[第二阶段第1题]攻防竞赛第二阶段第1题（攻击篇）答题

分析文章：
1.将密码的'-'字符去掉
2.密码每4个字节一组,然后将每字节加上密码表开始偏移得到表中数字.
3.将表中得到的数字进行逻辑运算得到3个值.
4.将逻辑运算出来的值与账户16进制进行对比是否相同,相同显示成功。
算法:

// 11.cpp : Defines the entry point for the console application.

//

#include "stdafx.h"

#include <stdio.h>

#include <string.h>

#include <windows.h>

unsigned char Table [256] = {

	0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x3E, 0x80, 0x80, 0x80, 0x3F, 

		0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x80, 0x80, 0x80, 0x00, 0x80, 0x80, 

		0x80, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 

		0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 

		0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 

		0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80

};

int main(int argc, char* argv[])

{

	char Account[256] = {0};//账户

	char Password[256] = {0};//密码

	char PasswordTemp[256] = {0};

	printf("-------------------crackme.l1.apk 注册机-------------\n");

//	printf("账户: ");

//	scanf("%s",Account);

	printf("密码: ");

	scanf("%s",Password);

/*	if (9 != strlen(Account))

	{

		printf("只支持9位数字账户\n");

		return -1;

	}*/

	if ( (Password[3] != '-') || (Password[7] != '-') || (Password[0XB] != '-'))

	{

		printf("输入密码格式有误!\n");

		return -1;

	}

	//-----去掉'-'

	for (int i = 0; i < strlen((const char *)Password); i++)

	{

		static int j = 0;

		if (Password[i] != '-')

		{

			PasswordTemp[j] = Password[i];

			j++;

		}

	}

	//算术右移ASRS

	//循环逻辑左移LSLS

	//异或ORRS

	//-------查表过程过

	BYTE results[256] = {0};

	for (BYTE t =0; t<strlen((const char *)PasswordTemp); t+=4)

	{

		static int inxres = 0;

		BYTE temp[4] = {0};

		for (BYTE f =0; f<4; f++)

		{

			BYTE index = PasswordTemp[t+f];

			temp[f] = Table[index];

		}

		//-------逻辑运算

		BYTE A1,A2,A3, A4,A5,A6,A7,A8;

		A1 = temp[1];

		A3 = A1;

		A1 >>=0X4;

		A2 = temp[0];

		A2 <<=0X2;

		A1 ^= A2;

		results[inxres+0] = A1;

		//---------

		A1 = temp[2];

		A4 = A1;

		A2 = A1 >> 0X2;

		//A2 = A3;

		A3 <<=0X4;

		A5 = A4;

		A3 ^= A2;

		results[inxres+1] = A3;

		//-------------

		A1 = temp[3];

		A2 = A5 << 0X6;

		A2 ^= A1;

		results[inxres+2] = A2;

		inxres+=3;

	}

	//---生成表并填充0x80

/*	BYTE *Table1 = (BYTE*)malloc(0x100);

	BYTE *TableTemp  = NULL;

	if (NULL == Table1)

	{

		return -1;

	}

	memset(Table1, 0x80, 0x100);

	TableTemp = Table1;

	Table1 += 0X41;

	for (BYTE n = 0; n <=0x1A; n++)

	{

		Table1[n] = n;

		if (n == 0x1A)

		{

			Table1 = TableTemp;

			Table1 += 0x62;

			Table1[n] = n;

			for (BYTE m = 0; m != 0x62; m++)

			{

				Table1[m] = m;

			}

		}

	}*/

	getchar();

	return 0;

}