一道CTF的逆运算

小朋友呢

已经逆出来了算法和验证key，但是算法逆运算过程，实在是太难没有搞出来，来求助下大佬们

[C++] 纯文本查看 复制代码

#include "stdafx.h"
#include <string.h>
#include <stdlib.h>
#include <Windows.h>

char key[0x30] = {
        0x16, 0xB6, 0xEC, 0x52, 0xA1, 0x5D, 0x9C, 0xA6, 0x0C, 0x44, 0x8C, 0xE5, 0xE1, 0xA5, 0x02, 0x50,
        0x00, 0xBB, 0x74, 0x4B, 0x40, 0x70, 0x22, 0x35, 0x96, 0xA3, 0x0B, 0x2A, 0xF1, 0x6A, 0xC4, 0x1E,
        0xA6, 0xED, 0xDD, 0xE8, 0x3C, 0x01, 0x71, 0x4F, 0x9C, 0xFE, 0x62, 0x66, 0x7F, 0xB1, 0x29, 0x95
};

int input_flag()
{

        void* Dst = (void*)calloc(0x30, 1);
        int* Buf1 = (int*)calloc(0x30, 1);

        printf("please input string:");
        scanf("%s", &Dst);

        for (int i = 0; i < 6; ++i)
        {
                int o1 = *((int*)&Dst + i * 2);
                int o2 = *((int*)&Dst + i * 2 + 1);

                for (int j = 0; j < 64; ++j)
                {
                        
                        if (o2 >= 0)
                        {
                                _asm{
                                        mov cl, 0x1
                                                mov eax, [o1]
                                                mov edx, [o2]
                                                shld edx, eax, cl
                                                shl eax, cl
                                                mov[o1], eax
                                                mov[o2], edx
                                }

                        }
                        else{
                                _asm{
                                        mov cl, 0x1
                                                mov eax, [o1]
                                                mov edx, [o2]
                                                shld edx, eax, cl
                                                shl eax, cl
                                                mov[o1], eax
                                                mov[o2], edx
                                }
                                o1 = o1 ^ 0xEEFF0102;
                                o2 = o2 ^ 0xAABBCCDD;
                        }
                }
                Buf1[i * 2] = o1;
                Buf1[i * 2 + 1] = o2;

        }

        if (!memcmp(&Buf1, key,0x30u))
                puts("great~");
        else
                puts("wrong");
        
}



int _tmain(int argc, _TCHAR* argv[])
{
        input_flag();
        
        system("pause");
        return 0;
}

dongfang155

俩字：爆破
想逆  洗洗睡吧