[原创][Flare-on5] Challenge6 magic -Writeup

0x00 序

• Auth: vvv_347
• Date: 09/14/2018
• From: Flare-on5

0x01 破

signed __int64 __fastcall main(__int64 a1, char **a2, char **a3)

{

  unsigned __int64 v3; // rax

  unsigned __int64 len; // rax

  __int64 *v6; // [rsp+0h] [rbp-1E0h]

  unsigned int seed; // [rsp+1Ch] [rbp-1C4h]

  unsigned int i; // [rsp+20h] [rbp-1C0h]

  unsigned int j; // [rsp+20h] [rbp-1C0h]

  unsigned int k; // [rsp+24h] [rbp-1BCh]

  char input_s[128]; // [rsp+40h] [rbp-1A0h]

  char a3a; // [rsp+C0h] [rbp-120h]

  char arr_1[72]; // [rsp+140h] [rbp-A0h]

  char v14; // [rsp+188h] [rbp-58h]

  unsigned __int64 v15; // [rsp+1C8h] [rbp-18h]

  v15 = __readfsqword(0x28u);

  seed = 0;

  memset(input_s, 0, sizeof(input_s));

  memset(&a3a, 0, 0x80uLL);

  *arr_1 = 0x45123A7920755C24LL;

  *&arr_1[8] = 0x17263719711D201ELL;

  *&arr_1[16] = 0x4A7C67303E100367LL;

  *&arr_1[24] = 0x11621308555E1B11LL;

  *&arr_1[32] = 0x122C17445A7C6C68LL;

  *&arr_1[40] = 0x576D0C6324095979LL;

  *&arr_1[48] = 0x265D0F6A0C27651FLL;

  *&arr_1[56] = 0xA375C1433594643LL;

  *&arr_1[64] = 0x2C16022663LL;

  memset(&v14, 0, 0x38uLL);

  for ( i = 0; i < strlen("Run, Forrest, run!!"); i += 4 )

    seed ^= *&aRunForrestRun[i];

  srand(seed);

  if ( sub_402D47() )

  {

    v3 = strlen(a2[1]);

    func_proc1(a2[1], v3, &a3a);

    func_proc2(*a2);

    puts("Generated first permutation!");

    exit(0);

  }

  puts("Welcome to the ever changing magic mushroom!");

  printf("%d trials lie ahead of you!\n", 666LL, a2);

  for ( j = 0; j < 666; ++j )

  {

    printf("Challenge %d/%d. Enter key: ", j + 1, 666LL);

    if ( !fgets(input_s, 128, unk_617630) )

      return 0xFFFFFFFFLL;

    len = strlen(input_s);

    func_proc1(input_s, len, &a3a);

    for ( k = 0; k < strlen(input_s); ++k )

      arr_1[k] ^= input_s[k];

    func_proc2(*v6);

  }

  printf("Congrats! Here is your price:\n%s\n", arr_1);

  return 0LL;

}

main生成个固定seed，之后进入sub_402D47做check，run时发现不会进入branch，先忽略。
接着读输入Key，进入func_proc1，完成后与加密flag做xor，最后进入func_proc2。
一共做666次Chanllenges，全部正确即可拿到flag。

0 0 0 举报 分享

分享到

微信

QQ

微博

复制链接

取消分享

微信扫码分享

关闭

复制成功