先脱壳
upx -d /home/qinyuanxin132/Downloads/chall8 -o /home/qinyuanxin132/Downloads/chall8a
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2026
UPX 5.2.0 Markus Oberhumer, Laszlo Molnar & John Reiser Jun 8th 2026
File size Ratio Format Name
-------------------- ------ ----------- -----------
14544 <- 6940 47.72% linux/amd64 chall8a
Unpacked 1 file.然后寻找主函数
__int64 __fastcall main(int a1, char **a2, char **a3)
{
size_t v4; // rax
char v5[40]; // [rsp+0h] [rbp-130h] BYREF
size_t n; // [rsp+28h] [rbp-108h] BYREF
char s2[128]; // [rsp+30h] [rbp-100h] BYREF
char s[128]; // [rsp+B0h] [rbp-80h] BYREF
n = 0;
strcpy(v5, "Fnrr68qUFDSTA5tupNAp8pgrFPJNesF3R6KNk");
printf("Input flag: ");
if ( fgets(s, 128, stdin) )
{
s[strcspn(s, "\n")] = 0;
if ( (unsigned int)sub_401216(v5, s2, 128, &n) )
{
puts("Internal error!");
return 0;
}
else
{
v4 = strlen(s);
if ( v4 == n && !memcmp(s, s2, n) )
puts("Correct!");
else
puts("Wrong!");
return 0;
}
}
else
{
puts("Wrong!");
return 0;
}
}v5 可能是要加密的密文
我们直接看
sub_401216
把v5传给了a1
s2给了a2
__int64 __fastcall sub_401216(const char *a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4)
{
__int64 v5; // rax
__int64 v6; // rax
_BYTE s[140]; // [rsp+20h] [rbp-E0h] BYREF
int v10; // [rsp+ACh] [rbp-54h]
char *v11; // [rsp+B0h] [rbp-50h]
unsigned __int64 v12; // [rsp+B8h] [rbp-48h]
size_t v13; // [rsp+C0h] [rbp-40h]
unsigned __int64 ii; // [rsp+C8h] [rbp-38h]
unsigned __int64 n; // [rsp+D0h] [rbp-30h]
__int64 v16; // [rsp+D8h] [rbp-28h]
unsigned __int64 m; // [rsp+E0h] [rbp-20h]
int k; // [rsp+E8h] [rbp-18h]
int v19; // [rsp+ECh] [rbp-14h]
size_t j; // [rsp+F0h] [rbp-10h]
unsigned __int64 i; // [rsp+F8h] [rbp-8h]
memset(s, 0, 0x80u);
v13 = strlen(a1);
for ( i = 0; a1[i] == 49; ++i )
;
for ( j = 0; j < v13; ++j )
{
v11 = strchr("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz", a1[j]);
if ( !v11 )
return 0xFFFFFFFFLL;
v19 = v11 - "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
for ( k = 127; k >= 0; --k )
{
v10 = 58 * (unsigned __int8)s[k] + v19;
s[k] = v10;
v19 = v10 >> 8;
}
if ( v19 )
return 0xFFFFFFFFLL;
}
for ( m = 0; m <= 0x7F && !s[m]; ++m )
;
v12 = i - m + 128;
if ( a3 < v12 )
return 0xFFFFFFFFLL;
v16 = 0;
for ( n = 0; n < i; ++n )
{
v5 = v16++;
*(_BYTE *)(a2 + v5) = 0;
}
for ( ii = m; ii <= 0x7F; ++ii )
{
v6 = v16++;
*(_BYTE *)(v6 + a2) = s[ii];
}
*a4 = v12;
return 0;
}看着像base58
尝试解码
Fnrr68qUFDSTA5tupNAp8pgrFPJNesF3R6KNk
moectf{EaSy_UPX_anD_Base58}
评论交流
欢迎留下你的想法