CTF逆向中字符串处理
- str='''
.data:04001234 db 93h
.data:04001234 db 0A2h
.data:04001234 db 0ADh
'''
str=str.replace("\n"," ").replace("\r"," ").split(" ")
str = [i for i in str if i != ''] #clear null meta
#print str
result=[]
for i in str:
i=i.strip()
if i[-1:]=="h" or i[-1:]=="H":
result.append(int(i[:-1],16))
print result
输出：
[147, 162, 173]
str='''
.text:4012we4r xor esi, 5039b3adh
.text:40sswe4r add eax, 12345678h
.text:4012444r sub ecx, 1a2d4e5dh
'''
str=str.replace("\n"," ").replace("\r"," ").split(" ")
str = [i for i in str if i != ''] #clear null meta
result=[]
for i in str:
i=i.strip()
if i[-1:]=="h" or i[-1:]=="H":
result.append(int(i[:-1],16))
print result
输出：
[1345958829, 305419896, 439176797]
str='''
.text:4012we4r xor esi, 50231210h
.text:40sswe4r add eax, 12345678h
.text:4012444r sub ecx, 1a2d4e5dh
'''
str=str.replace("\n"," ").replace("\r"," ").split(" ")
str = [i for i in str if i != ''] #clear null meta
result=[]
for i in str:
i=i.strip()
if i[-1:]=="h" or i[-1:]=="H":
tmp=[]
for j in range(0, len(i[:-1]), 2):
tmp.append(int(i[j:j + 2], 16))
tmp=tmp[::-1]#result.append(int(i[:-1],16))
for i in tmp:
result.append(i)
print result输出：
[16, 18, 35, 80, 120, 86, 52, 18, 93, 78, 45, 26]
; DATA XREF: .data:ptr2↓o 这个要删掉
str='''.rodata:080486E8 96 unk_80486E8 db 96h ; DATA XREF: .data:ptr2↓o .rodata:080486E9 8B db 8Bh .rodata:080486EA CA db 0CAh .rodata:080486EB D8 db 0D8h .rodata:080486EC 72 db 72h ; r .rodata:080486ED F9 db 0F9h .rodata:080486EE E8 db 0E8h .rodata:080486EF C0 db 0C0h .rodata:080486F0 F7 db 0F7h .rodata:080486F1 0D db 0Dh .rodata:080486F2 46 db 46h ; F .rodata:080486F3 40 db 40h ; @ .rodata:080486F4 29 db 29h ; ) .rodata:080486F5 42 db 42h ; B .rodata:080486F6 A2 db 0A2h .rodata:080486F7 9F db 9Fh .rodata:080486F8 3E db 3Eh ; > .rodata:080486F9 2C db 2Ch ; , .rodata:080486FA 34 db 34h ; 4 .rodata:080486FB 71 db 71h ; q .rodata:080486FC B2 db 0B2h .rodata:080486FD 9E db 9Eh .rodata:080486FE DA db 0DAh .rodata:080486FF 00 db 0''' str=str.replace("\n"," ").replace("\r"," ").replace(";"," ").split(" ") str = [i for i in str if i != ''] #clear null meta result=[] for i in str: i=i.strip() if i[-1:]=="h" or i[-1:]=="H": result.append(int(i[:-1],16)) print result
输出：
[84, 35, 51, 153, 7, 18, 81]
- 异或处理：
str=[117,106,106,119,90,111,116,87,121,127,120,100,113,114,101,125,97,77,35,50,62,61,40,39,124,121,99,67,123,114,126,71]
for i in range(len(str)):
str[i]=str[i]^(i+1)
tmp=[0,0,0,0,0,0,0,1,1,5,5,5,5,5,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0]
flag=''
for i in range(32):
flag+=chr(tmp[i]^str[i])
print flag
其他：
举个例子，比如在处理逆向 pwn的数据处理，常需要将伪代码的数据进行整理，这个时候就需要将伪代码拷贝到txt中，比如
Buf2 = 54;
v20 = -54;
v21 = 33;
v22 = 99;
v23 = -107;
v24 = -109;
v25 = 51;
然后 cat 2.txt | awk -F '[=;]' '{print $2}' | tr "\r\n" "," （-F 指定了两个分隔符 = ；两个 tr替换）