[XCTF-Reverse] 13-18

13，tu-ctf-2016_re-for-50-plz-50

mips的题，但是机子上没安相应软件ida没法反编译成c，不过毕竟是2分题应该不很难，直接看汇编。

这里它弄了个串，然后把输入逐字节与0x37异或然后比较。

.text:004013C8 loc_4013C8:                              # CODE XREF: main+A4↓j
.text:004013C8                 lui     $v0, 0x4A
.text:004013CC                 addiu   $v1, $v0, (meow - 0x4A0000)  # "cbtcqLUBChERV[[Nh@_X^D]X_YPV[CJ"
.text:004013D0                 lw      $v0, 0x28+var_10($fp)
.text:004013D4                 addu    $v0, $v1, $v0
.text:004013D8                 lb      $v1, 0($v0)
.text:004013DC                 lw      $v0, 0x28+arg_4($fp)
.text:004013E0                 addiu   $v0, 4
.text:004013E4                 lw      $a0, 0($v0)
.text:004013E8                 lw      $v0, 0x28+var_10($fp)
.text:004013EC                 addu    $v0, $a0, $v0
.text:004013F0                 lb      $v0, 0($v0)
.text:004013F4                 xori    $v0, 0x37            <-------- 值异或0x37
.text:004013F8                 sll     $v0, 24
.text:004013FC                 sra     $v0, 24
.text:00401400                 beq     $v1, $v0, loc_401428
.text:00401404                 move    $at, $at
.text:00401408                 lui     $v0, 0x47
.text:0040140C                 addiu   $a0, $v0, (aNooooooooooooo - 0x470000)  # "NOOOOOOOOOOOOOOOOOO\n"
.text:00401410                 jal     print
.text:00401414                 move    $at, $at
.text:00401418                 lw      $gp, 0x28+var_18($fp)
.text:0040141C                 jal     exit_funct
.text:00401420                 move    $at, $at
.text:00401424                 lw      $gp, 0x28+var_18($fp)

于是进行下解码：

a = b"cbtcqLUBChERV[[Nh@_X^D]X_YPV[CJ"
print("".join([chr(i^0x37) for i in a]))
#TUCTF{but_really_whoisjohngalt}

14，suctf-2016_dmd-50

题目对输入作md5然后与指定串比较

  std::operator<<<std::char_traits<char>>(&std::cout, "Enter the valid key!\n", envp);std::operator>><char,std::char_traits<char>>(&edata, &v42);std::allocator<char>::allocator(&v38);std::string::string(&v39, &v42, &v38);md5(&v40, &v39);                          //<----对输入值进行md5v41 = (_BYTE *)std::string::c_str((std::string *)&v40);std::string::~string((std::string *)&v40);std::string::~string((std::string *)&v39);std::allocator<char>::~allocator(&v38);if ( *v41 != 55......|| v41[31] != 48 )

找解密网站解得

md5(md5(xxx))  = grape

由于题目只做了一次md5,所以要md5(grape)

b781cbb29054db12f88f08c6e161c199

15，school-ctf-winter-2015_parallel-comparator-200

这个题直接给的c原码

#include <stdlib.h>
#include <stdio.h>
#include <pthread.h>#define FLAG_LEN 20void * checking(void *arg) {char *result = malloc(sizeof(char));char *argument = (char *)arg;*result = (argument[0]+argument[1]) ^ argument[2];return result;
}int highly_optimized_parallel_comparsion(char *user_string)
{int initialization_number;int i;char generated_string[FLAG_LEN + 1];generated_string[FLAG_LEN] = '\0';while ((initialization_number = random()) >= 64);int first_letter;first_letter = (initialization_number % 26) + 97;pthread_t thread[FLAG_LEN];char differences[FLAG_LEN] = {0, 9, -9, -1, 13, -13, -4, -11, -9, -1, -7, 6, -13, 13, 3, 9, -13, -11, 6, -7};char *arguments[20];for (i = 0; i < FLAG_LEN; i++) {arguments[i] = (char *)malloc(3*sizeof(char));arguments[i][0] = first_letter;arguments[i][1] = differences[i];arguments[i][2] = user_string[i];pthread_create((pthread_t*)(thread+i), NULL, checking, arguments[i]);}void *result;int just_a_string[FLAG_LEN] = {115, 116, 114, 97, 110, 103, 101, 95, 115, 116, 114, 105, 110, 103, 95, 105, 116, 95, 105, 115};for (i = 0; i < FLAG_LEN; i++) {pthread_join(*(thread+i), &result);generated_string[i] = *(char *)result + just_a_string[i];  #生成gen再与just比较，即result=0free(result);free(arguments[i]);}int is_ok = 1;for (i = 0; i < FLAG_LEN; i++) {if (generated_string[i] != just_a_string[i])return 0;}return 1;
}int main()
{char *user_string = (char *)calloc(FLAG_LEN+1, sizeof(char));fgets(user_string, FLAG_LEN+1, stdin);int is_ok = highly_optimized_parallel_comparsion(user_string);if (is_ok)printf("You win!\n");elseprintf("Wrong!\n");return 0;
}

主要逻辑为

generated_string=result+just_a_string  == just_a_string

这个显然是要求result=0。再看生成result的check

result = (first_letter + differences)^ user_string

由于first_letter不确定，所以先作出26个解再找合适的解

a = [0, 9, -9, -1, 13, -13, -4, -11, -9, -1, -7, 6, -13, 13, 3, 9, -13, -11, 6, -7]
#b = [115, 116, 114, 97, 110, 103, 101, 95, 115, 116, 114, 105, 110, 103, 95, 105, 116, 95, 105, 115]
#generated_string[i] = *(char *)result + just_a_string[i];  #生成gen再与just比较，即result=0
# (?+a)^u ==0 ==> u==?+a
for i in range(26):print(bytes([i+97+a[j] for j in range(20)]))#b'lucky_hacker_you_are'

16，school-ctf-winter-2015-secret-galaxy-300

初看没有问题，然后逐个看函数发现__libc_csu_gala有数据（linux下的程序编译进的函数比较少，没几个函数很容易找）

__int64 _libc_csu_gala()
{__int64 result; // raxsc = off_601288;*((_QWORD *)&sc + 2) = &byte_601384;*((_DWORD *)&sc + 2) = 31337;*((_DWORD *)&sc + 3) = 1;byte_601384 = off_601268[8];   //Andromeda   abyte_601385 = off_601280[7];   //Triangulum  lbyte_601386 = off_601270[4];   //Messier     ibyte_601387 = off_601268[6];   //            ebyte_601388 = off_601268[1];   //            nbyte_601389 = off_601270[2];   //            sbyte_60138A = 95;              //            _byte_60138B = off_601268[8];   //            abyte_60138C = off_601268[3];   //            rbyte_60138D = off_601278[5];   //Sombrero    ebyte_60138E = 95;              //            _byte_60138F = off_601268[8];   //            abyte_601390 = off_601268[3];   //            rbyte_601391 = off_601268[4];   //            obyte_601392 = off_601280[6];   //            ubyte_601393 = off_601280[4];   //            nbyte_601394 = off_601268[2];   //            dbyte_601395 = 95;              //            _byte_601396 = off_601280[6];   //            uresult = (unsigned __int8)off_601270[3];byte_601397 = off_601270[3];   //            sbyte_601398 = 0;return result;
}

逐个点击找到对应的串的对应字母

//aliens_are_around_us

17，2019_西湖论剑_预选赛_testre

程序很乱没看大明白，发现对输入串进行编码后比较，这个编码用的是标准的base58

    while ( j < n ){v4 = v11;*((_BYTE *)s + v20) = byte_400EB0[v11[j]];// 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz   <---- base58编码*((_BYTE *)v26 + v20++) = byte_400EF0[v4[j++]];// ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/}*((_BYTE *)s + v20) = 0;*v30 = v20 + 1;if ( !strncmp((const char *)s, "D9", 2uLL)  // s=D9cS9N9iHjMLTdA8YSMRMp&& !strncmp((const char *)s + 20, "Mp", 2uLL)&& !strncmp((const char *)s + 18, "MR", 2uLL)&& !strncmp((const char *)s + 2, "cS9N", 4uLL)&& !strncmp((const char *)s + 6, "9iHjM", 5uLL)&& !strncmp((const char *)s + 11, "LTdA8YS", 7uLL) ){HIDWORD(v6) = puts("correct!");}

对对比串进行base58解码

//base58_is_boring

18，school-ctf-winter-2015_simple-check-100

这个逻辑有点复杂了，先与deadbeef异或后再与flag_data异或每4个一组倒着输出

  for ( i = 0; i <= 6; ++i ){v3 = *(_DWORD *)(4LL * i + v6) ^ 0xDEADBEEF;v1 = (int *)&v3;v7 = (int *)&v3;for ( j = 3; j >= 0; --j )LODWORD(v1) = putchar((char)(*((_BYTE *)v7 + j) ^ flag_data[4 * i + j]));}

解码程序

a = [84,-56,126,-29,100,-57,22,-102,-51,17,101,50,45,-29,-45,67,-110,-87,-99,-46,-26,109,44,-45,-74,-67,-2,106]
b = 0xDEADBEEF
b = [0xef,0xbe,0xad,0xde]
a = [(i+256)%256 for i in a]flag_data =[0xDC,0x17,0xBF,0x5B,0xD4,0x0A,0xD2,0x1B,0x7D,0xDA,0xA7,0x95,0xB5,0x32,0x10,0xF6,0x1C,0x65,0x53,0x53,0x67,0xBA,0xEA,0x6E,0x78,0x22,0x72,0xD3]
for i in range(7):for j in range(3,-1,-1):c = a[i*4+j]^b[j]^flag_data[i*4+j]print(chr(c), end='')#flag_is_you_know_cracking!!!

做饭了，明天见。

[XCTF-Reverse] 13-18相关推荐

Xctf Reverse菜鸟题解之csaw2013reversing2
Xctf Reverse菜鸟题解之csaw2013reversing2 IDA Pro静态分析 x32dbg动态调试分析绕过反调试机制 IDA Pro静态分析 x32dbg动态调试分析绕过反调试机 ...
OpenJudge NOI 1.13 18:Tomorrow never knows？
[题目链接] OpenJudge NOI 1.13 18:Tomorrow never knows? [题目考点] 1. 模拟 [解题思路] 模拟日期值的变化要计算当前日期的下一天,先将" ...
CentOS7下部署敏捷项目管理软件JIAR-7.13.18
文章目录第1章操作系统环境的基本说明 1.1 准备的服务器 1.2 操作系统环境 1.3 准备普通用户第2章安装MySQL软件及初始3306实例 2.1 安装MySQL软件 2.2 初始化33 ...
ROT5/13/18/47编码转换
ROT5.ROT13.ROT18.ROT47 编码是一种简单的码元位置顺序替换暗码.此类编码具有可逆性,可以自我解密,主要用于应对快速浏览,或者是机器的读取,而不让其理解其意. ROT5: rot ...
Android进阶课学习收获（13~18）
第13讲:Android是如何通过Activity进行交互的? taskAffinity 单纯使用taskAffinity不能导致Activity被创建在新的任务栈中,需要配合使用si ...
呆错网址导航系统V1.13.18 PHP源码
简介: 呆错网址导航系统是一款开源的PHP分类导航建站程序,支持免费发布.积分快审发布.VIP用户发布. 内附安装说明和伪静态规则网盘下载地址: http://zijiepan4.xyz/wW8U0 ...
第四范式冲刺IPO：4年亏13亿收入逐年翻番，研发工资人均2万
边策梦晨发自凹非寺量子位 | 公众号 QbitAI 知名AI独角兽第四范式,内部详情今天有了完整公开. 中国首个ACM世界冠军戴文渊创办.腾讯红杉加持,股东和客户集齐五大国有银行,创办7年累计 ...
一周一论文（翻译总结）—— [DSN 18] RDMC A Reliable RDMA Multicast for Large Objects :一个面向大型对象的可靠的RDMA广播框架
目录 Abstract 1.Introduction 2. Background On RDMA 3. High level RDMC summary 4. System Design 4.1 Ext ...
C++primer 13.1.6节练习
练习13.18 1 #include <iostream> 2 #include <string> 3 #include <memory> 4 5 using na ...
c++ primer 5th第13章拷贝控制知识点和自编习题答案
首先,先给大家提个醒.在网上的随书源代码里关于hasptr类的类指针版本编写的移动构造函数.移动赋值运算符.和析构函数部分是有错误的.大家可以把hasptr累指针版本(里面带移动构造函数和移动赋值运算 ...