或者干脆别折腾了老老实实学pythonTARGET [17, 6, 18, 1, 25, 16, 7, 18, 21, 12, 18, 21, 12, 18, 21, 12, 31]result []for i in TARGET:result.append(chr(i ^ 98))print(‘’.join(result))sdpc{repwnpwnpwn}upx放到Exeinfo PE看一眼Detected UPX!先脱壳然后放idaint __fastcall main(int argc, const char **argv, const char **envp){double v3; // xmm0_8int random_number; // [rsp4h] [rbp-4Ch]_BYTE v6[56]; // [rsp10h] [rbp-40h] BYREFunsigned __int64 v7; // [rsp48h] [rbp-8h]v7 __readfsqword(0x28u);puts(“ UPX Packed Program with Hidden Flag ”);puts(“This program is packed with UPX for demonstration purposes.”);puts(“Try to unpack it using UPX or other unpacking tools!\n”);useless_function(“Try to unpack it using UPX or other unpacking tools!\n”, argv);another_useless_function();random_number generate_random_number();printf(“Random number: %d\n”, random_number);v3 complex_calculation(100);printf(“Complex calculation result: %.2f\n”, v3);printf(“\nEnter the flag to verify: “);__isoc99_scanf(”%49s”, v6);if ( (unsigned int)validate_input(v6) )puts(“\nCongratulations! You found the correct flag!”);elseputs(“\nIncorrect flag. Please try again.”);return 0;}前面输出两个随机数烟雾弹关键部分__isoc99_scanf(“%49s”, v6);if ( (unsigned int)validate_input(v6) )puts(“\nCongratulations! You found the correct flag!”);__isoc99_scanf(“%49s”, v6);__isoc99_scanf是scanf 的标准版本_isoc99 是 GLIBC 里的版本标记。scanf — C 标准库函数读用户输入__isoc99_scanf — 编译时链接到了 ISO C99 标准 版本的 scanf功能完全一样只是符号名带版本后缀%49s — 读字符串限制长度 49防止溢出v6 — 就是一个 char v6[56] 数组用来存你输入的 flag跟进validate_input(v6)看逻辑_BOOL8 __fastcall validate_input(const char *s1){char s2[56]; // [rsp10h] [rbp-40h] BYREFunsigned __int64 v3; // [rsp48h] [rbp-8h]v3 __readfsqword(0x28u);decrypt_flag((__int64)s2);return strcmp(s1, s2) 0;}v3是金丝雀跟进decrypt_flag函数__int64 __fastcall decrypt_flag(__int64 p_s2){__int64 result; // raxint i; // [rsp10h] [rbp-8h]for ( i 0; ; i ){result encrypted_flag[i];if ( !(_BYTE)result )break;*(_BYTE *)(i p_s2) xor_key[i % 14] ^ encrypted_flag[i];}return result;}遍历encrypted_flag的值与xor_key的第1到14位的循环.rodata:0000000000002020 encrypted_flag db 3Eh, 5Ch, 33h, 38h, 28h, 36h, 2Ah, 3Fh, 35h, 38h, 3Ah.rodata:0000000000002020 ; DATA XREF: decrypt_flag21↑o.rodata:0000000000002020 ; decrypt_flag5E↑o.rodata:000000000000202B db 14h, 30h, 29h, 20h, 6Fh, 37h, 31h, 30h, 37h, 3Ah, 22h.rodata:0000000000002036 db 31h, 3Dh, 30h, 25h, 1Ah, 30h, 2Bh, 6Fh, 25h, 3Ah, 32h.rodata:0000000000002041 db 2Eh, 3Eh, 5 dup(0)xor_key db ‘X0R_SECRET_KEY’补充一句在汇编中h后缀表示这是16进制继续学pythonkey ‘X0R_SECRET_KEY’eflag [0x3E, 0x5C, 0x33, 0x38, 0x28, 0x36, 0x2A, 0x3F, 0x35, 0x38, 0x3A,0x14, 0x30, 0x29, 0x20, 0x6F, 0x37, 0x31, 0x30, 0x37, 0x3A, 0x22,0x31, 0x3D, 0x30, 0x25, 0x1A, 0x30, 0x2B, 0x6F, 0x25, 0x3A, 0x32,0x2E, 0x3E]dflag []for i in range(len(eflag)):dflag.append(chr(eflag[i] ^ ord(key[i % 14])))print(‘’.join(dflag))flag{simple_upx_encryption_is_weak}真的是一点包装都没有的原始版的rc4int __fastcall main(int argc, const char **argv, const char **envp){int keylen; // [rsp8h] [rbp-58h]unsigned __int8 *plaintext; // [rsp18h] [rbp-48h]unsigned __int8 plaintext_str[21]; // [rsp20h] [rbp-40h] BYREFunsigned __int8 content[21]; // [rsp40h] [rbp-20h] BYREFunsigned __int64 v8; // [rsp58h] [rbp-8h]v8 __readfsqword(0x28u);keylen strlen(“mysecret”);*(_QWORD *)plaintext_str 0xB966693F95CF918ALL;*(_QWORD *)plaintext_str[8] 0x636796D9DACB48EFLL;*(_DWORD *)plaintext_str[16] -1082017924;plaintext_str[20] 123;read(0, content, 0x15u);plaintext (unsigned __int8 *)malloc(0x15u);memcpy(plaintext, plaintext_str, 0x15u);printf(“plaintext: %s\n”, (const char *)plaintext_str);printf(“key: %s\n”, “mysecret”);rc4(“mysecret”, keylen, plaintext, 21);if ( memcpy(plaintext, content, 0x15u) )printf(“success”);elseprintf(“fail”);free(plaintext);return 0;}
