UCSC-WP&复现reverse

UCSC-WP&复现reverse

easy_re-ucsc

main函数

1.   v7 = 10;
2.   strcpy(Str, "n=<;:h2<'?8:?'9hl9'h:l>'2>>2>hk=>;:?");
3.   for ( i = 0; i < strlen(Str); ++i )
4.     Str1[i] = xor(v7, Str[i]);
5.   Str1[strlen(Str)] = 0;
6.   printf(Format);
7.   scanf("%s", Str2);
8.   if ( !strcmp(Str1, Str2) )
9.     puts("win,TQLLLLLLL!!!");
10.   else
11.     puts("sorry,this is not flag");
12.   return 0;

复制代码

脚本

1. Str = "n=<;:h2<'?8:?'9hl9'h:l>'2>>2>hk=>;:?"
2. v7 = 10
3. Str1 = ''.join([chr(ord(c) ^ v7) for c in Str])
4. print(Str1)

复制代码

EZ_debug-ucsc

mian函数：

1.   strcpy(Str, "UCSC");//key
2.   v5[0] = 0x89B83EC0E7A3CF8i64;
3.   v5[1] = 0x3F0EA83858C85F6Ai64;
4.   v5[2] = 0xAB8A1E39811B5F22ui64;
5.   v5[3] = 0x649F307A6475E9B1i64;
6.   v6 = 0xAB7BBD90;//v5和v6是密文
7.   v8 = 36;
8.   v3 = strlen(Str);
9.   rc4_init(Str, v3);
10.   rc4_crypt(v5, v8);
11.   return 0;

复制代码

脚本
[code]import structdef rc4_decrypt(ciphertext_hex, key):    ciphertext = bytes.fromhex(ciphertext_hex)    s = list(range(256))    j = 0    key_bytes = key.encode('ascii')    # KSA    for i in range(256):        j = (j + s + key_bytes[i % len(key_bytes)]) % 256        s, s[j] = s[j], s    # PRGA    i = j = 0    plaintext = []    for byte in ciphertext:        i = (i + 1) % 256        j = (j + s) % 256        s, s[j] = s[j], s        k = s[(s + s[j]) % 256]        plaintext.append(byte ^ k)    return bytes(plaintext)# 构造密文cipher_qwords = [    0x089B83EC0E7A3CF8,    0x3F0EA83858C85F6A,    0xAB8A1E39811B5F22,    0x649F307A6475E9B1,    0xAB7BBD90]cipher_bytes = b''.join(struct.pack("