-
-
[原创]看雪CTF.TSRC 2018 团队赛 第一题 初世纪 解题过程
-
发表于: 2018-12-3 14:30
-
打开IDA如上图，查看函数sub_140001340:
INT_PTR __fastcall sub_140001340(HWND a1, int a2, unsigned __int16 a3)
{
int v3; // ebx
unsigned __int16 v4; // si
HWND v5; // rdi
int v6; // ebx
int v7; // ebx
UINT v9; // ebx
CHAR *v10; // rdx
HICON v11; // rax
HWND v12; // rax
CHAR String2[16]; // [rsp+30h] [rbp-D0h]
int v14; // [rsp+40h] [rbp-C0h]
__int16 v15; // [rsp+44h] [rbp-BCh]
char v16; // [rsp+46h] [rbp-BAh]
__int64 v17; // [rsp+48h] [rbp-B8h]
int v18; // [rsp+50h] [rbp-B0h]
__int16 v19; // [rsp+54h] [rbp-ACh]
char v20; // [rsp+56h] [rbp-AAh]
CHAR Dst; // [rsp+60h] [rbp-A0h]
char v22; // [rsp+61h] [rbp-9Fh]
char v23; // [rsp+62h] [rbp-9Eh]
char v24; // [rsp+63h] [rbp-9Dh]
char v25; // [rsp+64h] [rbp-9Ch]
char v26; // [rsp+65h] [rbp-9Bh]
CHAR String; // [rsp+D0h] [rbp-30h]
v3 = a2;
v4 = a3;
v5 = a1;
memset(&String, 0, 0x50ui64);
memset(&Dst, 0, 0x64ui64);
v18 = -1497773645;
v19 = -24157;
v20 = 0;
v14 = -827016238;
v17 = -6799340578446268487i64;
v15 = -24157;
v16 = 0;
*(_OWORD *)String2 = xmmword_1400453C0;
v6 = v3 - 16;
if ( !v6 )
{
DestroyWindow(v5);
return 0i64;
}
v7 = v6 - 256;
if ( !v7 )
{
v11 = LoadIconA(hInstance, (LPCSTR)0x70);
SendMessageA(v5, 0x80u, 1ui64, (LPARAM)v11);
SendDlgItemMessageA(v5, 1000, 0xC5u, 0x50ui64, 0i64);
v12 = GetDlgItem(v5, 1000);
SetFocus(v12);
return 0i64;
}
if ( v7 != 1 )
return 0i64;
if ( v4 == 1002 )
{
SendMessageA(v5, 0x10u, 0i64, 0i64);
return 1i64;
}
if ( v4 != 1013 )
{
if ( v4 == 1014 || v4 == 40002 )
{
DialogBoxParamA(hInstance, (LPCSTR)0x67, v5, DialogFunc, 0i64);
return 1i64;
}
return 1i64;
}
v9 = GetDlgItemTextA(v5, 1000, &String, 81);
GetDlgItemTextA(v5, 1000, &Dst, 101);
if ( v9 != '\x06' || Dst != '6' || v22 != 'E' || v23 != 'w' || v24 != 'i' || v25 != '9' || v26 != 'H' )
v10 = String2;
else
v10 = (CHAR *)&v17;
lstrcpyA((LPSTR)&String1, v10);
DialogBoxParamA(hInstance, (LPCSTR)0x79, v5, sub_1400012E0, 0i64);
return 1i64;
}
发现是明文：
if ( v9 != '\x06' || Dst != '6' || v22 != 'E' || v23 != 'w' || v24 != 'i' || v25 != '9' || v26 != 'H' )
长度为6，字符串为6Ewi9H
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
666
|
