[CTF]DASCTF五月三道逆向题.
2020-05-24 15:07:05 Author: bbs.pediy.com(查看原文) 阅读量:371 收藏

exp: C语言写的, 比较冗长.

#include <stdio.h>

int decode_4(int a)
{
    int i = 0, j = 0, temp = 0;

    for(i = 0; i < 2000; i++)
    {
        j = i;

        j ^= 10;
        temp = (16*j >> 31)>>28;
        if(a == j + (((temp + 16*(*(char *)&j))&0xF)-temp))
            break; 
    }

    return i;    
}

int main(void)
{
    union
    {
        unsigned char ida_chars[152];
        int a[37];
    }A = {
                   66,   0,   0,   0,  74,   0,   0,   0,  68,   0, 
                0,   0, 123,   0,   0,   0,  51,   0,   0,   0, 
                  112,   3,   0,   0,  70,   0,   0,   0, 212,   0, 
                0,   0,  60,   0,   0,   0,  16,   6,   0,   0, 
                   79,   0,   0,   0, 200,   0,   0,   0, 108,   0, 
                   0,   0,  32,   3,   0,   0,  30,   0,   0,   0, 
                  144,   1,   0,   0, 111,   0,   0,   0,  48,   6, 
                0,   0,  70,   0,   0,   0, 144,   1,   0,   0, 
                   59,   0,   0,   0,  16,   6,   0,   0,  29,   0, 
                0,   0, 196,   0,   0,   0,  62,   0,   0,   0, 
                   96,   6,   0,   0,  75,   0,   0,   0, 208,   0, 
                0,   0, 108,   0,   0,   0,  16,   3,   0,   0, 
                   70,   0,   0,   0, 136,   1,   0,   0,  51,   0, 
                0,   0, 112,   3,   0,   0,  76,   0,   0,   0, 
                  204,   0,   0,   0, 125,   0,   0,   0,   0,   0, 
                0,   0
                };
    int i = 0, j = 36, temp = 0;
    int d[100] = {0}, e[100] = {0};
    int a1[100] = {3,6,5,4,5,11,1,7,9,5,3,6,10,9,5,4,11,1,6,3,7,9,10,9,5,4,14,1,7,9,10,9,4,5,3,6,1,5,3,6,7,9,10,9,36,3,6,36,4,1,5,7,9,3,6,5,10,9,4,1,7,9,10,9,5,4,5,1,5,7,9,5,10,9,3,6,5,4,5,11,1,7,9,5,3,6,10,9};                
    int b[100] = {1,2,3,4,19,31,25,14,23,33,13,9,24,6,26,34,17,10,8,29,12,15,22,11,18,16,32,28,21,36,20,7,5,27,30,35,37};
    int c[100] = {1,2,3,4,31,29,7,35,14,21,9,16,27,18,25,10,20,15,17,22,28,26,36,33,32,5,8,12,23,34,13,30,24,11,19,6,37};

    while(i >= -87)
    switch(a1[87+i])
    {

        case 1:
                --j;
                --i;
                A.a[j] = (A.a[j] / 16)*2;
                A.a[j] = A.a[j];
                A.a[j] /= 2;
                break;
        case 2:
                A.a[j] -= 128;
                A.a[j] = A.a[j]*j;
                --i;
                break;    
        case 3:
                A.a[++j] /= 10;
                --i;

                break;
        case 4:
                --j;
                --i;
                A.a[j] = decode_4(A.a[j]);
                break;
        case 5:
                A.a[j] = A.a[j];
                --i;
                break;
        case 6:
                A.a[j--] *= 10;
                --i;
                break;
        case 7:
                A.a[j] -= 128;
                A.a[j] = ~A.a[j];
                --i;
                break;
        case 9:
                --i;
                --j;
                break;
        case 10:
                A.a[j] /= 4;
                --i;
                break;
        default:
                --i;
                break;

    } 

    for(i = 0; i < 37; i++)
    {
        d[c[i]-1] = A.a[i];
    }

    for(i = 0; i < 37; i++)
    {
        e[b[i]-1] = d[i];
    }

    for(i = 4; i <= 19; i++)
    {
        temp = e[i];
        e[i] = e[i+16];
        e[i+16] = temp;
    }  

    for(i = 0; i < 37; i++)    
    printf("%c", e[i]); 

    return 0;

}


文章来源: https://bbs.pediy.com/thread-259707.htm
如有侵权请联系:admin#unsafe.sh