WUSTCTF2020 Cr0ssfun

https://buuoj.cn/challenges#[WUSTCTF2020]Cr0ssfun

64 elf

很有意思 很有意思

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4[48]; // [rsp+0h] [rbp-30h] BYREF
 
  puts(" _    _ _   _ _____ _____   _____           ");
  puts("| |  | | | | /  ___|_   _| /  ___|          ");
  puts("| |  | | | | \\ `--.  | |   \\ `--.  ___  ___ ");
  puts("| |/\\| | | | |`--. \\ | |    `--. \\/ _ \\/ __|");
  puts("\\  /\\  / |_| /\\__/ / | |   /\\__/ /  __/ (__ ");
  puts(" \\/  \\/ \\___/\\____/  \\_/   \\____/ \\___|\\___|");
  while ( 1 )
  {
    puts("Input the flag");
    __isoc99_scanf("%s", v4);
    if ( (unsigned int)check(v4) == 1 )
      break;
    puts("0ops, your flag seems fake.");
    puts("==============================");
    rewind(_bss_start);
  }
  puts("Your flag is correct, go and submit it!");
  return 0;
}

进入 check

_BOOL8 __fastcall iven_is_handsome(_BYTE *a1)
{
  return a1[10] == 112
      && a1[13] == 64
      && a1[3] == 102
      && a1[26] == 114
      && a1[20] == 101
      && (unsigned int)iven_is_c0ol(a1);
}

… 子子孙孙无穷匮也？

全部打开复制出来

a1[10] == 112
&& a1[13] == 64
&& a1[3] == 102
&& a1[26] == 114
&& a1[20] == 101
&& a1[7] == 48
&& a1[16] == 95
&& a1[11] == 112
&& a1[23] == 101
&& a1[30] == 117
&&*a1 == 119 && a1[6] == 50 && a1[22] == 115 && a1[31] == 110 && a1[12] == 95 &&
a1[15] == 100
&& a1[8] == 123
&& a1[18] == 51
&& a1[28] == 95
&& a1[21] == 114
&&a1[2] == 116
&& a1[9] == 99
&& a1[32] == 125
&& a1[19] == 118
&& a1[5] == 48
&& a1[14] == 110
&&a1[4] == 50 && a1[17] == 114 && a1[29] == 102 && a1[17] == 114 && a1[24] == 95 &&a1[1] == 99 && a1[25] == 64 && a1[27] == 101

写个正则匹配就行了

import re  
  
src = """a1[10] == 112  
&& a1[13] == 64  
&& a1[3] == 102  
&& a1[26] == 114  
&& a1[20] == 101  
&& a1[7] == 48  
&& a1[16] == 95  
&& a1[11] == 112  
&& a1[23] == 101  
&& a1[30] == 117  
&&*a1 == 119 && a1[6] == 50 && a1[22] == 115 && a1[31] == 110 && a1[12] == 95 &&  
a1[15] == 100  
&& a1[8] == 123  
&& a1[18] == 51  
&& a1[28] == 95  
&& a1[21] == 114  
&&a1[2] == 116  
&& a1[9] == 99  
&& a1[32] == 125  
&& a1[19] == 118  
&& a1[5] == 48  
&& a1[14] == 110  
&&a1[4] == 50 && a1[17] == 114 && a1[29] == 102 && a1[17] == 114 && a1[24] == 95 &&a1[1] == 99 &&  
a1[25] == 64 && a1[27] == 101"""  
  
pattern = re.compile(r"a1\[(\d+)\] == (\d+)")  
matches = pattern.findall(src)  
flag = " " * 33  
for i in matches:  
    flag = flag[:int(i[0])] + chr(int(i[1])) + flag[int(i[0])+1:]  
print(flag)

 ctf2020{cpp_@nd_r3verse_@re_fun}