ret_noname

ret_noname

1.分析函数逻辑
输入字符串存储在flagstr数组里，进入construct()函数，也是本题关键函数


进入函数后，经过三个for循环，得到目标outFlag3={BEDhv}}wsreFiveBwsvDEB}！！！
逆向c语言代码：

#include
#include
using namespace std;
typedef pair abc;
void changeBytes_re ( char *ch ) // Reverse process of changeByte_stage1().
{
	if( *ch > 96 && *ch < 103 ) 
	{
       *ch -= 87;
	} 
	else{
	   *ch -= 48;
	}
}
char* First_for ( char *outFlag1 ) // Reverse process of first "for" cycle.
{
	char* flag = new char[23];
	memset ( flag, 0, sizeof ( flag ) );
	for ( int i = strlen ( outFlag1 ) / 2 - 1; i >= 0; i-- )
	{
		changeBytes_re ( &outFlag1[2 * i + 1] );
		changeBytes_re ( &outFlag1[2 * i] );
		flag[i] = ( outFlag1[2 * i] & 0xF ) ^ ( ( outFlag1[2 * i + 1] << 4 ) & 0xF0 );
	}
	printf ( "flag: %s\n", flag );
	return flag;
}

char* Second_for ( char *outFlag2 ) // Reverse process of second "for" cycle.
{
	char* outFlag1 = new char[45];
	for ( int i = strlen ( outFlag2 ) / 2 - 1; i >= 0; i-- )
	{
		outFlag1[2 * i] = ( outFlag2[2 * i] - 2 ) ^ 1;
		outFlag1[2 * i + 1] = ( outFlag2[2 * i + 1] - 2 ) ^ 1;
	}
	printf ( "outFlag1: %s\n", outFlag1 );
	return outFlag1;
}

abc mergeByte_re ( char ch ) // Reverse process of mergeByte_stage_3().
//return type: pair
{
	char v3; // Put 4 low bits in high bits.
	char v4;
	char a1, a2;
	v3 = ( ch >> 4 ) & 0xF;
	v4 = ch & 0xF;
	if( v4 > 9 && v4 < 16 ) 
	{
         a2 = v4 + 87;
	} 
	else
	{
		 a2 = v4 + 48;
	}
	if( v3 > 9 && v3 < 16 ) 
	{
        a1 = v3 + 87;
	}  
	else
	{
		a1 = v3 + 48;
	}
	
	return make_pair ( a1, a2 ); // Use pair to return 2 elements.

}
char* Third_for ( char *outFlag3 ) // Reverse process of third "for" cycle.
{
	char* outFlag2 = new char[45];
	memset ( outFlag2, 0, sizeof ( outFlag2 ) );
	abc temp;
	for ( int i = strlen ( outFlag3 ) - 1; i >= 0; i-- )
	{
		temp = mergeByte_re ( outFlag3[i] );
		outFlag2[2 * i + 1] = temp.first;
		outFlag2[2 * i] = temp.second;

	}
	printf ( "outFlag2: %s\n", outFlag2 );
	return outFlag2;
}

int main()
{
	char outFlag3[23] = "BEDhv}}wsreFiveBwsvDEB";
	char *outFlag2 = Third_for ( outFlag3 );
	char *outFlag1 = Second_for ( outFlag2 );
	char *flag = First_for ( outFlag1 );
	printf ( "flagStr: %s\n", flag );
}