大小写互换 异或

main函数 里面有一个头尾验证和长度验证

int __cdecl main(int argc, const char **argv, const char **envp)
{
  size_t i; // [esp+4Ch] [ebp-8Ch]
  char v5[8]; // [esp+50h] [ebp-88h] BYREF
  char Str[128]; // [esp+58h] [ebp-80h] BYREF

  printf(&unk_446360, "Give me your flag:");
  sub_4013F0(sub_403670);
  sub_401440(Str, 127);
  if ( strlen(Str) < 30 && strlen(Str) > 4 )
  {
    strcpy(v5, "EIS{");
    for ( i = 0; i < strlen(v5); ++i )
    {
      if ( Str[i] != v5[i] )
        goto LABEL_7;
    }
    if ( Str[28] != '}' )
    {
LABEL_7:
      printf(&unk_446360, "Sorry, keep trying! ");
      sub_4013F0(sub_403670);
      return 0;
    }
    if ( (unsigned __int8)sub_4011C0(Str) )
      printf(&unk_446360, "Congratulations! ");
    else
      printf(&unk_446360, "Sorry, keep trying! ");
    sub_4013F0(sub_403670);
    return 0;
  }
  else
  {
    printf(&unk_446360, "Sorry, keep trying!");
    sub_4013F0(sub_403670);
    return 0;
  }
}

我们转到能触发Congratulations!的函数

bool __cdecl sub_4011C0(char *Str)
{
  int v2; // [esp+50h] [ebp-B0h]
  char Str2[32]; // [esp+54h] [ebp-ACh] BYREF
  int v4; // [esp+74h] [ebp-8Ch]
  int v5; // [esp+78h] [ebp-88h]
  size_t i; // [esp+7Ch] [ebp-84h]
  char v7[128]; // [esp+80h] [ebp-80h] BYREF

  if ( strlen(Str) <= 4 )
    return 0;
  i = 4;
  v5 = 0;
  while ( i < strlen(Str) - 1 )
    v7[v5++] = Str[i++];
  v7[v5] = 0;
  v4 = 0;
  v2 = 0;
  memset(Str2, 0, sizeof(Str2));
  for ( i = 0; i < strlen(v7); ++i )
  {
    if ( v7[i] >= 97 && v7[i] <= 122 )
    {
      v7[i] -= 32;
      v2 = 1;
    }
    if ( !v2 && v7[i] >= 65 && v7[i] <= 90 )
      v7[i] += 32;
    Str2[i] = byte_4420B0[i] ^ sub_4013C0(v7[i]);
    v2 = 0;
  }
  return strcmp("GONDPHyGjPEKruv{{pj]X@rF", Str2) == 0;
}

int __cdecl sub_4013C0(int a1)
{
  return (a1 ^ 0x55) + 72;
}

数据

byte_4420B0 = [0x0D, 0x13, 0x17, 0x11, 0x02, 0x01, 0x20, 0x1D, 0x0C, 0x02, 0x19, 0x2F, 0x17, 0x2B, 0x24, 0x1F, 0x1E, 0x16, 0x09, 0x0F, 0x15, 0x27, 0x13, 0x26, 0x0A, 0x2F, 0x1E, 0x1A, 0x2D, 0x0C, 0x22, 0x04]
Str2 = "GONDPHyGjPEKruv{{pj]X@rF"

直接逆就可以了 一个大小写呼唤 一个

exp

import string
byte_4420B0 = bytearray([0x0D, 0x13, 0x17, 0x11, 0x02, 0x01, 0x20, 0x1D, 0x0C, 0x02, 0x19, 0x2F, 0x17, 0x2B, 0x24, 0x1F, 0x1E, 0x16, 0x09,
     0x0F, 0x15, 0x27, 0x13, 0x26, 0x0A, 0x2F, 0x1E, 0x1A, 0x2D, 0x0C, 0x22, 0x04])
Str2 = b"GONDPHyGjPEKruv{{pj]X@rF"
Str1 = bytes(a ^ b for a, b in zip(Str2, byte_4420B0))
Str3 = bytes((b-72) ^ 0x55 for b in Str1).swapcase()
print(f"EIS{{{Str3.decode()}}}")

flag

EIS{wadx_tdgk_aihc_ihkn_pjlm}