文章目錄

• [FlareOn2]very_success
• • 拖入ida
  • 分析sub_401084
  • 腳本
• [FlareOn3]Challenge1
• • 拖進ida
  • sub_511260((int)Buffer, NumberOfBytesWritten - 2)
  • 碼表

[FlareOn2]very_success

拖入ida

一開始我以為加殼了，就倆函數，后來仔細看了看，沒有。。

這里和輸入相關v4，v4的值是輸入字符串的長度+2，v5是一個地址值。unk_402159是輸入字符串的地址，作為參數傳入了判斷函數，retaddr是和輸入字符串相對于判斷的字符串。

分析sub_401084

v8參與運算，結果放入了v12，v11每次都是1

v8和v15異或，看匯編就知道只運算了低8位，v15為0xc7

v4初始為0，每次加v12，即每次加一個字節參與運算后的結果

這里a4判斷了大于37，也就是說，輸入字符必須是35個字符以上

這是判斷字符串地址0x401108，動調取出字符串。

AA EC A4 BA AF AE AA 8A C0 A7 B0 BC 9A BA A5 A5 BA AF B8 9D B8 F9 AE 9D AB B4 BC B6 B3 90 9A A8

A8是字符串最后一個，它從最后一個開始判斷，我一直以為A8是第一個，它是慢慢填充的，結果………………一直忽視了那個+36

這里也就是對輸入字符進行一些字符操作，然后進行和已知字符數組判斷是否相同嘍，分析完畢，開寫腳本

腳本

a=[0xAA,0xEC,0xA4,0xBA,0xAF,0xAE,0xAA,0x8A,0xC0,0xA7,0xB0,0xBC,0x9A,0xBA,0xA5,0xA5,0xBA,0xAF,0xB8,0x9D,0xB8,0xF9,0xAE ,0x9D,0xAB,0xB4,0xBC,0xB6,0xB3,0x90,0x9A,0xA8] a=a[::-1] flag="" v4=0 for i in range(len(a)):tmp=(1<<(v4&0x3))flag+=chr((a[i]-tmp-1)^0xc7)v4+=a[i] print(flag)

flag{a_Little_b1t_harder_plez@flare-on.com}

貼一下其它博主的學習一下：

def rol(value, count):temp=((value>>(8-count))&0xFF)|((value<<count)& 0xFF)return temp v7=[0xAA, 0xEC, 0xA4, 0xBA, 0xAF, 0xAE, 0xAA, 0x8A, 0xC0, 0xA7,0xB0, 0xBC, 0x9A, 0xBA, 0xA5, 0xA5, 0xBA, 0xAF, 0xB8, 0x9D,0xB8, 0xF9, 0xAE, 0x9D, 0xAB, 0xB4, 0xBC, 0xB6, 0xB3, 0x90,0x9A, 0xA8] flag='' v4=0 for i in range(len(v7)):flag+=chr((v7[len(v7)-i-1]-rol(1,v4&3)-1)^0xC7)v4+=v7[len(v7)-i-1] print('flag{'+flag+'n.com}') sumv = 0 lenv = 37 rolv = 1 flag = 1 result = ''values = [0xa8,0x9a,0x90,0xb3,0xb6,0xbc,0xb4,0xab,0x9d,0xae,0xf9,0xb8,0x9d,0xb8,0xaf,0xba,0xa5,0xa5,0xba,0x9a,0xbc,0xb0,0xa7,0xc0,0x8a,0xaa,0xae,0xaf,0xba,0xa4,0xec,0xaa,0xae,0xeb,0xad,0xaa,0xaf,] for i in range(37):rolv = (1 << (sumv & 3)) % 256code = (455 ^ (values[i] - rolv - flag)% 256) %256result = result + chr(code)sumv = sumv + values[i] print result

[FlareOn3]Challenge1

拖進ida

主要函數sub_511260((int)Buffer, NumberOfBytesWritten - 2)

sub_511260((int)Buffer, NumberOfBytesWritten - 2)

_BYTE *__cdecl sub_511260(int a1, unsigned int a2) {int v3; // [esp+Ch] [ebp-24h]int v4; // [esp+10h] [ebp-20h]int v5; // [esp+14h] [ebp-1Ch]int i; // [esp+1Ch] [ebp-14h]unsigned int v7; // [esp+20h] [ebp-10h]_BYTE *v8; // [esp+24h] [ebp-Ch]int v9; // [esp+28h] [ebp-8h]int v10; // [esp+28h] [ebp-8h]unsigned int v11; // [esp+2Ch] [ebp-4h]v8 = malloc(4 * ((a2 + 2) / 3) + 1);if ( !v8 )return 0;v11 = 0;v9 = 0;while ( v11 < a2 ){v5 = *(unsigned __int8 *)(v11 + a1);if ( ++v11 >= a2 ){v4 = 0;}else{v4 = *(unsigned __int8 *)(v11 + a1);++v11;}if ( v11 >= a2 ){v3 = 0;}else{v3 = *(unsigned __int8 *)(v11 + a1);++v11;}v7 = v3 + (v5 << 16) + (v4 << 8);v8[v9] = byte_523000[(v7 >> 18) & 0x3F];v10 = v9 + 1;v8[v10] = byte_523000[(v7 >> 12) & 0x3F];v8[++v10] = byte_523000[(v7 >> 6) & 0x3F];v8[++v10] = byte_523000[v3 & 0x3F];v9 = v10 + 1;}for ( i = 0; i < byte_523040[a2 % 3]; ++i )v8[4 * ((a2 + 2) / 3) - i - 1] = '=';v8[4 * ((a2 + 2) / 3)] = 0;return v8; }

三個一組，進行變換，而且還涉及到能不能被3整除，一看 就是base64，先找碼表

碼表

ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/

剛開始我還一直在算這里

v7 = v3 + (v5 << 16) + (v4 << 8);v8[v9] = byte_523000[(v7 >> 18) & 0x3F];v10 = v9 + 1;v8[v10] = byte_523000[(v7 >> 12) & 0x3F];v8[++v10] = byte_523000[(v7 >> 6) & 0x3F];v8[++v10] = byte_523000[v3 & 0x3F];v9 = v10 + 1;

后來忽然看到碼表。。不淡定了。。

sh00ting_phish_in_a_barrel@flare-on.com

總結

以上是生活随笔為你收集整理的[FlareOn2]very_success [FlareOn3]Challenge1的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。