学习一下攻防世界reverse专题😀

logmein (动调)

动调出来右边的值就可以了

1
2
3
flag = 	[0x52,0x43,0x33,0x2d,0x32,0x30,0x31,0x36,0x2d,0x58,0x4f,0x52,0x49,0x53,0x47,0x55,0x44]
for i in flag:
print(chr(i),end = "")

RC3-2016-XORISGUD

insanity

9447{This_is_a_flag}

python-trade

在线pyc反汇编

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
import base64

def encode(message):
s = ''
for i in message:
x = ord(i) ^ 32
x = x + 16
s += chr(x)

return base64.b64encode(s)

correct = 'XlNkVmtUI1MgXWBZXCFeKY+AaXNt'
flag = ''
print 'Input flag:'
flag = raw_input()
if encode(flag) == correct:
print 'correct'
else:
print 'wrong'
1
2
3
4
5
6
7
8
import base64
string = 'XlNkVmtUI1MgXWBZXCFeKY+AaXNt'
string2 = base64.b64decode(string)
string2 = [int(hex(i),16) for i in string2]
flag = ""
for i in range(len(string2)):
flag += chr((string2[i]-16) ^ 32)
print(flag)

nctf{d3c0mpil1n9_PyC}

re (动调)

先查个壳,动调一下就出来了

DUTCTF{We1c0met0DUTCTF}

game (动调)

说一下思路,直接修改汇编,跳转到最后成功的函数中,然后动调出最后的v2数组(0x73是第二个值)

1
2
3
4
5
flag = [0x7a,0x73,0x63,0x74,0x66,0x7B,0x54,0x39,0x69,0x73,0x5f,0x74,0x4f,0x70,0x69,0x63,\
0x5f,0x31,0x73,0x5f,0x76,0x35,0x72,0x79,0x5f,0x69,0x6e,0x74,0x37,0x72,0x65,0x73,0x74,0x69,0x6e,0x67\
,0x5f,0x62,0x36,0x74,0x5f,0x6f,0x74,0x68,0x65,0x72,0x73,0x5f,0x61,0x72,0x65,0x5f,0x6e,0x30,0x74,0x7d]
for i in flag:
print(chr(i),end= "")

zsctf{T9is_tOpic_1s_v5ry_int7resting_b6t_others_are_n0t}

Hello,CTF

题目的意思就是把flag,转成16进制数

1
2
3
flag = [0x43,0x72,0x61,0x63,0x6b,0x4d,0x65,0x4a,0x75,0x73,0x74,0x46,0x6f,0x72,0x46,0x75,0x6e]
for i in flag:
print(chr(i),end = "")

或者:

1
2
3
from Crypto.Util.number import *
f = 0x437261636b4d654a757374466f7246756e
print(long_to_bytes(f))

no-strings-attached(动调)

但是没有关系,我们不需要修补程序

我们跟进decrypt函数,查看汇编之后,我们去内存中查找[eax],就能查看flag了

19447{you_are_an_international_mystery}

csaw2013reversing2(动调)

先用的ida调试,看一下整体布局,发现有一个反调试函数,跳过之后,发现flag旁边还有一块,没有运行过

直接运行右边的flag是这个样子

转到x32dbg,找到main函数入口点

这边有个int3,需要nop掉,不然执行不下去

nop掉跳转语句,messageA函数执行,但是没有结果

到这边还会跳转,我们继续nop掉跳转,让程序完整的执行代码

getit

开始认真了,先查个壳

貌似是在/tmp目录下下一个flag.txt文件,然后还会把flag文件给删掉

在这边下个断点,一直f9

t字符串变成了harifCTF{b70c59275fcfa8aebf2d5911223c6589}

但是flag不对

看了好一会儿,才注意到,harif……前面还有一个0x53,麻了……选中他们,然后按a键转换成字符串。当然要是想好玩一点,也可以把下面的u,转换成t就行,flag的值就写道文本文档里了。

maze

放到ida64中查看

地图:

长度为64,推测是8*8

1
2
3
maze = "  *******   *  **** * ****  * ***  *#  *** *** ***     *********"
for i in range(8):
print(maze[i*8:(i+1)*8])

猜测O为右,o为左,.为上,0为下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
string = "右下右右下下左下下下右右右右上上左左"
direction = ""
for i in string:
if i == "右":
direction += "O"
elif i == "左":
direction += "o"
elif i == "下":
direction += "0"
elif i == "上":
direction += "."
flag = "nctf{"+direction+"}"
print(len(flag))
print(flag)

nctf{O0OO00o000OOOO..oo}