666 2019_UNCTF
main
int __cdecl main(int argc, const char **argv, const char **envp) { char myen; // [rsp+0h] [rbp-1E0h] char myinput; // [rsp+F0h] [rbp-F0h] memset(&myen, 0, 0x1EuLL); printf("Please Input Key: ", 0LL); __isoc99_scanf("%s", &myinput); encode(&myinput, &myen); if ( strlen(&myinput) == key ) { if ( !strcmp(&myen, enflag) ) puts("You are Right"); else puts("flag{This_1s_f4cker_flag}"); } return 0; }
关键函数
int __fastcall encode(const char *myinput, char *myen) { char v3[32]; // [rsp+10h] [rbp-70h] char v4[32]; // [rsp+30h] [rbp-50h] char v5[40]; // [rsp+50h] [rbp-30h] int v6; // [rsp+78h] [rbp-8h] int i; // [rsp+7Ch] [rbp-4h] i = 0; v6 = 0; if ( strlen(myinput) != key ) // 18位 return puts("Your Length is Wrong"); for ( i = 0; i < key; i += 3 ) { v5[i] = key ^ (myinput[i] + 6); v4[i + 1] = (myinput[i + 1] - 6) ^ key; v3[i + 2] = myinput[i + 2] ^ 6 ^ key; myen[i] = v5[i]; myen[i + 1] = v4[i + 1]; myen[i + 2] = v3[i + 2]; } return (signed int)myen; }
wp:
#!/usr/bin/python enflag=[105, 122, 119, 104, 114, 111, 122, 34, 34, 119, 34, 118, 46, 75, 34, 46, 78, 105, 0] flag='' for i in range(0,18,3): flag+=chr((18^enflag[i])-6) flag+=chr((18^enflag[i+1])+6) flag+=chr(18^enflag[i+2]^6) print(flag)
unctf{b66_6b6_66b}