title: buu-re-luck_guy
    tags:

    • CTF
    • RE
    • buu
      abbrlink: 6c2d8964
      date: 2021-03-10 15:51:56

    拿到后使用IDA64打开后，发现有main函数，进入后反编译为伪代码

    1. int __cdecl main(int argc, const char **argv, const char **envp)
    2. {
    3.   int v4; // [rsp+14h] [rbp-Ch]
    4.   unsigned __int64 v5; // [rsp+18h] [rbp-8h]
    6.   v5 = __readfsqword(0x28u);
    7.   welcome(*(_QWORD *)&argc, argv, envp);
    8.   puts("_________________");
    9.   puts("try to patch me and find flag");
    10.   v4 = 0;
    11.   puts("please input a lucky number");
    12.   __isoc99_scanf("%d", &v4);
    13.   patch_me(v4);
    14.   puts("OK,see you again");
    15.   return 0;
    16. }

    看到一个负责对比flag的patch_me函数，进入这个函数，看到如下

    1. int __fastcall patch_me(int a1)
    2. {
    3.   int result; // eax
    5.   if ( a1 % 2 == 1 )
    6.     result = puts("just finished");
    7.   else
    8.     result = get_flag();
    9.   return result;
    10. }

    很显然，get_flag就是获取flag的函数，进入这个函数

    1. unsigned __int64 get_flag()
    2. {
    3.   unsigned int v0; // eax
    4.   char v1; // al
    5.   signed int i; // [rsp+4h] [rbp-3Ch]
    6.   signed int j; // [rsp+8h] [rbp-38h]
    7.   __int64 s; // [rsp+10h] [rbp-30h]
    8.   char v6; // [rsp+18h] [rbp-28h]
    9.   unsigned __int64 v7; // [rsp+38h] [rbp-8h]
    11.   v7 = __readfsqword(0x28u);
    12.   v0 = time(0LL);
    13.   srand(v0);
    14.   for ( i = 0; i <= 4; ++i )
    15.   {
    16.     switch ( rand() % 200 )
    17.     {
    18.       case 1:
    19.         puts("OK, it's flag:");
    20.         memset(&s, 0, 0x28uLL);
    21.         strcat((char *)&s, f1);
    22.         strcat((char *)&s, &f2);
    23.         printf("%s", &s);
    24.         break;
    25.       case 2:
    26.         printf("Solar not like you");
    27.         break;
    28.       case 3:
    29.         printf("Solar want a girlfriend");
    30.         break;
    31.       case 4:
    32.         v6 = 0;
    33.         s = 9180147350284624745LL;
    34.         strcat(&f2, (const char *)&s);
    35.         break;
    36.       case 5:
    37.         for ( j = 0; j <= 7; ++j )
    38.         {
    39.           if ( j % 2 == 1 )
    40.             v1 = *(&f2 + j) - 2;
    41.           else
    42.             v1 = *(&f2 + j) - 1;
    43.           *(&f2 + j) = v1;
    44.         }
    45.         break;
    46.       default:
    47.         puts("emmm,you can't find flag 23333");
    48.         break;
    49.     }
    50.   }

    可以看到整个处理的case是在1-199之间随机生成的，处理后发现真正对串进行过处理的只有case1/4/5，其中字符串f1已经有值了，回溯过去内容为GXY{do_not_，f2的处理是对内容串进行了一系列操作，可以直接转化为C程序

    1. #include<iostream>
    3. using namespace std;
    5. int main()
    6. {
    7.     char f2[]={0x69, 0x63, 0x75, 0x67, 0x60, 0x6f, 0x66, 0x7f, 0};
    8.     for(int i=0;i<8;i++)
    9.     {
    10.         if(i%2==1)
    11.             f2[i]-=2;
    12.         else
    13.             f2[i]-=1;
    14.     }
    15.     char f1[]="GXY{do_not_";
    16.     char flag[20];
    17.     memset(flag, 0, 20);
    18.     strcat(flag, f1);
    19.     strcat(flag, f2);
    20.     puts(flag);
    21.     return 0;
    22. }

    运行后得到flagGXY{do_not_hate_me}