CTF-BUUCTF-Reverse刷题之旅-(1)

0x01 xor

导入ida，发现是一个f(x) = f(x)^f(x-1)的加密方式，直接逆出来就好了，脚本如下

encode = 'f\nk\x0cw&O.@\x11x\x0dZ;U\x11p\x19F\x1Fv"M#D\x0Eg\x06h\x0FG20'
flag = ''
flag+='f'
for i in range(1,len(encode)):
	flag += chr(ord(encode[i])^ord(encode[i-1]))
print flag

flag{QianQiuWanDai_YiTongJiangHu}

0x02 新年快乐

程序是UPX3加壳，脱壳后导入ida，看到一个字符串比较，就是flag

flag{HappyNewYear!}

0x03 reverse_2

导入ida中，发现flag字符串，然后在main里发现一个字符替换，替换方式如下

flag字符串为hacking_for_fun
将i和r换成1，然后加上flag{}

flag{hack1ng_fo1_fun}

0x04 内涵的软件

导入ida直接看到flag

flag{49d3c93df25caad81232130f3d2ebfad}

0x05 reverse3

导入ida，发现加密后的字符串为

e3nifIH9b_C@n@dH

两次加密，先是base64加密，然后每一位字符加上自己位置的偏移

import base64
encode = "e3nifIH9b_C@n@dH"
decode1 = ''
flag = ''
for i in range(0,len(encode)):
	decode1 += chr(ord(encode[i]) - i)
print base64.b64decode(decode1)

flag{i_l0ve_you}

0x06 Java逆向解密

把class反编译一下，得到以下代码

import java.io.PrintStream;
import java.util.ArrayList;
import java.util.Scanner;

public class Reverse
{
  public static void main(String[] args)
  {
    Scanner s = new Scanner(System.in);
    System.out.println("Please input the flag :");
    String str = s.next();
    System.out.println("Your input is:");
    System.out.println(str);
    char[] stringArr = str.toCharArray();
    Encrypt(stringArr);
  }
  
  public static void Encrypt(char[] arr)
  {
    ArrayList<Integer> Resultlist = new ArrayList();
    for (int i = 0; i < arr.length; i++)
    {
      int result = arr[i] + '@' ^ 0x20;
      Resultlist.add(Integer.valueOf(result));
    }
    int[] KEY = { 180, 136, 137, 147, 191, 137, 147, 191, 148, 136, 133, 191, 134, 140, 129, 135, 191, 65 };
    ArrayList<Integer> KEYList = new ArrayList();
    for (int j = 0; j < KEY.length; j++) {
      KEYList.add(Integer.valueOf(KEY[j]));
    }
    System.out.println("Result:");
    if (Resultlist.equals(KEYList)) {
      System.out.println("Congratulations!");
    } else {
      System.err.println("Error!");
    }
  }
}

简单分析了就一下就可以写出解密算法

encrypto = [180, 136, 137, 147, 191, 137, 147, 191, 148, 136, 133, 191, 134, 140, 129, 135, 191, 65]
flag = ''
for i in encrypto:
	flag += chr(i - ord('@')^0x20)
	print flag

flag{This_is_the_flag_!}

0x07 简单注册器

导入jeb，搜索flag{找到关键代码，然后反编译为源码，然后直接复制粘贴出加密代码，然后直接还原，代码如下：

public static void main(String args[]) {
        int v11 = 31;
        int v9 = 2;
        int v2 = 1;
        char[] v5 = "dd2940c04462b4dd7c450528835cca15".toCharArray();
        v5[v9] = ((char)(v5[v9] + v5[3] - 50));
        v5[4] = ((char)(v5[v9] + v5[5] - 48));
        v5[30] = ((char)(v5[v11] + v5[9] - 48));
        v5[14] = ((char)(v5[27] + v5[28] - 97));
        int v4;
        for(v4 = 0; v4 < 16; ++v4) {
            char v0 = v5[31 - v4];
            v5[31 - v4] = v5[v4];
            v5[v4] = v0;
        }
        System.out.println(v5);
}

flag{59acc538825054c7de4b26440c0999dd}