0x00 日常查壳

无壳32位

0x01分析主函数

分析如图

9051D8函数（input1）

于是我们进入9051D8函数

 sub_9051D8      proc near               ; DATA XREF: _main+15A↑o
.data:009051D8                 call    $+5		; call 0就是原地TP + push 下一条指令的值放到堆栈
.data:009051DD                 pop     esi
.data:009051DE                 push    edi
.data:009051DF                 xor     edi, edi
.data:009051E1
.data:009051E1 loc_9051E1:                             ; CODE XREF: sub_9051D8+1D↓j
.data:009051E1                 cmp     edi, 151h       ; 循环0x151次
.data:009051E7                 jg      short loc_9051FB ; 跳出
.data:009051E9                 mov     bl, [esi+edi+1Fh] ; 对这段内容进行异或SMC
.data:009051ED                 xor     bl, 72h
.data:009051F0                 mov     [esi+edi+1Fh], bl
.data:009051F4                 inc     edi
.data:009051F5                 jmp     short loc_9051E1 ; 循环0x151次
.data:009051F5 ; ---------------------------------------------------------------------------
.data:009051F7                 db  48h ; H
.data:009051F8                 db  65h ; e
.data:009051F9                 db  79h ; y
.data:009051FA                 db  21h ; !
.data:009051FB ; ---------------------------------------------------------------------------
.data:009051FB
.data:009051FB loc_9051FB:                             ; CODE XREF: sub_9051D8+F↑j

就是对下面那段也就是9051FB之后的内容进行SMC

动调跟也行，静调也可用IDC写个脚本

#include <idc.idc>

static main()
{
	auto addr = 0x9051DD + 0x1F;
	auto i;

	for ( i = 0; i <= 0x151; i++ )
		PatchByte(addr + i, Byte(addr + i) ^ 0x72);
}

注意我们执行这个函数传入的是inpu1（也就是第一part代码）然后可以直接异或得到数据

jmp eax（input2）

于是现在我们的flag是格式是ACTF{yOu0y*_abcdef_ABCDEF}

有了input1就可以去eax（地址是0x9012AC）看看了

上od在jmp eax下个断点

单步跟进 jmp eax

会发现第一段循环 就只是值的迁移

然后遇到第二段循环 干了同样的事

第三段循环就是重点了

除了图中还有一点是要注意data是哪？指令中的ds:[eax + ebx]就是在eax指向的数据区以ebx为下标取值（ebx就是flag[i] ^ (i + 0x83)）

继续往下跟发现比较的地址，那么肯定是我们要的加密字符串了，取6位

同时根据eax地址取data值

input3

在jmp eax下面直接找到了 part3的字符串

0x02 GetFlag!

处理下数据直接解

#include <stdio.h>
#include <string.h>

int main(void)
{
    char data1[] = "3@1b;b";
    char data2[] = "elcome";
    int i, j;
    unsigned char part2[] = { 0x30, 4, 4, 3, 0x30, 0x63 };
    unsigned char data3[] =
    {
        0xF6, 0xA3, 0x5B, 0x9D, 0xE0, 0x95, 0x98, 0x68, 0x8C, 0x65, 0xBB, 0x76, 0x89, 0xD4, 0x09, 0xFD,
        0xF3, 0x5C, 0x3C, 0x4C, 0x36, 0x8E, 0x4D, 0xC4, 0x80, 0x44, 0xD6, 0xA9, 0x01, 0x32, 0x77, 0x29,
        0x90, 0xBC, 0xC0, 0xA8, 0xD8, 0xF9, 0xE1, 0x1D, 0xE4, 0x67, 0x7D, 0x2A, 0x2C, 0x59, 0x9E, 0x3D,
        0x7A, 0x34, 0x11, 0x43, 0x74, 0xD1, 0x62, 0x60, 0x02, 0x4B, 0xAE, 0x99, 0x57, 0xC6, 0x73, 0xB0,
        0x33, 0x18, 0x2B, 0xFE, 0xB9, 0x85, 0xB6, 0xD9, 0xDE, 0x7B, 0xCF, 0x4F, 0xB3, 0xD5, 0x08, 0x7C,
        0x0A, 0x71, 0x12, 0x06, 0x37, 0xFF, 0x7F, 0xB7, 0x46, 0x42, 0x25, 0xC9, 0xD0, 0x50, 0x52, 0xCE,
        0xBD, 0x6C, 0xE5, 0x6F, 0xA5, 0x15, 0xED, 0x64, 0xF0, 0x23, 0x35, 0xE7, 0x0C, 0x61, 0xA4, 0xD7,
        0x51, 0x75, 0x9A, 0xF2, 0x1E, 0xEB, 0x58, 0xF1, 0x94, 0xC3, 0x2F, 0x56, 0xF7, 0xE6, 0x86, 0x47,
        0xFB, 0x83, 0x5E, 0xCC, 0x21, 0x4A, 0x24, 0x07, 0x1C, 0x8A, 0x5A, 0x17, 0x1B, 0xDA, 0xEC, 0x38,
        0x0E, 0x7E, 0xB4, 0x48, 0x88, 0xF4, 0xB8, 0x27, 0x91, 0x00, 0x13, 0x97, 0xBE, 0x53, 0xC2, 0xE8,
        0xEA, 0x1A, 0xE9, 0x2D, 0x14, 0x0B, 0xBF, 0xB5, 0x40, 0x79, 0xD2, 0x3E, 0x19, 0x5D, 0xF8, 0x69, 
        0x39, 0x5F, 0xDB, 0xFA, 0xB2, 0x8B, 0x6E, 0xA2, 0xDF, 0x16, 0xE2, 0x63, 0xB1, 0x20, 0xCB, 0xBA,
        0xEE, 0x8D, 0xAA, 0xC8, 0xC7, 0xC5, 0x05, 0x66, 0x6D, 0x3A, 0x45, 0x72, 0x0D, 0xCA, 0x84, 0x4E, 
        0xF5, 0x31, 0x6B, 0x92, 0xDC, 0xDD, 0x9C, 0x3F, 0x55, 0x96, 0xA1, 0x9F, 0xCD, 0x9B, 0xE3, 0xA0, 
        0xA7, 0xFC, 0xC1, 0x78, 0x10, 0x2E, 0x82, 0x8F, 0x30, 0x54, 0x04, 0xAC, 0x41, 0x93, 0xD3, 0x3B, 
        0xEF, 0x03, 0x81, 0x70, 0xA6, 0x1F, 0x22, 0x26, 0x28, 0x6A, 0xAB, 0x87, 0xAD, 0x49, 0x0F, 0xAF
    };

    // for ( i = 0; i < 6; i++ )
    //     printf("%c", (data1[i] ^ data2[i]) + 35); 
    for ( i = 0; i < 6; i++ )
    {
        for ( j = 0; j < sizeof(data3) / sizeof(unsigned char); j++ )
        {
            if ( part2[i] == data3[j] )
            {
//                printf("%x ", j);
                part2[i] = j ^ (i + 0x83);
            }
                
        }
        printf("%c", part2[i]);
    }

    return 0;
}
//ACTF{yOu0y*_knowo3_5mcsM<}
//yOu0y*
//ACTF{yOu0y*_abcdef_5mcsM<}

GetFlag!