前言

继续ctf的旅程
攻防世界Reverse高手进阶区的2分题
本篇是reverse-for-the-holy-grail-350的writeup

发现攻防世界的题目分数是动态的
就仅以做题时的分数为准了

解题过程

PE查壳

扔进IDA

关键函数 stringMod

__int64 __fastcall stringMod(__int64 *a1)
{
  __int64 v1; // r9
  __int64 v2; // r10
  __int64 v3; // rcx
  signed int v4; // er8
  int *v5; // rdi
  int *v6; // rsi
  signed int v7; // ecx
  signed int v8; // er9
  int v9; // er10
  unsigned int v10; // eax
  int v11; // esi
  int v12; // esi
  int v14[24]; // [rsp+0h] [rbp-60h]
  int _48[24]; // [rsp+48h] [rbp-18h]

  memset(v14, 0, 0x48uLL);
  v1 = a1[1];
  if ( v1 )
  {
    v2 = *a1;
    v3 = 0LL;
    v4 = 0;
    do
    {
      v12 = *(char *)(v2 + v3);
      v14[v3] = v12;
      if ( 3 * ((unsigned int)v3 / 3) == (_DWORD)v3 && v12 != firstchar[(unsigned int)v3 / 3] ) //3的倍数对应firstchar
        v4 = -1;
      ++v3;
    }
    while ( v3 != v1 );
  }
  else
  {
    v4 = 0;
  }
  v5 = v14;
  v6 = v14;
  v7 = 666;
  do
  {
    *v6 = v7 ^ *(unsigned __int8 *)v6; //异或
    v7 += v7 % 5;
    ++v6;
  }
  while ( _48 != v6 ); //18次
  v8 = 1;
  v9 = 0;
  v10 = 1;
  v11 = 0;
  do
  {
    if ( v11 == 2 )
    {
      if ( *v5 != thirdchar[v9] )
        v4 = -1;
      if ( v10 % *v5 != masterArray[v9] )
        v4 = -1;
      ++v9;
      v10 = 1;
      v11 = 0;
    }
    else
    {
      v10 *= *v5;
      if ( ++v11 == 3 )
        v11 = 0;
    }
    ++v8;
    ++v5;
  }
  while ( v8 != 19 );
  return (unsigned int)(v7 * v4);
}

firstchar =   [0x41,  0x69,  0x6e,  0x45,  0x6f,  0x61]
thirdchar =   [0x2ef, 0x2c4, 0x2dc, 0x2c7, 0x2de, 0x2fc]
masterarray = [0x1d7, 0xc,   0x244, 0x25e, 0x93,  0x6c]
 
xor_number=0x29a
xor_array=[]
for i in range(18):
	xor_array.append(xor_number)
	xor_number += xor_number % 5
 
flag=""
for i in range(6):
	one=firstchar[i]
	three=thirdchar[i] ^ xor_array[(i*3) + 2]
	for j in range(256):
		if masterarray[i]==(j^xor_array[i*3+1])*(one^xor_array[i*3])%thirdchar[i]:
			flag+=chr(one)+chr(j)+chr(three)
			break
print("tuctf{" + flag + "}")

得到flag：tuctf{AfricanOrEuropean?}

结语

简单题