re学习笔记（56）WUSTCTF - Re方向WP

新手一枚，如有错误（不足）请指正，谢谢！！

WUSTCTF-re-Cr0ssFun

IDA64载入，进入main函数

查看check函数







都提取出来就是flag了。。。
得到flag为wctf2020{cpp_@nd_r3verse_@re_fun}

WUSTCTF-re-level1

下载下来压缩包有两个文件，一个是ELF64位，一个是output.txt是程序的输出
IDA64位载入查看main函数

对19位的flag变换后输出，，
写脚本

#include 
int main(void)
{
    unsigned int i,flag[] = { 198,232,816,200,1536,300,6144,984,51200,570,92160,1200,565248,756,1474560,800,6291456,1782,65536000 };
    for (i = 0; i < 19; i++)
    {
        if ((i + 1) & 1)
            flag[i] >>= (i + 1);
        else
            flag[i] /= (i + 1);
        printf("%c", flag[i]);
    }
    return 0;
}

因为少了第一位的校验，比赛的flag头都是wctf2020，再前面补一个w得到了flag
得到flag为wctf2020{d9-dE6-20c}

WUSTCTF-re-level2

IDA32位

pusha推测被加壳
查壳发现UPX壳

使用官方upx工具脱壳


得到flag为wctf2020{Just_upx_-d}

WUSTCTF-re-level3

IDA64位载入来到main函数

推测是base64自定义字符表加密

找到对base字符表进行变换的函数
直接IDA动态调试得到变换后的字符表

写python脚本

import base64
biao = str.maketrans("TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/","ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")
enstr = "d2G0ZjLwHjS7DmOzZAY0X2lzX3CoZV9zdNOydO9vZl9yZXZlcnGlfD=="
flag = base64.b64decode(enstr.translate(biao).encode('utf-8'))
print(str(flag,'utf-8'))

得到flag为wctf2020{Base64_is_the_start_of_reverse}

WUSTCTF-re-level4

IDA64位载入

左右左右的应该是树，数据结构？没学过的我，告辞！
运行一下……

二叉树的前序中序后序。。。。
参考文章

• 二叉树前序后序中序互推总结
• 知道中序和后序遍历，画二叉树和写出前序遍历 - 百度经验

因为知道flag头部是wctf2020呀，可以知道给出的是中序和后序，求前序

按照百度经验那个参考资料，还原后
画的有点丑emmm

得到flag为wctf2020{This_IS_A_7reE}

WUSTCTF-re-main

IDA64位载入，发现上面有好长的未解析成函数的代码……

start函数里也执行了main函数
题目名称是main函数就去找main函数……
双击跟过main函数去

选中，摁p键将其声明成函数

现在可以F5了……
F5之后有个JMPOUT，花指令，返回汇编代码看一下


上面的jz和jnz指向同一个地址loc_40061A+1，也就是不管怎样都会跳这个地址的。。
看一下loc_40061A的字节码，由于指向的是loc_40061A+1，也就是第一个字节指令E8是没用的，用IDA自带的patch将其改为90
再下面的jz short near ptr loc_400621+2，说明loc_400621的前两个字节05 CD是无用的，将其改为90 90
修改完后

其中这三个跳转都是往下一行跳的，，可以直接nop掉，然后中间那个db 0x80h不知道啥玩意直接nop
再修改完后

然后下面有三个数据，，，这本应该和后面解析成代码的，光标选中摁C将其解析成代码
最终效果

继续F5，，发现下面还有

一共三四处吧。步骤基本一样就不累述了。会IDC或者IDApython的可以识别特征码用脚本改。。。

修复后main函数变成了这样，，，
先是比较输入长度是否等于38
然后比较前五位是否为flag{，最后一位是否为}
然后中间进行了三百五十多次对中括号内的数据进行加密……


用正则表达式一点点删除……（刚开始写了个正则漏了四个变换，淦！）
提取出这三百多个变换，写脚本……

#include 
unsigned int data[33] = {
    0xD9, 0x2C, 0x27, 0xD6, 0xD8, 0x2A, 0xDA, 0x2D, 0xD7, 0x2C, 0xDC, 0xE1, 0xDB, 0x2C, 0xD9, 0xDD,
    0x27, 0x2D, 0x2A, 0xDC, 0xDB, 0x2C, 0xE1, 0x29, 0xDA, 0xDA, 0x2C, 0xDA, 0x2A, 0xD9, 0x29, 0x2A
};
int main(void)
{
    int i;
    printf("flag{");
    for (i = 0; i < 32; i++)
    {
        data[i] -= 8;
        data[i] -= 21;
        data[i] -= 60;
        data[i] -= 24;
        data[i] -= 7;
        data[i] -= 16;
        data[i] -= 20;
        data[i] -= 31;
        data[i] -= 28;
        data[i] -= 54;
        data[i] -= 26;
        data[i] -= 78;
        data[i] -= 34;
        data[i] -= 45;
        data[i] -= 13;
        data[i] -= 81;
        data[i] -= 98;
        data[i] -= 22;
        data[i] -= 76;
        data[i] -= 93;
        data[i] -= 36;
        data[i] -= 48;
        data[i] -= 72;
        data[i] -= 3;
        data[i] -= 95;
        data[i] -= 92;
        data[i] -= 18;
        data[i] -= 51;
        data[i] -= 25;
        data[i] -= 35;
        data[i] -= 39;
        data[i] -= 63;
        data[i] -= 88;
        data[i] -= 19;
        data[i] -= 46;
        data[i] -= 82;
        data[i] -= 66;
        data[i] -= 27;
        data[i] -= 47;
        data[i] -= 49;
        data[i] -= 29;
        data[i] -= 62;
        data[i] -= 23;
        data[i] -= 2;
        data[i] -= 77;
        data[i] -= 15;
        data[i] -= 37;
        data[i] -= 40;
        data[i] -= 4;
        data[i] -= 75;
        data[i] -= 14;
        data[i] -= 69;
        data[i] -= 61;
        data[i] -= 42;
        data[i] -= 52;
        data[i] -= 73;
        data[i] -= 6;
        data[i] -= 56;
        data[i] -= 96;
        data[i] -= 71;
        data[i] -= 67;
        data[i] -= 50;
        data[i] -= 68;
        data[i] -= 97;
        data[i] -= 32;
        data[i] -= 55;
        data[i] -= 86;
        data[i] -= 94;
        data[i] -= 11;
        data[i] -= 33;
        data[i] -= 43;
        data[i] -= 38;
        data[i] -= 17;
        data[i] -= 74;
        data[i] -= 10;
        data[i] -= 84;
        data[i] -= 12;
        data[i] -= 70;
        data[i] -= 44;
        data[i] -= 89;
        data[i] -= 85;
        data[i] -= 41;
        data[i] -= 53;
        data[i] -= 65;
        data[i] -= 57;
        data[i] -= 90;
        data[i] -= 1;
        data[i] -= 58;
        data[i] -= 59;
        data[i] -= 83;
        data[i] -= 87;
        data[i] -= 99;
        data[i] -= 5;
        data[i] -= 9;
        data[i] -= 91;
        data[i] -= 30;
        data[i] -= 79;
        data[i] -= 64;
        data[i] -= 80;
        data[i] ^= 0x67;
        data[i] ^= 0x68;
        data[i] ^= 0xC3;
        data[i] ^= 0x23;
        data[i] ^= 0xE9;
        data[i] ^= 8;
        data[i] ^= 0x3B;
        data[i] ^= 0x50;
        data[i] ^= 0xFA;
        data[i] ^= 0x64;
        data[i] ^= 0xC8;
        data[i] ^= 5;
        data[i] ^= 0xF5;
        data[i] ^= 0x76;
        data[i] ^= 0x86;
        data[i] ^= 0x41;
        data[i] ^= 0x99;
        data[i] ^= 0xF0;
        data[i] ^= 0x37;
        data[i] ^= 0x49;
        data[i] ^= 0x4C;
        data[i] ^= 0x18;
        data[i] ^= 0x39;
        data[i] ^= 0x5D;
        data[i] ^= 0x2C;
        data[i] ^= 0x75;
        data[i] ^= 0x4D;
        data[i] ^= 0x95;
        data[i] ^= 0xED;
        data[i] ^= 0x84;
        data[i] ^= 0x10;
        data[i] ^= 0x32;
        data[i] ^= 2;
        data[i] ^= 0x12;
        data[i] ^= 0x9C;
        data[i] ^= 0x65;
        data[i] ^= 0x73;
        data[i] ^= 0x2F;
        data[i] ^= 0x13;
        data[i] ^= 0xC;
        data[i] ^= 0xBD;
        data[i] ^= 0x96;
        data[i] ^= 0xA8;
        data[i] ^= 0x33;
        data[i] ^= 0xD2;
        data[i] ^= 0xE2;
        data[i] ^= 0xC7;
        data[i] ^= 0xD3;
        data[i] ^= 0x4E;
        data[i] ^= 0xA9;
        data[i] ^= 0xF9;
        data[i] = ~data[i];
        data[i] ^= 0xEF;
        data[i] ^= 0x62;
        data[i] ^= 0x66;
        data[i] ^= 0xCE;
        data[i] ^= 0x14;
        data[i] ^= 0xB;
        data[i] ^= 0xB6;
        data[i] ^= 7;
        data[i] ^= 0xA3;
        data[i] ^= 0x97;
        data[i] ^= 0xDC;
        data[i] ^= 0xB8;
        data[i] ^= 0xE7;
        data[i] ^= 0xD5;
        data[i] ^= 0x7F;
        data[i] ^= 0x82;
        data[i] ^= 0x34;
        data[i] ^= 0xE1;
        data[i] ^= 0x98;
        data[i] ^= 0xE3;
        data[i] ^= 0xF6;
        data[i] ^= 0xEB;
        data[i] ^= 0xD8;
        data[i] ^= 0xDA;
        data[i] ^= 0x1D;
        data[i] ^= 0x9D;
        data[i] ^= 0x7D;
        data[i] += 128;
        data[i] ^= 0xC9;
        data[i] ^= 0x27;
        data[i] ^= 0xA0;
        data[i] ^= 0x8E;
        data[i] ^= 0xF7;
        data[i] ^= 0x6F;
        data[i] ^= 0xFB;
        data[i] ^= 0x9A;
        data[i] ^= 0x9B;
        data[i] ^= 0xCB;
        data[i] ^= 0xD4;
        data[i] ^= 0x30;
        data[i] ^= 0xAC;
        data[i] ^= 0x60;
        data[i] ^= 0x92;
        data[i] ^= 0xAF;
        data[i] ^= 0x2D;
        data[i] ^= 0xAB;
        data[i] ^= 0x51;
        data[i] ^= 0xB7;
        data[i] ^= 0x35;
        data[i] ^= 0xD0;
        data[i] ^= 0xA4;
        data[i] ^= 0xAD;
        data[i] ^= 0xC0;
        data[i] ^= 0xEC;
        data[i] ^= 0xBE;
        data[i] ^= 0xFC;
        data[i] ^= 0xBB;
        data[i] ^= 0x54;
        data[i] ^= 0xC5;
        data[i] ^= 0xC1;
        data[i] ^= 0xC6;
        data[i] ^= 3;
        data[i] ^= 0xDE;
        data[i] ^= 0x5E;
        data[i] ^= 0x3A;
        data[i] ^= 0xFD;
        data[i] ^= 0x29;
        data[i] ^= 0x31;
        data[i] ^= 0x85;
        data[i] ^= 0x2B;
        data[i] ^= 0xB9;
        data[i] ^= 0x55;
        data[i] ^= 0xDF;
        data[i] ^= 0xCF;
        data[i] ^= 0x4B;
        data[i] ^= 0xCC;
        data[i] ^= 0x1F;
        data[i] ^= 0xD6;
        data[i] ^= 0x93;
        data[i] ^= 0xF;
        data[i] ^= 0xE0;
        data[i] ^= 0xD1;
        data[i] ^= 0xB0;
        data[i] ^= 0xF1;
        data[i] ^= 0x56;
        data[i] ^= 0xF4;
        data[i] ^= 0x45;
        data[i] ^= 0x63;
        data[i] ^= 0x7C;
        data[i] ^= 0x2E;
        data[i] ^= 0x11;
        data[i] ^= 0x81;
        data[i] ^= 0x1C;
        data[i] ^= 0x77;
        data[i] ^= 0xFE;
        data[i] ^= 0x3F;
        data[i] ^= 0x36;
        data[i] ^= 0x87;
        data[i] ^= 0xBF;
        data[i] ^= 0xBA;
        data[i] ^= 0x8B;
        data[i] ^= 0xA7;
        data[i] ^= 0x26;
        data[i] ^= 0x5F;
        data[i] ^= 0x72;
        data[i] ^= 0xDB;
        data[i] ^= 0x47;
        data[i] ^= 0x4A;
        data[i] ^= 0x15;
        data[i] ^= 0x19;
        data[i] ^= 0xB4;
        data[i] ^= 0x7B;
        data[i] ^= 0x8A;
        data[i] ^= 9;
        data[i] ^= 0xE8;
        data[i] ^= 0x71;
        data[i] ^= 0x20;
        data[i] ^= 0x88;
        data[i] ^= 0xE6;
        data[i] ^= 0x46;
        data[i] ^= 0x25;
        data[i] ^= 0xEE;
        data[i] ^= 0xA5;
        data[i] ^= 0x8F;
        data[i] ^= 0x43;
        data[i] ^= 0x1A;
        data[i] ^= 0x5B;
        data[i] ^= 0xD9;
        data[i] ^= 0x61;
        data[i] ^= 0x79;
        data[i] ^= 0xA6;
        data[i] ^= 0xB3;
        data[i] ^= 0x8C;
        data[i] ^= 0x90;
        data[i] ^= 0x44;
        data[i] ^= 0x3D;
        data[i] ^= 0xC2;
        data[i] ^= 0x22;
        data[i] ^= 0x6B;
        data[i] ^= 0xA2;
        data[i] ^= 0x1E;
        data[i] ^= 0x6D;
        data[i] ^= 0x57;
        data[i] ^= 0x74;
        data[i] ^= 1;
        data[i] ^= 0xBC;
        data[i] ^= 0x94;
        data[i] ^= 0x2A;
        data[i] ^= 0x7E;
        data[i] ^= 0xE5;
        data[i] ^= 0x21;
        data[i] ^= 0x5C;
        data[i] ^= 0x69;
        data[i] ^= 0xB1;
        data[i] ^= 0x5A;
        data[i] ^= 0x17;
        data[i] ^= 0xD;
        data[i] ^= 0xB5;
        data[i] ^= 0xD7;
        data[i] ^= 0x16;
        data[i] ^= 0x89;
        data[i] ^= 0x40;
        data[i] ^= 0x6E;
        data[i] ^= 0xE4;
        data[i] ^= 0x48;
        data[i] ^= 0xEA;
        data[i] ^= 0x28;
        data[i] ^= 0x70;
        data[i] ^= 0x78;
        data[i] ^= 6;
        data[i] ^= 0xA1;
        data[i] ^= 0x3C;
        data[i] ^= 0x9F;
        data[i] ^= 0xF2;
        data[i] ^= 0x58;
        data[i] ^= 0xF8;
        data[i] ^= 0xAE;
        data[i] ^= 0xAA;
        data[i] ^= 0x1B;
        data[i] ^= 0x52;
        data[i] ^= 0xDD;
        data[i] ^= 0x7A;
        data[i] ^= 0x38;
        data[i] ^= 0x8D;
        data[i] ^= 0xE;
        data[i] ^= 0x42;
        data[i] ^= 0x9E;
        data[i] ^= 4;
        data[i] ^= 0x53;
        data[i] ^= 0xC4;
        data[i] ^= 0x83;
        data[i] ^= 0x24;
        data[i] ^= 0x4F;
        data[i] ^= 0x6C;
        data[i] ^= 0x3E;
        data[i] ^= 0xCA;
        data[i] ^= 0xF3;
        data[i] ^= 0xA;
        data[i] ^= 0x59;
        data[i] ^= 0x6A;
        data[i] ^= 0xCD;
        data[i] ^= 0x91;
        printf("%c", data[i]);
    }
    putchar('}');
}

得到flag为flag{1dc20f6e3d497d15cef47d9a66d6f1af}