这是一个将flag换base64表之后加密的代码
https://wwvc.lanzouj.com/iwZuF1bmzehg
无壳,32位
丢入ida32,找到main函数F5
第12和第13没有用,Source是base64表,也就是ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
,Str是输入的flag,先经过base64这个函数加密,我们先点入base64函数里面看看
发现basechange(Source),怀疑将base64表换了,我们继续跟进basechange函数
将Source的表换成Destination,可以直接跑出来换后的表,即Destination值
脚本
换后的表
gJ1BRjQie/FIWhEslq7GxbnL26M4+HXUtcpmVTKaydOP38of5v90ZSwrkYzCAuND
接下来就好办了,把之前写过的base64解密代码的base64表替换一下,找到加密后的值
也就是basecheck函数
双击跟进,找到加密后的值
GQTZlSqQXZ/ghxxwhju3hbuZ4wufWjujWrhYe7Rce7ju
现在换的表和加密后的值都找到了,可以得到flag值了,直接上脚本
运行即得flag:LitCTF{B@5E64_l5_tooo0_E3sy!!!!!}
int
__cdecl main(
int
argc,
const
char
**argv,
const
char
**envp)
{
char
Source[61];
char
v5[4];
char
Str1[1000];
char
Str[1012];
__main();
memset
(Str, 0, 1000);
memset
(Str1, 0,
sizeof
(Str1));
*(_DWORD *)Source = *(_DWORD *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
;
strcpy
(v5,
"9+/"
);
qmemcpy(&Source[1], &aAbcdefghijklmn[-(Source - &Source[1])], 4 * (((Source - &Source[1] + 65) & 0xFFFFFFFC) >> 2));
puts
(
"Please input flag:"
);
gets
(Str);
if
(
strlen
(Str) == 33 )
{
base64(Source, Str, Str1);
basecheck(Str1);
}
return
0;
}
int
__cdecl main(
int
argc,
const
char
**argv,
const
char
**envp)
{
char
Source[61];
char
v5[4];
char
Str1[1000];
char
Str[1012];
__main();
memset
(Str, 0, 1000);
memset
(Str1, 0,
sizeof
(Str1));
*(_DWORD *)Source = *(_DWORD *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
;
strcpy
(v5,
"9+/"
);
qmemcpy(&Source[1], &aAbcdefghijklmn[-(Source - &Source[1])], 4 * (((Source - &Source[1] + 65) & 0xFFFFFFFC) >> 2));
puts
(
"Please input flag:"
);
gets
(Str);
if
(
strlen
(Str) == 33 )
{
base64(Source, Str, Str1);
basecheck(Str1);
}
return
0;
}
#include<stdio.h>
#include<string.h>
int
main()
{
char
*result;
char
Destination[65];
int
v3[65];
int
j;
int
i;
char
Source[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
;
memset
(v3, 0,
sizeof
(v3));
v3[0] = 16;
v3[1] = 34;
v3[2] = 56;
v3[3] = 7;
v3[4] = 46;
v3[5] = 2;
v3[6] = 10;
v3[7] = 44;
v3[8] = 20;
v3[9] = 41;
v3[10] = 59;
v3[11] = 31;
v3[12] = 51;
v3[13] = 60;
v3[14] = 61;
v3[15] = 26;
v3[16] = 5;
v3[17] = 40;
v3[18] = 21;
v3[19] = 38;
v3[20] = 4;
v3[21] = 54;
v3[22] = 52;
v3[23] = 47;
v3[24] = 3;
v3[25] = 11;
v3[26] = 58;
v3[27] = 48;
v3[28] = 32;
v3[29] = 15;
v3[30] = 49;
v3[31] = 14;
v3[32] = 37;
v3[34] = 55;
v3[35] = 53;
v3[36] = 24;
v3[37] = 35;
v3[38] = 18;
v3[39] = 25;
v3[40] = 33;
v3[41] = 43;
v3[42] = 50;
v3[43] = 39;
v3[44] = 12;
v3[45] = 19;
v3[46] = 13;
v3[47] = 42;
v3[48] = 9;
v3[49] = 17;
v3[50] = 28;
v3[51] = 30;
v3[52] = 23;
v3[53] = 36;
v3[54] = 1;
v3[55] = 22;
v3[56] = 57;
v3[57] = 63;
v3[58] = 8;
v3[59] = 27;
v3[60] = 6;
v3[61] = 62;
v3[62] = 45;
v3[63] = 29;
result =
strcpy
(Destination, Source);
for
( i = 0; i <= 47; ++i )
{
for
( j = 0; j <= 63; ++j )
Source[j] = Destination[v3[j]];
result =
strcpy
(Destination, Source);
}
printf
(
"%s"
,Destination);
return
0;
}
#include<stdio.h>
#include<string.h>
int
main()
{
char
*result;
char
Destination[65];
int
v3[65];
int
j;
int
i;
char
Source[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
;
memset
(v3, 0,
sizeof
(v3));
v3[0] = 16;
v3[1] = 34;
v3[2] = 56;
v3[3] = 7;
v3[4] = 46;
v3[5] = 2;
v3[6] = 10;
v3[7] = 44;
v3[8] = 20;
v3[9] = 41;
v3[10] = 59;
v3[11] = 31;
v3[12] = 51;
v3[13] = 60;
v3[14] = 61;
v3[15] = 26;
v3[16] = 5;
v3[17] = 40;
v3[18] = 21;
v3[19] = 38;
v3[20] = 4;
v3[21] = 54;
v3[22] = 52;
v3[23] = 47;
v3[24] = 3;
v3[25] = 11;
v3[26] = 58;
v3[27] = 48;
v3[28] = 32;
v3[29] = 15;
v3[30] = 49;
v3[31] = 14;
v3[32] = 37;
v3[34] = 55;
v3[35] = 53;
v3[36] = 24;
v3[37] = 35;
v3[38] = 18;
v3[39] = 25;
v3[40] = 33;
v3[41] = 43;
v3[42] = 50;
v3[43] = 39;
v3[44] = 12;
v3[45] = 19;
v3[46] = 13;
v3[47] = 42;
v3[48] = 9;
v3[49] = 17;
v3[50] = 28;
v3[51] = 30;
v3[52] = 23;
v3[53] = 36;
v3[54] = 1;
v3[55] = 22;
v3[56] = 57;
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
最后于 2023-10-14 09:38
被kanxue编辑
,原因: