附件：https://files.buuoj.cn/files/7458c5c0ce999ac491df13cf7a7ed9f1/SimpleRev
- 查壳
64位ELF文件，无壳
- IDApro处理，f5
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
int v3; // eax
char v4; // [rsp+Fh] [rbp-1h]
while ( 1 )
{
while ( 1 )
{
printf("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ");
v4 = getchar();
if ( v4 != 100 && v4 != 68 )
break;
Decry();
}
if ( v4 == 113 || v4 == 81 )
Exit("Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: ", argv);
puts("Input fault format!");
v3 = getchar();
putchar(v3);
}
}
分析代码，重点在Decry函数
- 跟进去，进行分析
unsigned __int64 Decry()
{
char v1; // [rsp+Fh] [rbp-51h]
int v2; // [rsp+10h] [rbp-50h]
int v3; // [rsp+14h] [rbp-4Ch]
int i; // [rsp+18h] [rbp-48h]
int v5; // [rsp+1Ch] [rbp-44h]
char src[8]; // [rsp+20h] [rbp-40h] BYREF
__int64 v7; // [rsp+28h] [rbp-38h]
int v8; // [rsp+30h] [rbp-30h]
__int64 v9[2]; // [rsp+40h] [rbp-20h] BYREF
int v10; // [rsp+50h] [rbp-10h]
unsigned __int64 v11; // [rsp+58h] [rbp-8h]
v11 = __readfsqword('(');
*(_QWORD *)src = 'SLCDN';
v7 = 0LL;
v8 = 0;
v9[0] = 'wodah';
v9[1] = 0LL;
v10 = 0;
text = join(key3, (const char *)v9); // text = "killshadow"
strcpy(key, key1);
strcat(key, src);
v2 = 0;
v3 = 0;
getchar();
v5 = strlen(key);//v5==>10
for ( i = 0; i < v5; ++i )
{
if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )
key[i] = key[v3 % v5] + 32;
++v3;
} //key = "ADSFKNDCLS" ==>"adsfkndcls"
/*
将key中的大写字母转换为小写字母
*/
printf("Please input your flag:");
while ( 1 )
{
v1 = getchar();
if ( v1 == 10 ) //0x0a 结束输入
break;
if ( v1 == 32 ) //0x20 v2加1
{
++v2;
}
else
{
if ( v1 <= 96 || v1 > 122 )
{
if ( v1 > 64 && v1 <= 90 ) //大写
{
str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97;
++v3;
}
}
else // (97,122] 小写字母
{
str2[v2] = (v1 - 39 - key[v3 % v5] + 97) % 26 + 97; //[65-90]
++v3;
}
//对str2中的字母最后转换为小写
if ( !(v3 % v5) ) //判断str2的长度是否是key的整数倍，整数倍就输出空格
putchar(32);
++v2; //v2统计输入的字符个数、指向下一个字符位置
}
}
if ( !strcmp(text, str2) )
puts("Congratulation!\n");
else
puts("Try again!\n");
return __readfsqword(0x28u) ^ v11;
}
-
分析结果
读取输入的字符串(以回车符结束)》对每个字母进行处理(v1 - 39 - key[v3 % v5] + 97) % 26 + 97》和"killshadow"进行比较 -
逆向分析
将整个流程反推即可
》payload
lt='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
key=list('ADSFKNDCLS'.lower())
klens=len(key)
text='killshadow'
flag=''
for i in range(len(text)):
str2=text[i]
for c in lt:
if str2== chr((ord(c) - 39 - ord(key[i % klens]) + 97) % 26 + 97):
flag+=c
print('flag{'+flag+'}')
小结
个人代码分析能力比较弱，分析程序意图的能力还有待提高