赞
踩
提示:文章写完后,目录可以自动生成,如何生成可参考右边的帮助文档
区段查看器
名称 V. 偏移 V. 大小 R. 偏移 R. 大小 标志
UPX0 00001000 0000F000 00000400 00000000 E0000080
UPX1 00010000 00009000 00000400 00008400 E0000040
.rsrc 00019000 00002000 00008800 00001800 C0000040
特征码1:60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF
特征码2:60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75
特征码3:55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80
00418110 > 60 pushad
00418111 BE 00004100 mov esi,packed.00410000
00418116 8DBE 0010FFFF lea edi,dword ptr ds:[esi+FFFF1000]
0041811C 57 push edi
0041811D EB 0B jmp short packed.0041812A
0041811F 90 nop
00418120 8A06 mov al,byte ptr ds:[esi]
00418130 > 60 pushad
00418131 90 nop
00418132 BE 00004100 mov esi,Ep_2_5_1.00410000
00418137 8DBE 0010FFFF lea edi,dword ptr ds:[esi+FFFF1000]
0041813D 57 push edi
0041813E EB 0A jmp short Ep_2_5_1.0041814A
00418140 8A06 mov al,byte ptr ds:[esi]
00418142 46 inc esi
00418131 ^\72 ED jb short packed.00418120
00418133 B8 01000000 mov eax,1
00418138 01DB add ebx,ebx
00418151 ^\72 ED jb short Ep_2_5_1.00418140
00418153 33C0 xor eax,eax
00418155 40 inc eax
00418156 8BC0 mov eax,eax
00418158 01DB add ebx,ebx
00418295 39C4 cmp esp,eax
00418297 ^ 75 FA jnz short packed.00418293
00418299 83EC 80 sub esp,-80
0041829C - E9 82DDFEFF jmp packed.00406023
00418295 39C4 cmp esp,eax
00418297 ^ 0F85 F6FFFFFF jnz packed.00418293
0041829D 83EC 80 sub esp,-80
004182A0 - E9 7EDDFEFF jmp packed.00406023
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ?  00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ? @ 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 ? 00000040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ? ???L?Th 00000050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno 00000060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS 00000070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode. nbsp; 00000080 99 3C 71 89 DD 5D 1F DA DD 5D 1F DA DD 5D 1F DA ?q壿] 谳] 谳] ? 00000090 5E 41 11 DA D2 5D 1F DA 53 55 40 DA DC 5D 1F DA ^A 谝] 赟U@谲] ? 000000A0 DD 5D 1E DA 66 5D 1F DA 5E 55 42 DA CE 5D 1F DA 輂 趂] 赹UB谖] ? 000000B0 35 42 14 DA DF 5D 1F DA 35 42 15 DA A9 5D 1F DA 5B 谶] ?B 讴] ? 000000C0 65 5B 19 DA DC 5D 1F DA 52 69 63 68 DD 5D 1F DA e[ 谲] 赗ich輂 ? 000000D0 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 PE L 000000E0 9A DA 22 4D 00 00 00 00 00 00 00 00 E0 00 0F 01 氌"M ? 000000F0 0B 01 06 00 00 90 00 00 00 20 00 00 00 F0 00 00 ? ? 00000100 10 81 01 00 00 00 01 00 00 90 01 00 00 00 40 00 ? ? @ 00000110 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 00000120 04 00 00 00 00 00 00 00 00 B0 01 00 00 10 00 00 ? 00000130 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00000140 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00000150 00 00 00 00 00 00 00 00 D0 A5 01 00 04 02 00 00 啸 00000160 00 90 01 00 D0 15 00 00 00 00 00 00 00 00 00 00 ? ? 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001B0 00 00 00 00 00 00 00 00
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ?  00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ? @ 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 @ 00000040 50 45 00 00 4C 01 03 00 9A DA 22 4D 00 00 00 00 PE L 氌"M 00000050 00 00 00 00 78 01 0F 01 0B 01 06 00 00 90 00 00 x ? 00000060 00 20 00 00 00 F0 00 00 10 81 01 00 00 00 01 00 ? ? 00000070 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 ? @ 00000080 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00000090 00 B0 01 00 00 10 00 00 00 00 00 00 02 00 00 00 ? 000000A0 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 000000B0 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 000000C0 D0 A5 01 00 04 02 00 00 00 90 01 00 D0 15 00 00 啸 ? ? 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001B0 00 00 00 00 00 00 00 00
__int64 sub_1400181C0() { __int64 v0; // rax __int64 v1; // rax sub_140011514(&unk_14002B069); sub_1400110AF(std::cout, "Please input the flag:"); sub_1400114D8(std::cin, Str); v0 = sub_1400110AF(std::cout, "Can you calculated out z3?"); std::ostream::operator<<(v0, sub_14001104B); sub_1400110AF(std::cout, "Please input z3:"); sub_1400114D8(std::cin, &unk_140025588); for ( dword_1400254C8 = 0; (unsigned int)dword_1400254C8 < j_strlen(Str); ++dword_1400254C8 ) dword_140025520[dword_1400254C8] = sub_14001124E( (unsigned int)Str[dword_1400254C8], dword_140025000[dword_1400254C8]); sub_14001103C(&unk_140025588); sub_1400112F8(&unk_140025588); dword_1400254C4 = sub_1400110E6(); if ( dword_1400254C4 == 1 ) v1 = sub_1400110AF(std::cout, "yeah!!!!!!you get the flag"); else v1 = sub_1400110AF(std::cout, "oh no!!!!!your flag is wrong,try again"); std::ostream::operator<<(v1, sub_14001104B); system("pause"); return 0i64; }
__int64 __fastcall sub_140014E90(char *a1) { __int64 v1; // rax __int64 v2; // rax sub_140011514((__int64)&unk_14002B069); if ( 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + *a1 + 2 * a1[1] - 3 * a1[2] - 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2582239 || 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] + 5 * a1[4] + 3 * a1[2] + 2 * a1[1] * *a1 - 4 * a1[3] - 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - (18 * a1[17] + 17 * a1[16]) == 2602741 || 19 * a1[18] + 18 * a1[17] + 14 * a1[13] * 13 * a1[12] + 12 * a1[11] * 11 * a1[10] + 9 * a1[8] + 7 * a1[6] * 30 * a1[5] + *a1 - 2 * a1[1] - 4 * a1[3] * 3 * a1[2] - 5 * a1[4] + 8 * a1[7] - 10 * a1[9] - 15 * a1[14] - 17 * a1[16] * 16 * a1[15] - 20 * a1[19] == 2668123 || 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + (13 * a1[12] + 11 * a1[10] - 12 * a1[11]) * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + *a1 + 2 * a1[1] - 3 * a1[2] - 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2520193 || 18 * a1[17] + 17 * a1[16] + 15 * a1[14] + 13 * a1[12] * 12 * a1[11] + 10 * a1[9] + 9 * a1[8] * 8 * a1[7] + 3 * a1[2] * 2 * a1[1] * *a1 - 4 * a1[3] - 5 * a1[4] - 30 * a1[5] - 7 * a1[6] - 11 * a1[10] - 14 * a1[13] - 16 * a1[15] - 19 * a1[18] - 20 * a1[19] == 8904587 || 18 * a1[17] + 7 * a1[6] * 30 * a1[5] * 5 * a1[4] + 4 * a1[3] + 8 * a1[7] + *a1 - 2 * a1[1] - 3 * a1[2] - 9 * a1[8] - 11 * a1[10] * 10 * a1[9] - 16 * a1[15] * (13 * a1[12] + 12 * a1[11] - 14 * a1[13] - 15 * a1[14]) - 17 * a1[16] - 19 * a1[18] - 20 * a1[19] == 1227620874 || 20 * a1[19] * 19 * a1[18] + 17 * a1[16] + 14 * a1[13] + 13 * a1[12] + 12 * a1[11] * 11 * a1[10] * 10 * a1[9] + 7 * a1[6] * 30 * a1[5] + 5 * a1[4] + 3 * a1[2] + *a1 + 2 * a1[1] + 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 18 * a1[17] == 1836606059 || 20 * a1[19] * 19 * a1[18] + 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 13 * a1[12] + 12 * a1[11] + 7 * a1[6] * 30 * a1[5] + 5 * a1[4] + 2 * a1[1] * *a1 - 3 * a1[2] + 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 10 * a1[9] - 11 * a1[10] - 17 * a1[16] - 18 * a1[17] == 8720560 || 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * (10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8]) + *a1 + 2 * a1[1] - 3 * a1[2] - 12 * a1[11] - (16 * a1[15] - 17 * a1[16] - 18 * a1[17]) * 15 * a1[14] == 11387045 || 20 * a1[19] * 19 * a1[18] + 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 9 * a1[8] + 3 * a1[2] + *a1 - 2 * a1[1] + 4 * a1[3] - 5 * a1[4] - 30 * a1[5] - 7 * a1[6] + 8 * a1[7] - 12 * a1[11] - 13 * a1[12] - 17 * a1[16] - 18 * a1[17] == 7660269 || 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] - 12 * a1[11] + *a1 + 2 * a1[1] - (4 * a1[3] * 3 * a1[2] - 5 * a1[4] - 30 * a1[5]) - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2461883 || 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 9 * a1[8] * 8 * a1[7] + 7 * a1[6] + 2 * a1[1] * *a1 - 4 * a1[3] * 3 * a1[2] - 5 * a1[4] - 30 * a1[5] - 12 * a1[11] - 13 * a1[12] - 15 * a1[14] - 17 * a1[16] * 16 * a1[15] - 18 * a1[17] - 19 * a1[18] - 20 * a1[19] == -966296 || 14 * a1[13] + 13 * a1[12] + (11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 3 * a1[2] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8]) * 2 * a1[1] + *a1 - 12 * a1[11] - 15 * a1[14] - 16 * a1[15] - 17 * a1[16] - 18 * a1[17] - 20 * a1[19] * 19 * a1[18] == 254500223 || 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 7 * a1[6] * 30 * a1[5] + *a1 - 2 * a1[1] - 3 * a1[2] - 5 * a1[4] * 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 12 * a1[11] - 13 * a1[12] - 17 * a1[16] - 18 * a1[17] - 19 * a1[18] - 20 * a1[19] == 6022286 || 18 * a1[17] + 16 * a1[15] - 17 * a1[16] + 14 * a1[13] + 12 * a1[11] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 4 * a1[3] * 3 * a1[2] + 2 * a1[1] * *a1 - 9 * a1[8] * 8 * a1[7] * 7 * a1[6] - 13 * a1[12] - 15 * a1[14] - 19 * a1[18] - 20 * a1[19] == -636956022 || 20 * a1[19] * 19 * a1[18] + 13 * a1[12] + 12 * a1[11] + 11 * a1[10] * 10 * a1[9] + 7 * a1[6] + 30 * a1[5] + 5 * a1[4] + 3 * a1[2] * 2 * a1[1] * *a1 - 4 * a1[3] - 9 * a1[8] * 8 * a1[7] - 14 * a1[13] - 15 * a1[14] - 16 * a1[15] - 17 * a1[16] - 18 * a1[17] == 10631829 || 20 * a1[19] * 19 * a1[18] + 16 * a1[15] - 17 * a1[16] - 18 * a1[17] + 15 * a1[14] * 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] - 12 * a1[11] + 7 * a1[6] + (4 * a1[3] - 5 * a1[4] - 30 * a1[5]) * 3 * a1[2] + *a1 + 2 * a1[1] + 8 * a1[7] - 9 * a1[8] == 6191333 || 14 * a1[13] + 10 * a1[9] * 9 * a1[8] * 8 * a1[7] + 5 * a1[4] + 4 * a1[3] * 3 * a1[2] + 2 * a1[1] * *a1 - 7 * a1[6] * 30 * a1[5] - 11 * a1[10] - 13 * a1[12] * 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - 18 * a1[17] * 17 * a1[16] - 20 * a1[19] * 19 * a1[18] == 890415359 || 20 * a1[19] + 19 * a1[18] + 18 * a1[17] + 16 * a1[15] - 17 * a1[16] + 12 * a1[11] + 11 * a1[10] + 10 * a1[9] + 9 * a1[8] + 30 * a1[5] + *a1 + 4 * a1[3] * 3 * a1[2] * 2 * a1[1] - 5 * a1[4] - 7 * a1[6] + 8 * a1[7] - 13 * a1[12] - 14 * a1[13] - 15 * a1[14] == 23493664 || 20 * a1[19] * 19 * a1[18] + 13 * a1[12] + 12 * a1[11] + 10 * a1[9] + 3 * a1[2] * 2 * a1[1] + *a1 - 4 * a1[3] - 5 * a1[4] + 8 * a1[7] * 7 * a1[6] * 30 * a1[5] - 9 * a1[8] - 11 * a1[10] - 14 * a1[13] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 1967260144 ) { v2 = sub_1400110AF(std::cout, "YOU are right"); std::ostream::operator<<(v2, sub_14001104B); } else { v1 = sub_1400110AF(std::cout, "YOU are wrong"); std::ostream::operator<<(v1, sub_14001104B); } return 0i64; }
from z3 import * a1 = [BitVec("num[%d]" % i, 32) for i in range(20)] s = Solver() s.add( 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + a1[0] + 2 * a1[1] - 3 * a1[2] - 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2582239) s.add( 20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] + 5 * a1[4] + 3 * a1[2] + 2 * a1[1] * a1[0] - 4 * a1[3] - 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - (18 * a1[17] + 17 * a1[16]) == 2602741) s.add(19 * a1[18] + 18 * a1[17] + 14 * a1[13] * 13 * a1[12] + 12 * a1[11] * 11 * a1[10] + 9 * a1[8] + 7 * a1[6] * 30 * a1[5] + a1[0] - 2 * a1[1] - 4 * a1[3] * 3 * a1[2] - 5 * a1[4] + 8 * a1[7] - 10 * a1[9] - 15 * a1[14] - 17 * a1[16] * 16 * a1[15] - 20 * a1[19] == 2668123) s.add(20 * a1[19] * 19 * a1[18] + 14 * a1[13] + (13 * a1[12] + 11 * a1[10] - 12 * a1[11]) * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + a1[0] + 2 * a1[1] - 3 * a1[2] - 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2520193) s.add( 18 * a1[17] + 17 * a1[16] + 15 * a1[14] + 13 * a1[12] * 12 * a1[11] + 10 * a1[9] + 9 * a1[8] * 8 * a1[7] + 3 * a1[2] * 2 * a1[1] * a1[0] - 4 * a1[3] - 5 * a1[4] - 30 * a1[5] - 7 * a1[6] - 11 * a1[10] - 14 * a1[13] - 16 * a1[15] - 19 * a1[18] - 20 * a1[19] == 8904587) s.add( 18 * a1[17] + 7 * a1[6] * 30 * a1[5] * 5 * a1[4] + 4 * a1[3] + 8 * a1[7] + a1[0] - 2 * a1[1] - 3 * a1[2] - 9 * a1[8] - 11 * a1[10] * 10 * a1[9] - 16 * a1[15] * (13 * a1[12] + 12 * a1[11] - 14 * a1[13] - 15 * a1[14]) - 17 * a1[16] - 19 * a1[18] - 20 * a1[19] == 1227620874) s.add(20 * a1[19] * 19 * a1[18] + 17 * a1[16] + 14 * a1[13] + 13 * a1[12] + 12 * a1[11] * 11 * a1[10] * 10 * a1[9] + 7 * a1[6] * 30 * a1[5] + 5 * a1[4] + 3 * a1[2] + a1[0] + 2 * a1[1] + 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 18 * a1[17] == 1836606059) s.add( 20 * a1[19] * 19 * a1[18] + 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 13 * a1[12] + 12 * a1[11] + 7 * a1[6] * 30 * a1[5] + 5 * a1[4] + 2 * a1[1] * a1[0] - 3 * a1[2] + 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 10 * a1[9] - 11 * a1[10] - 17 * a1[16] - 18 * a1[17] == 8720560) s.add(20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * (10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8]) + a1[0] + 2 * a1[1] - 3 * a1[2] - 12 * a1[11] - (16 * a1[15] - 17 * a1[16] - 18 * a1[17]) * 15 * a1[14] == 11387045) s.add( 20 * a1[19] * 19 * a1[18] + 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 9 * a1[8] + 3 * a1[2] + a1[0] - 2 * a1[1] + 4 * a1[3] - 5 * a1[4] - 30 * a1[5] - 7 * a1[6] + 8 * a1[7] - 12 * a1[11] - 13 * a1[12] - 17 * a1[16] - 18 * a1[17] == 7660269) s.add(20 * a1[19] * 19 * a1[18] + 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] - 12 * a1[11] + a1[0] + 2 * a1[1] - (4 * a1[3] * 3 * a1[2] - 5 * a1[4] - 30 * a1[5]) - 7 * a1[6] + 8 * a1[7] - 9 * a1[8] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 2461883) s.add( 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 9 * a1[8] * 8 * a1[7] + 7 * a1[6] + 2 * a1[1] * a1[0] - 4 * a1[3] * 3 * a1[2] - 5 * a1[4] - 30 * a1[5] - 12 * a1[11] - 13 * a1[12] - 15 * a1[14] - 17 * a1[16] * 16 * a1[15] - 18 * a1[17] - 19 * a1[18] - 20 * a1[19] == -966296) s.add( 14 * a1[13] + 13 * a1[12] + (11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 3 * a1[2] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8]) * 2 * a1[1] + a1[0] - 12 * a1[11] - 15 * a1[14] - 16 * a1[15] - 17 * a1[16] - 18 * a1[17] - 20 * a1[19] * 19 * a1[18] == 254500223 ) s.add( 16 * a1[15] * 15 * a1[14] + 14 * a1[13] + 11 * a1[10] * 10 * a1[9] + 7 * a1[6] * 30 * a1[5] + a1[0] - 2 * a1[1] - 3 * a1[2] - 5 * a1[4] * 4 * a1[3] + 8 * a1[7] - 9 * a1[8] - 12 * a1[11] - 13 * a1[12] - 17 * a1[16] - 18 * a1[17] - 19 * a1[18] - 20 * a1[19] == 6022286 ) s.add( 18 * a1[17] + 16 * a1[15] - 17 * a1[16] + 14 * a1[13] + 12 * a1[11] + 11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 4 * a1[3] * 3 * a1[2] + 2 * a1[1] * a1[0] - 9 * a1[8] * 8 * a1[7] * 7 * a1[6] - 13 * a1[12] - 15 * a1[14] - 19 * a1[18] - 20 * a1[19] == -636956022 ) s.add( 20 * a1[19] * 19 * a1[18] + 13 * a1[12] + 12 * a1[11] + 11 * a1[10] * 10 * a1[9] + 7 * a1[6] + 30 * a1[5] + 5 * a1[4] + 3 * a1[2] * 2 * a1[1] * a1[0] - 4 * a1[3] - 9 * a1[8] * 8 * a1[7] - 14 * a1[13] - 15 * a1[14] - 16 * a1[15] - 17 * a1[16] - 18 * a1[17] == 10631829 ) s.add( 20 * a1[19] * 19 * a1[18] + 16 * a1[15] - 17 * a1[16] - 18 * a1[17] + 15 * a1[14] * 14 * a1[13] + 13 * a1[12] + 11 * a1[10] * 10 * a1[9] - 12 * a1[11] + 7 * a1[6] + (4 * a1[3] - 5 * a1[4] - 30 * a1[5]) * 3 * a1[2] + a1[0] + 2 * a1[1] + 8 * a1[7] - 9 * a1[8] == 6191333 ) s.add( 14 * a1[13] + 10 * a1[9] * 9 * a1[8] * 8 * a1[7] + 5 * a1[4] + 4 * a1[3] * 3 * a1[2] + 2 * a1[1] * a1[0] - 7 * a1[6] * 30 * a1[5] - 11 * a1[10] - 13 * a1[12] * 12 * a1[11] - 16 * a1[15] * 15 * a1[14] - 18 * a1[17] * 17 * a1[16] - 20 * a1[19] * 19 * a1[18] == 890415359 ) s.add( 20 * a1[19] + 19 * a1[18] + 18 * a1[17] + 16 * a1[15] - 17 * a1[16] + 12 * a1[11] + 11 * a1[10] + 10 * a1[9] + 9 * a1[8] + 30 * a1[5] + a1[0] + 4 * a1[3] * 3 * a1[2] * 2 * a1[1] - 5 * a1[4] - 7 * a1[6] + 8 * a1[7] - 13 * a1[12] - 14 * a1[13] - 15 * a1[14] == 23493664 ) s.add( 20 * a1[19] * 19 * a1[18] + 13 * a1[12] + 12 * a1[11] + 10 * a1[9] + 3 * a1[2] * 2 * a1[1] + a1[0] - 4 * a1[3] - 5 * a1[4] + 8 * a1[7] * 7 * a1[6] * 30 * a1[5] - 9 * a1[8] - 11 * a1[10] - 14 * a1[13] - 16 * a1[15] * 15 * a1[14] - 17 * a1[16] - 18 * a1[17] == 1967260144 ) print(s.check()) for i in a1: print(s.model()[i].as_long(), end=",")
__int64 __fastcall sub_140014830(__int64 a1)
{
sub_140011514(&unk_14002B069);
for ( dword_1400254C8 = 0; (unsigned int)dword_1400254C8 < j_strlen(Str); ++dword_1400254C8 )
dword_1400254D0[dword_1400254C8] = *(char *)(a1 + j_strlen(Str) - (unsigned int)dword_1400254C8 - 1) ^ dword_140025520[dword_1400254C8];
return 0i64;
}
size_t sub_140014770()
{
size_t result; // rax
sub_140011514((__int64)&unk_14002B069);
dword_1400254CC = 0;
result = j_strlen(Str);
if ( result )
return dword_1400254D0[dword_1400254CC] == dword_140025050[dword_1400254CC];
return result;
}
b = [4615,19616,20257,57,107811,570,2342,19623,25952,54,108955,19624,113632,14085,2342,30675,39576,25979,24,2833]
_int64 __fastcall sub_140014CC0(int a1, int a2)
{
unsigned int v3; // [rsp+24h] [rbp+4h]
sub_140011514((__int64)&unk_14002B069);
v3 = 1;
while ( a2 )
{
if ( (a2 & 1) != 0 )
v3 *= a1;
a1 = a1 * a1 % 1000;
a2 >>= 2;
}
return v3;
}
b = [4615,19616,20257,57,107811,570,2342,19623,25952,54,108955,19624,113632,14085,2342,30675,39576,25979,24,2833] a = [104,97,104,97,104,97,116,104,105,115,105,115,102,97,99,107,102,108,97,103] d =[0]*20 for i in range(20): d[i] = b[i] ^ a[19-i] print(d) key = [7,7,7,9,5,6,7,7,7,9,7,7,5,7,7,7,5,7,9,7] def powmod(b,c): ans = 1 while (c != 0): if ((c & 1) != 0): ans *= b y1 = (b * b) % 1000 b = y1 c >>= 2 return ans for i in range(len(key)): for x in range(32,128): y=powmod(x,key[i]) if y==d[i]: print(chr(x),end="") break
use Math::GMP;
$n=Math::GMP->new(qq(536018640196762457338417213156139210797503288570914761082715926425358449791328993937721926376105480732615175814278026237005963393643271375551776466074880078352176848748633274705308676504241945010083370664252174660968981608953119805998112599444060117661138019669941300626094793785491036807276934081756872237035956066726023202435146319519186296845387730847082301207272706630575162904104891798083143447249860927095605483756287763072034119769237339974564945305247939664464781533502444109841292054088680415296886140803754567227251363793912074682950313333484488520417086224770611908328633006024083949830736713715761501454281636788229391326476406245753793013887786365670859995142806760509151118148600568866548233674044514257067962241030850686575331644579302648429368515448183731464587114229394619632992183021530788695198534470594966402044396279950016455526781914520195216651795834698311226746366299875263541011225002788347929468168715114352661339771654233339021594637252699132137826888653030047359889519548601018119305304054251358133937242275573738930265735630891392403144442528153565918878904736766442438330118148177424487919937321030740669950264125585344665111413876835134091927335636095883215944455112774026188920367809061832030746565487875663208490503939534644466596746478366934570764522389807721704658952585780912109790158728868790523426031411340205991624428072384506507538321806087186528621427227281378044005559557013663505177910861852605171692522203626393685704184832547059732919177380600272123088053085559220467180468530632223977693446355995434579173580848428361179171194581466611364419911403932027093667597947428863948279950204080270018521963443517628196446289843070452581111359251862675192796305658555602637885256086237258547426276510185414325103524910341740343369666492736208387291296903817941660932252561211329968446058806881036295951481851107596050492224467933898074211388015228033645706311747694044899970880702136400492862579927938186258415344231883422369698811234415306780453008593763066386409293253445503592904165997213846772992745684701510199006516693015777069346721040457598081443961030290765298803955230953588530690781946089450259077609678850665125724750895581020239617235767981458050496828730736032792402047586857987009509860521095657941173026952231244500844709739141614811803950864407503348165649017532197947302901691949629432327121868776195092474161882521086237930801738676554611694935296174071567195135987213020171355911905229219543499652499346136281398590838201242575718858549556940211460864292701830795292884047284846085429328906977415710922318903943876646319192420997493084804807447410521269115546294610249231249199998809879581954790784649094310934755061823741473872554786278527721130956448003101603540409775541626306820355806893604655310531957949403286042507894994343941405394191263692663159004814773433521553298133350288534911033173270333917231702429952746745980272349634748915246222027686188663941242604225311133674177313422472062183318182382233069927217196084167997366146805112332026188868290931694204087884649515997296110047248905389300265027971517383292006833586355062503579106363153859100263800703364744692135557184042844025975678124347327782633248949050465222340254333242422214668886453924352051721821505479430415620064575934769236281916435708673562516267244328571102602515490125021704471842501411413491726868689039070168844092343017290739479230544731248371895349090043614681912967677554655436835960301478846001693511522952068798227030561795200135470941410173276382068055193544624197725372044387303231662116394016154634236466841547450714649628436349013444588877375888483952736261634922475345054655836299638737052246866918583027409040838402178729288131625690520741721731793577576321297042097038100447773550121170491840027565290553451385865338395632831455402374088893130353117797526457513269540823576719932416627961054137416143258657573279807299206311750030448921495513478258761302356583376579373865212397302533672264105433071343112329554553192539423143937968994832359098112031756001812978148462182020549206353513799381906904370717954311705246231773174066945734041202629864821803549550107697611149449836551488244929092534531452107584238794228638535834526081002269878422651095844173916790081068160033465763985959040750740645471240904195802641208399623487455621716969583068722657224347071857465628331129671407270542673383919644680689842401432861889740312270377928474023777879113362415351381613377174492905238591569772833470016304160242504042833358305208104682231696700895206457536721929136841065546117344486651383910269021156619055157939767524679555957843512776699128442016466721435955089993735773872597037668496242506029886801502668195930896557643210792537791632558662313397367812541434804102159625838245131250255704894766430940677995495806111498589936548317464015294200634272062546923549886350454035660095385899513832694551585435531531092918953760332288897076214872664526342794157833628445960346553154906913253392684636335946550654599740863451201584080828599468914405113401887258745264729306827598631718613919111530361852799166927771847465134848282799044855979461783025683988354660220319819832181748527760487478889128839452331570222950056314110866469657534242229205162039541817359769507304852173924512545615242223850883137665194647206224769412888277184331727851282953145215699562616948467820366267070768134646567716070724846838905308067930357609452185901463456368079086587479593478755483299238881430238451353791271668444825394161866024928513256084422344952973940284969139863839569945606170100584707413646323274306716452974258722155501389728407724240587875795205659957089685715005610853300899554627907591050676556562502782357288625297608629678345422935042214036086514974569763876640833160546586937279594905565261339424125419638888107213644286014623774476904195393844200606144861332204228588903508110895795243261569340052155573304292662820519802935112926033473565189725836542832972462437026478286144282874379223534176446928255904628251552486076324922361544972282931115143055793543391800420954156353858561531625223326379017303383423591171728648565267989197407276948981844719741118258087164267398600698128638259557435732029831343846199617460021996965550385893295027868882255266368411670603703667933205583740913898644920136897853640923833545313569906032969695573409587116832277212979339114637688708152797058466260134585711583787805058784880124696739754314190204797748001676393934339826376486668914130305536156936757348761332045059807531515913478836681384644449917009386581589228986524038386629494542317733409916019127199037937989307573904286897466286193427365601150509626654618312201146046320337576448486458612875182234122752170564475311817610609791564137211769388845328705980509417212586877520318133180949125196902365835546688456494136371831250152415004494146181245825783836579761229397753468323213425024089304520098056692459203073896356975232389739970486845448320084979535958367044841575139983858481627710402990234527365357624766461753188248059706449581450756797098824800933085462544436249978046092624071524790546061870880938333189123172096854645929833928744179719682187161552263785959471311488977941528835968867632262301272247739550831902936645553508173947884990035046584904533207916835764716864547503565215662609065941420404380428919206329231642305891620579333072658346824144206465717943891515035715097417220304496263004880090810920434091751429526448800967263998482796977258335541766126283866643612377879489607658841296623946555450959723125063731448084064806834669600286394377324985329207643214718019187483183269935305444629949849943037179844281714336005231649119949368818264219552186708890120227421072187865534457019987836926535670852906888914703504733741618570072573236045903079307612428152736356667661598315660492761276964237842021170226789423902132947182867554977266528742475959477643399990866134243575203794514585407604328984996971140248310947221578782792470389214301506905005474092045872024984199436670674468083756554895031307322941237883565507999065527762990693360431159690157868262133055311695191034400636497555040569649292217694775029598279040235313682424219784025313983067475455023587467089466417359979232779498678299557587777065154201465244738728190215504957623945147716639649915378475397455313480571576835752892920443562728563596314314933894911388019505556299874499387806637254384387244833764880967334418268126100382088726261460041572119796062724019258520405106320430266755946299150437490832503299320751468216906296966997978544183482647070153681901837433240013288421602518298792831260216915630645934204484646050974104346843362707928248741521884208045179469305639093500392799243049507976081342625414746804566075476697556188430594583343218341344847476484475326000756058576221283693464138330373036141174864521270139806190597982916586759080622790567856887663887411439056835201628369422597766928668026483503403309490993042710666485673892047332517203533607788846604410973397882087809096482781875429576444685788373148838455532621471093473989055058610727268734482933515265488578979657907909048726125490166193528504383211483877307565365739316770479665413576178412246537562558743718115849143045741340537999766352880597842102605661874515865255245812173544701654728908310097666401588159471434691280939392477732046684700652876266021695971312021447273708372515509783011686469987836853545332343623116832512874109490997646372557506537777435195298013745382212351694785702861882699545659248974894355819474086618096962216403826355560765421634755646007114283691647652553698118160685184799259115386033897513061035343191551804647662722856888120453311530211054238605313256874768688845585248000180469382191293594397194936666510474312402845796532862283140799442481493492409041110695101198733062902742963580888183805992394815274018647245856968117814655120062117147524743556181108229157105216806756835767627452561814479269315701534114368077961829593112780850452929638153223627516150223193442716100294689994629503029722784481176392782574539028959121502715073243981856750917886069948639657209334247292963249361663140414285243811360703657426626027651876768820296008720753559828483600764245456427184292551129684846409930148847048792478234281982299816644117248720105156965255960755735288463297721789204681110091891626221767542660437298077410487775229596481519369430425538164930344613458851028022663530378549341888752119342680920488696303787626329225364499941548652135663141545093010007418659262558044807876470699225470792281280471394402449273917294280711925256732896706344035628757063265572983007628183765366139905503257771405290401572655086825662960234454768665630645638597486445581317328118790026653080908126662045348127089579956347373420700241116706741144585592832003614655366806737595597934395420030825225529792315004141331150126502300783706882180026271176885635458741834202094134380779511989962007391225157898343447565380497116417905104613125411722796861265589975768040298871368481191463994487565359005290881418594310942038242095490137457430113921700914190809041712626349483221038596162823551380518361432625778100425766135915983461968285145479749284005213549575053749454547006856109030816831572325785833840465662608981829817315104129860357895536386815511220320856147380661700388739290891664207309462038381138614017816515897184596470509041708788049376381966580982191120470292259391410277362045420169283294480418719253687205110764586237254068062224157061988489536518731041315082051423598047403969732651381597974399599052734874989258534202064544059190888836570452075232534432080692849891308648288345658858913557200530375251664318481313749999208677156216679772500334650589188023132426008213751771975339931267455651020549172088534103265639345824548733115364407668098476174093750671307027999140467794869781064102514506387524937283185899747308790496205925637979039941073714989234191503713197365240251962384929422385098371833218735917065179197095408247070205619717852555506775114221897384593867674797972997625141305959100358807323290103015774024838588524261536872464615464372444499998134799790282084969317956385368477763876504767687777508890699913408022991698004395568773456122344991418727562815150713036328131761207743991479769178514725642343502661969274142628564332796075301308620783432595115486362698177864488771632758645429306471967176400313912306573528834497594518248036195273913032689136494318349766919622955918916570327666837133665964914674336488926026955966120456683245217960124790775202182559336216031406539008107050994985942544261419801453546346300579507673631763045902571738594054201174991240395872827818656733808736951806253591371928775018516968607172025244377586033635452011629443100668970123075598516485275709529469885598726526794223482610330955615022809511904624391856316948509920041734654810705967688872895481492343322360101176110518837886196834982294040392466844991384794437670776312367213399185513156636326696930037612148636211987354550863417491502916195307997005490132242465305836267780946943064688451354167588683385972678158662740981015192689905944888944219495967534478509217480965118225228403516975667947865142854647461861332459907168166992765261271471614650286060618717631106041973380069490908012615839492796565354245833892329240477121114364355466496433328996768094126356391224662178679410555736610094829075805417771970821025774499640734405754596104988282657838949729486362327056560299828126547892700617710009283766176834381144640016660977728799590803611580475645783091183624784844760499308806477200752253757429175734114250977691175772572746536071107936581761240694567354138628767191325801861058917189408404204418346014973781198380317438362029569541246652831810879152248260206395395237447784560491086153440399762040393624114255227447834251171143138269053577294848519623567291539590740299333939174692100635933124268159494722746337823116482069177379470205678557176691015558981664269627478334729382852554771289775136436287751216774011789993086094997687607888054599098278874224899709472480063529715101854322139584268537262580418113863575240204470029025496519117162564631862155782383228603023004177278164392870854023804644457208767059995119772226532851232815953125839577615562921740920277563172121650425976694450888433705228944141981853410273199853460260028282781245235763102929837778843937718395086759841413076487260571967926363321170251043880386459929440667321460163083684601048499850213020296776025722077868054054761619435793187510416563682091514284885148368063521342223419097330136408040659487592398755361339113507122836515291521728118229961396822179844693778076680340429101286603366024277896078571669306774777638203804665815968866557628859092741906584180352659047082205807422249803250558044968345857546746771646024613826459399128465814363061463599832420276265521613296879275698636840302271681454084905609885047282233019868592705535317289234117412047959477774785056445434543637847908443020562954821196439513704205637291606949668622595090905887793346651206621287466317017153684275393090031632561873332623265486457780489517419016427840879779092174738511707693116035052431089103295483658260274233251385564295187821492148010451455271252635223930008657764397300712154837693772916831234464548167973138522585118438538316052354427184072284165602378198723551206823096756348300021697763322171730444874824891757334146837198310855411537328297102389122575639447321579461302877464122087635722838175298402530406663937966340503164327397282632238195670137601369687004823923879625428795876117815799767697008062347128284807333426801813181697777948701321862763776345979940252911841656237181912565833413503129939441756393396494618078588510503454493455342506941975727123508105712131070880978305946662608217939449203156076619683830403183830186456498006653738061812335148469362877003850966618430859695919070186653458866625305916459519272196354580521800034053508922314981178499150324027654342678662937414325040577483309807127303156865877488830495531818928006222042617110855502577186623703059175985567664722424995855383934781271759883735865463278112030008483817080199002078598269172229266019049499162055209062845868372896323467428106440891328543770518697297303176417742847470066077018939409318173648546522634886617309161992431082882500155405849990797509897668173036121106093167833941168676796917849185927729063394639355821114527971750706567478583249790138286313842677250708820487212270299633787308420417261584055083677740909339779238074054204348974021123216698001562045028227412060563590308274121184428220427293160776427453775031459384264452123708084708495418534339734195790272933415885486583750879743799700526323339071123982971926213786186492741369871540713680431053741794240366942798007594061051198197127085820125669920506248833874008891567576100384617669534435446079736544527904089769954152423436011562330612821215844862917213363272915582803183342153333832546132694574718057327479556735324382306432024035909048410391170285142090169529502853531337512985467469754405167540214085277771037677125184782958426647392175442634956071157068982449319464893723664912386621873779451388728844469204936727623058314518561898159221605777669361878826359990257579428781380853635172977849088922915492937809157686949617792456559060716403455924973628663638221251723138402774064287467084832070357790237274785396108290571067985598122819965034332041400763155594698742175645305651924288248528454790418478728338079159502314919083251174965929751592157924163035463086458657709914922663331141538299201510314662870550760304034042869152812443625950965188315472692066667756851484511478312021347765236997911702317805372058004786043400133080909630472734022559109937019237009421137207520589216466326695781833495639724382562948098413969826653086240302796086363085880700476989769025580716193074503423703106726845086213785827947184654568971085567932706065680525864221954087499423710257987834470058249196303879662871022361426342465119026315560382179534719767943571892554617373844353439083777270753986814517786458130770202395503847602360638535708314812632048727430195024222153111503458757855603388031674039988314174076748188814595409424290073226413843774289668812749536427766190005885590545255733834338493472641024174769510862096350235603899460851648533836129894433546831793847607930761699327208522266027035142088354414635936891025504994457982266778758462769132787032485075450251380314228124412366813691098623253990518717180608929679551953664564817901647676790976624514712373977713303808214119736634277036680349054934944378911310066942607216390266846251067277443747529790491978174450027449222636925981846559757475121956207465335077027955125957789804456843432258334982841057568245352408725210590352753647758514637996490140766871440337743702307376499683975961018366552885302977886430423317666909471351297411610131012076185929461554535079133619252548826687502893483008063951862898351574610306267165992614897772486538439468678544464686836205581666959113470559539824537249814008710282162599094192255743583803221978203375281144253142722652434488016030197908849691029748383061113015795746908341611854838380614126430118921819870663546271753946828869530688394294288081304497394578767687660238589979106916413212340494128596539490101771554930775817201758275396358303388918820659489907730304272648845547098719361989457768904762294496163091714672474196315358138679703022317914845723755615392808282119361983528249968859941774266195954014617820952858554925056857374817842191597522226770873433049370685184032377041438883653273024779557146412336783691114481919880762797926650172652693052962024849946826027516041895525251011236457544801440531583692602444383470699061352749158134022062755638220949538009985259285085876819591029123985383603087718611969465948062859802804207808812882828054294872754225741254883578199926900412635143634882752030919344025216242465381690642415150469730483130283));
$i=275707953942;
$a=';
$i=%d;
$a=%c%s%c;
$r = $n->bxor($n->blshift(1,0))->band(Math::GMP->new(2)**65535-1);
exit printf $a,$i-(print "use Math::GMP;\n\$n=Math::GMP->new(qq(",$r,"))"),39,$a,39 if$i;
do{$c=($n+$i/3)%256;print chr$c if$c>31||$c==10}while$n>>=8;';
$r = $n->bxor($n->blshift(1,0))->band(Math::GMP->new(2)**65535-1);
exit printf $a,$i-(print "use Math::GMP;\n\$n=Math::GMP->new(qq(",$r,"))"),39,$a,39 if$i;
do{$c=$n%256;print chr$c if$c>31+$i||$c==10}while $n=$n->brshift(8);
sub canuse : lvalue {
$val;}
canuse() = 9;它可以很安全地把右值赋给$var。
use Math::GMP; $n = Math::GMP->new(qq(…)); foreach my $i (0..65535) { $n = $n->bxor($n->blshift(1,0))->band(Math::GMP->new(2)**65535-1); $nn = $n->gmp_copy(); my $res = ''; do { $c = $nn % 256; $res .= chr($c) if $c > 31 || $c == 10 } while $nn=$nn->brshift(8, 0); if (index($res, 'watevr') != -1) { print $res; } }
int __cdecl main(int argc, const char **argv, const char **envp) { char Str[8]; // [rsp+20h] [rbp-30h] BYREF __int64 v5; // [rsp+28h] [rbp-28h] __int64 v6; // [rsp+30h] [rbp-20h] __int64 v7; // [rsp+38h] [rbp-18h] char v8; // [rsp+40h] [rbp-10h] int v9; // [rsp+44h] [rbp-Ch] int i; // [rsp+48h] [rbp-8h] unsigned int v11; // [rsp+4Ch] [rbp-4h] _main(); init(); *(_QWORD *)Str = 0i64; v5 = 0i64; v6 = 0i64; v7 = 0i64; v8 = 0; puts("This is a easy puzzle.\nInput your route."); scanf("%31c", Str); v11 = 0; v9 = strlen(Str); for ( i = 0; i < v9; ++i ) v11 = moving(v11, (unsigned int)Str[i]); if ( v11 != 511 || jur ) printf("Wrong way!"); else printf("Right!"); return 0; }
__int64 init() { __int64 result; // rax int j; // [rsp+4h] [rbp-Ch] int i; // [rsp+8h] [rbp-8h] int v3; // [rsp+Ch] [rbp-4h] v3 = 0; for ( i = 0; i <= 7; ++i ) { for ( j = 0; j <= 7; ++j ) { puzzle[8 * i + conut + 7 - j] = (gen[conut / 8 + i] >> j) & 1; ++v3; } } result = (unsigned int)(conut + v3); conut += v3; return result; }
__int64 __fastcall moving(int a1, char a2) { __int64 result; // rax int v3; // [rsp+2Ch] [rbp-4h] switch ( a2 ) { case 'a': v3 = a1 - 1; goto LABEL_11; case 'd': v3 = a1 + 1; goto LABEL_11; case 'n': v3 = a1 - 64; if ( --layer >= 0 ) goto LABEL_11; result = 0i64; break; case 's': v3 = a1 + 8; goto LABEL_11; case 'u': v3 = a1 + 64; if ( ++layer <= 7 ) { init(); LABEL_11: if ( v3 > 511 ) { LABEL_15: jur = 1; result = 0i64; } else if ( puzzle[v3] ) { jur = 1; result = 0i64; } else { result = (unsigned int)v3; } } else { result = 0i64; } break; case 'w': v3 = a1 - 8; goto LABEL_11; default: goto LABEL_15; } return result; }
maze_arr=[ 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] for l in range(8): for i in range(8): for j in range(8): print(maze_arr[l*64*4+i*8*4+j*4], end='') print('\n', end='') print('\n',end='')
int __cdecl main(int argc, const char **argv, const char **envp) { _DWORD v4[28]; // [esp-6Ch] [ebp-F8h] BYREF _DWORD *v5; // [esp+4h] [ebp-88h] _DWORD *v6; // [esp+8h] [ebp-84h] int v7; // [esp+Ch] [ebp-80h] char v8[108]; // [esp+10h] [ebp-7Ch] BYREF int v9; // [esp+88h] [ebp-4h] if ( sub_8AEF90() ) return 1; sub_8A26C0(0x6Cu); sub_8A1FE0(v4[27], v5); v9 = 0; v6 = v4; sub_8AF360(v8); sub_8AF080(v4[0], v4[1]); v5 = v4; sub_8AF360(v8); sub_8AF150(argc, (int)argv); v7 = 0; v9 = -1; sub_8A21C0(v8); return v7; }
_DWORD *__thiscall sub_8A1FE0(_DWORD *this) { int i; // [esp+4h] [ebp-14h] *this = &EASYRE::`vftable'; this[1] = 0; *((_BYTE *)this + 52) = 8; *((_BYTE *)this + 53) = -22; *((_BYTE *)this + 54) = 88; *((_BYTE *)this + 55) = -34; *((_BYTE *)this + 56) = -108; *((_BYTE *)this + 57) = -48; *((_BYTE *)this + 58) = 59; *((_BYTE *)this + 59) = -66; *((_BYTE *)this + 60) = -120; *((_BYTE *)this + 61) = -44; *((_BYTE *)this + 62) = 50; *((_BYTE *)this + 63) = -74; *((_BYTE *)this + 64) = 20; *((_BYTE *)this + 65) = -126; *((_BYTE *)this + 66) = -73; *((_BYTE *)this + 67) = -81; *((_BYTE *)this + 68) = 20; *((_BYTE *)this + 69) = 84; *((_BYTE *)this + 70) = 127; *((_BYTE *)this + 71) = -49; qmemcpy(this + 18, " 03\"3 0 203\" $ ", 20); sub_8A30A0(this + 23); sub_8A2DE0(this + 26); for ( i = 0; i < 40; ++i ) *((_BYTE *)this + i + 12) = 0; return this; }
BOOL __thiscall sub_8A24B0(_DWORD *this, int a2)
{
BOOL result; // eax
this[2] = a2;
result = 0;
if ( (*(int (__thiscall **)(_DWORD *))(*this + 12))(this) )
{
(*(void (__thiscall **)(_DWORD *))(*this + 24))(this);
if ( (*(int (__thiscall **)(_DWORD *))(*this + 40))(this) )
return 1;
}
return result;
}
int __thiscall sub_8A2500(const char **this) { int v2; // [esp+Ch] [ebp-B0h] unsigned int v3; // [esp+14h] [ebp-A8h] int i; // [esp+24h] [ebp-98h] char v6[56]; // [esp+30h] [ebp-8Ch] BYREF char v7[20]; // [esp+68h] [ebp-54h] BYREF char v8[48]; // [esp+7Ch] [ebp-40h] BYREF int v9; // [esp+B8h] [ebp-4h] v3 = (unsigned int)&this[2][strlen(this[2])]; strcpy(v8, "Ncg`esdvLkLgk$mL=Lgk$mL=Lgk$mL=Lgk$mL=Lgk$mLm"); sub_8A26C0(v6, 0x38u); sub_8A2B00(); v9 = 0; for ( i = 0; i < 45; ++i ) v8[i] ^= 0x10u; sub_8A26C0(v7, 0x14u); sub_8A2A70(v8, 1); LOBYTE(v9) = 1; v2 = (unsigned __int8)sub_8A4260(this[2], v3, v6, v7, 0); LOBYTE(v9) = 0; sub_8A2A50(v7); v9 = -1; sub_8A26A0(); return v2; }
swpuctf{\w{4}-\w{4}-\w{4}-\w{4}-\w{4}},即为flag格式
this+24
int __thiscall sub_8A2730(_DWORD *this, int a2) { int v2; // esi int v3; // ecx unsigned __int8 v4; // al char v6; // cf char v7; // bl char v8; // t2 int v10; // [esp+Ch] [ebp-30h] int i; // [esp+14h] [ebp-28h] int j; // [esp+1Ch] [ebp-20h] int v13; // [esp+20h] [ebp-1Ch] BYREF int v14; // [esp+24h] [ebp-18h] int v15; // [esp+28h] [ebp-14h] int v16; // [esp+2Ch] [ebp-10h] int v17; // [esp+30h] [ebp-Ch] int v18; // [esp+34h] [ebp-8h] v13 = 0; v14 = 0; v15 = 0; v16 = 0; v17 = 0; v18 = 0; v10 = this[2] + 5 * a2 + 8; for ( i = 0; i < 4; ++i ) *((_BYTE *)&v13 + i) = *(_BYTE *)(i + v10); v2 = 0; v3 = 4; do { v4 = *((_BYTE *)&v13 + v2); _DL = v4; __asm { rcl dl, 1 } *((_BYTE *)&v15 + v2) = 1; v7 = 0; v6 = 0; do { v8 = v6 << 7; v6 = v4 & 1; v4 = (v4 >> 1) | v8; ++v7; } while ( v6 ); *((_BYTE *)&v16 + v2++) = v7 - 1; --v3; } while ( v3 ); for ( j = 0; j < 4; ++j ) { *((_BYTE *)&v14 + j) = *((_BYTE *)&v16 + j) + *((_BYTE *)&v15 + j); *((_BYTE *)&v17 + j) = *((char *)&v13 + j) << *((_BYTE *)&v15 + j); *((_BYTE *)&v18 + j) = (*((char *)&v13 + j) << (8 - *((_BYTE *)&v16 + j))) | ((unsigned __int8)(*((char *)&v13 + j) >> (8 - *((_BYTE *)&v15 + j))) << *((_BYTE *)&v15 + j)); } return sub_8A2F80(&v13); }
.text:008A1E40 push ebp .text:008A1E41 mov ebp, esp .text:008A1E43 sub esp, 30h .text:008A1E46 mov eax, ___security_cookie .text:008A1E4B xor eax, ebp .text:008A1E4D mov [ebp+var_4], eax .text:008A1E50 push ebx .text:008A1E51 push esi .text:008A1E52 push edi .text:008A1E53 mov [ebp+var_2C], ecx .text:008A1E56 xor eax, eax .text:008A1E58 mov [ebp+var_1C], eax .text:008A1E5B mov [ebp+var_18], eax .text:008A1E5E mov [ebp+var_14], eax .text:008A1E61 mov [ebp+var_10], eax .text:008A1E64 mov [ebp+var_C], eax .text:008A1E67 mov [ebp+var_8], eax .text:008A1E6A imul ecx, [ebp+arg_0], 5 .text:008A1E6E mov edx, [ebp+var_2C] .text:008A1E71 mov eax, [edx+8] .text:008A1E74 lea ecx, [eax+ecx+8] .text:008A1E78 mov [ebp+var_30], ecx .text:008A1E7B mov [ebp+var_28], 0 .text:008A1E82 jmp short loc_8A1E8D .text:008A1E82 .text:008A1E84 ; --------------------------------------------------------------------------- .text:008A1E84 .text:008A1E84 loc_8A1E84: ; CODE XREF: sub_8A1E40+62↓j .text:008A1E84 mov edx, [ebp+var_28] .text:008A1E87 add edx, 1 .text:008A1E8A mov [ebp+var_28], edx .text:008A1E8A .text:008A1E8D .text:008A1E8D loc_8A1E8D: ; CODE XREF: sub_8A1E40+42↑j .text:008A1E8D cmp [ebp+var_28], 4 .text:008A1E91 jge short loc_8A1EA4 .text:008A1E91 .text:008A1E93 mov eax, [ebp+var_30] .text:008A1E96 add eax, [ebp+var_28] .text:008A1E99 mov ecx, [ebp+var_28] .text:008A1E9C mov dl, [eax] .text:008A1E9E mov byte ptr [ebp+ecx+var_1C], dl .text:008A1EA2 jmp short loc_8A1E84 .text:008A1EA2 .text:008A1EA4 ; --------------------------------------------------------------------------- .text:008A1EA4 .text:008A1EA4 loc_8A1EA4: ; CODE XREF: sub_8A1E40+51↑j .text:008A1EA4 pusha .text:008A1EA5 xor esi, esi .text:008A1EA7 mov ecx, 4 .text:008A1EA7 .text:008A1EAC .text:008A1EAC loc_8A1EAC: ; CODE XREF: sub_8A1E40+99↓j .text:008A1EAC xor eax, eax .text:008A1EAE mov al, byte ptr [ebp+esi+var_1C] .text:008A1EB5 mov edx, eax .text:008A1EB7 xor ebx, ebx .text:008A1EB7 .text:008A1EB9 .text:008A1EB9 loc_8A1EB9: ; CODE XREF: sub_8A1E40+7E↓j .text:008A1EB9 rcl dl, 1 .text:008A1EBB inc ebx .text:008A1EBC jb short loc_8A1EC0 .text:008A1EBC .text:008A1EBE jmp short loc_8A1EB9 .text:008A1EBE .text:008A1EC0 ; --------------------------------------------------------------------------- .text:008A1EC0 .text:008A1EC0 loc_8A1EC0: ; CODE XREF: sub_8A1E40+7C↑j .text:008A1EC0 mov byte ptr [ebp+esi+var_14], bl .text:008A1EC7 xor ebx, ebx .text:008A1EC7 .text:008A1EC9 .text:008A1EC9 loc_8A1EC9: ; CODE XREF: sub_8A1E40+8E↓j .text:008A1EC9 rcr al, 1 .text:008A1ECB inc ebx .text:008A1ECC jb short loc_8A1ED0 .text:008A1ECC .text:008A1ECE jmp short loc_8A1EC9 .text:008A1ECE .text:008A1ED0 ; --------------------------------------------------------------------------- .text:008A1ED0 .text:008A1ED0 loc_8A1ED0: ; CODE XREF: sub_8A1E40+8C↑j .text:008A1ED0 dec ebx .text:008A1ED1 mov byte ptr [ebp+esi+var_10], bl .text:008A1ED8 inc esi .text:008A1ED9 loop loc_8A1EAC .text:008A1ED9 .text:008A1EDB popa .text:008A1EDC mov [ebp+var_20], 0 .text:008A1EE3 jmp short loc_8A1EEE .text:008A1EE3 .text:008A1EE5 ; --------------------------------------------------------------------------- .text:008A1EE5 .text:008A1EE5 loc_8A1EE5: ; CODE XREF: sub_8A1E40+171↓j .text:008A1EE5 mov eax, [ebp+var_20] .text:008A1EE8 add eax, 1 .text:008A1EEB mov [ebp+var_20], eax .text:008A1EEB .text:008A1EEE .text:008A1EEE loc_8A1EEE: ; CODE XREF: sub_8A1E40+A3↑j .text:008A1EEE cmp [ebp+var_20], 4 .text:008A1EF2 jge loc_8A1FB6 .text:008A1EF2 .text:008A1EF8 mov ecx, [ebp+var_20] .text:008A1EFB movzx edx, byte ptr [ebp+ecx+var_14] .text:008A1F00 mov eax, [ebp+var_20] .text:008A1F03 movzx ecx, byte ptr [ebp+eax+var_10] .text:008A1F08 add edx, ecx .text:008A1F0A mov eax, [ebp+var_20] .text:008A1F0D mov byte ptr [ebp+eax+var_18], dl .text:008A1F11 mov ecx, [ebp+var_20] .text:008A1F14 movsx edx, byte ptr [ebp+ecx+var_1C] .text:008A1F19 mov eax, [ebp+var_20] .text:008A1F1C movzx ecx, byte ptr [ebp+eax+var_14] .text:008A1F21 shl edx, cl .text:008A1F23 mov ecx, [ebp+var_20] .text:008A1F26 mov byte ptr [ebp+ecx+var_C], dl .text:008A1F2A mov edx, [ebp+var_20] .text:008A1F2D mov eax, [ebp+var_20] .text:008A1F30 mov dl, byte ptr [ebp+edx+var_C] .text:008A1F34 mov cl, byte ptr [ebp+eax+var_18] .text:008A1F38 shr dl, cl .text:008A1F3A mov eax, [ebp+var_20] .text:008A1F3D mov byte ptr [ebp+eax+var_C], dl .text:008A1F41 mov ecx, [ebp+var_20] .text:008A1F44 movzx edx, byte ptr [ebp+ecx+var_14] .text:008A1F49 mov eax, 8 .text:008A1F4E sub eax, edx .text:008A1F50 mov [ebp+var_22], al .text:008A1F53 mov ecx, [ebp+var_20] .text:008A1F56 movsx edx, byte ptr [ebp+ecx+var_1C] .text:008A1F5B movzx ecx, [ebp+var_22] .text:008A1F5F sar edx, cl .text:008A1F61 mov [ebp+var_24], dl .text:008A1F64 mov eax, [ebp+var_20] .text:008A1F67 movzx ecx, byte ptr [ebp+eax+var_10] .text:008A1F6C mov edx, 8 .text:008A1F71 sub edx, ecx .text:008A1F73 mov [ebp+var_23], dl .text:008A1F76 mov eax, [ebp+var_20] .text:008A1F79 movsx edx, byte ptr [ebp+eax+var_1C] .text:008A1F7E movzx ecx, [ebp+var_23] .text:008A1F82 shl edx, cl .text:008A1F84 mov [ebp+var_21], dl .text:008A1F87 mov eax, [ebp+var_20] .text:008A1F8A mov dl, [ebp+var_21] .text:008A1F8D mov cl, byte ptr [ebp+eax+var_18] .text:008A1F91 shr dl, cl .text:008A1F93 mov [ebp+var_21], dl .text:008A1F96 movzx eax, [ebp+var_24] .text:008A1F9A mov ecx, [ebp+var_20] .text:008A1F9D movzx ecx, byte ptr [ebp+ecx+var_14] .text:008A1FA2 shl eax, cl .text:008A1FA4 movzx edx, [ebp+var_21] .text:008A1FA8 or eax, edx .text:008A1FAA mov ecx, [ebp+var_20] .text:008A1FAD mov byte ptr [ebp+ecx+var_8], al .text:008A1FB1 jmp loc_8A1EE5 .text:008A1FB1 .text:008A1FB6 ; --------------------------------------------------------------------------- .text:008A1FB6 .text:008A1FB6 loc_8A1FB6: ; CODE XREF: sub_8A1E40+B2↑j .text:008A1FB6 lea edx, [ebp+var_1C] .text:008A1FB9 push edx .text:008A1FBA mov ecx, [ebp+var_2C] .text:008A1FBD add ecx, 5Ch ; '\' .text:008A1FC0 call sub_8A2F80 .text:008A1FC0 .text:008A1FC5 pop edi .text:008A1FC6 pop esi .text:008A1FC7 pop ebx .text:008A1FC8 mov ecx, [ebp+var_4] .text:008A1FCB xor ecx, ebp ; StackCookie .text:008A1FCD call @__security_check_cookie@4 ; __security_check_cookie(x) .text:008A1FCD .text:008A1FD2 mov esp, ebp .text:008A1FD4 pop ebp .text:008A1FD5 retn 4 .text:008A1FD5 .text:008A1FD5 sub_8A1E40 endp
保存的地址分别为[ebp+esi+var_1C+8] [ebp+…+0xC], 同时再 esi ++
也就是看看dl的最高位1在第几位
int __thiscall sub_8A28A0(_DWORD *this) { _DWORD *v1; // eax int v2; // eax int result; // eax int v4; // eax int v5; // eax int v6; // eax char v7; // bl int v8; // eax int v9; // eax int v10; // eax char v11[4]; // [esp+4h] [ebp-1Ch] BYREF char v12[4]; // [esp+8h] [ebp-18h] BYREF int v13; // [esp+Ch] [ebp-14h] int v14; // [esp+10h] [ebp-10h] _DWORD *v15; // [esp+14h] [ebp-Ch] int i; // [esp+18h] [ebp-8h] _DWORD *v17; // [esp+1Ch] [ebp-4h] v17 = this; v14 = 32; v13 = 0; v15 = this + 3; v1 = (_DWORD *)sub_8A2EA0(v12); v17[26] = *v1; while ( 1 ) { v2 = sub_8A2E40(v11); result = sub_8A2E00(v2); if ( !(_BYTE)result ) break; for ( i = 0; i < 8; ++i ) { if ( i >= 4 ) { v9 = sub_8A2DC0(v17 + 26); v14 -= *(unsigned __int8 *)(v9 + i); v10 = sub_8A2DC0(v17 + 26); *v15 |= *(unsigned __int8 *)(v10 + i + 16) << v14; } else { v4 = sub_8A2DC0(v17 + 26); v13 = 8 - *(unsigned __int8 *)(v4 + i + 4); v14 -= v13; v5 = sub_8A2DC0(v17 + 26); *v15 |= *(unsigned __int8 *)(v5 + i + 16) << v14; v6 = sub_8A2DC0(v17 + 26); v7 = 16 * *(_BYTE *)(v6 + i + 8); v8 = sub_8A2DC0(v17 + 26); *((_BYTE *)v15 + i + 20) = *(_BYTE *)(v8 + i + 12) | v7; } } ++v15; sub_8A2DA0(v17 + 26); } return result; }
校验flag格式
通过-分割flag成5部分,对flag进行位移运算,对flag的每个字符都得到5个结果,将其存储到内存中
进行5次循环,每次循环处理4个字符,利用每个字符得到的5个结果继续进行移位和或运算,最终会生成两个结果,一个结果受字符影响,而另外一个结果是每个字符独立存在,不受其他字符的影响
将得到的结果与初始化中的两个字符串进行对比
import string class SwpuctfBabyre(): def __init__(self): self.s2 = ' 03\"3 0 203\" $ ' self.s = ['08', 'EA', '58', 'DE', '94', 'D0', '3B', 'BE', '88', 'D4', '32', 'B6', '14', '82', 'B7', 'AF', '14', '54', '7F', 'CF'] self.flag = 'swpuctf{' self.d = dict.fromkeys(list(set(self.s2))) self.v14 = 0x20 for i in list(set(self.s2)): self.d[i] = [] def check_1(self, c): # 左移进位位数 num = 0 while True: c = c << 1 num += 1 if c & 0x100: return num def check_0(self, c): # 右边0的个数 num = 0 while True: if c & 1: return num num += 1 c = c >> 1 def generate_0(self, c): res1 = self.check_0(c) + self.check_1(c) res2 = ((c << self.check_1(c)) & 0xff) >> res1 res3 = ((c >> (8 - self.check_1(c))) << self.check_1(c)) | ((c << (8 - self.check_0(c)) & 0xff) >> res1) return [res1, res2, res3] def check_part(self, c): tmp = list(set(self.s2)) tmp2 = self.check_0(c) | (16 * self.check_1(c)) for i in tmp: if tmp2 == ord(i): return i return '' def classify(self): for_each = string.ascii_lowercase + string.ascii_uppercase + string.digits for i in for_each: tmp = self.check_part(ord(i)) if tmp: self.d[tmp].append(i) def test_1(self, c): exam = {c: self.generate_0(ord(c))} self.v14 = self.v14 - (8 - exam[c][0]) tmp = exam[c][1] << self.v14 return tmp def test_2(self, c): exam = {c: self.generate_0(ord(c))} self.v14 = self.v14 - exam[c][0] tmp = exam[c][2] << self.v14 return tmp def calc_first_part(self, s): self.v14 = 0x20 tmp = 0 for i in s: tmp |= self.test_1(i) for i in s: tmp |= self.test_2(i) return tmp def check_first_part(self, second_part, first_part): for i in self.d[second_part[0]]: for j in self.d[second_part[1]]: for k in self.d[second_part[2]]: for m in self.d[second_part[3]]: tmp = i + j + k + m if self.calc_first_part(tmp) == first_part: return tmp def run(self): self.classify() for i in range(0, 5): first_part = int(self.s[3 + 4 * i]+self.s[2 + 4 * i]+self.s[1 + 4 * i]+self.s[4 * i], 16) second_part = self.s2[i*4:i*4+4] res = self.check_first_part(second_part, first_part) if i == 4: self.flag += res break self.flag += res + '-' self.flag += '}' print(self.flag) if __name__ == '__main__': swpuctf = SwpuctfBabyre() swpuctf.run()
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。