WUSTCTF2020 level3

https://buuoj.cn/challenges#[WUSTCTF2020]level3

elf 64

看起来 base64加密 里面有问题

char *__fastcall base64_encode(char *a1)
{
  int v1; // eax
  int v2; // eax
  int v4; // [rsp+1Ch] [rbp-54h]
  int v5; // [rsp+20h] [rbp-50h]
  int v6; // [rsp+24h] [rbp-4Ch]
  int v7; // [rsp+28h] [rbp-48h]
  int v8; // [rsp+2Ch] [rbp-44h]
  char src[56]; // [rsp+30h] [rbp-40h] BYREF
  unsigned __int64 v10; // [rsp+68h] [rbp-8h]
 
  v10 = __readfsqword(0x28u);
  v1 = strlen(a1);
  v8 = v1 % 3;
  v7 = v1 / 3;
  memset(src, 0, 0x30uLL);
  v6 = 0;
  v4 = 0;
  v5 = 0;
  while ( v4 < v7 )
  {
    src[v6] = base64_table[a1[v5] >> 2];
    src[v6 + 1] = base64_table[(16 * (a1[v5] & 3)) | (a1[v5 + 1] >> 4)];
    src[v6 + 2] = base64_table[(4 * (a1[v5 + 1] & 0xF)) | (a1[v5 + 2] >> 6)];
    v2 = v6 + 3;
    v6 += 4;
    src[v2] = base64_table[a1[v5 + 2] & 0x3F];
    v5 += 3;
    ++v4;
  }
  if ( v8 == 1 )
  {
    src[v6] = base64_table[a1[v5] >> 2];
    src[v6 + 1] = base64_table[16 * (a1[v5] & 3)];
    strcat(src, "==");
  }
  else if ( v8 == 2 )
  {
    src[v6] = base64_table[a1[v5] >> 2];
    src[v6 + 1] = base64_table[(16 * (a1[v5] & 3)) | (a1[v5 + 1] >> 4)];
    src[v6 + 2] = base64_table[4 * (a1[v5 + 1] & 0xF)];
    src[v6 + 3] = 61;
  }
  strcpy(a1, src);
  return a1;
}

看起来没什么问题

那应该就是对表做手脚了

__int64 O_OLookAtYou()
{
  __int64 result; // rax
  char v1; // [rsp+1h] [rbp-5h]
  int i; // [rsp+2h] [rbp-4h]
 
  for ( i = 0; i <= 9; ++i )
  {
    v1 = base64_table[i];
    base64_table[i] = base64_table[19 - i];
    result = 19 - i;
    base64_table[result] = v1;
  }
  return result;
}

base64_map = list("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")  
  
for i in range(10):  
    v1 = base64_map[i]  
    base64_map[i] = base64_map[19 - i]  
    result = 19 - i  
    base64_map[result] = v1  
  
print("".join(base64_map))

map: TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

wctf2020{Base64_is_the_start_of_reverse}