2023第十四届极客大挑战 — RE WP

RE方向出自：队友。

Shiftjmp

去花后按p然后再反编译

最后flag为SYC{W3lc0me_tO_th3_r3veR5e_w0r1d~}

点击就送的逆向题

gcc 1.s -o 1`

生成elf

最后flag为SYC{TQWEFGHYIICIOJKLBNMCVBFGHSDFF}

幸运数字

爆破v5

运行获得flag

最后flag为SYC{C0ngratulati0nnnns_You_gAessEd_R1ght}

砍树

反编译

关键逻辑

由于是native 去找相关的so文件

ida打开

跟进 A0OWO0A

接着跟进_Z7A0OWO0APhPKh

EXP：

最后flag为SYC{t@ke_thE_bul1_By_the_h0rns_TAT}

easymath

exp:

运行获得flag

最后flag为SYC{xtd4co_ymiunbbx3Aypsmbzii}

听说cpp很难？

exp:

运行获得flag

加上括号

flower-or-tea

去花指令

exp1:

#include <stdio.h> 
#include <stdint.h> 
#include <stdio.h> 
void decrypt(uint32_t* v, uint32_t* k) { 
int v7 = 0; 
for (int i = 0; i < 54; i++) { 
v7 += 0x31415927; 
} 
v7 = v7 & 0xffffffff; 
uint32_t v6 = v[0], v5 = v[1], i; 
uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3]; 
for (i = 0; i < 54; i++) { 
v7 -= 0x31415927; 
v6 -= (k[(v7 & 3)] + v7) ^ (v5 + ((v5 >> 5) ^ (16 * v5))); 
v5 -= v7 ^ (k[((v7 >> 11) & 3)] + v7) ^ (v6 + ((v6 >> 5) ^(16 * v6))); 
} 
v[0] = v6; v[1] = v5; 
} 
int main() 
{ 
uint32_t key[4] = { 
32,27,39,44 
}; 
uint32_t array[38] = { 0x9af9464b, 0xc417b89e, 0xb217a713, 
0xc93ba9e8, 0x94f3e44e, 0xb5cc2ab5, 0x4451e42c, 0x7a8a289a, 
0x53c8d008, 0x6e117b49, 0x9bffd794, 0x5eff2df9, 0x17e72531, 
0xdfbd9979, 0x8f871b3a, 0x73e8c5ac, 0xb28670a6, 
0x5af6a369,0x2cf7da24, 0x347b66af, 
0xb9c84d60, 0x911e912f, 0xbd5a2f9b, 0xcb96733a, 0xc59968be, 
0xa00013e9, 0xc12f4ea4, 0xde863a10, 0xa0c4d594, 
0x4380983c, 0x7e2f7648, 0xe54ddc89, 0x3f27a690, 0xb58d3199, 
0x604ae517, 0x9c903984, 0xf4e04481, 0x3cf4edff }; 
uint32_t temp[2] = { 0 }; 
int i = 0; 
for (i = 0; i < 38; i += 2) 
{ 
temp[0] = array[i]; 
temp[1] = array[i+1]; 
decrypt(temp, key); 
printf("%c%c%c%c%c%c%c%c", ((char)&temp[0] + 0), * 
((char*)&temp[0] + 1), ((char)&temp[0] + 2), ((char)&temp[0] + 
3), ((char)&temp[1] + 0), ((char)&temp[1] + 1), * 
((char*)&temp[1] + 2), ((char)&temp[1] + 3)); 
} 
return 0; 
}

运行c代码

得到字符串 S}Y?C?{ADe0t__Yro3vw_o1liFk_ek_nTioR_d

exp2：

运行获得flag

最后flag为SYC{D0_Yov_1ike_To_dRink_Flow3r_teA??}

mySelf

自解密

动调

exp：

#include <stdio.h>#include <stdint.h> 
#include <stdio.h> 
void decrypt(uint32_t* v) { 
int v2 = 0; 
for (int i = 0; i < 32; i++) { 
v2 -= 0x61C88647; 
} 
v2 = v2 & 0xffffffff; 
uint32_t v3= v[0], result= v[1], i; 
for (i = 0; i < 32; i++) { 
result -= ((v3 >> 5) + 4) ^ (16 * v3 + 3) ^ (v2 + v3); 
v3 -= ((result >> 5) + 2) ^ (16 * result + 2) ^ (v2 + 
result); 
v2 += 0x61C88647; 
} 
v[0] = v3; v[1] = result; 
} 
int main() 
{ 
//uint32_t key[4] = { 
//32,27,39,44 
//}; 
uint32_t array[38] = { 
0x0BDBDF9F0,0x0E26194C4,0x80799125,0x1F0FC219,0x0EB6A1815,0x84F572C5,0x40CC3A85,0x0 
D2A32ABB }; 
uint32_t temp[2] = { 0 }; 
int i = 0; 
for (i = 0; i < 8; i += 2) 
{ 
temp[0] = array[i]; 
temp[1] = array[i + 1]; 
decrypt(temp); 
printf("%c%c%c%c%c%c%c%c", ((char)&temp[0] + 0), * 
((char*)&temp[0] + 1), ((char)&temp[0] + 2), ((char)&temp[0] + 
3), ((char)&temp[1] + 0), ((char)&temp[1] + 1), *((char*)&temp[1] + 2), ((char)&temp[1] + 3)); 
} 
return 0; 
}

运行得到flag

最后flag为SYC{H0w_7o_R@te_YOurs31f_iNtRo?}

rainbow

直接手撕了

运行获得flag

最后flag为SYC{TAke_1t_3asy_Just_a_STart!!}

小黄鸭

解包

反编译

完整代码

Exp:

运行得到字符串GMQ{1_v0ds_mCi_QvOgs_McIf_rf3omg}

凯撒解密

保证m不变，其他凯撒位移

最后flag为SYC{1_h0pe_yOu_ChAse_YoUr_dr3ams}

寻找初音未来

Exp:

运行获得flag

最后flag为SYC{N0thing_1s_sEriOus_But_MIku}

ezandroid

24位或者是24的倍数，不够的使用'X'进行补齐，将其给到sb

分两组，一组给到sb4，一组给到sb5 sb4是会进行操作的，进行tea加密

其实出现的"ad@#E!@a123"和"eCAS213@!@3"都是对象

第一部分flag:

exp：

#include <stdio.h> 
#include 
#include <stdlib.h> 
void decrypt(int *v, int *k) 
{ 
int v0 = v[0], v1 = v[2], v2 = v[1], sum = 0x9E3779B9 * 64, i; 
/* set up */ 
int delta = 0x9E3779B9; 
/* a key schedule constant */ 
int k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3]; 
/* cache key */ 
for (i = 0; i < 32; i++) 
{ /* basic cycle start */ 
v1 -= (((v2 << 4) + k2) ^ (v2 + sum)) ^ ((v2 >> 5) + k3); 
v2 -= (((v1 << 4) + k0) ^ (v1 + sum)) ^ ((v1 >> 5) + k1); 
sum -= delta; 
} 
for (i = 0; i < 32; i++) 
{ /* basic cycle start */ 
v1 -= (((v0 << 4) + k2) ^ (v0 + sum)) ^ ((v0 >> 5) + k3); 
v0 -= (((v1 << 4) + k0) ^ (v1 + sum)) ^ ((v1 >> 5) + k1); sum -= delta; 
} 
v[0] = v0; 
v[1] = v1; 
v[2] = v2; 
} 
int main() 
{ 
char encode1[12] = {-91, -8, -110, -55, -49, 75, 115, 13, -76, 
-113, 102, 80}; 
int key[4] = {2023708229, -158607964, -2120859654, 1167043672}; 
char temp; 
for (int i = 0; i < 3; i++) 
{ 
temp = encode1[4 * i]; 
encode1[4 * i] = encode1[4 * i + 3]; 
encode1[4 * i + 3] = temp; 
temp = encode1[4 * i + 1]; 
encode1[4 * i + 1] = encode1[4 * i + 2]; 
encode1[4 * i + 2] = temp; 
} 
int *flag1 = (int *)encode1; 
decrypt(flag1, key); 
for (int i = 0; i < 3; i++) 
{ 
temp = encode1[4 * i]; 
encode1[4 * i] = encode1[4 * i + 3]; 
encode1[4 * i + 3] = temp; 
temp = encode1[4 * i + 1]; 
encode1[4 * i + 1] = encode1[4 * i + 2]; 
encode1[4 * i + 2] = temp; 
} 
for (int i = 0; i < 12; i++) 
{ putchar(encode1[i]); 
} 
system("pause"); 
return 0; 
}

运行得到T0Vt33Tn0itr