https://cgctf.nuptsast.com/files/2.asm

題解：

int main(int argc, char const *argv[]) {char input[] = {0x0, 0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c};func(input, 28);printf("%s\n",input+1);return 0; }

2.asm文件?

00000000004004e6 <func>:4004e6: 55 push rbp4004e7: 48 89 e5 mov rbp,rsp4004ea: 48 89 7d e8 mov QWORD PTR [rbp-0x18],rdi4004ee: 89 75 e4 mov DWORD PTR [rbp-0x1c],esi4004f1: c7 45 fc 01 00 00 00 mov DWORD PTR [rbp-0x4],0x14004f8: eb 28 jmp 400522 <func+0x3c>4004fa: 8b 45 fc mov eax,DWORD PTR [rbp-0x4]4004fd: 48 63 d0 movsxd rdx,eax400500: 48 8b 45 e8 mov rax,QWORD PTR [rbp-0x18]400504: 48 01 d0 add rax,rdx400507: 8b 55 fc mov edx,DWORD PTR [rbp-0x4]40050a: 48 63 ca movsxd rcx,edx40050d: 48 8b 55 e8 mov rdx,QWORD PTR [rbp-0x18]400511: 48 01 ca add rdx,rcx400514: 0f b6 0a movzx ecx,BYTE PTR [rdx]400517: 8b 55 fc mov edx,DWORD PTR [rbp-0x4]40051a: 31 ca xor edx,ecx40051c: 88 10 mov BYTE PTR [rax],dl40051e: 83 45 fc 01 add DWORD PTR [rbp-0x4],0x1400522: 8b 45 fc mov eax,DWORD PTR [rbp-0x4]400525: 3b 45 e4 cmp eax,DWORD PTR [rbp-0x1c]400528: 7e d0 jle 4004fa <func+0x14>40052a: 90 nop40052b: 5d pop rbp40052c: c3 ret

00000000004004e6 <func>: ; 虛擬地址 ; 對應的計算機指令 ; 匯編語言4004e6: 55 push rbp ; 將寄存器的值壓入棧中 /* 這兩行是每個函數都會有的，有關函數調用的4004e7: 48 89 e5 mov rbp,rsp ; 建立新棧幀 */4004ea: 48 89 7d e8 mov QWORD PTR [rbp-0x18],rdi ; rdi存第一個參數 //[rbp-0x18] = input[0]4004ee: 89 75 e4 mov DWORD PTR [rbp-0x1c],esi ; esi存第二個參數 //[rbp-0x1c] = 284004f1: c7 45 fc 01 00 00 00 mov DWORD PTR [rbp-0x4],0x1 ; 首先將0x1賦值給[rbp-0x4] //i = 14004f8: eb 28 jmp 400522 <func+0x3c> ; 無條件跳轉到4005224004fa: 8b 45 fc mov eax,DWORD PTR [rbp-0x4] ; [rbp-0x4]賦值給eax // eax=i=14004fd: 48 63 d0 movsxd rdx,eax ; eax符號擴展給rdx // rdx=eax=i=1400500: 48 8b 45 e8 mov rax,QWORD PTR [rbp-0x18] ; 把input[0]復制給 rax // rax=[rbp-0x18]=input[0]400504: 48 01 d0 add rax,rdx ; rax += rdx // rax=input[0]+=i400507: 8b 55 fc mov edx,DWORD PTR [rbp-0x4] ; [rbp-0x4]的值給edx //即令edx=i=140050a: 48 63 ca movsxd rcx,edx ; edx符號擴展給rcx // rcx=edx=i=140050d: 48 8b 55 e8 mov rdx,QWORD PTR [rbp-0x18] ; [rbp-0x18]給rdx //rdx = [rbp-0x18] = *input = input[0]400511: 48 01 ca add rdx,rcx ; rcx += rdx // rdx = input[1]400514: 0f b6 0a movzx ecx,BYTE PTR [rdx] ; 將rdx無符號擴展，并傳送至ecx //即ecx=chr(rdx) =chr(input[0])400517: 8b 55 fc mov edx,DWORD PTR [rbp-0x4] ; [rbp-0x4]賦值給edx // edx = i = 1 40051a: 31 ca xor edx,ecx ; edx ^ ecx結果存到dx // input[0] ^ i40051c: 88 10 mov BYTE PTR [rax],dl ; rax = dl dx的低8位(dl)存到rax40051e: 83 45 fc 01 add DWORD PTR [rbp-0x4],0x1 ; [rbp-0x4] += 1 // i++400522: 8b 45 fc mov eax,DWORD PTR [rbp-0x4] ; 把[rbp-0x4]賦值給eax400525: 3b 45 e4 cmp eax,DWORD PTR [rbp-0x1c] ; eax和[rbp-0x1c]判斷400528: 7e d0 jle 4004fa <func+0x14> ; 如果eax <= [rbp-0x1c] 跳轉到4004fa40052a: 90 nop40052b: 5d pop rbp ; rbp出棧40052c: c3 ret ; return 返回地址 //取出當前棧頂值，作為返回地址

?C++版本

char * func(char* inputs,int num){char * flag=new char[num];for(int i=1;i<=28;i++)flag[i-1]=(char)(inputs[i-1]^i);return flag; } int main(){char inputs[]={0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c};char * flag = func(inputs, 28);printf("%s",flag); } //flag{read_asm_is_the_basic}

?Python版本

def func(inputs, num):flag = ''for i in range(1, num):flag += chr(inputs[i-1] ^ i)return flagdef main():inputs = [0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c]flag = func(inputs, 28)print flagif __name__=='__main__':main()# flag{read_asm_is_the_basic}

?

總結

以上是生活随笔為你收集整理的CG CTF RE ReadAsm2的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。