buu [MRCTF2020]EasyCpp
上次没写出，这次认真分析了一下，发现自己的调试水平也有了上涨，也看了一些C++逆向的文章，尤其是stl，发现C++的oop还是挺复杂，这题还没考啥虚函数的还行了。
一.拖入ida，找到主函数，还是挺容易的
int __cdecl main(int argc, const char **argv, const char **envp)
{
double v3; // xmm0_8
__int64 v4; // rax
__int64 v5; // rcx
__int64 v6; // r8
__int64 v7; // r9
__int64 v8; // rbx
__int64 v9; // rax
int v10; // ebx
__int64 v11; // rax
__int64 v12; // rax
__int64 v13; // rax
__int64 v14; // rax
__int64 v15; // rax
__int64 v16; // rax
char v18; // [rsp+0h] [rbp-140h]
__int64 v19; // [rsp+28h] [rbp-118h]
__int64 v20; // [rsp+30h] [rbp-110h]
int v21; // [rsp+3Ch] [rbp-104h]
char v22; // [rsp+40h] [rbp-100h]
char v23; // [rsp+60h] [rbp-E0h]
char v24; // [rsp+90h] [rbp-B0h]
char v25; // [rsp+AFh] [rbp-91h]
char v26; // [rsp+B0h] [rbp-90h]
char v27; // [rsp+DFh] [rbp-61h]
char v28; // [rsp+E0h] [rbp-60h]
int v29; // [rsp+104h] [rbp-3Ch]
char *v30; // [rsp+108h] [rbp-38h]
int *v31; // [rsp+110h] [rbp-30h]
_DWORD *v32; // [rsp+118h] [rbp-28h]
int *v33; // [rsp+120h] [rbp-20h]
int i; // [rsp+128h] [rbp-18h]
int v35; // [rsp+12Ch] [rbp-14h]
v35 = 0;
std::vector<int,std::allocator<int>>::vector(&v24, argv, envp);
std::vector<bool,std::allocator<bool>>::vector(&v23);
std::allocator<char>::allocator(&v25);
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(&v22, &unk_500E, &v25);
std::allocator<char>::~allocator(&v25);
v4 = std::operator<<<std::char_traits<char>>(&std::cout, "give me your key!");
std::ostream::operator<<(v4, &std::endl<char,std::char_traits<char>>);
for ( i = 0; i <= 8; ++i )
{
std::istream::operator>>(&std::cin, &keys[i]);
std::__cxx11::to_string((std::__cxx11 *)&v26, keys[i], (unsigned int)keys[i], v5, v6, v7);
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::operator+=(&v22, &v26);
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v26);// 输入9组字符
}
v32 = keys;
v33 = keys;
v31 = (int *)&unk_83E4;
while ( v33 != v31 )
{
v21 = *v33;
std::vector<int,std::allocator<int>>::push_back(&v24, &v21);
++v33;
} // 将输入的字符串存入vector中
v8 = std::vector<int,std::allocator<int>>::end(&v24);
v9 = std::vector<int,std::allocator<int>>::begin(&v24);
std::for_each<__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>,main::{lambda(int &)#1}>(// 每组异或1
v8,
v9,
v8);
v30 = &v24;
v20 = std::vector<int,std::allocator<int>>::begin(&v24);
v19 = std::vector<int,std::allocator<int>>::end(v30);// 类似头指针和尾指针
while ( (unsigned __int8)__gnu_cxx::operator!=<int *,std::vector<int,std::allocator<int>>>(&v20, &v19) )
{
v29 = *(_DWORD *)__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>::operator*(&v20);
std::allocator<char>::allocator(&v27);
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(&v18, &unk_500E, &v27);// 定义string
std::allocator<char>::~allocator(&v27);
depart(v29, (__int64)&v18, v3); // 一波骚操作
{lambda(std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>> &)#1}::operator()(
(__int64)&func, // 一波替换
(__int64)&v18);
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(&v28, &v18);// string复制
v10 = (unsigned __int64){lambda(std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>,int)#2}::operator()(
(__int64)&check, // 比较函数
(__int64)&v28,
v35) ^ 1;
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v28);
if ( (_BYTE)v10 )
{
v11 = std::operator<<<std::char_traits<char>>(&std::cout, "Wrong password!");
std::ostream::operator<<(v11, &std::endl<char,std::char_traits<char>>);
system("pause");
exit(0);
}
++v35;
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v18);
__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>::operator++(&v20);// 头指针加一
}
v12 = std::operator<<<std::char_traits<char>>(&std::cout, "right!");
std::ostream::operator<<(v12, &std::endl<char,std::char_traits<char>>);
v13 = std::operator<<<std::char_traits<char>>(&std::cout, "flag:MRCTF{md5(");
v14 = std::operator<<<char,std::char_traits<char>,std::allocator<char>>(v13, &v22);
v15 = std::operator<<<std::char_traits<char>>(v14, ")}");
std::ostream::operator<<(v15, &std::endl<char,std::char_traits<char>>);
v16 = std::operator<<<std::char_traits<char>>(
&std::cout,
"md5()->{32/upper case/put the string into the function and transform into md5 hash}");
std::ostream::operator<<(v16, &std::endl<char,std::char_traits<char>>);
system("pause");
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v22);
std::vector<bool,std::allocator<bool>>::~vector(&v23);
std::vector<int,std::allocator<int>>::~vector(&v24);
return 0;
}
把我的分析都写在注释里了，发现这个程序大体的逻辑是，输入9个数字，每个数字异或1，之后，遍历每个数字，进过depart函数，再进行替换，flag里面包含是md5加密的输入的9个数字。这里比较坑的有几点：
1.
当时一直没找到这个函数在哪。。原来点击那个Lambda就可以进入函数中了，lambda之前也百度了一下，之前一道加密题也碰到过，不过是python的语法，C++里面这个和python里面意思大体一致，相当于一个匿名函数，在主函数体里面定义，()里面是指的捕捉对象，具体，用的时候，再回忆。
2.
depart函数，这个递归感觉会劝退很多人，这个函数意思就是将数字分解，最后将除数和最后一个数字拼接成字符串。
二.根据我们的思路逆向写出一个脚本，最后的数字找个在线网站直接加密下就好了。
strs=["=zqE=z=z=z","=lzzE","=ll=T=s=s=E","=zATT","=s=s=s=E=E=E","=EOll=E","=lE=T=E=E=E","=EsE=s=z","=AT=lE=ll"]
def replacediy(str):
str=str.replace("O","0")
str=str.replace("l","1")
str=str.replace("z","2")
str=str.replace("E","3")
str=str.replace("A","4")
str=str.replace("s","5")
str=str.replace("G","6")
str=str.replace("T","7")
str=str.replace("B","8")
str=str.replace("q","9")
str=str.replace("="," ")
return str
flag=""
for i in strs:
tmp=replacediy(i).split(" ")[1:]
print tmp
sum=1
for j in range(len(tmp)):
sum*=int(tmp[j],10)
sum^=1
flag+=str(sum)
print flag
