GFSJ0164-【elrond32】
字符判断 + ^
题目简介
Download file(rev300.zip)
main函数很干净
int __cdecl main(int a1, char **a2)
{
if ( a1 > 1 && sub_8048414(a2[1], 0) )
{
puts("Access granted");
sub_8048538(a2[1]);
}
else
{
puts("Access denied");
}
return 0;
}
字符判断 结果 isengard
int __cdecl sub_8048414(_BYTE *a1, int a2)
{
int result; // eax
switch ( a2 )
{
case 0:
if ( *a1 == 105 )
goto LABEL_19;
result = 0;
break;
case 1:
if ( *a1 == 101 )
goto LABEL_19;
result = 0;
break;
case 3:
if ( *a1 == 110 )
goto LABEL_19;
result = 0;
break;
case 4:
if ( *a1 == 100 )
goto LABEL_19;
result = 0;
break;
case 5:
if ( *a1 == 97 )
goto LABEL_19;
result = 0;
break;
case 6:
if ( *a1 == 103 )
goto LABEL_19;
result = 0;
break;
case 7:
if ( *a1 == 115 )
goto LABEL_19;
result = 0;
break;
case 9:
if ( *a1 == 114 )
LABEL_19:
result = sub_8048414(a1 + 1, 7 * (a2 + 1) % 11);
else
result = 0;
break;
default:
result = 1;
break;
}
return result;
}
^
int __cdecl sub_8048538(int a1)
{
_DWORD v2[33]; // [esp+18h] [ebp-A0h] BYREF
int i; // [esp+9Ch] [ebp-1Ch]
qmemcpy(v2, &unk_8048760, sizeof(v2));
for ( i = 0; i <= 32; ++i )
putchar(v2[i] ^ *(char *)(a1 + i % 8));
return putchar(10);
}
数据
unk_8048760 = [0xF, 0x1F, 0x4, 0x9, 0x1C, 0x12, 0x42, 0x9, 0xC, 0x44, 0xD, 0x7, 0x9, 0x6, 0x2D, 0x37, 0x59, 0x1E, 0x0, 0x59, 0xF, 0x8, 0x1C, 0x23, 0x36, 0x7, 0x55, 0x2, 0xC, 0x8, 0x41, 0xA, 0x14]
exp
b = bytearray([0xF, 0x1F, 0x4, 0x9, 0x1C, 0x12, 0x42, 0x9, 0xC, 0x44, 0xD, 0x7, 0x9, 0x6, 0x2D, 0x37, 0x59, 0x1E, 0x0, 0x59, 0xF, 0x8, 0x1C, 0x23, 0x36, 0x7, 0x55, 0x2, 0xC, 0x8, 0x41, 0xA, 0x14])
c = b'isengard'
for i in range(len(b)):
print(chr(b[i] ^ c[i % 8]),end = '')
flag
flag{s0me7hing_S0me7hinG_t0lki3n}
评论