测试文件：https://www.lanzous.com/ib5y9cb
代码分析
1 __int64 __fastcall main(__int64 a1, char **a2, char **a3)
2 {
3 signed int i; // [rsp+8h] [rbp-68h]
4 signed int j; // [rsp+Ch] [rbp-64h]
5 __int64 v6; // [rsp+10h] [rbp-60h]
6 __int64 v7; // [rsp+18h] [rbp-58h]
7 __int64 v8; // [rsp+20h] [rbp-50h]
8 __int64 v9; // [rsp+28h] [rbp-48h]
9 __int64 v10; // [rsp+30h] [rbp-40h]
10 __int64 v11; // [rsp+40h] [rbp-30h]
11 __int64 v12; // [rsp+48h] [rbp-28h]
12 __int64 v13; // [rsp+50h] [rbp-20h]
13 __int64 v14; // [rsp+58h] [rbp-18h]
14 __int64 v15; // [rsp+60h] [rbp-10h]
15 unsigned __int64 v16; // [rsp+68h] [rbp-8h]
16
17 v16 = __readfsqword(0x28u);
18 puts("Let us play a game?");
19 puts("you have six chances to input");
20 puts("Come on!");
21 v6 = 0LL;
22 v7 = 0LL;
23 v8 = 0LL;
24 v9 = 0LL;
25 v10 = 0LL;
26 for ( i = 0; i <= 5; ++i )
27 {
28 printf("%s", "input: ", (unsigned int)i);
29 __isoc99_scanf("%d", (char *)&v6 + 4 * i);
30 }
31 v11 = 0LL;
32 v12 = 0LL;
33 v13 = 0LL;
34 v14 = 0LL;
35 v15 = 0LL;
36 for ( j = 0; j <= 4; j += 2 ) // 0,2,4
37 {
38 dword_601078 = *((_DWORD *)&v6 + j); // 下标0,2,4
39 dword_60107C = *((_DWORD *)&v6 + j + 1); // 下标1,3,5
40 sub_400686((unsigned int *)&dword_601078, &unk_601060);
41 *((_DWORD *)&v11 + j) = dword_601078;
42 *((_DWORD *)&v11 + j + 1) = dword_60107C;
43 }
44 if ( (unsigned int)sub_400770(&v11) != 1 )
45 {
46 puts("NO NO NO~ ");
47 exit(0);
48 }
49 puts("Congratulation!\n");
50 puts("You seccess half\n");
51 puts("Do not forget to change input to hex and combine~\n");
52 puts("ByeBye");
53 return 0LL;
54 }
55 /* Orphan comments:
56 a2指向v6的空间
57 2234
58 */这段代码，对输入数字的处理，我们可以分成两部分
- 第36~43行代码，输入整型数组变换
- 第44行代码，判断变换后的数组是否满足要求
第二部分
打开sub_400770函数
__int64 __fastcall sub_400770(_DWORD *a1)
{
__int64 result; // rax
if ( a1[2] - a1[3] != 2225223423LL || a1[3] + a1[4] != 4201428739LL || a1[2] - a1[4] != 1121399208LL )
{
puts("Wrong!");
result = 0LL;
}
else if ( *a1 != 0xDF48EF7E || a1[5] != 0x84F30420 || a1[1] != 550153460 )
{
puts("Wrong!");
result = 0LL;
}
else
{
puts("good!");
result = 1LL;
}
return result;
}整理信息，我们可以获取到变换后的数组a1的相关信息
a1[2] - a1[3] == 2225223423
a1[3] + a1[4] == 4201428739
a1[2] - a1[4] == 1121399208
a1[0] == 0xDF48EF7E
a1[1] == 550153460
a1[5] == 0x84F30420
用z3解方程
# -*- coding:utf-8 -*-
from z3 import *
a2,a3,a4 = BitVecs('a2 a3 a4',64)
s = Solver()
s.add(a2 - a3 == 2225223423)
s.add(a3 + a4 == 4201428739)
s.add(a2 - a4 == 1121399208)
if s.check() == sat:
m = s.model()
for i in m:
print("%s = %ld" % (i, m[i].as_long()))得到：
a4 = 2652626477
a2 = 3774025685
a3 = 1548802262
第一部分
打开sub_400686函数
__int64 __fastcall sub_400686(unsigned int *a1, _DWORD *a2)
{
__int64 result; // rax
unsigned int v3; // [rsp+1Ch] [rbp-24h]
unsigned int v4; // [rsp+20h] [rbp-20h]
int v5; // [rsp+24h] [rbp-1Ch]
unsigned int i; // [rsp+28h] [rbp-18h]
v3 = *a1;
v4 = a1[1];
v5 = 0;
for ( i = 0; i <= 0x3F; ++i )
{
v5 += 1166789954;
v3 += (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
v4 += (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
}
*a1 = v3;
result = v4;
a1[1] = v4;
return result;
}这就是一个利用已知数组unk_601060对我们输入的整型数组进行异或操作，因此我们只需要将整个过程逆过来，for循环那段，你将异或过程看成一个整体就行，最后就能得到输入的整型数组。
脚本
#include <iostream>
#pragma warning(disable:4996)
using namespace std;
int main()
{
__int64 a[6] = { 3746099070, 550153460, 3774025685, 1548802262, 2652626477, 2230518816 };
unsigned int a2[4] = { 2,2,3,4 };
unsigned int v3, v4;
int v5;
for (int j = 0; j <= 4; j += 2) {
v3 = a[j];
v4 = a[j + 1];
v5 = 1166789954*0x40;
for (int i = 0; i <= 0x3F; ++i) {
v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
v5 -= 1166789954;
}
a[j] = v3;
a[j + 1] = v4;
}
/*将整型数组作为字符输出，注意计算机小端排序*/
for (int i = 0; i < 6; ++i) {
cout << *((char*)&a[i] + 2) << *((char*)&a[i] + 1) << * ((char*)&a[i]);
}
system("PAUSE");
return 0;
}
get flag！
flag{re_is_great!}
来源：oschina
链接：https://my.oschina.net/u/4384923/blog/4264922