reverse

reverse

反编译后的加密函数

__int64 __fastcall stringMod(__int64 *a1)
{__int64 v1; // r9__int64 v2; // r10__int64 v3; // rcxint v4; // er8int *v5; // rdiint *v6; // rsiint v7; // ecxint v8; // er9int v9; // er10unsigned int v10; // eaxint v11; // esiint v12; // esiint v14[18]; // [rsp+0h] [rbp-60h] BYREF__int64 v15; // [rsp+48h] [rbp-18h] BYREFmemset(v14, 0, sizeof(v14));v1 = a1[1];if ( v1 ){v2 = *a1;v3 = 0LL;v4 = 0;do{v12 = *(char *)(v2 + v3);v14[v3] = v12;if ( 3 * ((unsigned int)v3 / 3) == (_DWORD)v3 && v12 != firstchar[(unsigned int)v3 / 3] )  // flag[3n] = firstchar[n]v4 = -1;++v3;}while ( v3 != v1 );}else{v4 = 0;}v5 = v14;v6 = v14;v7 = 666;do  {*v6 = v7 ^ *(unsigned __int8 *)v6;  // 对flag[n]进行异或处理v7 += v7 % 5;++v6;}while ( &v15 != (__int64 *)v6 );v8 = 1;v9 = 0;v10 = 1;v11 = 0;do{if ( v11 == 2 ){if ( *v5 != thirdchar[v9] )  // 处理后，flag[3n+2] = thirdchar[n]v4 = -1;if ( v10 % *v5 != masterArray[v9] )  //处理后， flag[3n] * flag[3n+1] % flag[3n+2] = masterArray[n]v4 = -1;++v9;v10 = 1;v11 = 0;}else{v10 *= *v5;if ( ++v11 == 3 )v11 = 0;}++v8;++v5;}while ( v8 != 19 );return (unsigned int)(v7 * v4);
}

Exp

first = [0x41, 0x69, 0x6E, 0x45, 0x6F, 0x61]
third = [0x2EF, 0x2C4, 0x2DC, 0x2C7, 0x2DE, 0x2FC]
master = [0x1D7, 0x0C, 0x244, 0x25E, 0x93, 0x6C]
flag = [0] * 18
v7 = 666
v = []
# 求flag[3n]
for i in range(6):flag[3 * i] = first[i]# 计算参与异或数组
for i in range(18):v.append(v7)v7 += v7 % 5# 求flag[3n+2]
for i in range(6):flag[3 * i + 2] = v[3 * i + 2] ^ third[i]# 求flag[3n+1](爆破)
for i in range(6):for j in range(32, 127):if (flag[3 * i] ^ v[3 * i]) * (j ^ v[3 * i + 1]) % (flag[3 * i + 2] ^ v[3 * i + 2]) == master[i]:flag[3 * i + 1] = jbreak
print('tuctf{' + ''.join(map(chr, flag)) + '}')

输出 tuctf{AfricanOrEuropean?}