攻防世界-Reversing-x64Elf-100

Reversing-x64Elf-100

18最佳Writeup由 yuchouxuan 提供

收藏

反馈

难度：1

方向：Reverse

题解数：15

解出人数：2460

题目来源:

题目描述: 暂无

note:undefined8 FUN_004006fd(long param_1){int local_2c;char *local_28 [4];local_28[0] = "Dufhbmf";local_28[1] = "pG`imos";local_28[2] = "ewUglpt";local_2c = 0;while( true ) {if (0xb < local_2c) {return 0;}if ((int)local_28[local_2c % 3][(local_2c / 3) * 2] - (int)*(char *)(param_1 + local_2c) != 1)break;local_2c = local_2c + 1;}return 1;
}

signed __int64 __fastcall sub_4006FD(__int64 a1)
{signed int i; // [rsp+14h] [rbp-24h]const char *v3; // [rsp+18h] [rbp-20h]const char *v4; // [rsp+20h] [rbp-18h]const char *v5; // [rsp+28h] [rbp-10h]v3 = "Dufhbmf";v4 = "pG`imos";v5 = "ewUglpt";for ( i = 0; i <= 11; ++i ){if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )return 1LL;}return 0LL;
}

*(char *)(i + a1) =(&v3)[i % 3][2 * (i / 3)]-1

CcmbPZ[dd\ig

DepfU`blmfts____________CdoeT_aklesr____________67 100 111 101 84 95 97 107 108

101 115 114

wrong try!

#include<stdio.h>int sub_4006FD(void)
{signed int i; // [rsp+14h] [rbp-24h]const char *v3; // [rsp+18h] [rbp-20h]const char *v4; // [rsp+20h] [rbp-18h]const char *v5; // [rsp+28h] [rbp-10h]
//int a1;v3 = "Dufhbmf";v4 = "pG`imos";v5 = "ewUglpt";for ( i = 0; i <= 11; ++i ){printf("%c",(&v3)[i % 3][2 * (i / 3)]);
//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
//      return 1LL;}for ( i = 0; i <= 11; ++i ){printf("%s","-");//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )//      return 1LL;}for ( i = 0; i <= 11; ++i ){printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )//      return 1LL;}for ( i = 0; i <= 11; ++i ){printf("-");//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )//      return 1LL;}for ( i = 0; i <= 11; ++i ){printf("%d ",(&v3)[i % 3][2 * (i / 3)]-1);//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )//      return 1LL;}return 0LL;
}int main(void){sub_4006FD();return 0;
}

DepfU`blmfts------------CdoeT_aklesr------------67 100 111 101 84 95 97 107 108

101 115 114

Process exited after 0.07565 seconds with return value 0
请按任意键继续. . .

┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ ./43ba593623a7434fa5437cdd5c7862a1.re  
Enter the password: CcmbPZ[dd\ig
Incorrect password!┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ ./43ba593623a7434fa5437cdd5c7862a1.re                                                                                                                                    1 ⨯
Enter the password: Code_Talkers
Nice!┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ 

Final try!

#include<stdio.h>int  FUN_004006fd( void)
{int local_2c,n,i;char *local_28 [4];int param_1[11]={99};local_28[0] = "Dufhbmf";local_28[1] = "pG`imos";local_28[2] = "ewUglpt";local_2c = 0;for ( local_2c = 0; local_2c <= 11; ++local_2c ) {for (n=0;n<222;n++){if (local_28[local_2c % 3][(local_2c / 3) * 2] - (n + local_2c) == 1)param_1[local_2c]=n;}local_2c = local_2c + 1;}for ( i = 0; i <= 11; ++i ){printf("%c",param_1[i]);}printf("\n------------------------\n");for ( i = 0; i <= 11; ++i ){printf("%c",local_28[i % 3][(i / 3) * 2]-1);}      return 1;
}int sub_4006FD(void)
{int i,n; // [rsp+14h] [rbp-24h]const char *v3; // [rsp+18h] [rbp-20h]const char *v4; // [rsp+20h] [rbp-18h]const char *v5; // [rsp+28h] [rbp-10h]
//int a1;v3 = "Dufhbmf";v4 = "pG`imos";v5 = "ewUglpt";int a1[11]={1};//  for ( i = 0; i <= 11; ++i )
//  {
//  	printf("%c",(&v3)[i % 3][2 * (i / 3)]);if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )return 1LL;
//  }
//
//
//
//	      	printf("\n------------------------\n");
//
//
//        for ( i = 0; i <= 11; ++i )
//	    {
//	    	printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);
//
//	    }printf("\n------------------------\n");for ( i = 0; i <= 11; ++i ){//	printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);for ( n = 0; n < 222; n++){if ((&v3)[i % 3][2 * (i / 3)]- n == 1)a1[i] = n;}}	for ( i = 0; i <= 11; ++i ){printf("%c",a1[i]);}   printf("\n------------------------\n");return 0LL;
}int main(void){sub_4006FD();FUN_004006fd();return 0;
}

Useful code:

int  FUN_004006fd( void)
{int local_2c,n,i;char *local_28 [4];int param_1[11]={99};local_28[0] = "Dufhbmf";local_28[1] = "pG`imos";local_28[2] = "ewUglpt";local_2c = 0;printf("\n------------------------\n");for ( i = 0; i <= 11; ++i ){printf("%c",local_28[i % 3][(i / 3) * 2]-1);}      return 1;
}

  int local_2c,n,i;char *local_28 [4];int param_1[11]={99};local_28[0] = "Dufhbmf";local_28[1] = "pG`imos";local_28[2] = "ewUglpt";local_2c = 0;printf("\n------------------------\n");for ( i = 0; i <= 11; ++i ){printf("%c",local_28[i % 3][(i / 3) * 2]-1);}  

https://www.freebuf.com/articles/network/327979.html算法分析丨Reversing-x64Elf-100逆向题

https://blog.csdn.net/czw2479/article/details/124996658

res = ""
word = ["Dufhbmf", "pG`imos", "ewUglpt"]
for i in range(12):res += chr(ord(word[i % 3][2 * (i // 3)]) - 1)
print(res)"""output
Code_Talkers
"""

https://www.freebuf.com/articles/network/327979.html算法分析丨Reversing-x64Elf-100逆向题

res = “”
word = [“Dufhbmf”, “pG`imos”, “ewUglpt”]
for i in range(12):
res += chr(ord(word[i % 3][2 * (i // 3)]) - 1)
print(res)

“”“output
Code_Talkers
“””