buu-[FlareOn4]IgniteMe

32位无壳

程序还是那么个程序，输错flag直接退出

string看不懂，异或吧）

看main

void __noreturn start()
{
  DWORD NumberOfBytesWritten; // [esp+0h] [ebp-4h]

  NumberOfBytesWritten = 0;
  hFile = GetStdHandle(0xFFFFFFF6);
  dword_403074 = GetStdHandle(0xFFFFFFF5);
  WriteFile(dword_403074, aG1v3M3T3hFl4g, 0x13u, &NumberOfBytesWritten, 0);
  sub_4010F0(NumberOfBytesWritten);
  if ( sub_401050() )
    WriteFile(dword_403074, aG00dJ0b, 0xAu, &NumberOfBytesWritten, 0);
  else
    WriteFile(dword_403074, aN0tT00H0tRWe7r, 0x24u, &NumberOfBytesWritten, 0);
  ExitProcess(0);
}

进入if函数

signed int sub_401050()
{
  int v0; // ST04_4
  int i; // [esp+4h] [ebp-8h]
  unsigned int j; // [esp+4h] [ebp-8h]
  char v4; // [esp+Bh] [ebp-1h]

  v0 = sub_401020((int)byte_403078);
  v4 = sub_401000();
  for ( i = v0 - 1; i >= 0; --i )
  {
    byte_403180[i] = v4 ^ byte_403078[i];
    v4 = byte_403078[i];
  }
  for ( j = 0; j < 0x27; ++j )
  {
    if ( byte_403180[j] != (unsigned __int8)byte_403000[j] )
      return 0;
  }
  return 1;
}

v4经过动态调试后得到为定值4
异或后结果要等于byte_403000

脚本安排上

byte_403000 = [0x0D,0x26,0x49,0x45,0x2A,0x17,0x78,0x44,0x2B,0x6C,0x5D,0x5E,0x45,0x12,0x2F,0x17,
0x2B,0x44,0x6F,0x6E,0x56,0x09,0x5F,0x45,0x47,0x73,0x26,0x0A,0x0D,0x13,0x17,0x48,
0x42,0x01,0x40,0x4D,0x0C,0x02,0x69]

byte_403180 = []
flag=[]
v4 = 4
for i in range(len(byte_403000)-1,-1,-1):
    byte_403180.append(byte_403000[i] ^ v4)
    v4 = byte_403180[-1]

for x in byte_403180[::-1]:
     flag.append(chr(x))
flag=''.join(flag)
print(flag)

flag{R_y0u_H0t_3n0ugH_t0_1gn1t3@flare-on.com}