• 搜索字符串shift+F12

  

• 发现可疑字符串KanXueCTF2019JustForhappy，双击进入

• 选中字符串,按X找到这个字符串被交叉引用的地址
  
  

• 双击004035c0进入，F5查看伪代码

    int __cdecl sub_4017F0(int a1)
    {
      int result; // eax
      char Str1[28]; // [esp+D8h] [ebp-24h]
      int v3; // [esp+F4h] [ebp-8h]
      int v4; // [esp+F8h] [ebp-4h]
  
      v4 = 0;
      v3 = 0;
      while ( *(_DWORD *)(a1 + 4 * v4) < 62 && *(_DWORD *)(a1 + 4 * v4) >= 0 )
      {
        Str1[v4] = aAbcdefghiabcde[*(_DWORD *)(a1 + 4 * v4)];
        ++v4;
      }
      Str1[v4] = 0;
      if ( !strcmp(Str1, "KanXueCTF2019JustForhappy") )
        result = sub_401770();
      else
        result = sub_4017B0();
      return result;
    }
  

  • 分析可知：我们输入的passwd字符串保存到a1指向的地址,经过转换得到KanXueCTF2019JustForhappy
  • 我们现在需要了解转换方式,然后逆向出解密算法

• 双击sub_4017F0进入a1的交叉引用地址
  

• 可以看到以下伪代码

    int __thiscall sub_401890(CWnd *this)
    {
      struct CString *v1; // ST08_4
      CWnd *v2; // eax
      int v3; // eax
      int v5[26]; // [esp+4Ch] [ebp-74h]
      int i; // [esp+B4h] [ebp-Ch]
      char *Str; // [esp+B8h] [ebp-8h]
      CWnd *v8; // [esp+BCh] [ebp-4h]
  
      v8 = this;
      v1 = (CWnd *)((char *)this + 100);
      v2 = CWnd::GetDlgItem(this, 1002);
      CWnd::GetWindowTextA(v2, v1);
      v3 = sub_401A30((char *)v8 + 100);
      Str = CString::GetBuffer((CWnd *)((char *)v8 + 100), v3);
      if ( !strlen(Str) )
        return CWnd::MessageBoxA(v8, &byte_4035DC, 0, 0);
      for ( i = 0; Str[i]; ++i )
      {
       if ( Str[i] > 57 || Str[i] < 48 )
        {
          if ( Str[i] > 'z' || Str[i] < 'a' )        //h,r变化进制，编码
          {
            if ( Str[i] > 'Z' || Str[i] < 'A' )
              sub_4017B0();
            else
              v5[i] = Str[i] - 29;
          }
          else
          {
            v5[i] = Str[i] - 87;
          }
        }
        else
        {
          v5[i] = Str[i] - 48;
        }
      }
      return sub_4017F0((int)v5);
    }
  

• 这个算法比较简单,直接引用原代码编写解密脚本

    content = "abcdefghiABCDEFGHIJKLMNjklmn0123456789opqrstuvwxyzOPQRSTUVWXYZ"
    flag="KanXueCTF2019JustForhappy"
    position =[]
    v5=0
    for i in flag:
            for j in range(0,len(content)):
                if i==content[j]:
                    position.append(j)
  
    print(position)
  
    for i in range(0,len(content)):
        num=ord(content[i])
        if num>57 or num <97:
            if num>122 or num <97:
                pass
            else:
                v5=num-29
        else:
            v5=num-48
        if v5==48:
            print(content[i])
  

• 解出flag : j0rXI4bTeustBiIGHeCF70DDM

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界