BUUOJ reverse SimpleRev (blasting)

SimpleRev

SimpleRev (flag needs to submit plus flag {}) Note: Please obtained packet flag filed on flag {}

Drag ida find the key function:

unsigned __int64 Decry()
{
  char v1; // [rsp+Fh] [rbp-51h]
  int v2; // [rsp+10h] [rbp-50h]
  int v3; // [rsp+14h] [rbp-4Ch]
  int i; // [rsp+18h] [rbp-48h]
  int v5; // [rsp+1Ch] [rbp-44h]
  __int64 v6; // [rsp+20h] [rbp-40h]
  __int64 v7; // [rsp+28h] [rbp-38h]
  int v8; // [rsp+30h] [rbp-30h]
  __int64 v9; // [rsp+40h] [rbp-20h]
  __int64 v10; // [rsp+48h] [rbp-18h]
  int v11; // [rsp+50h] [rbp-10h]
  unsigned __int64 v12; // [rsp+58h] [rbp-8h]

  v12 = __readfsqword(0x28u);
  v6 = 'SLCDN';
  v7 = 0LL;
  v8 = 0;
  v9 = 'wodah';
  v10 = 0LL;
  v11 = 0;
  text = join(key3, (const char *)&v9);         
  strcpy(key, key1);
  strcat(key, (const char *)&v6);               
  v2 = 0;
  v3 = 0;
  getchar();
  v5 = strlen(key);
  for ( i = 0; i < v5; ++i )
  {
    if ( key[v3 % v5] > 64 && key[v3 % v5] <= 90 )
      key[i] = key[v3 % v5] + 32;
    ++v3;
  }
  printf("Please input your flag:", &v6);
  while ( 1 )
  {
    v1 = getchar();
    if ( v1 == 10 )
      break;
    if ( v1 == 32 )
    {
      ++v2;
    }
    else
    {
      if ( v1 <= 96 || v1 > 122 )
      {
        if ( v1 > 64 && v1 <= 90 )
          str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;
      }
      else
      {
        str2[v2] = (v1 - 39 - key[v3++ % v5] + 97) % 26 + 97;
      }
      if ( !(v3 % v5) )
        putchar(32);
      ++v2;
    }
  }
  if ( !strcmp(text, str2) )
    puts("Congratulation!\n");
  else
    puts("Try again!\n");
  return __readfsqword(0x28u) ^ v12;
}

It can be seen that a start is splicing two functions, two text strings and key configured to note here that, because it is a long list of numbers stored in little-endian, when so required by the operation sequence of characters in turn, so here is the key "ADSFKNDCLS", text is "killshadow".

And then to write the script, here mainly to learn how to write the next blast:

key="ADSFKNDCLS"
text="killshadow"
s=""
flag=""
loop="ABCDEFGHIJKLMNOPQRSTUVWXYZ"

v2 = 0
v3 = 0
v5 = len(key)
for i in range(0,v5):
    if ( ord(key[i]) > 64 and ord(key[i]) <= 90 ):
        s += chr(ord(key[i]) + 32)
    else:
        s +=key[i]
print(s)

for i in range(0,len(text)):
    for j in loop:
        if ord(text[i])==(ord(j)-39-ord(s[i])+97)%26+97:
            flag+=j

print(flag)