GUET-CTF2019 re

https://buuoj.cn/challenges#[GUET-CTF2019]re

upx -d

elf 64

字符串定位到 sub_400E28 位置

__readfsqword 是汇编指令，用于读取 FS 段寄存器中存储的 64 位整数。 __readfsqword(0x28u) 赋值给变量 v7 则表示将 FS 段寄存器中偏移为 0x28 的地址处存储的 64 位整数值赋值给变量 v7

sub_4009AE 函数检验

写个脚本逆回去

import re  
  
source = """ if ( 1629056 * a1[0] != 166163712 )  
    return 0LL;  if ( 6771600 * a1[1] != 731332800 )    return 0LL;  if ( 3682944 * a1[2] != 357245568 )    return 0LL;  if ( 10431000 * a1[3] != 1074393000 )    return 0LL;  if ( 3977328 * a1[4] != 489211344 )    return 0LL;  if ( 5138336 * a1[5] != 518971936 )    return 0LL;  if ( 7532250 * a1[7] != 406741500 )    return 0LL;  if ( 5551632 * a1[8] != 294236496 )    return 0LL;  if ( 3409728 * a1[9] != 177305856 )    return 0LL;  if ( 13013670 * a1[10] != 650683500 )    return 0LL;  if ( 6088797 * a1[11] != 298351053 )    return 0LL;  if ( 7884663 * a1[12] != 386348487 )    return 0LL;  if ( 8944053 * a1[13] != 438258597 )    return 0LL;  if ( 5198490 * a1[14] != 249527520 )    return 0LL;  if ( 4544518 * a1[15] != 445362764 )    return 0LL;  if ( 3645600 * a1[17] != 174988800 )    return 0LL;  if ( 10115280 * a1[16] != 981182160 )    return 0LL;  if ( 9667504 * a1[18] != 493042704 )    return 0LL;  if ( 5364450 * a1[19] != 257493600 )    return 0LL;  if ( 13464540 * a1[20] != 767478780 )    return 0LL;  if ( 5488432 * a1[21] != 312840624 )    return 0LL;  if ( 14479500 * a1[22] != 1404511500 )    return 0LL;  if ( 6451830 * a1[23] != 316139670 )    return 0LL;  if ( 6252576 * a1[24] != 619005024 )    return 0LL;  if ( 7763364 * a1[25] != 372641472 )    return 0LL;  if ( 7327320 * a1[26] != 373693320 )    return 0LL;  if ( 8741520 * a1[27] != 498266640 )    return 0LL;  if ( 8871876 * a1[28] != 452465676 )    return 0LL;  if ( 4086720 * a1[29] != 208422720 )    return 0LL;  if ( 9374400 * a1[30] == 515592000 )    return 5759124 * a1[31] == 719890500;  return 0LL;"""  
# 匹配字符串里面三个一组的数字 并相除作为字符串输出  
# 10431000 * a1[3] != 1074393000 -> 1074393000 / 10431000 = 103  
  
  
flag = [0 for i in range(32)]  
pattern = re.compile(r"(\d+) \* a1\[(\d+)] [!=]= (\d+)")  
for match in pattern.findall(source):  
    a, b, c = map(int, match)  
    flag[b] = chr(c // a)  
print(flag)  
# list to string  
print("".join(flag))

但是喜提报错

TypeError: sequence item 6: expected str instance, int found

发现第六个没给出来，那就爆破

import re  
  
source = """ if ( 1629056 * a1[0] != 166163712 )  
    return 0LL;  if ( 6771600 * a1[1] != 731332800 )    return 0LL;  if ( 3682944 * a1[2] != 357245568 )    return 0LL;  if ( 10431000 * a1[3] != 1074393000 )    return 0LL;  if ( 3977328 * a1[4] != 489211344 )    return 0LL;  if ( 5138336 * a1[5] != 518971936 )    return 0LL;  if ( 7532250 * a1[7] != 406741500 )    return 0LL;  if ( 5551632 * a1[8] != 294236496 )    return 0LL;  if ( 3409728 * a1[9] != 177305856 )    return 0LL;  if ( 13013670 * a1[10] != 650683500 )    return 0LL;  if ( 6088797 * a1[11] != 298351053 )    return 0LL;  if ( 7884663 * a1[12] != 386348487 )    return 0LL;  if ( 8944053 * a1[13] != 438258597 )    return 0LL;  if ( 5198490 * a1[14] != 249527520 )    return 0LL;  if ( 4544518 * a1[15] != 445362764 )    return 0LL;  if ( 3645600 * a1[17] != 174988800 )    return 0LL;  if ( 10115280 * a1[16] != 981182160 )    return 0LL;  if ( 9667504 * a1[18] != 493042704 )    return 0LL;  if ( 5364450 * a1[19] != 257493600 )    return 0LL;  if ( 13464540 * a1[20] != 767478780 )    return 0LL;  if ( 5488432 * a1[21] != 312840624 )    return 0LL;  if ( 14479500 * a1[22] != 1404511500 )    return 0LL;  if ( 6451830 * a1[23] != 316139670 )    return 0LL;  if ( 6252576 * a1[24] != 619005024 )    return 0LL;  if ( 7763364 * a1[25] != 372641472 )    return 0LL;  if ( 7327320 * a1[26] != 373693320 )    return 0LL;  if ( 8741520 * a1[27] != 498266640 )    return 0LL;  if ( 8871876 * a1[28] != 452465676 )    return 0LL;  if ( 4086720 * a1[29] != 208422720 )    return 0LL;  if ( 9374400 * a1[30] == 515592000 )    return 5759124 * a1[31] == 719890500;  return 0LL;"""  
# 匹配字符串里面三个一组的数字 并相除作为字符串输出  
# 10431000 * a1[3] != 1074393000 -> 1074393000 / 10431000 = 103  
# AI是一个好东西
  
flag = [0 for i in range(32)]  
pattern = re.compile(r"(\d+) \* a1\[(\d+)] [!=]= (\d+)")  
for match in pattern.findall(source):  
    a, b, c = map(int, match)  
    flag[b] = chr(c // a)  
print(flag)  
# list to string  
#爆破第六位  
import string  
for i in string.printable:  
    flag[6] = i  
    print("".join(flag))

一个个试，其实第二个就对了

flag{e165421110ba03099a1c039337}