hitconctf2022 Meow Way

1. int __cdecl main(int argc, const char **argv, const char **envp)
2. {
3.   char v4; // [esp+0h] [ebp-24h]
4.   int v5; // [esp+0h] [ebp-24h]
5.   int flag; // [esp+14h] [ebp-10h]
6.   _DWORD v7[2]; // [esp+18h] [ebp-Ch] BYREF
8.   v7[0] = -1;
9.   v7[1] = -1;
10.   if ( argc < 2 )
11.   {
12.     sub_921340("Usage: %s <flag>\n", (char)*argv);
13.     exit(1);
14.   }
15.   if ( strlen(argv[1]) != 48 )
16.   {
17.     sub_921340("Wrong length\n", v4);
18.     exit(1);
19.   }
20.   flag = (int)argv[1];
21.   off_92544C(flag, flag >> 31, flag, flag >> 31, 196, 0, v7, (int)v7 >> 31);
22.   ++flag;
23.   off_9253A8(flag, flag >> 31, flag, flag >> 31, 22, 0, v7, (int)v7 >> 31);
24.   ++flag;
25.   off_9253B4(flag, flag >> 31, flag, flag >> 31, 142, 0, v7, (int)v7 >> 31);
26.   ++flag;
27.   off_9253F0(flag, flag >> 31, flag, flag >> 31, 119, 0, v7, (int)v7 >> 31);
28.   ++flag;
29.   off_925448(flag, flag >> 31, flag, flag >> 31, 5, 0, v7, (int)v7 >> 31);
30.   ++flag;
31.   off_9253FC(flag, flag >> 31, flag, flag >> 31, 185, 0, v7, (int)v7 >> 31);
32.   ++flag;
33.   off_925400(flag, flag >> 31, flag, flag >> 31, 13, 0, v7, (int)v7 >> 31);
34.   ++flag;
35.   off_925410(flag, flag >> 31, flag, flag >> 31, 107, 0, v7, (int)v7 >> 31);
36.   ++flag;
37.   off_9253F8(flag, flag >> 31, flag, flag >> 31, 36, 0, v7, (int)v7 >> 31);
38.   ++flag;
39.   off_925430(flag, flag >> 31, flag, flag >> 31, 85, 0, v7, (int)v7 >> 31);
40.   ++flag;
41.   off_9253D0(flag, flag >> 31, flag, flag >> 31, 18, 0, v7, (int)v7 >> 31);
42.   ++flag;
43.   off_925434(flag, flag >> 31, flag, flag >> 31, 53, 0, v7, (int)v7 >> 31);
44.   ++flag;
45.   off_92545C(flag, flag >> 31, flag, flag >> 31, 118, 0, v7, (int)v7 >> 31);
46.   ++flag;
47.   off_925454(flag, flag >> 31, flag, flag >> 31, 231, 0, v7, (int)v7 >> 31);
48.   ++flag;
49.   off_9253C0(flag, flag >> 31, flag, flag >> 31, 251, 0, v7, (int)v7 >> 31);
50.   ++flag;
51.   off_9253E4(flag, flag >> 31, flag, flag >> 31, 160, 0, v7, (int)v7 >> 31);
52.   ++flag;
53.   off_9253C4(flag, flag >> 31, flag, flag >> 31, 218, 0, v7, (int)v7 >> 31);
54.   ++flag;
55.   off_925440(flag, flag >> 31, flag, flag >> 31, 52, 0, v7, (int)v7 >> 31);
56.   ++flag;
57.   off_9253BC(flag, flag >> 31, flag, flag >> 31, 132, 0, v7, (int)v7 >> 31);
58.   ++flag;
59.   off_9253AC(flag, flag >> 31, flag, flag >> 31, 180, 0, v7, (int)v7 >> 31);
60.   ++flag;
61.   off_925408(flag, flag >> 31, flag, flag >> 31, 200, 0, v7, (int)v7 >> 31);
62.   ++flag;
63.   off_9253D8(flag, flag >> 31, flag, flag >> 31, 155, 0, v7, (int)v7 >> 31);
64.   ++flag;
65.   off_9253B8(flag, flag >> 31, flag, flag >> 31, 239, 0, v7, (int)v7 >> 31);
66.   ++flag;
67.   off_9253C8(flag, flag >> 31, flag, flag >> 31, 180, 0, v7, (int)v7 >> 31);
68.   ++flag;
69.   off_9253E0(flag, flag >> 31, flag, flag >> 31, 185, 0, v7, (int)v7 >> 31);
70.   ++flag;
71.   off_925418(flag, flag >> 31, flag, flag >> 31, 10, 0, v7, (int)v7 >> 31);
72.   ++flag;
73.   off_9253EC(flag, flag >> 31, flag, flag >> 31, 87, 0, v7, (int)v7 >> 31);
74.   ++flag;
75.   off_925414(flag, flag >> 31, flag, flag >> 31, 92, 0, v7, (int)v7 >> 31);
76.   ++flag;
77.   off_925450(flag, flag >> 31, flag, flag >> 31, 254, 0, v7, (int)v7 >> 31);
78.   ++flag;
79.   off_9253E8(flag, flag >> 31, flag, flag >> 31, 197, 0, v7, (int)v7 >> 31);
80.   ++flag;
81.   off_9253D4(flag, flag >> 31, flag, flag >> 31, 106, 0, v7, (int)v7 >> 31);
82.   ++flag;
83.   off_92541C(flag, flag >> 31, flag, flag >> 31, 115, 0, v7, (int)v7 >> 31);
84.   ++flag;
85.   off_92542C(flag, flag >> 31, flag, flag >> 31, 73, 0, v7, (int)v7 >> 31);
86.   ++flag;
87.   off_925444(flag, flag >> 31, flag, flag >> 31, 189, 0, v7, (int)v7 >> 31);
88.   ++flag;
89.   off_925458(flag, flag >> 31, flag, flag >> 31, 17, 0, v7, (int)v7 >> 31);
90.   ++flag;
91.   off_925420(flag, flag >> 31, flag, flag >> 31, 214, 0, v7, (int)v7 >> 31);
92.   ++flag;
93.   off_9253B0(flag, flag >> 31, flag, flag >> 31, 143, 0, v7, (int)v7 >> 31);
94.   ++flag;
95.   off_9253DC(flag, flag >> 31, flag, flag >> 31, 107, 0, v7, (int)v7 >> 31);
96.   ++flag;
97.   off_925464(flag, flag >> 31, flag, flag >> 31, 10, 0, v7, (int)v7 >> 31);
98.   ++flag;
99.   off_9253CC(flag, flag >> 31, flag, flag >> 31, 151, 0, v7, (int)v7 >> 31);
100.   ++flag;
101.   off_925424(flag, flag >> 31, flag, flag >> 31, 171, 0, v7, (int)v7 >> 31);
102.   ++flag;
103.   off_92543C(flag, flag >> 31, flag, flag >> 31, 78, 0, v7, (int)v7 >> 31);
104.   ++flag;
105.   off_925404(flag, flag >> 31, flag, flag >> 31, 237, 0, v7, (int)v7 >> 31);
106.   ++flag;
107.   off_925428(flag, flag >> 31, flag, flag >> 31, 254, 0, v7, (int)v7 >> 31);
108.   ++flag;
109.   off_925460(flag, flag >> 31, flag, flag >> 31, 151, 0, v7, (int)v7 >> 31);
110.   ++flag;
111.   off_92540C(flag, flag >> 31, flag, flag >> 31, 249, 0, v7, (int)v7 >> 31);
112.   ++flag;
113.   off_9253F4(flag, flag >> 31, flag, flag >> 31, 152, 0, v7, (int)v7 >> 31);
114.   off_925438(flag + 1, (flag + 1) >> 31, flag + 1, (flag + 1) >> 31, 101, 0, v7, (int)v7 >> 31);
115.   v5 = memcmp(&unk_925018, argv[1], 0x30u);
116.   if ( v5 )
117.   {
118.     sub_921340("Wrong\n", v5);
119.     exit(-1);
120.   }
121.   sub_921340("I know you know the flag!\n", 0);
122.   return 0;
123. }

复制代码

ida打开简单审计代码可知程序对flag的每一位进行了操作，我们随便点击一个看一下，其他的依此类推。

 
 
 
 
 
 
最终来到这个函数，这里已经手动patch过了
可以f5看伪代码也可以直接看汇编
额这里为了好说明就看伪代码吧

 
 
其中a5是传入的参数，a2就是flag的密文，我们猜测(a5+36)的地址对应的值就是flag传入的一位，因此将每一个a5参数提取出来，猜测flag是按照从左往右的顺序加密。建flag的密文提取出来，然后将异或的每个值提取出来写出解密脚本

1. enc=[ 0x96, 0x50, 0xCF, 0x2C, 0xEB, 0x9B, 0xAA, 0xFB, 0x53, 0xAB,
2.   0x73, 0xDD, 0x6C, 0x9E, 0xDB, 0xBC, 0xEE, 0xAB, 0x23, 0xD6,
3.   0x16, 0xFD, 0xF1, 0xF0, 0xB9, 0x75, 0xC3, 0x28, 0xA2, 0x74,
4.   0x7D, 0xE3, 0x27, 0xD5, 0x95, 0x5C, 0xF5, 0x76, 0x75, 0xC9,
5.   0x8C, 0xFB, 0x42, 0x0E, 0xBD, 0x51, 0xA2, 0x98]
6. a=[196,22, 142, 119, 5,185, 13, 107, 36, 85,  18, 53, 118,  231,  251, 160, 218,  52,  132,  180,  200, 155,  239,  180, 185, 10, 87,  92, 254,  197,  106,115, 73, 189, 17,214,  143, 107,  10, 151,  171,  78,  237,  254,  151,  249,152,101]
7. k=[0xba,0x2f,0xcd,0xf6,0x9f,0xd0,0x22,0xf7,0xd0,0x1f,0xa8,0x3d,0xc7,0xa5,0x47,0x68,0xd7,0x4a,0x96,0x91,0x2e,0x19,0xc5,0xe3,0x88,0xbd,0x4e,0x93,0x13,0xf1,0xcc,0x47,0xab,0xc9,0x48,0x2b,0x9,0x50,0x4f,0xe9,0xc0,0x5e,0xef,0x8b,0x85,0xcb,0x55,0x70]
8. flag=""
9. for i in range(48):
10.   tmp=(enc[i]^k[i])-a[i]
11.   if tmp>0 and tmp<126:
12.     flag+=chr(tmp)
13.   elif tmp>=126:
14.     flag+=chr(256-tmp)
15.   elif tmp<0 and tmp>-126:
16.     flag+=chr(-tmp)
17.   else:
18.     flag+=chr(256+tmp)
19. print(flag)

复制代码

这里通过flag格式测试可知，范围为-126到126(也可以是-128到128)之间的数直接将其绝对值转为ascii对应的字符，范围之外的正数用256减去，负数用256加上。控制在ascii字符范围内。
最终得flag:hitcon{___7U5T_4_S1mpIE_xB6_M@G1C_4_mE0w_W@y___}

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！