安恒九月赛

作为一名新菜鸡，就只能签下到，最后的re还是看了大佬的wp才明白的

1：NewDrive

    首先，直接对IDA 里面  找到mian F5，然后发现

  

发现指针偏移 值没找到  ，然后就ALt+k  平衡栈堆。就ok  

   我分析了好久，都没分，比赛后也是个朋友 给了指点和他的wp我看才明白。

其实第一个就是base64加密 下面的就是rc4，其实不知道下面的也ok的。

进入第一个函数，

  if ( v2 > 0 )
  {
    v18 = v16;
    v15 = v1;
    v14 = v2;
    do
    {
      v3 = 0;
      *(_DWORD *)Dest = 0;
      strncpy(Dest, v1, 3u);
      v4 = Dest;
      v5 = 0;
      do
        v6 = *v4++;
      while ( v6 );
      v7 = v4 - &Dest[1];
      if ( v4 != &Dest[1] )
      {
        v8 = 0x10;
        do
        {
          v9 = Dest[v5++] << v8;
          v8 -= 8;
          v3 |= v9;
        }
        while ( v5 < v7 );
      }
      v10 = 0;
      v11 = 18;
      do
      {
        if ( v7 + 1 <= v10 )
          *((_BYTE *)v18 + v10) = 0x3D;
        else
          *((_BYTE *)v18 + v10) = byte_402138[(v3 >> v11) & 0x3F];
        v11 -= 6;
        ++v10;
      }
      while ( v11 > -6 );
      v18 = (char *)v18 + 4;
      v1 = v15 + 3;
      v12 = v14-- == 1;
      v15 += 3;
    }
    while ( !v12 );
  }

　　

 ; char byte_402138[]
.rdata:00402138     byte_402138     db 41h                  ; DATA XREF: sub_401160+DEr
.rdata:00402138                                             ; .data:00403018o
.rdata:00402139     aBcdefghijstuvw db 'BCDEFGHIJSTUVWKLMNOPQRXYZabcdqrstuvwxefghijklmnopyz0123456789+/',0

　　又找到了 这个 还有

  v1 = a1;
  v2 = strlen(a1) / 3 + (strlen(a1) % 3 != 0);
  v16 = malloc(4 * v2 + 1);
  memset(v16, 0, 4 * v2 + 1);
  if ( v2 > 0 )

　　这差不多就能明白是base64加密，只是这个加密用的字符串和平时的不一样而已。所以这里最好返回加密后的字符串。

接下来的 一个函数是生成了一个16*16的矩阵。就是利用前面的假flag 生成的，

v12 = 256;
  while ( 1 )
  {
    v10 = *result;
    v3 = ((unsigned __int8)*result + result[(_DWORD)v8] + v3) % 256;
    *result++ = a1[v3];
    v11 = v12-- == 1;
    a1[v3] = v10;
    if ( v11 )
      break;
    v8 = (char *)(&v13 - a1);

　　这里进行了256次。。。

所以我们可以进行动态调试，去抠出来，

 sub_401000(&v7, (int)&v9, strlen(&v9));
    sub_4010E0((int)&v7, (int)v3, strlen(v3));

　　第一个生成的v7 个下面的用，如果抠的话，可以下断点在下面的函数，再

int __usercall sub_4010E0@<eax>(int result@<eax>, int a2, unsigned int a3)

　　再根据这个 找到eax的值  扣出来就ok了   其实还有种简单的方法，我也看了大佬的做法，就是进od里面，在进入第二加密的函数地方，去把加密生成的*(_BYTE *)((v6 + *(_BYTE *)(v3 + result)) % 256 + result) 抠出来  这样更快 而且也不用逆第二加密前面的算法，这里就不多说了 ，有兴趣的可以去试试。。

  

  if ( a3 )
  {
    do
    {
      v3 = (v3 + 1) % 256;
      v6 = *(_BYTE *)(v3 + result);
      v4 = (*(_BYTE *)(v3 + result) + v4) % 256;
      *(_BYTE *)(v3 + result) = *(_BYTE *)(v4 + result);
      *(_BYTE *)(v4 + result) = v6;
      *(_BYTE *)(v5++ + a2) ^= *(_BYTE *)((v6 + *(_BYTE *)(v3 + result)) % 256 + result);
    }
    while ( v5 < a3 );
  }

　　最后一个就加密 也就是第二个加密。直接 从内存扣出来 加密后的 再后再 base64解密就ok

这里就贴出大佬的代码，毕竟我一个菜鸡，代码能力差，写不出来：

     

key=[0x66, 0x32, 0xCA, 0xA0, 0xBF, 0x98, 0x2D, 0x76, 0xF1, 0x59, 0x2A, 0x4A, 0xF4, 0x30, 0xAD, 0xD2, 0x1D, 0x02, 0xD8, 0x23, 0x89, 0x5D, 0x83, 0x38, 0x09, 0xF2, 0x74, 0x65, 0x40, 0x19, 0xC6, 0xDD, 0x18, 0xD3, 0x8F, 0x6C, 0x8B, 0xC0, 0xC5, 0x54, 0x2E, 0x81, 0x10, 0xC4, 0x26, 0x56, 0x5F, 0x53, 0x80, 0x43, 0x27, 0x62, 0xEA, 0x3D, 0xE6, 0x00, 0xE7, 0xB7, 0x50, 0x94, 0x90, 0x4C, 0x3F, 0x9D, 0x07, 0xE0, 0xA3, 0x9C, 0x4E, 0x0F, 0x9F, 0xFE, 0x5B, 0x8E, 0xDE, 0x88, 0x72, 0x2F, 0xC1, 0x67, 0x31, 0x70, 0x8D, 0xFD, 0xBE, 0x64, 0xC3, 0xBD, 0x6B, 0x7A, 0xCF, 0x0C, 0x34, 0x1F, 0x6F, 0x01, 0xF0, 0x7C, 0x5E, 0xA4, 0x1E, 0x49, 0x8C, 0x75, 0x1C, 0xE3, 0x20, 0x48, 0x28, 0x79, 0xA5, 0x7F, 0xF5, 0xEC, 0x4F, 0x78, 0x58, 0x11, 0xF7, 0xCD, 0x91, 0x13, 0xFC, 0xB8, 0x2C, 0x04, 0xEE, 0xD5, 0x08, 0x44, 0xA9, 0xE1, 0xB1, 0x42, 0x84, 0x29, 0xA7, 0x47, 0x97, 0x7E, 0xE8, 0xB3, 0x60, 0x0B, 0xF9, 0x4B, 0x3C, 0x77, 0x17, 0x03, 0x82, 0x69, 0x87, 0xD4, 0x95, 0x1A, 0x33, 0x25, 0x6E, 0xCC, 0xD6, 0xBB, 0x99, 0xB0, 0x85, 0x41, 0xB2, 0x0D, 0xDB, 0x35, 0x3B, 0x5C, 0xF8, 0xED, 0x9E, 0xA6, 0x96, 0x39, 0x63, 0x0A, 0x1B, 0x93, 0x21, 0x46, 0x12, 0xD0, 0xB4, 0x22, 0x51, 0xC9, 0x61, 0xD1, 0x2B, 0xAA, 0x45, 0x06, 0x05, 0xCE, 0xFA, 0x92, 0x68, 0xAB, 0x36, 0xDA, 0xC8, 0xE2, 0x37, 0xD9, 0xA2, 0x5A, 0xD7, 0x6A, 0xB5, 0xFF, 0xE9, 0xBA, 0x52, 0x15, 0xF6, 0xBC, 0x9A, 0xB6, 0xEF, 0x6D, 0xCB, 0x4D, 0xAE, 0xE4, 0xA1, 0xAC, 0xEB, 0x0E, 0x71, 0x7B, 0xF3, 0x24, 0xC2, 0xFB, 0x7D, 0x86, 0x55, 0xAF, 0x3A, 0xDF, 0x3E, 0x14, 0xB9, 0x9B, 0x16, 0xDC, 0x73, 0x57, 0xE5, 0xC7, 0x8A, 0xA8, 0x66, 0x6C, 0x61, 0x67, 0x7B, 0x74, 0x68, 0x69, 0x73, 0x5F, 0x69, 0x73, 0x5F, 0x6E, 0x6F, 0x74, 0x5F, 0x74, 0x68, 0x65, 0x5F, 0x66, 0x6C, 0x61, 0x67, 0x5F, 0x68, 0x61, 0x68, 0x61, 0x68, 0x61, 0x7D]
key2=[0x20, 0xC3, 0x1A, 0xAE, 0x97, 0x3C, 0x7A, 0x41, 0xDE, 0xF6, 0x78, 0x15, 0xCB, 0x4B, 0x4C, 0xDC, 0x26, 0x55, 0x8B, 0x55, 0xE5, 0xE9, 0x55, 0x75, 0x40, 0x3D, 0x82, 0x13, 0xA5, 0x60, 0x13, 0x3B, 0xF5, 0xD8, 0x19, 0x0E, 0x47, 0xCF, 0x5F, 0x5E, 0xDE, 0x9D, 0x14, 0xBD]
key3=[]
v3=0
v4=0
v6=0
s=""
for v3 in range(44):
  v3+=1
  v6=key[v3]
  v4=(v6+v4)%256
  key[v3]=key[v4]
  key[v4]=v6
  key3.append(key[(key[v3]+v6)%256])
for i in range(44):
  key2[i]^=key3[i]
for i in key2:
  s+=chr(i)
print s

作者：Kirin_say
链接：https://www.jianshu.com/p/7fdfe26f27a8
來源：简书
简书著作权归作者所有，任何形式的转载都请联系作者获得授权并注明出处。

　　base64解密的：

#include<stdio.h>
#include<string.h>
int findchar(char *str,char c){
for(int i=0;str[i];i++)
  if(str[i]==c)
      return i;
return -1;
}

int main(){
char key[]="ABCDEFGHIJSTUVWKLMNOPQRXYZabcdqrstuvwxefghijklmnopyz0123456789+/";
char str[100];
char ans[100];
int temp[2];
memset(str,0,100);
memset(ans,0,100);
scanf("%s",str);
for(int i=0,j=0;str[i];i+=4,j+=3)
  {temp[0]=findchar(key,str[i]);
   temp[1]=findchar(key,str[i+1]);
   ans[j]=(temp[0]<<2&0xfc)|(temp[1]>>4&0x3);
   if(!str[i+2]||str[i+2]=='=')
            break;
   else{
      temp[0]=findchar(key,str[i+2]);
      ans[j+1]=(temp[1]<<4&0xf0)|(temp[0]>>2&0xf);  
       }
   if(!str[i+3]||str[i+3]=='=')
            break;
    else{
       temp[1]=findchar(key,str[i+3]);
       ans[j+2]=(temp[0]<<6&0xc0)|(temp[1]&0x3f);
         }
    }
puts(ans);
}

作者：Kirin_say
链接：https://www.jianshu.com/p/7fdfe26f27a8
來源：简书
简书著作权归作者所有，任何形式的转载都请联系作者获得授权并注明出处。

　2：misc1

 

  直接修改图片 高度，然后再binwalk 发现有rar 直接解密 发现有个数据包，就分析，里面就发现一串奇怪的文字

直接base64解密就出来了  我也是导出http才找到，在直接分析的时候找不到，有大佬在的  ，希望能给我指点下。

3：misc2

题目都给出crc 所以直接撸，刚刚开始的时候实在太懒，脚本都不想写，所以就猜啊猜 是那个组合那个，所以  浪费一堆时间，

就是这些，然后就直接上脚本，再爆破字典就OK

f1=open("1.txt")
f2=open("2.txt")
f3=open("3.txt")
c1=f1.readlines()
c2=f2.readlines()
c3=f3.readlines()
f4=open("4.txt","a+")
s=""
for line in c1:
	for line1 in c2:
		for line2 in c3:
			line=line.rstrip("\n")
			line1=line1.rstrip("\n")
			line2=line2.rstrip("\n")
			s=line+line1+line2+"\n"
			print s
			f4.write(s)
			s=""


f1.close()
f2.close()
f3.close()

　　爆破密码就出来了，然后就发现一串

001111000110100101101101011001110010000001110011011100100110001100111101001000100110010001100001011101000110000100111010011010010110110101100001011001110110010100101111011100000110111001100111001110110110001001100001011100110110010100110110001101000010110001101001010101100100001001001111010100100111011100110000010010110100011101100111011011110100000101000001010000010100000101001110010100110101010101101000010001010101010101100111010000010100000101000001010100100110011101000001010000010100000101000101010110010100001101000001010010010100000101000001010000010100000101001001001101110100100000110111011000100100000101000001010000010100011001010010001100000110110001000101010100010101011001010010001101000110111001001111001100110110010001010001010110010011010101100010010011100111100001000010010000010101000101010101001010110101000100101011001100010010111101011010010011110101010101000111010010010110011101001000011011000111000101001110001100100110010101110001011101000110111101011001011011000110101001100110010100010110011001110101010001110110100101010001001011110101000001110010001110010010101100101111011000110111011000110100010100000010111100110101001101100011000000111001001011110100000101010000011001110100111101101000010000010101000101000010010010010101010101000110010000010101001101000010010000010101000101000101011001110101001101000101010000100100000101000101011010000101000101010101010000100100100101000101010100000110101000110111001110000100011100111001011001100101100000110001001110010110101001101110011110010100111101011000010001000011010101101111011011100111011000110100001100110100010001101000001101110010111100110111010001110101000001101011010011000100110001101110011011010111011001010011011001010110001101101110011110010110111101101111010001010100000101010011010001100100001001010001010001010110011101010001010001010100001001001001010001010110100001000001010100010100001001001001010101010100011001000001010100110100001001000001010100010100010101100111010100100100111101000001001110010110110101000100010010100110011001110100011100010011100001110111010010000110011000110000001110010101000001001010011101010111100000101111011011000011011101101000010100000110110101000100001110000100010001110010010101000011010101010001010101100100001101010001010010100100001101100111011011110100001101010001010010010100001101000001011010110100001101000001011001110100101001000001011010110100101101000011011001110100101001000001011001110100100101000011010100010100100101011000010000010011010101101011010001000011010101100010010011010100011101010001001011110111010100110101011011110111100101010100001100000011100001101101010001000010111101011001010100000100110000101111010110000111010101010100010100000010111101000101011001000101011101110000010001010110011101001001010000110101000101001001010000110100000101101011010000110101000101101111010010110100000101101011010000110100000101100111010010100100000101100111010010010100001101010001010010100100001101100111011010110100000100101111011010110100100000110001011000010101000001110001011100110011100101010111010001000100101100110100010110000100010001001100011010000110011001011010001100000101011001000011010100010100101001000011011001110110111101000011010100010100100101000011010000010110101101000011010000010110011101001010010000010110101101001011010000110110011101001010010000010110011101001001010000110101000101001001001011110100110101010011010000100011011101001111010100100111100001110101001100110110010001000100001100000111000101100100010100000101010001110110001101100101101001110010010001010110011101010001010001010100001001001001010001010110100001000001010100010100001001001001010101010100011001000001010100110100001001000001010100010100010101100111010100110100010101000010010000010100010101101000010100010110000101000001011001100111100101001000001101110101100001001000010110100110011000110101010010010110001000110010010101000111010100110011010001010101000000111001011101100011100101100101001010110111101000101111011010000100110001111001011100110101001101001010010010010101000101000101010000010101001101000110010000100101000101000101011001110101000101000101010000100100100101000101011010000100000101010001010000100100100101010101010001100100000101010011010000100100001100110100010010000100110101100111001010110111011001100001001100010111100100101111001100100011001001110111011010110011011101010000011000010100101001010100011001100111000101010000011101100011000101000101001011110110001001001001011010010101000101010101010010100100100101000101010000100100000101010011010000100100100101010001010001010100000101010011010001100100001001010001010001010110011101010001010001010100001001001001010001010110100001000001010100110100001001110010011110010110010100110010010010000011001000110110011101110101101001000001010100110011010101100110001110010111101000110101010011010011010100111000011011110100101101111000010010010100010101101000010000010101000101000010010010010101010101000110010000010101001101000010010000010101000101000101011001110101001101000101010000100100000101000101011010000101000101010101010000100100100101000101010000100110011101100100011110010100111101011001011010100111100101001101011010110101100001101110010011100111011101110101011001010111001001000100011010110111011001010001001101100110010101100110011100010100101101110101010101110101101001000101011001110100100101000011010100010100100101000011010000010110101101000011010100010110111101001011010000010110101101000011010000010110011101001010010000010110011101001001010000110101000101001010010000110110011101110011010001000110111101101011011000110101011101010100011001000011011000110011011001010111011001010111010000100111010101111001011001100100100001001001010000100011000001110100011011010110110101101011011101010100011100111001011001000110010101110011010100110100001001000001010100010100010101100111010100110100010101000010010000010100010101101000010100010101010101000010010010010100010101000010010000010101001101000010010010010101000101000101010000010101001101000110010000100011010001001000010010010110011101110101001110000101010001010100010001100011010000101111011001010111101001010111011011110110111000111001011101110111011001101110001110000110011100110011010010010110010101111000001101000100000101001011011110000100100101000101011010000100000101010001010000100100100101010101010001100100000101010011010000100100000101010001010001010110011101010011010001010100001001000001010001010110100001010001010101010100001001001001010001010100010001100111011001000101011101100010011110100110101101010001010011110100000100110111011010110010111101110100011100010110110000110010011101110101100000110011011001010010111101110000011101110011011001001100010100000111001001000101011001110101000101000101010000100100100101000101011010000100000101010001010000100100100101010101010001100100000101010011010000100100000101010001010001010110011101010011010001010100001001000001010001010110100001010001011001010100001100110000010100010011001101011010011110010011000000101011010011000110101101010000010011110011011101110000001110000011010101100001010110000100010001001000001011110011001101001000011110000101101000111001001101010010111101110010001100110111001101101001010010100100001001010001010001010110011101010001010001010100001001001001010001010110100001000001010100010100001001001001010101010100011001000001010100110100001001000001010100010100010101100111010100110100010101000010010010010100100001001100010010010011010001110101010110000011001101001110001100100011010101011010010001100101101000110111001110000101000001010100001110000110010001001101011011010111011000101111010011010101000101101100011101110110110001011001011010110100001101000001011001110100101001000001011010110100101101000011011001110100101001000001011001110100100101000011010100010100100101000011010000010110101101000011010100010110111101001011010000010110101101000011010001000111011101100010011001010010101101010001011011100101001001110111011011010011011101110100001011110011010001100101010101110110011001001010011101000110110101010110010010000100011001110011010011100101000001001001010100110101000101001001010000110100000101101011010000110101000101101111010010110100000101101011010000110100000101100111010010100100000101100111010010010100001101010001010010100100001101100111011100110100010001101100010010000110001001001010010011000110010001101001010110010100111101000100001110010011000000110010001100100100100000101011011110000011011100110011011000110011100101000001001110010110110101010010011110000110011001000010011110000101000101101111010010110100000101101011010000110100000101100111010010100100000101100111010010010100001101010001010010100100001101100111011011110100001101010001010010010100001101000001011010110100001101010000010100100011001101111001010011100011011001011010011101100100101101000110001100010110001101100111010100110011010100110101010001000111010101100011001100110100001001010001001110000100111101010011010110000110011001001101001110000110000100110001010010010110101101000110010000010101001101000010010000010101000101000101011001110101001101000101010000100100000101000101011010000101000101010101010000100100100101000101010000100100000101010011010000100100100101010001010001010110011101100100010011100100000101100100011100110110110001001010011101100100111000111001001100010011011001110000011100100101000001010100001011110101000000110011010101110110111001001010010100100011011101001101010001110110010100110000001101000111100101110100010100110100001001000001010100010100010101100111010100110100010101000010010000010100010101101000010100010101010101000010010010010100010101000010010000010101001101000010010010010101000101000101010000010101001101000110010000100110111101001100001110010100010001001110011100000011100100110010010011000101001001101101001101100011001101100010001100010110011101010000011011100101011000111001001010110111000001010100011011010010111101010011010100000110101000110110011110010110011001001011011010010110011101010001010000100100100101010101010001100100000101010011010000100100000101010001010001010110011101010011010001010100001001000001010001010110100001010001010101010100001001001001010001010100001001000001010100110100001001000011001101110111011001101011010001000011000101011001010011010110101000101011001110010111001100101011010100010110111100110101011011110100110101101100011110000111100101001110010100000101011101101110010010010111010101110011010110010100010101110011011001100100101001111001010100010100100101000011010000010110101101000011010000010110011101001010010000010110101101001011010000110110011101001010010000010110011101001001010000110101000101001001010000110100000101101011010000110010111101010001001101110101101001100111011110010101011101010100011101000101010101101101010101000100110100101011011010010110111001001100001101100101010100111001011001010100111101001100011101100111001101101001010010100100001001010001010001010110011101010001010001010100001001001001010001010110100001000001010100010100001001001001010101010100011001000001010100110100001001000001010100010100010101100111010100110100010101000010010010010100100001010100010100010100100001100010010010100111001001110100010110000011100101101101001100000111100101011000010001000100001100110111001100110110011000110100011101110011011101101011011101110110001101100100010110000011001100111001001101000100101101111000010010010100010101101000010000010101000101000010010010010101010101000110010000010101001101000010010000010101000101000101011001110101001101000101010000100100000101000101011010000101000101010101010000100100100101000101010001000110011101001110010110100100101000101111011001010110110101101010011100010011010101000111001100110110010001111001011101110110101001110100011100000111101001110111001100100111010001000110011110010011100000110100011110100100100101101111010001010100000101010011010001100100001001010001010001010110011101010001010001010100001001001001010001010110100001000001010100010100001001001001010101010100011001000001010100110100001001000001010100010100010101100111010100010111010101101010011110010111100000101011011001010110110101001001001101000111010101011010010011100011000001100011011011000010111101110100001100000011001101110100001101000100101000111001001011110111001001000101001100110010101101111001010001100101000101101011010000110101000101101111010010110100000101101011010000110100000101100111010010100100000101100111010010010100001101010001010010100100001101100111011011110100001101010001010010010100001101000001011010110100001101010000010100100011001101111001010001010011011101100101001010110100100001101100011011100111100101100100011000100101010101001010011000100101000001100001001100110100101000110101011001000111000100101111001011110110110101000101001101110010101101111001010001100101000101101011010000110101000101101111010010110100000101101011010000110100000101100111010010100100000101100111010010010100001101010001010010100100001101100111011011110100001101010001010010010100001101000001011010110100001101010000010100010100010000110010011000010110010001001110010001000110101101101101010110000011011101000100010010010010101101101101010100000111100101010100011011000011010101111000011011010011011101000001001101010101101000101011010010100100111101000101010000100100000101000101011010000101000101010101010000100100100101000101010000100100000101010011010000100100100101010001010001010100000101010011010001100100001001010001010001010110011101010001001010110100100101101011010001000011001001010011010101110101010000110000010010000111011101000101010011110110001001101101010101100110010101001110010010110101001100110111011000100011001101101110011100100011100101100101010010110100001001000001010001010110100001010001010101010100001001001001010001010100001001000001010100110100001001001001010100010100010101000001010100110100011001000010010100010100010101100111010100010100010101000010010010010100010100101011011011110100100001110011011010110110111001001000011011100110111001100011011010110110100000110110011001010100011100111001010010100110011100111001010101100101100001110110010010100110010101000010001011110110101101001111001100100101010100111001011000110100110000110010011101000100011001100111011011110100001101010001010010010100001101000001011010110100001101000001011001110100101001000001011010110100101101000011011001110100101001000001011001110100100101000011010100010100100101000011010000010110101101000011010110000011010100111000010110010101010001101101001100110111011100111001010001110011001001110111011010110010111100111000011100100011100100101111010101000100100100101011010010100110111101010110010000110101000101001010010000110110011101101111010000110101000101001001010000110100000101101011010000110100000101100111010010100100000101101011010010110100001101100111010010100100000101100111010010010100001101010001010010010110111001000001011000010111100101110111010010000011100101101011010100100101100101001011010000010110101101000011010000010110011101001010010000010110011101001001010000110101000101001010010000110110011101101111010000110101000101001001010000110100000101101011010000110100000101100111010010100100000101101011010010110100001101110111010001000011100100110110011011110101000101001111010001010011011000111000001101000100110000110001010100010100000101000001010000010100000101000010010010100101001001010101001101010100010101110010011010110100101001100111011001110110011100111101001111010010001000111110001111000010111101101001011011010110011100111110

　　http://www.5ixuexiwang.com/str/from-binary.php 这个网站可以直接二进制转ascii

然后就简单了  再base64转图片，发现二维码，

扫就出来。

这些比赛有很大的收获，也明白了base64算法和rc4。