 = 49;
\n v70 = 65;
\n v71 = 32;
\n v72 = 12;
\n v73 = 48;
\n v74 = 65;
\n v75 = 31;
\n v76 = 78;
\n v77 = 62;
\n v78 = 32;
\n v79 = 49;
\n v80 = 32;
\n v81 = 1;
\n v82 = 57;
\n v83 = 96;
\n v84 = 3;
\n v85 = 21;
\n v86 = 9;
\n v87 = 4;
\n v88 = 62;
\n v89 = 3;
\n v90 = 5;
\n v91 = 4;
\n v92 = 1;
\n v93 = 2;
\n v94 = 3;
\n v95 = 44;
\n v96 = 65;
\n v97 = 78;
\n v98 = 32;
\n v99 = 16;
\n v100 = 97;
\n v101 = 54;
\n v102 = 16;
\n v103 = 44;
\n v104 = 52;
\n v105 = 32;
\n v106 = 64;
\n v107 = 89;
\n v108 = 45;
\n v109 = 32;
\n v110 = 65;
\n v111 = 15;
\n v112 = 34;
\n v113 = 18;
\n v114 = 16;
\n v115 = 0;
\n v2 = 123;
\n v3 = 32;
\n v4 = 18;
\n v5 = 98;
\n v6 = 119;
\n v7 = 108;
\n v8 = 65;
\n v9 = 41;
\n v10 = 124;
\n v11 = 80;
\n v12 = 125;
\n v13 = 38;
\n v14 = 124;
\n v15 = 111;
\n v16 = 74;
\n v17 = 49;
\n v18 = 83;
\n v19 = 108;
\n v20 = 94;
\n v21 = 108;
\n v22 = 84;
\n v23 = 6;
\n v24 = 96;
\n v25 = 83;
\n v26 = 44;
\n v27 = 121;
\n v28 = 104;
\n v29 = 110;
\n v30 = 32;
\n v31 = 95;
\n v32 = 117;
\n v33 = 101;
\n v34 = 99;
\n v35 = 123;
\n v36 = 127;
\n v37 = 119;
\n v38 = 96;
\n v39 = 48;
\n v40 = 107;
\n v41 = 71;
\n v42 = 92;
\n v43 = 29;
\n v44 = 81;
\n v45 = 107;
\n v46 = 90;
\n v47 = 85;
\n v48 = 64;
\n v49 = 12;
\n v50 = 43;
\n v51 = 76;
\n v52 = 86;
\n v53 = 13;
\n v54 = 114;
\n v55 = 1;
\n v56 = 117;
\n v57 = 126;
\n v58 = 0;
\n for ( i = 0; i < 56; ++i )\n {\n *(&v2 + i) ^= *(&v59 + i);\n *(&v2 + i) ^= 0x13u;\n }\n return sub_45A7BE(\"%s\\n\");\n}\n<\/details>\n#exp.py\na=[18,64,98,5,2,4,6,3,6,48,49,65,32,12,48,65,31,78,62,32,49,32,1,57,96,3,21,9,4,62,3,5,4,1,2,3,44,65,78,32,16,97,54,16,44,52,32,64,89,45,32,65,15,34,18,16,0]\nb=[123,32,18,98,119,108,65,41,124,80,125,38,124,111,74,49,83,108,94,108,84,6,96,83,44,121,104,110,32,95,117,101,99,123,127,119,96,48,107,71,92,29,81,107,90,85,64,12,43,76,86,13,114,1,117,126,0]\ni=0\nc=''\nwhile (i<56):\n a[i]^=b[i]\n a[i]^=19\n c=c+chr(a[i])\n i=i+1\nprint (c)\n#C:\\Users\\Administrator\\Desktop\n#\u03bb python exp.py\n#zsctf{T9is_tOpic_1s_v5ry_int7resting_b6t_others_are_n0t}<\/code><\/pre>\nsub_457AB4()<\/code>\u3002<\/p>\nopen-source<\/h1>\n
![\"image-20220211203509220\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350416.png\")
<\/div><\/p>\n#include <stdio.h>\n#include <string.h>\n\nint main(int argc, char *argv[]) {\n if (argc != 4) {\n printf("what?\\n");\n exit(1);\n }\n\n unsigned int first = atoi(argv[1]);\n if (first != 0xcafe) {\n printf("you are wrong, sorry.\\n");\n exit(2);\n }\n\n unsigned int second = atoi(argv[2]);\n if (second % 5 == 3 || second % 17 != 8) {\n printf("ha, you won't get it!\\n");\n exit(3);\n }\n\n if (strcmp("h4cky0u", argv[3])) {\n printf("so close, dude!\\n");\n exit(4);\n }\n\n printf("Brr wrrr grr\\n");\n\n unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;\n\n printf("Get your key: ");\n printf("%x\\n", hash);\n return 0;\n}<\/code><\/pre>\nwhat?<\/code>\u3002<\/p>\n#include <stdlib.h><\/code>\uff0c\u52a0\u4e0a\u5c31\u4e00\u5207\u6b63\u5e38\u4e86\uff01<\/p>\n\n
25<\/code>\uff08\u6ee1\u8db3 second % 5 = = 3 || second % 17 != 8<\/code> \uff09<\/p>\n<\/li>\n h4cky0u <\/code><\/p>\n<\/li>\n<\/ul>\nPwn@ubuntu:~\/\u684c\u9762$ .\/a.out 51966 25 h4cky0u\nBrr wrrr grr\nGet your key: c0ffee<\/code><\/pre>\n#include <stdio.h>\n#include <string.h>\n\nint main(int argc, char* argv[]) {\n\n int first = 0xcafe;\n int second = 25;\n argv[3] = "h4cky0u";\n\n printf("Brr wrrr grr\\n");\n\n unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;\n\n printf("Get your key: ");\n printf("%x\\n", hash);\n\n system("PAUSE");\n return 0;\n}<\/code><\/pre>\nsimple-unpack<\/h1>\n
![\"image-20220218232717192\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350417.png\")
<\/div><\/p>\nExeinfo PE<\/code>\uff0c\u770b\u4e00\u4e0b\u76f8\u5173\u4fe1\u606f\uff1a<\/p>\n![\"image-20220218233100931\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350418.png\")
<\/div><\/p>\n\u4e00\u3001IDA\u4e8c\u8fdb\u5236\u6253\u5f00<\/h2>\n
![\"image-20220218234842075\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350419.png\")
<\/div><\/p>\n\u4e8c\u3001UPX\u8131\u58f3<\/h2>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/Desktop]\n\u2514\u2500$ upx -d 847be14b3e724782b658f2dda2e8045b \n Ultimate Packer for eXecutables\n Copyright (C) 1996 - 2020\nUPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020\n\n File size Ratio Format Name\n -------------------- ------ ----------- -----------\n 912808 <- 352624 38.63% linux\/amd64 847be14b3e724782b658f2dda2e8045b\n\nUnpacked 1 file.<\/code><\/pre>\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n char s1; \/\/ [rsp+0h] [rbp-70h]\n unsigned __int64 v5; \/\/ [rsp+68h] [rbp-8h]\n\n v5 = __readfsqword(0x28u);\n _isoc99_scanf((unsigned __int64)"%96s");\n if ( !strcmp(&s1, flag) )\n puts("Congratulations!", flag);\n else\n puts("Try again!", flag);\n return 0;\n}<\/code><\/pre>\n![\"image-20220219000054721\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350420.png\")
<\/div><\/p>\nlogmein<\/h1>\n
![\"image-20220219024629496\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350421.png\")
<\/div><\/p>\nExeinfo PE<\/code>\uff0c\u67e5\u770b\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n![\"image-20220219024745806\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350422.png\")
<\/div><\/p>\n![\"image-20220219025130696\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350423.png\")
<\/div><\/p>\nvoid __fastcall __noreturn main(__int64 a1, char **a2, char **a3)\n{\n size_t v3; \/\/ rsi\n int i; \/\/ [rsp+3Ch] [rbp-54h]\n char s[36]; \/\/ [rsp+40h] [rbp-50h]\n int v6; \/\/ [rsp+64h] [rbp-2Ch]\n __int64 v7; \/\/ [rsp+68h] [rbp-28h]\n char v8[8]; \/\/ [rsp+70h] [rbp-20h]\n int v9; \/\/ [rsp+8Ch] [rbp-4h]\n\n v9 = 0;\n strcpy(v8, ":\\"AL_RT^L*.?+6\/46");\n v7 = 28537194573619560LL;\n v6 = 7;\n printf("Welcome to the RC3 secure password guesser.\\n", a2, a3);\n printf("To continue, you must enter the correct password.\\n");\n printf("Enter your guess: ");\n __isoc99_scanf("%32s", s);\n v3 = strlen(s);\n if ( v3 < strlen(v8) )\n sub_4007C0(v8);\n for ( i = 0; i < strlen(s); ++i )\n {\n if ( i >= strlen(v8) )\n ((void (*)(void))sub_4007C0)();\n if ( s[i] != (char)(*((_BYTE *)&v7 + i % v6) ^ v8[i]) )\n ((void (*)(void))sub_4007C0)();\n }\n sub_4007F0();\n}<\/code><\/pre>\nvoid __noreturn sub_4007C0()\n{\n printf("Incorrect password!\\n");\n exit(0);\n}<\/code><\/pre>\nvoid __noreturn sub_4007F0()\n{\n printf("You entered the correct password!\\nGreat job!\\n");\n exit(0);\n}<\/code><\/pre>\n\u7b49\u4e8e\u7ecf\u8fc7\u5904\u7406\u7684v7\u548cv8\u7684\u5f02\u6216<\/code>\uff0cv8\u5f88\u660e\u663e\uff0c\u4f46\u662fv7\u4e0d\u662f\u5f88\u660e\u786e\uff0c\u4e0a\u7f51\u67e5\u627e\u4e00\u4e0b\uff0c\u53ef\u4ee5\u77e5\u9053LL\u662f\u957f\u957f\u6574\u578b\uff0cv7\u8981\u8f6c\u6362\u4e3a16\u8fdb\u5236\u7136\u540e\u5728\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\uff0c\u800c\u4e14\u5b57\u7b26\u662f\u5c0f\u7aef\u5e8f\uff0c\u6240\u4ee5\u628a\u5f97\u5230\u7684\u5b57\u7b26\u7ffb\u8f6c\u7136\u540e\u548cv8\u7684\u6bcf\u4e00\u4f4d\u8fdb\u884c\u5f02\u6216\u3002\u8fd9\u91cc\u501f\u9274\u5927\u4f6c\u7684\u811a\u672c\uff1a<\/p>\n#wp.py\na = 'harambe'\nb = ':\\"AL_RT^L*.?+6\/46'\nprint(b)\ntmp = ''\nfor i in range(len(b)):\n c = ord(a[i % 7]) ^ ord(b[i])\n tmp += chr(c)\n print(tmp)<\/code><\/pre>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/Desktop]\n\u2514\u2500$ python wp.py \n:"AL_RT^L*.?+6\/46\nR\nRC\nRC3\nRC3-\nRC3-2\nRC3-20\nRC3-201\nRC3-2016\nRC3-2016-\nRC3-2016-X\nRC3-2016-XO\nRC3-2016-XOR\nRC3-2016-XORI\nRC3-2016-XORIS\nRC3-2016-XORISG\nRC3-2016-XORISGU\nRC3-2016-XORISGUD<\/code><\/pre>\ninsanity<\/h1>\n
![\"image-20220219003714917\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350424.png\")
<\/div><\/p>\n![\"image-20220219003825660\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350425.png\")
<\/div><\/p>\n![\"image-20220219004321294\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350426.png\")
<\/div><\/p>\nF5<\/code>\u67e5\u770b\u4e00\u4e0b\u4f2a\u51fd\u6570\uff1a<\/p>\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n unsigned int v3; \/\/ eax\n unsigned int v4; \/\/ eax\n\n puts("Reticulating splines, please wait..");\n sleep(5u);\n v3 = time(0);\n srand(v3);\n v4 = rand();\n puts((&strs)[v4 % 0xA]);\n return 0;\n}<\/code><\/pre>\n![\"image-20220219005210595\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350427.png\")
<\/div><\/p>\npython-trade<\/h1>\n
![\"image-20220219005945601\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350428.png\")
<\/div><\/p>\n.pyc<\/code>\u662fpy\u7a0b\u5e8f\u7f16\u8bd1\u4ee5\u540e\u7684\u5b57\u8282\u7801\u6587\u4ef6\uff0c\u9700\u8981\u7528\u76f8\u5e94\u5de5\u5177\u9006\u5411\uff0c\u6211\u4f7f\u7528\u7684\u662funcompyle<\/code><\/p>\n\n
I don't know about Python version '3.9.10' yet.\nPython versions 3.9 and greater are not supported.\nI don't know about Python version '3.9.10' yet.\nPython versions 3.9 and greater are not supported.<\/code><\/pre>\nC:\\Users\\Administrator\\Desktop\n\u03bb uncompyle6 trade.pyc\n# uncompyle6 version 3.8.0\n# Python bytecode 2.7 (62211)\n# Decompiled from: Python 3.8.10 (default, May 19 2021, 13:12:57) [MSC v.1916 64 bit (AMD64)]\n# Embedded file name: 1.py\n# Compiled at: 2017-06-03 10:20:43\nimport base64\ndef encode(message):\n s = ''\n for i in message:\n x = ord(i) ^ 32\n x = x + 16\n s += chr(x)\n return base64.b64encode(s)\ncorrect = 'XlNkVmtUI1MgXWBZXCFeKY+AaXNt'\nflag = ''\nprint 'Input flag:'\nflag = raw_input()\nif encode(flag) == correct:\n print 'correct'\nelse:\n print 'wrong'\n# okay decompiling trade.pyc<\/code><\/pre>\n#wp.py\nimport base64\ndef decode(message):\n s = ''\n imessage = base64.b64decode(message)\n for i in imessage:\n x = ord(i) - 16\n x = x ^ 32\n s += chr(x)\n return s\ncorrect = 'XlNkVmtUI1MgXWBZXCFeKY+AaXNt'\nflag = decode(correct)\nprint(flag)<\/code><\/pre>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/Desktop]\n\u2514\u2500$ python2 wp.py\nnctf{d3c0mpil1n9_PyC}<\/code><\/pre>\nre1<\/h1>\n
![\"image-20220219142713515\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350429.png\")
<\/div><\/p>\n.exe<\/code>\u6587\u4ef6\uff1a<\/p>\n![\"image-20220219142816151\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350430.png\")
<\/div><\/p>\nExeinfo PE<\/code>\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n![\"image-20220219143039112\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350431.png\")
<\/div><\/p>\nIDA \u4e8c\u8fdb\u5236\u6253\u5f00<\/h2>\n
\n
\n\u2014\u2014\u5f6c\u5f6c\u900a<\/a><\/p>\n<\/blockquote>\n![\"image-20220219163728748\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350432.png\")
<\/div>
\n![\"image-20220219163834308\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350433.png\")
<\/div><\/p>\nIDA<\/h2>\n
\/\/main\u51fd\u6570\uff1a\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n int v3; \/\/ eax\n __int128 v5; \/\/ [esp+0h] [ebp-44h]\n __int64 v6; \/\/ [esp+10h] [ebp-34h]\n int v7; \/\/ [esp+18h] [ebp-2Ch]\n __int16 v8; \/\/ [esp+1Ch] [ebp-28h]\n char v9; \/\/ [esp+20h] [ebp-24h]\n\n _mm_storeu_si128((__m128i *)&v5, _mm_loadu_si128((const __m128i *)&xmmword_413E34));\n v7 = 0;\n v6 = qword_413E44;\n v8 = 0;\n printf(&byte_413E4C);\n printf(&byte_413E60);\n printf(&byte_413E80);\n scanf("%s", &v9);\n v3 = strcmp((const char *)&v5, &v9);\n if ( v3 )\n v3 = -(v3 < 0) | 1;\n if ( v3 )\n printf(aFlag);\n else\n printf((const char *)&unk_413E90);\n system("pause");\n return 0;\n}<\/code><\/pre>\n![\"image-20220219143922593\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350434.png\")
<\/div><\/p>\n![\"image-20220219165001100\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350435.png\")
<\/div><\/p>\nflag get<\/code>\uff0c\u8bc1\u660e\u6211\u4eec\u5e94\u8be5\u662f\u627e\u5bf9\u4e86\uff0c\u4f46\u662f\u627e\u53c8\u627e\u4e0d\u5230\uff0c\u6ca1\u529e\u6cd5\uff0c\u53ea\u80fd\u67e5\u770b\u6761\u4ef6\u4e86\uff0cv9 \u662f\u8f93\u5165\u9879\uff0cv5 \u662f\u7ed9\u7684\uff0c\u8ffd\u8e2a\u4e00\u4e0b v5\uff0c\u6ca1\u53d1\u73b0\u4ec0\u4e48\u4e1c\u897f\u3002<\/p>\n![\"image-20220219165625539\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350436.png\")
<\/div><\/p>\n![\"image-20220219174400896\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350437.png\")
<\/div><\/p>\nxmmword_413E34<\/code>:<\/p>\n![\"image-20220219174553498\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350439.png\")
<\/div><\/p>\nqword_413E44<\/code>\u548cxmmword_413E34<\/code>\u7684\u6570\u636e\u62fc\u8d77\u6765\u7528python\u628a16\u8fdb\u5236\u7684\u6570\u8f6c\u5316\u6210\u6587\u672c\u7136\u540e\u53cd\u5411\u5c31\u53ef\u4ee5\u5199\u51fa flag\u3002<\/p>\nprint ('7D4654435455443074656D30633165577B465443545544'.decode('hex'))\n# \u89e3\u7801\u7ed3\u679c\uff1a }FTCTUD0tem0c1eW{FTCTUD<\/code><\/pre>\nxmmword<\/code>\u518d\u6309a<\/code>\u4e5f\u53ef\u4ee5\u8f6c\u5316\u6210\u5b57\u7b26\u4e32\u4e5f\u53ef\u4ee5\u5f97\u5230 flag\u3002<\/p>\n![\"image-20220219175046826\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350440.png\")
<\/div><\/p>\nHello, CTF<\/h1>\n
![\"image-20220219175150467\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350441.png\")
<\/div><\/p>\n![\"image-20220219175241559\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350442.png\")
<\/div>
\n![\"image-20220219175320873\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350443.png\")
<\/div><\/p>\n\/\/main\u51fd\u6570\n signed int v3; \/\/ ebx\n char v4; \/\/ al\n int result; \/\/ eax\n int v6; \/\/ [esp+0h] [ebp-70h]\n int v7; \/\/ [esp+0h] [ebp-70h]\n char v8; \/\/ [esp+12h] [ebp-5Eh]\n char v9[20]; \/\/ [esp+14h] [ebp-5Ch]\n char v10; \/\/ [esp+28h] [ebp-48h]\n __int16 v11; \/\/ [esp+48h] [ebp-28h]\n char v12; \/\/ [esp+4Ah] [ebp-26h]\n char v13; \/\/ [esp+4Ch] [ebp-24h]\n\n strcpy(&v13, "437261636b4d654a757374466f7246756e");\n while ( 1 )\n {\n memset(&v10, 0, 0x20u);\n v11 = 0;\n v12 = 0;\n sub_40134B(aPleaseInputYou, v6);\n scanf(aS, v9);\n if ( strlen(v9) > 0x11 )\n break;\n v3 = 0;\n do\n {\n v4 = v9[v3];\n if ( !v4 )\n break;\n sprintf(&v8, asc_408044, v4);\n strcat(&v10, &v8);\n ++v3;\n }\n while ( v3 < 17 );\n if ( !strcmp(&v10, &v13) )\n sub_40134B(aSuccess, v7);\n else\n sub_40134B(aWrong, v7);\n }\n sub_40134B(aWrong, v7);\n result = stru_408090._cnt-- - 1;\n if ( stru_408090._cnt < 0 )\n return _filbuf(&stru_408090);\n ++stru_408090._ptr;\n return result;\n}<\/code><\/pre>\n\n
![\"image-20220219180611864\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350444.png\")
<\/div><\/p>\nno-strings-attached<\/h1>\n
![\"image-20220219202346085\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350445.png\")
<\/div><\/p>\n![\"image-20220219203534103\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350446.png\")
<\/div><\/p>\n\/\/main()\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n setlocale(6, &locale);\n banner();\n prompt_authentication();\n authenticate();\n return 0;\n}<\/code><\/pre>\n\/\/setlocale()\nchar *setlocale(int category, const char *locale)\n{\n return setlocale(category, locale);\n}<\/code><\/pre>\n\/\/bannner()\nint banner()\n{\n unsigned int v0; \/\/ eax\n v0 = time(0);\n srand(v0);\n wprintf(&unk_80488B0);\n rand();\n return wprintf(&unk_8048960);\n}<\/code><\/pre>\n\/\/prompt_authentication()\nint prompt_authentication()\n{\n return wprintf(&unk_80489F8);\n}<\/code><\/pre>\n\/\/authenticate()\nvoid authenticate()\n{\n wchar_t ws[8192]; \/\/ [esp+1Ch] [ebp-800Ch]\n wchar_t *s2; \/\/ [esp+801Ch] [ebp-Ch]\n\n s2 = (wchar_t *)decrypt(&s, &dword_8048A90);\n if ( fgetws(ws, 0x2000, stdin) )\n {\n ws[wcslen(ws) - 1] = 0;\n if ( !wcscmp(ws, s2) )\n wprintf(&unk_8048B44);\n else\n wprintf(&unk_8048BA4);\n }\n free(s2);\n}<\/code><\/pre>\nauthenticate()<\/code>\u6bd4\u8f83\u91cd\u8981\uff0c\u89c2\u5bdf\u8fd9\u4e2a\u51fd\u6570\u53ef\u4ee5\u770b\u5230\u6709\u4e00\u4e2adecrypt<\/code>\u7684\u51fd\u6570\uff0c\u5c06dword_8048A90<\/code>\u7ed9\u52a0\u5bc6\u4e86\uff0c\u518d\u5f80\u4e0b\u770b\uff0c\u5c06\u8f93\u5165\u7684 ws \u503c\u4e0e s2 \u8fdb\u884c\u5bf9\u6bd4\uff0c\u6253\u5370\uff0c\u53ef\u4ee5\u5206\u6790\u5f97\u51fa s2 \u5c31\u662f flag \u3002<\/p>\n![\"image-20220513234634711\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132346975.png\")
<\/div><\/p>\ncsaw2013reversing2<\/h1>\n
![\"image-20220220113950597\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350447.png\")
<\/div><\/p>\n![\"image-20220220114035416\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350448.png\")
<\/div><\/p>\n![\"image-20220220114112765\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350449.png\")
<\/div><\/p>\n\/\/main()\nint __cdecl __noreturn main(int argc, const char **argv, const char **envp)\n{\n int v3; \/\/ ecx\n CHAR *lpMem; \/\/ [esp+8h] [ebp-Ch]\n HANDLE hHeap; \/\/ [esp+10h] [ebp-4h]\n\n hHeap = HeapCreate(0x40000u, 0, 0);\n lpMem = (CHAR *)HeapAlloc(hHeap, 8u, MaxCount + 1);\n memcpy_s(lpMem, MaxCount, &unk_409B10, MaxCount);\n if ( sub_40102A() || IsDebuggerPresent() )\n {\n __debugbreak();\n sub_401000(v3 + 4, lpMem);\n ExitProcess(0xFFFFFFFF);\n }\n MessageBoxA(0, lpMem + 1, "Flag", 2u);\n HeapFree(hHeap, 0, lpMem);\n HeapDestroy(hHeap);\n ExitProcess(0);\n}<\/code><\/pre>\nsub_40102A()<\/code> \u6216 IsDebuggerPresent()<\/code> \u7684\u8fd4\u56de\u503c\u4e3a\u771f\uff0c\u5219\u6267\u884c\u8c03\u8bd5\u65ad\u70b9\u6307\u4ee4 __debugbreak()<\/code>\u3001sub_401000(v3 + 4, lpMem)<\/code>\u3001ExitProcess(0xFFFFFFFF)<\/code>\uff0c\u5426\u5219\u6267\u884c MessageBoxA(0, lpMem + 1, "Flag", 2u)<\/code>\u3002<\/p>\nsub_40102A()<\/code>:<\/p>\nint sub_40102A()\n{\n char v0; \/\/ t1\n\n v0 = *(_BYTE *)(*(_DWORD *)(__readfsdword(0x18u) + 48) + 2);\n return 0;\n}<\/code><\/pre>\nIsDebuggerPresent()<\/code>\u662f\u4e00\u4e2a\u5224\u65ad\u662f\u5426\u5904\u4e8e\u8c03\u8bd5\u72b6\u6001\u7684\u5e93\u51fd\u6570\uff0c\u82e5\u7a0b\u5e8f\u5904\u4e8e\u8c03\u8bd5\u6a21\u5f0f\u4e0b\uff0c\u5219\u8fd4\u56de\u503c\u4e3a\u975e\u96f6\uff1b\u82e5\u672a\u5904\u4e8e\u8c03\u8bd5\u6a21\u5f0f\u4e0b\uff0c\u5219\u8fd4\u56de\u503c\u4e3a\u96f6\u3002<\/p>\nsub_401000()<\/code> \u67e5\u770b\u5176\u53cd\u7f16\u8bd1\u4ee3\u7801\uff1a<\/p>\nunsigned int __fastcall sub_401000(int a1, int a2)\n{\n int v2; \/\/ esi\n unsigned int v3; \/\/ eax\n unsigned int v4; \/\/ ecx\n unsigned int result; \/\/ eax\n\n v2 = dword_409B38;\n v3 = a2 + 1 + strlen((const char *)(a2 + 1)) + 1;\n v4 = 0;\n result = ((v3 - (a2 + 2)) >> 2) + 1;\n if ( result )\n {\n do\n *(_DWORD *)(a2 + 4 * v4++) ^= v2;\n while ( v4 < result );\n }\n return result;\n}<\/code><\/pre>\n![\"image-20220220121732196\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350450.png\")
<\/div><\/p>\nint 3<\/code> \u4e2d\u65ad\u5373\u4e3a\u8c03\u8bd5\u65ad\u70b9\u6307\u4ee4\uff0c\u5c06\u5149\u6807\u7f6e\u4e8e\u4e2d\u65ad\u6307\u4ee4\u6240\u5728\u884c\uff0c\u4f9d\u6b21\u70b9\u51fb Edit -> Patch program -> Assemble<\/strong>\uff0c\u5c06\u5176\u6539\u4e3a\u7a7a\u6307\u4ee4 nop<\/code>\u3002<\/p>\njmp short loc_4010EF<\/code> \u4fee\u6539\u4e3a jmp short loc_4010B9<\/code>\uff0c\u5c06 jz short loc_4010B9<\/code> \u4fee\u6539\u4e3a jmp short loc_401096<\/code><\/p>\n![\"image-20220220122321254\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350451.png\")
<\/div><\/p>\n![\"image-20220220122512485\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350452.png\")
<\/div><\/p>\ngetit<\/h1>\n
![\"image-20220220130946299\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350453.png\")
<\/div><\/p>\n![\"image-20220220131149152\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350454.png\")
<\/div><\/p>\n\/\/main()\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n char v3; \/\/ al\n __int64 v5; \/\/ [rsp+0h] [rbp-40h]\n int i; \/\/ [rsp+4h] [rbp-3Ch]\n FILE *stream; \/\/ [rsp+8h] [rbp-38h]\n char filename[8]; \/\/ [rsp+10h] [rbp-30h]\n unsigned __int64 v9; \/\/ [rsp+28h] [rbp-18h]\n\n v9 = __readfsqword(0x28u);\n LODWORD(v5) = 0;\n while ( (signed int)v5 < strlen(s) )\n {\n if ( v5 & 1 )\n v3 = 1;\n else\n v3 = -1;\n *(&t + (signed int)v5 + 10) = s[(signed int)v5] + v3;\n LODWORD(v5) = v5 + 1;\n }\n strcpy(filename, "\/tmp\/flag.txt");\n stream = fopen(filename, "w");\n fprintf(stream, "%s\\n", u, v5);\n for ( i = 0; i < strlen(&t); ++i )\n {\n fseek(stream, p[i], 0);\n fputc(*(&t + p[i]), stream);\n fseek(stream, 0LL, 0);\n fprintf(stream, "%s\\n", u);\n }\n fclose(stream);\n remove(filename);\n return 0;\n}<\/code><\/pre>\nwhile ( (signed int)v5 < strlen(s) )\n {\n if ( v5 & 1 )\n v3 = 1;\n else\n v3 = -1;\n *(&t + (signed int)v5 + 10) = s[(signed int)v5] + v3;\n LODWORD(v5) = v5 + 1; \n }<\/code><\/pre>\n![\"image-20220220132813608\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350455.png\")
<\/div><\/p>\nt=SharifCTF{????????????????????????????????}\ns='c61b68366edeb7bdce3c6820314b7498'<\/code><\/pre>\n#include <stdio.h>\n#include <string.h>\nint main()\n{\n char s[]="c61b68366edeb7bdce3c6820314b7498";\n char t[]="SharifCTF{????????????????????????????????}";\n int v5=0;\n int v3=0;\n while(v5<strlen(s))\n {\n if(v5&1)\n v3=1;\n else\n v3=-1;\n t[v5+10]=s[v5]+v3;\n v5+=1;\n }\n printf("%s",t);\n return 0;\n}\n<\/code><\/pre>\n![\"image-20220220133514410\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350456.png\")
<\/div><\/p>\nmaze<\/h1>\n
![\"image-20220220133628618\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350457.png\")
<\/div><\/p>\n![\"image-20220220133920933\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350458.png\")
<\/div><\/p>\n\/\/main()\n__int64 __fastcall main(__int64 a1, char **a2, char **a3)\n{\n const char *v3; \/\/ rsi\n signed __int64 v4; \/\/ rbx\n signed int v5; \/\/ eax\n char v6; \/\/ bp\n char v7; \/\/ al\n const char *v8; \/\/ rdi\n __int64 v10; \/\/ [rsp+0h] [rbp-28h]\n\n v10 = 0LL;\n puts("Input flag:");\n scanf("%s", &s1, 0LL);\n if ( strlen(&s1) != 24 || (v3 = "nctf{", strncmp(&s1, "nctf{", 5uLL)) || *(&byte_6010BF + 24) != 125 )\n {\nLABEL_22:\n puts("Wrong flag!");\n exit(-1);\n }\n v4 = 5LL;\n if ( strlen(&s1) - 1 > 5 )\n {\n while ( 1 )\n {\n v5 = *(&s1 + v4);\n v6 = 0;\n if ( v5 > 78 )\n {\n v5 = (unsigned __int8)v5;\n if ( (unsigned __int8)v5 == 79 )\n {\n v7 = sub_400650((char *)&v10 + 4, v3);\n goto LABEL_14;\n }\n if ( v5 == 111 )\n {\n v7 = sub_400660((char *)&v10 + 4, v3);\n goto LABEL_14;\n }\n }\n else\n {\n v5 = (unsigned __int8)v5;\n if ( (unsigned __int8)v5 == 46 )\n {\n v7 = sub_400670(&v10, v3);\n goto LABEL_14;\n }\n if ( v5 == 48 )\n {\n v7 = sub_400680(&v10, v3);\nLABEL_14:\n v6 = v7;\n goto LABEL_15;\n }\n }\nLABEL_15:\n v3 = (const char *)HIDWORD(v10);\n if ( !(unsigned __int8)sub_400690(asc_601060, HIDWORD(v10), (unsigned int)v10) )\n goto LABEL_22;\n if ( ++v4 >= strlen(&s1) - 1 )\n {\n if ( v6 )\n break;\nLABEL_20:\n v8 = "Wrong flag!";\n goto LABEL_21;\n }\n }\n }\n if ( asc_601060[8 * (signed int)v10 + SHIDWORD(v10)] != 35 )\n goto LABEL_20;\n v8 = "Congratulations!";\nLABEL_21:\n puts(v8);\n return 0LL;\n}<\/code><\/pre>\nbool __fastcall sub_400650(_DWORD *a1)\/\/(_DWORD *)&v9 + 1 'O'\n{\n int v1; \/\/ eax\n\n v1 = (*a1)--;\n return v1 > 0;\n}<\/code><\/pre>\nbool __fastcall sub_400660(int *a1)\/\/(int *)&v9 + 1 'o'\n{\n int v1; \/\/ eax\n\n v1 = *a1 + 1;\n *a1 = v1;\n return v1 < 8;\n}<\/code><\/pre>\nbool __fastcall sub_400670(_DWORD *a1)\/\/&v9 '.'\n{\n int v1; \/\/ eax\n\n v1 = (*a1)--;\n return v1 > 0;\n}<\/code><\/pre>\nbool __fastcall sub_400680(int *a1)\/\/&v9 '0'\n{\n int v1; \/\/ eax\n\n v1 = *a1 + 1;\n *a1 = v1;\n return v1 < 8;\n}<\/code><\/pre>\n\n
![\"image-20220220134817151\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202205132350459.png\")
<\/div><\/p>\n ******\n* * *\n*** * **\n** * **\n* *# *\n** *** *\n** *\n********<\/code><\/pre>\nif ( strlen(&s1) != 24 || (v3 = "nctf{", strncmp(&s1, "nctf{", 5uLL)) || *(&byte_6010BF + 24) != 125 )<\/code><\/pre>\n