【攻防世界】Reverse——secret-galaxy-300 writeup

由main函数查看相关代码，但是代码中并没有直接的关于flag的信息：

int __cdecl main(int argc, const char **argv, const char **envp)
{__main();fill_starbase(&starbase);print_starbase((int)&starbase);return 0;
}
void __cdecl fill_starbase(int a1)
{int i; // [esp+8h] [ebp-10h]int v2; // [esp+Ch] [ebp-Ch]v2 = 0;for ( i = 0; i <= 4; ++i ){*(_DWORD *)(a1 + 24 * i) = galaxy_name[i];*(_DWORD *)(24 * i + a1 + 4) = rand();*(_DWORD *)(24 * i + a1 + 8) = 0;*(_DWORD *)(24 * i + a1 + 12) = 0;*(_DWORD *)(24 * i + a1 + 16) = 24 * (i + 1) + a1;*(_DWORD *)(a1 + 24 * i + 20) = v2;v2 = 24 * i + a1;}
}
int __cdecl print_starbase(int a1)
{int result; // eaxconst char *v2; // edxint i; // [esp+1Ch] [ebp-Ch]puts("--------------GALAXY DATABASE-------------");printf("%10s | %s | %s\n", "Galaxy name", "Existence of life", "Distance from Earth");result = puts("-------------------------------------------");for ( i = 0; i <= 4; ++i ){if ( *(_DWORD *)(24 * i + a1 + 8) == 1 )v2 = "INHABITED";elsev2 = "IS NOT INHABITED";result = printf("%11s | %17s | %d\n", *(const char **)(24 * i + a1), v2, *(_DWORD *)(24 * i + a1 + 4));}return result;
}

注意到print_starbase只是打印了5个galaxy，但galaxy_name有6个元素：

c通过交叉引用，找到了下面的代码：

int __libc_csu_gala()
{int result; // eaxsc[0] = off_409014;sc[3] = &byte_40DAC0;sc[1] = 31337;sc[2] = 1;byte_40DAC0 = off_409004[0][8];byte_40DAC1 = off_409010[0][7];byte_40DAC2 = off_409008[0][4];byte_40DAC3 = off_409004[0][6];byte_40DAC4 = off_409004[0][1];byte_40DAC5 = off_409008[0][2];byte_40DAC6 = 95;byte_40DAC7 = off_409004[0][8];byte_40DAC8 = off_409004[0][3];byte_40DAC9 = off_40900C[0][5];byte_40DACA = 95;byte_40DACB = off_409004[0][8];byte_40DACC = off_409004[0][3];byte_40DACD = off_409004[0][4];byte_40DACE = off_409010[0][6];byte_40DACF = off_409010[0][4];byte_40DAD0 = off_409004[0][2];byte_40DAD1 = 95;byte_40DAD2 = off_409010[0][6];result = *((unsigned __int8 *)off_409008[0] + 3);byte_40DAD3 = off_409008[0][3];byte_40DAD4 = 0;return result;
}

但是上面代码中的result并不是我们要的flag，而是byte_40DAC0数组。解密方法有两种，一种是动态的就是在上面的代码中下断点，另一种是通过静态分析，用python改写上面的代码：

off_409004 = "Andromeda".encode('utf-8')
off_409008= "Messier".encode('utf-8')
off_40900C = "Sombrero".encode('utf-8')
off_409010  = "Triangulum".encode('utf-8')
off_409014 = "DARK SECRET GALAXY".encode('utf-8')def __libc_csu_gala():byte_40DAC = bytearray(21)  byte_40DAC[0] = off_409004[8]byte_40DAC[1] = off_409010[7]byte_40DAC[2] = off_409008[4]byte_40DAC[3] = off_409004[6]byte_40DAC[4] = off_409004[1]byte_40DAC[5] = off_409008[2]byte_40DAC[6] = 95byte_40DAC[7] = off_409004[8]byte_40DAC[8] = off_409004[3]byte_40DAC[9] = off_40900C[5]byte_40DAC[10] = 95byte_40DAC[11] = off_409004[8]byte_40DAC[12] = off_409004[3]byte_40DAC[13] = off_409004[4]byte_40DAC[14] = off_409010[6]byte_40DAC[15] = off_409010[4]byte_40DAC[16] = off_409004[2]byte_40DAC[17] = 95byte_40DAC[18] = off_409010[6]byte_40DAC[19] = off_409008[3]byte_40DAC[20] = 0return byte_40DAC.decode('utf-8')  result = __libc_csu_gala()
print(result)