![Reverse: Level1 Cracked by Eswink插图 Reverse: Level1 Cracked by Eswink插图](https://static.esw.eswlnk.com/2021/10/2021102615143759-1024x493.png)
Information
Flag:SYC{ppxdtedZrekKSpAMeqzNoewKQjEFTOMaFNCQiLeMFGg}
Necessary Tools
- IDA 7.5 Linux Cracked by ericyudatou
- Pwntools
- Pycharm && Python3
Debugging Environment
Linux kali 5.10.0-kali9-amd64
Decompile
检测程序架构信息
pwn checksec level1
![Reverse: Level1 Cracked by Eswink插图1 Reverse: Level1 Cracked by Eswink插图1](https://static.esw.eswlnk.com/2021/10/2021102615131097.png)
目标程序为64位程序,选择使用IDA x64反编译该程序,并且跟随来到level1()
函数入口,F5
转换为伪代码,并对变量进行重命名,便于分析。
分析主要代码
v7 = __readfsqword(0x28u);
__readfsqword
用于本地反调试,远程调试即可解决此问题
for ( i = 0; i <= 47; ++i )
{
for ( j = 0; j <= 53; ++j )
{
v1 ^= j ^ v2 ^ 0x5E;
s[i] ^= s[(i + 1) % 48];
s[i] ^= v1;
++v2;
}
}
for ( k = 0; k <= 47; ++k )
{SYC{ppxdtedZrekKSpAMeqzNoewKQjEFTOMaFNCQiLeMFGg}
if ( s[k] != compare_data[k] )
{
puts("Ohhhh, TRY HARD");
return __readfsqword(0x28u) ^ v7;
}
}
循环中的异或操作,可由密文再次异或得到明文,并且位置不受影响,遵循交换律,如:
a ^ b = b ^ a
异或后,再与.data
中的compare_data
内存比较,如果相同则提示:You Win
在IDA中,提取compare_data
中的内容,并且转换为Python List
,便于接下来的还原。
data = [13, 5, 137, 179, 22, 20, 106, 116, 250, 233, 94, 98, 164, 177, 41, 11, 173, 140, 43, 37, 99, 117, 200, 254, 65, 73, 173, 147, 39, 30, 167, 166, 202, 211, 71, 105, 224, 234, 17, 1, 167, 128, 31, 53, 80, 83, 229, 253]
Reverse Script
Script Language
Python3
data = [13, 5, 137, 179, 22, 20, 106, 116, 250, 233, 94, 98, 164, 177, 41, 11, 173, 140, 43, 37, 99, 117, 200, 254, 65,
73, 173, 147, 39, 30, 167, 166, 202, 211, 71, 105, 224, 234, 17, 1, 167, 128, 31, 53, 80, 83, 229, 253]
v1 = -85
v2 = 0
s = data
# s=[95, 94, 201, 204]
for i in range(48):
for j in range(54):
v1 ^= j ^ v2 ^ 0x5e
s[i] = s[i] ^ s[(i + 1) % 4]
s[i] ^= v1
v2 = v2 + 1
print(s)
s = ""
d = ""
#对data[i]进行转换,如果大于127,则%128再转换得到对应的ascii,即可得到对应的明文字符
for i in range(len(data)):
d = data[i]
if d > 127:
d = d % 128
s = s + "".join(chr(d))
print(len(s))
print(s)
运行该脚本后,即可得到对应的Flag:
SYC{ppxdtedZrekKSpAMeqzNoewKQjEFTOMaFNCQiLeMFGg}
Result verification
将得到的Flag的值输入,最后得到正确结果
![Reverse: Level1 Cracked by Eswink插图2 Reverse: Level1 Cracked by Eswink插图2](https://static.esw.eswlnk.com/2021/10/2021102615133935.png)
Reflection & Proposal
- 当ASCII大于127并且需要将其转换为可视字符,需要%128再进行转换
- 异或运算,明文秘钥和密文相互转换,知道其二可求其一
📮评论