查壳:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509165233515-1671205186.png)
64位,进IDA:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509170319016-155469294.png)
进来后发现c++经常用的std,(当然用c++的也有可能不经常见),跟进伪代码,找输出:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171109353-401470135.png)
有个判断跟进Human::~Human看看:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171203772-1304747815.png)
调用了一个方法,字符串又指向了name,跟进方法:off_4863D0:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171254085-942104869.png)
发现存了一个基地址:跟进基地址:_ZN5Human9give_flagEv:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171327473-504472640.png)
进入伪代码:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171340131-646026419.png)
找到我们要拿的东西了,而且自身还在异或,看看flag里存放了啥:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171425906-1499378750.png)
既然异或,那么应该会有一个比较:查看它的调用:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230509171506184-660585135.png)
果然不只一个调用,找到比较的调用方法:发现没有,再看看off_4863D0里边,发现是将异或后的直接拼接上去,那么写脚本吧:
Des = [0x44, 0x59, 0x59, 0x49, 0x5E, 0x4C, 0x71, 0x7E, 0x62, 0x63,
0x79, 0x55, 0x63, 0x79, 0x55, 0x44, 0x43, 0x59, 0x4B, 0x55,
0x78, 0x6F, 0x55, 0x79, 0x63, 0x6D, 0x64, 0x77]
flag = ''
for i in Des:
flag += chr(i ^ ord('\n'))
print(flag)
得到NSSCTF{this_is_NISA_re_sign}