文章目錄

• [FlareOn2]very_success
• • 拖入ida
  • 分析sub_401084
  • 腳本
• [FlareOn3]Challenge1
• • 拖進(jìn)ida
  • sub_511260((int)Buffer, NumberOfBytesWritten - 2)
  • 碼表

[FlareOn2]very_success

拖入ida

一開始我以為加殼了，就倆函數(shù)，后來仔細(xì)看了看，沒有。。

這里和輸入相關(guān)v4，v4的值是輸入字符串的長度+2，v5是一個(gè)地址值。unk_402159是輸入字符串的地址，作為參數(shù)傳入了判斷函數(shù)，retaddr是和輸入字符串相對于判斷的字符串。

分析sub_401084

v8參與運(yùn)算，結(jié)果放入了v12，v11每次都是1

v8和v15異或，看匯編就知道只運(yùn)算了低8位，v15為0xc7

v4初始為0，每次加v12，即每次加一個(gè)字節(jié)參與運(yùn)算后的結(jié)果

這里a4判斷了大于37，也就是說，輸入字符必須是35個(gè)字符以上

這是判斷字符串地址0x401108，動(dòng)調(diào)取出字符串。

AA EC A4 BA AF AE AA 8A C0 A7 B0 BC 9A BA A5 A5 BA AF B8 9D B8 F9 AE 9D AB B4 BC B6 B3 90 9A A8

A8是字符串最后一個(gè)，它從最后一個(gè)開始判斷，我一直以為A8是第一個(gè)，它是慢慢填充的，結(jié)果………………一直忽視了那個(gè)+36

這里也就是對輸入字符進(jìn)行一些字符操作，然后進(jìn)行和已知字符數(shù)組判斷是否相同嘍，分析完畢，開寫腳本

腳本

a=[0xAA,0xEC,0xA4,0xBA,0xAF,0xAE,0xAA,0x8A,0xC0,0xA7,0xB0,0xBC,0x9A,0xBA,0xA5,0xA5,0xBA,0xAF,0xB8,0x9D,0xB8,0xF9,0xAE ,0x9D,0xAB,0xB4,0xBC,0xB6,0xB3,0x90,0x9A,0xA8] a=a[::-1] flag="" v4=0 for i in range(len(a)):tmp=(1<<(v4&0x3))flag+=chr((a[i]-tmp-1)^0xc7)v4+=a[i] print(flag)

flag{a_Little_b1t_harder_plez@flare-on.com}

貼一下其它博主的學(xué)習(xí)一下：

def rol(value, count):temp=((value>>(8-count))&0xFF)|((value<<count)& 0xFF)return temp v7=[0xAA, 0xEC, 0xA4, 0xBA, 0xAF, 0xAE, 0xAA, 0x8A, 0xC0, 0xA7,0xB0, 0xBC, 0x9A, 0xBA, 0xA5, 0xA5, 0xBA, 0xAF, 0xB8, 0x9D,0xB8, 0xF9, 0xAE, 0x9D, 0xAB, 0xB4, 0xBC, 0xB6, 0xB3, 0x90,0x9A, 0xA8] flag='' v4=0 for i in range(len(v7)):flag+=chr((v7[len(v7)-i-1]-rol(1,v4&3)-1)^0xC7)v4+=v7[len(v7)-i-1] print('flag{'+flag+'n.com}') sumv = 0 lenv = 37 rolv = 1 flag = 1 result = ''values = [0xa8,0x9a,0x90,0xb3,0xb6,0xbc,0xb4,0xab,0x9d,0xae,0xf9,0xb8,0x9d,0xb8,0xaf,0xba,0xa5,0xa5,0xba,0x9a,0xbc,0xb0,0xa7,0xc0,0x8a,0xaa,0xae,0xaf,0xba,0xa4,0xec,0xaa,0xae,0xeb,0xad,0xaa,0xaf,] for i in range(37):rolv = (1 << (sumv & 3)) % 256code = (455 ^ (values[i] - rolv - flag)% 256) %256result = result + chr(code)sumv = sumv + values[i] print result

[FlareOn3]Challenge1

拖進(jìn)ida

主要函數(shù)sub_511260((int)Buffer, NumberOfBytesWritten - 2)

sub_511260((int)Buffer, NumberOfBytesWritten - 2)

_BYTE *__cdecl sub_511260(int a1, unsigned int a2) {int v3; // [esp+Ch] [ebp-24h]int v4; // [esp+10h] [ebp-20h]int v5; // [esp+14h] [ebp-1Ch]int i; // [esp+1Ch] [ebp-14h]unsigned int v7; // [esp+20h] [ebp-10h]_BYTE *v8; // [esp+24h] [ebp-Ch]int v9; // [esp+28h] [ebp-8h]int v10; // [esp+28h] [ebp-8h]unsigned int v11; // [esp+2Ch] [ebp-4h]v8 = malloc(4 * ((a2 + 2) / 3) + 1);if ( !v8 )return 0;v11 = 0;v9 = 0;while ( v11 < a2 ){v5 = *(unsigned __int8 *)(v11 + a1);if ( ++v11 >= a2 ){v4 = 0;}else{v4 = *(unsigned __int8 *)(v11 + a1);++v11;}if ( v11 >= a2 ){v3 = 0;}else{v3 = *(unsigned __int8 *)(v11 + a1);++v11;}v7 = v3 + (v5 << 16) + (v4 << 8);v8[v9] = byte_523000[(v7 >> 18) & 0x3F];v10 = v9 + 1;v8[v10] = byte_523000[(v7 >> 12) & 0x3F];v8[++v10] = byte_523000[(v7 >> 6) & 0x3F];v8[++v10] = byte_523000[v3 & 0x3F];v9 = v10 + 1;}for ( i = 0; i < byte_523040[a2 % 3]; ++i )v8[4 * ((a2 + 2) / 3) - i - 1] = '=';v8[4 * ((a2 + 2) / 3)] = 0;return v8; }

三個(gè)一組，進(jìn)行變換，而且還涉及到能不能被3整除，一看 就是base64，先找碼表

碼表

ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/

剛開始我還一直在算這里

v7 = v3 + (v5 << 16) + (v4 << 8);v8[v9] = byte_523000[(v7 >> 18) & 0x3F];v10 = v9 + 1;v8[v10] = byte_523000[(v7 >> 12) & 0x3F];v8[++v10] = byte_523000[(v7 >> 6) & 0x3F];v8[++v10] = byte_523000[v3 & 0x3F];v9 = v10 + 1;

后來忽然看到碼表。。不淡定了。。

sh00ting_phish_in_a_barrel@flare-on.com

總結(jié)

以上是生活随笔為你收集整理的[FlareOn2]very_success [FlareOn3]Challenge1的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。