32位elf文件，MIPS指令集
在gayhub上下载有关ida的插件
根据ida-master/plugins的readme文件安装插件
有了插件但是不会用，原地载了一个7.5版本的ida（7.5版本支持mips的伪代码）（吾爱破解上有
查看主函数
int __fastcall main(int a1, char **a2, char **a3)
{
int result; // $v0
int i; // [sp+18h] [+18h] BYREF
char v5[36]; // [sp+1Ch] [+1Ch] BYREF
setbuf((FILE *)stdout, 0);
setbuf((FILE *)stdin, 0);
printf("Give me your flag:");
scanf("%32s", v5);
for ( i = 0; i < 32; ++i )
*((_BYTE *)&i + i + 4) ^= 32 - (_BYTE)i;
if ( !strncmp(v5, fdata, 5u) )
result = sub_4007F0(v5);
else
result = puts("Wrong");
return result;
}
fdata的值
跟进sub_4007F0()函数
int __fastcall sub_4007F0(const char *a1)
{
char v1; // $v1
int result; // $v0
size_t i; // [sp+18h] [+18h]
for ( i = 5; i < strlen(a1); ++i )
{
if ( (i & 1) != 0 )
v1 = (a1[i] >> 2) | (a1[i] << 6);
else
v1 = (4 * a1[i]) | (a1[i] >> 6);
a1[i] = v1;
}
if ( !strncmp(a1 + 5, (const char *)off_410D04, 0x1Bu) )
result = puts("Right!");
else
result = puts("Wrong!");
return result;
}
经过一个for循环后的值等于off_410D04
shift+E提取数据
unsigned char ida_chars[] =
{
0x52, 0xFD, 0x16, 0xA4, 0x89, 0xBD, 0x92, 0x80, 0x13, 0x41,
0x54, 0xA0, 0x8D, 0x45, 0x18, 0x81, 0xDE, 0xFC, 0x95, 0xF0,
0x16, 0x79, 0x1A, 0x15, 0x5B, 0x75, 0x1F
};
i&1等价于判断奇偶，然后进行移位运算
a1[i] >> 2 | a1[i] << 6
等价于
00 010010 | 01 000000
结果为01 010010
if的两个分支就是简单的左（右）移两位
（一开始在纠结移位的乘法，想来想去想了半天
后面上个厕所 想到二进制的移位就想通了
off_410D04 =[
0x52, 0xFD, 0x16, 0xA4, 0x89, 0xBD, 0x92, 0x80, 0x13, 0x41,
0x54, 0xA0, 0x8D, 0x45, 0x18, 0x81, 0xDE, 0xFC, 0x95, 0xF0,
0x16, 0x79, 0x1A, 0x15, 0x5B, 0x75, 0x1F
]
flag=[]
h=list("Q|j{g")
for i in range(len(h)):
flag.append(ord(h[i])^((0x20 - i)))
#逆向
for i in range(len(off_410D04)):
if((i&1)!=0):
res=(off_410D04[i]&0xfc) >> 2 | (off_410D04[i]&0x3 ) << 6
else:
res= (off_410D04[i]&0x3f) << 2 | (off_410D04[i]&0xc0) >> 6
flag.append(res^0x20 - i-5)
"""
#爆破
for i in range(5,len(off_410D04)+5):
for j in range(32,128):
tmp=(j^((0x20 - i)))
if ( (i&1)!= 0 ):
res = (tmp >> 2) | (tmp << 6)% 0x100
else:
res = (tmp<<2)% 0x100 | ((tmp >> 6))
#print(res)
if res==off_410D04[i-5]:
flag.append(j)
"""
for i in flag:
print(chr(i),end='')
flag{ReA11y_4_B@89_mlp5_4_XmAn_}
