标签：
因为题目还可以做所以不放比赛名称，做个备忘吧～
首先上IDA，前面401000处第一条指令跳过，修复栈平衡。
然后发现验证的函数如下，可以看出这里主要是要逆算法了。
当时室友也在做这题，晚了10分钟解出来，卡在我分析的地方，以后一定记住所见即所得。
把算法捋一下，同时用ollydbg跑，即可看出算法的大致端倪。
----------------------------------code------------------------------------------------
int __usercall sub_401084@<eax>(int result@<eax>, int v_0x11, int str, signed int len)
{
__int16 sum; // bx@1
signed int lenval; // ecx@1
int ptr; // esi@2
int v7; // edi@2
char chr; // al@3
unsigned int v9; // et0@3
char v10; // ah@3
char v11; // cf@3
__int16 tmprs; // ax@3
bool equal; // zf@3
int unuse; // edi@3
int result_2; // [sp+0h] [bp-Ch]@3
sum = 0;
lenval = 37;
if ( len >= 37 ) // len > 37
{
ptr = str; // v7 = 35 at first
v7 = v_0x11 + 36;
while ( 1 )
{
LOWORD(result) = 455;
result_2 = result;
chr = *(_BYTE *)ptr++;
v9 = __readeflags(); // pushf
v10 = __ROL1__(1, sum & 3);
__writeeflags(v9); // popf
tmprs = (unsigned __int8)(v10 + v11 + (result_2 ^ chr));
sum += tmprs;
equal = *(_BYTE *)v7 == (_BYTE)tmprs; // key
unuse = v7 + 1;
if ( !equal )
LOWORD(lenval) = 0;
result = result_2;
if ( !lenval )
break;
v7 = unuse - 2; // v7 = v7 - 1
--lenval;
if ( !lenval )
return result;
}
}
return 0;
}
-----------------------------------------code---------------------------------
len=37
value=ptr@401108-
sum=0
while(1){
chr = str(ptr)
tmprs = (__ROL1__(1, sum & 3) + xxxtmprs_low_bitxxx 应该是1！ + (455 ^ chr));
sum += tmprs; //we known the value of tmprs and sum
if(*value != tmprs) break;
value--
ptr++
len--
if(!j) return 1
}
接下来算法就好写了。
-------------------------------------code--------------------------
sumv = 0
lenv = 37
rolv = 1
flag = 1
result = ‘‘
values = [0xa8,0x9a,0x90,0xb3,0xb6,0xbc,0xb4,0xab,0x9d,0xae,0xf9,0xb8,0x9d,0xb8,0xaf,0xba,0xa5,0xa5,0xba,0x9a,0xbc,0xb0,0xa7,0xc0,0x8a,0xaa,0xae,0xaf,0xba,0xa4,0xec,0xaa,0xae,0xeb,0xad,0xaa,0xaf,]
for i in range(37):
rolv = (1 << (sumv & 3)) % 256
code = (455 ^ (values[i] - rolv - flag)% 256) %256
result = result + chr(code)
sumv = sumv + values[i]
print result
【Reverse】level2_very_success writeup
标签：
原文地址：http://www.cnblogs.com/windcarp/p/4688014.html
