【2019看雪CTF】Q2赛季第一题神秘来信 WP

Console题目，直接main函数f5得到如下伪代码：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // esi
  unsigned int v4; // kr00_4
  unsigned int v6; // ecx
  char input[20]; // [esp+10h] [ebp-3Ch]
  CPPEH_RECORD ms_exc; // [esp+34h] [ebp-18h]
 
  v3 = 0;
  sub_401410((int)"请输入序列号:\n");
  sub_4013D0("%s", input);
  v4 = strlen(input);
  if ( v4 < 7
    && input[5] == '3'
    && input[4] == '5'
    && input[3] == '3'
    && (unsigned __int8)input[2] + (unsigned __int8)input[1] + (unsigned __int8)input[0] == 0x95 )
  {
    v6 = 0;
    if ( v4 )
    {
      do
        v3 = (unsigned __int8)input[v6++] + 16 * v3 - 48;
      while ( v6 < v4 );
    }
    ms_exc.registration.TryLevel = 0;
    MEMORY[0] = 65;
    sub_401410((int)"error!\n");
    while ( 1 )
      ;
  }
  sub_401410((int)"error\n");
  return 0;
}

先是检查输入长度小于7，输入第4，5，6字节分别为'3'、'5'、'3'，前三字节ascii码之和为0x95。然后下面的的逻辑似乎不对了。直接看asm。

.text:004012F9 loc_4012F9:                             ; CODE XREF: _main+6C↑j
.text:004012F9                 cmp     [ebp+input+5], 33h
.text:004012FD                 jnz     short loc_4012CE
.text:004012FF                 cmp     [ebp+input+4], 35h
.text:00401303                 jnz     short loc_4012CE
.text:00401305                 cmp     [ebp+input+3], 33h
.text:00401309                 jnz     short loc_4012CE
.text:0040130B                 movzx   ecx, [ebp+input]
.text:0040130F                 movzx   eax, [ebp+input+1]
.text:00401313                 add     ecx, eax
.text:00401315                 movzx   eax, [ebp+input+2]
.text:00401319                 add     ecx, eax
.text:0040131B                 cmp     ecx, 95h
.text:00401321                 jnz     short loc_4012CE
.text:00401323                 xor     ecx, ecx
.text:00401325                 test    edx, edx
.text:00401327                 jz      short loc_401342
.text:00401329                 nop     dword ptr [eax+00000000h]
.text:00401330
.text:00401330 loc_401330:                             ; CODE XREF: _main+E0↓j
.text:00401330                 movzx   eax, [ebp+ecx+input]
.text:00401335                 shl     esi, 4
.text:00401338                 add     esi, 0FFFFFFD0h
.text:0040133B                 add     esi, eax
.text:0040133D                 inc     ecx
.text:0040133E                 cmp     ecx, edx
.text:00401340                 jb      short loc_401330
.text:00401342
.text:00401342 loc_401342:                             ; CODE XREF: _main+C7↑j
.text:00401342 ;   __try { // __except at loc_401379
.text:00401342                 mov     [ebp+ms_exc.registration.TryLevel], 0
.text:00401349                 test    esi, esi
.text:0040134B                 jz      short loc_40135D
.text:0040134D                 push    eax
.text:0040134E                 call    loc_401354
.text:0040134E ; ---------------------------------------------------------------------------
.text:00401353                 db 0EBh
.text:00401354 ; ---------------------------------------------------------------------------
.text:00401354
.text:00401354 loc_401354:                             ; CODE XREF: _main+EE↑j
.text:00401354                 pop     eax
.text:00401355                 sub     eax, 0
.text:00401358                 sub     esi, eax
.text:0040135A                 div     esi
.text:0040135C                 pop     eax
.text:0040135D
.text:0040135D loc_40135D:                             ; CODE XREF: _main+EB↑j
.text:0040135D                 mov     large byte ptr ds:0, 41h
.text:00401364                 push    offset aError_0 ; "error!\n"
.text:00401369                 call    sub_401410
.text:0040136E                 add     esp, 4
.text:00401371
.text:00401371 loc_401371:                             ; CODE XREF: _main:loc_401371↓j
.text:00401371                 jmp     short loc_401371
.text:00401373 ; ---------------------------------------------------------------------------
.text:00401373
.text:00401373 loc_401373:                             ; DATA XREF: .rdata:stru_41CC98↓o
.text:00401373 ;   __except filter // owned by 401342
.text:00401373                 mov     eax, 1
.text:00401378                 retn
.text:00401379 ; ---------------------------------------------------------------------------
.text:00401379
.text:00401379 loc_401379:                             ; DATA XREF: .rdata:stru_41CC98↓o
.text:00401379 ;   __except(loc_401373) // owned by 401342
.text:00401379                 mov     esp, [ebp+ms_exc.old_esp]
.text:0040137C                 lea     edx, [ebp+input]
.text:0040137F                 lea     ecx, [edx+1]
.text:00401382
.text:00401382 loc_401382:                             ; CODE XREF: _main+127↓j
.text:00401382                 mov     al, [edx]
.text:00401384                 inc     edx
.text:00401385                 test    al, al
.text:00401387                 jnz     short loc_401382
.text:00401389                 sub     edx, ecx
.text:0040138B                 xor     ecx, ecx
.text:0040138D                 test    edx, edx
.text:0040138F                 jle     short loc_4013A7
.text:00401391
.text:00401391 loc_401391:                             ; CODE XREF: _main+145↓j
.text:00401391                 movzx   eax, [ebp+ecx+input]
.text:00401396                 add     ax, 9
.text:0040139A                 mov     word_41F300[ecx*2], ax
.text:004013A2                 inc     ecx
.text:004013A3                 cmp     ecx, edx
.text:004013A5                 jl      short loc_401391
.text:004013A7
.text:004013A7 loc_4013A7:                             ; CODE XREF: _main+12F↑j
.text:004013A7                 push    offset aSuccess ; "success!\n"
.text:004013AC                 call    sub_401410
.text:004013B1                 add     esp, 4
.text:004013B4
.text:004013B4 loc_4013B4:                             ; CODE XREF: _main:loc_4013B4↓j
.text:004013B4                 jmp     short loc_4013B4
.text:004013B4 ;   } // starts at 401342
.text:004013B4 ; } // starts at 401260