BUU-[SWPU2019]ReverseMe

yu遇到复杂的函数不妨动态跟一下

程序流程很清晰

1.输入判断是否为32位

2.与字符串 SWPU_2019_CTF 异或

3.maincode加密

4.对比

这里的加密函数极为复杂我们用x32dbg跟一下发现仍然是一个异或加密

BUU-[SWPU2019]ReverseMe

异或数据如下

BUU-[SWPU2019]ReverseMe

直接异或解密得到flag

from pwn import *
mid1 = 'SWPU_2019_CTFSWPU_2019_CTFSWPU_2019_CTF'
mid2 = []
f = open('so.in')
for i in range(2):
    s = f.readline()
    for j in range(16):
        mid2.append(int(s[j*3:j*3+2],16))
end = ''
end += p32(0xF80F37B3)
end += p32(0x5DAEBCBC)
end += p32(0x864D5ABA)
end += p32(0xD3629744)
end += p32(0x1624BA4F)
end += p32(0x1A729F0B)
end += p32(0x266D6865)
end += p32(0x67C86BBA)
flag = ''
for i in range(32):
    flag += chr(ord(end[i]) ^ ord(mid1[i]) ^ mid2[i])
print flag




so.in
86 0C 3E CA 98 D7 AE 19 E2 77 6B A6 6A A1 77 B0
69 91 37 05 7A F9 7B 30 43 5A 4B 10 86 7D D4 28

View Code