0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 3 years have passed since last update.

CpawCTF - Quection23 [Reversing] またやらかした!

Posted at

#CpawCTF - Quection23 [Reversing] またやらかした!

  • 問題

    • またprintf()をし忘れたプログラムが見つかった。
      とある暗号を解くプログラムらしい…
    • +実行ファイル
  • IDAで逆アセ

    • mainから重要なところだけ抜き出し

    • 値の初期化

      image.png

    • 順番に値を入れてって

      image.png

    • [ebp+var_80]が0D以下の間だけloc_804847Aをやる

      • [ebp+var_80]は最初0から始まって1ずつインクリメント
      • つまり14回loc_804847Aにはいる
    • loc_804847A

      • [ebp+var_7C]とeaxでxorをとる
      • [ebp+var_7C]は0x19で固定
      • eaxは[ebp+var_78+eax*4]
        • eax*4は0 - 14まで入る
          image.png
  • c++で書き直したあと実行して終了

#include <bits/stdc++.h>
using namespace std;

#define INF 2e9
#define INF_LL 1LL<<60
#define ll long long

#define REP(i, n) for (ll (i) = 0 ; (i) < (ll)(n) ; ++(i))
#define REPN(i, m, n) for (ll (i) = m ; (i) < (ll)(n) ; ++(i))
#define REP_REV(i, n) for (ll (i) = (ll)(n) - 1 ; (i) >= 0 ; --(i))
#define REPN_REV(i, m, n) for (ll (i) = (ll)(n) - 1 ; (i) >= m ; --(i))

int main(){
    int var[] = {0x7a, 0x69, 0x78, 0x6e, 0x62, 0x6f, 0x7c, 0x6b, 
                    0x77, 0x78, 0x74, 0x38, 0x38, 0x64}; 
    int var2 = 0x19;
    int ans[14];

    REP(i, 14) {
        ans[i] = var[i] ^ var2;
    }

    REP(i, 14) {
        cout << (char)ans[i] << " ";
    }
    cout << endl;

    return 0;
}
0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?