-
-
[原创]看雪CTF.TSRC 2018 团队赛 第一题 初世纪 解题过程
-
发表于: 2018-12-3 14:30
-
打开IDA如上图，查看函数sub_140001340:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 | INT_PTR __fastcall sub_140001340(HWND a1, int a2, unsigned __int16 a3){ int v3; // ebx unsigned __int16 v4; // si HWND v5; // rdi int v6; // ebx int v7; // ebx UINT v9; // ebx CHAR *v10; // rdx HICON v11; // rax HWND v12; // rax CHAR String2[16]; // [rsp+30h] [rbp-D0h] int v14; // [rsp+40h] [rbp-C0h] __int16 v15; // [rsp+44h] [rbp-BCh] char v16; // [rsp+46h] [rbp-BAh] __int64 v17; // [rsp+48h] [rbp-B8h] int v18; // [rsp+50h] [rbp-B0h] __int16 v19; // [rsp+54h] [rbp-ACh] char v20; // [rsp+56h] [rbp-AAh] CHAR Dst; // [rsp+60h] [rbp-A0h] char v22; // [rsp+61h] [rbp-9Fh] char v23; // [rsp+62h] [rbp-9Eh] char v24; // [rsp+63h] [rbp-9Dh] char v25; // [rsp+64h] [rbp-9Ch] char v26; // [rsp+65h] [rbp-9Bh] CHAR String; // [rsp+D0h] [rbp-30h] v3 = a2; v4 = a3; v5 = a1; memset(&String, 0, 0x50ui64); memset(&Dst, 0, 0x64ui64); v18 = -1497773645; v19 = -24157; v20 = 0; v14 = -827016238; v17 = -6799340578446268487i64; v15 = -24157; v16 = 0; *(_OWORD *)String2 = xmmword_1400453C0; v6 = v3 - 16; if ( !v6 ) { DestroyWindow(v5); return 0i64; } v7 = v6 - 256; if ( !v7 ) { v11 = LoadIconA(hInstance, (LPCSTR)0x70); SendMessageA(v5, 0x80u, 1ui64, (LPARAM)v11); SendDlgItemMessageA(v5, 1000, 0xC5u, 0x50ui64, 0i64); v12 = GetDlgItem(v5, 1000); SetFocus(v12); return 0i64; } if ( v7 != 1 ) return 0i64; if ( v4 == 1002 ) { SendMessageA(v5, 0x10u, 0i64, 0i64); return 1i64; } if ( v4 != 1013 ) { if ( v4 == 1014 || v4 == 40002 ) { DialogBoxParamA(hInstance, (LPCSTR)0x67, v5, DialogFunc, 0i64); return 1i64; } return 1i64; } v9 = GetDlgItemTextA(v5, 1000, &String, 81); GetDlgItemTextA(v5, 1000, &Dst, 101); if ( v9 != '\x06' || Dst != '6' || v22 != 'E' || v23 != 'w' || v24 != 'i' || v25 != '9' || v26 != 'H' ) v10 = String2; else v10 = (CHAR *)&v17; lstrcpyA((LPSTR)&String1, v10); DialogBoxParamA(hInstance, (LPCSTR)0x79, v5, sub_1400012E0, 0i64); return 1i64;} |
发现是明文：
1 | if ( v9 != '\x06' || Dst != '6' || v22 != 'E' || v23 != 'w' || v24 != 'i' || v25 != '9' || v26 != 'H' ) |
长度为6，字符串为6Ewi9H
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
666
|
