官方bilibiliWindows破解入门Android逆向入门
【网络诊断修复工具】切换到窄版

吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步，快速开始

吾爱破解 - 52pojie.cn»网站 › 【 软件安全 】 › 『脱壳破解区』 › 安恒周周练-西湖论剑特别版
1234下一页
返回列表 发新帖
查看: 9125|回复: 31
收起左侧

[CTF] 安恒周周练-西湖论剑特别版

[复制链接]
姚小宝
姚小宝 发表于 2019-3-28 17:12
本帖最后由 yechen123 于 2019-3-28 17:14 编辑


题目虽然简单   但是蛮有意思的
题目.rar (90.71 KB, 下载次数: 24)

Mysterious



从DialogBoxParamA 函数中定位处理函数
[Asm] 纯文本查看 复制代码
int __stdcall sub_401090(HWND hWnd, int a2, int a3, int a4)
{
  char v5; // [esp+50h] [ebp-310h]
  CHAR Text[4]; // [esp+154h] [ebp-20Ch]
  char v7; // [esp+159h] [ebp-207h]
  __int16 v8; // [esp+255h] [ebp-10Bh]
  char v9; // [esp+257h] [ebp-109h]
  int v10; // [esp+258h] [ebp-108h]
  CHAR String; // [esp+25Ch] [ebp-104h]
  char v12; // [esp+25Fh] [ebp-101h]
  char v13; // [esp+260h] [ebp-100h]
  char v14; // [esp+261h] [ebp-FFh]

  memset(&String, 0, 0x104u);
  v10 = 0;
  if ( a2 == 16 )
  {
    DestroyWindow(hWnd);
    PostQuitMessage(0);
  }
  else if ( a2 == 273 )
  {
    if ( a3 == 1000 )
    {
      GetDlgItemTextA(hWnd, 1002, &String, 260);
      strlen(&String);
      if ( strlen(&String) > 6 )
        ExitProcess(0);
      v10 = atoi(&String) + 1;
      if ( v10 == 123 && v12 == 120 && v14 == 122 && v13 == 121 )
      {
        strcpy(Text, "flag");
        memset(&v7, 0, 0xFCu);
        v8 = 0;
        v9 = 0;
        _itoa(v10, &v5, 10);
        strcat(Text, "{");
        strcat(Text, &v5);
        strcat(Text, "_");
        strcat(Text, "Buff3r_0v3rf|0w");
        strcat(Text, "}");
        MessageBoxA(0, Text, "well done", 0);
      }
      SetTimer(hWnd, 1u, 0x3E8u, TimerFunc);
    }
    if ( a3 == 1001 )
      KillTimer(hWnd, 1u);
  }
  return 0;
}



输入的字符不能超过6位  要为6位

[Asm] 纯文本查看 复制代码
if ( v10 == 123 && String[3] == 120 && String[5] == 122 && String[4] == 121 )

可以得知 经过atoi函数转为数字后 +1 要等于123  后边三位是xyz
所以key是122xyz
1.png



findKey


打开软件后发现没有输入窗口
查看函数

[Asm] 纯文本查看 复制代码
ATOM __cdecl sub_4011D0(HINSTANCE hInstance)
{
  WNDCLASSEXA v2; // [esp+4Ch] [ebp-30h]

  v2.cbSize = 48;
  v2.style = 3;
  v2.lpfnWndProc = (WNDPROC)sub_401014;
  v2.cbClsExtra = 0;
  v2.cbWndExtra = 0;
  v2.hInstance = hInstance;
  v2.hIcon = LoadIconA(hInstance, (LPCSTR)0x6B);
  v2.hCursor = LoadCursorA(0, (LPCSTR)0x7F00);
  v2.hbrBackground = (HBRUSH)6;
  v2.lpszMenuName = (LPCSTR)109;
  v2.lpszClassName = ClassName;
  v2.hIconSm = LoadIconA(hInstance, (LPCSTR)0x6C);
  return RegisterClassExA(&v2);
}



发现处理函数sub_401014


在函数中发现调用了 DialogBoxParamA  

[Asm] 纯文本查看 复制代码
.text:00401721 loc_401721:                             ; CODE XREF: .text:00401714↑j
.text:00401721                 mov     esi, esp
.text:00401723                 push    0
.text:00401725                 push    offset sub_40100A
.text:0040172A                 mov     eax, [ebp+8]
.text:0040172D                 push    eax
.text:0040172E                 push    67h
.text:00401730                 mov     ecx, hInstance
.text:00401736                 push    ecx
.text:00401737                 call    ds:DialogBoxParamA
.text:0040173D                 cmp     esi, esp



处理函数是  sub_40100A
[Asm] 纯文本查看 复制代码
int __stdcall sub_401B20(HWND hDlg, int a2, int a3, int a4)
{
  switch ( a2 )
  {
    case 272:
      return 1;
    case 273:
      if ( (unsigned __int16)a3 != 1 && (unsigned __int16)a3 != 2 )
        goto LABEL_6;
      EndDialog(hDlg, (unsigned __int16)a3);
      return 1;
    case 514:
LABEL_6:
      byte_428C54[dword_428C50++] = 49;
      return 0;
    case 517:
      byte_428C54[dword_428C50++] = 51;
      break;
    case 520:
      if ( dword_428D58 < 3 )
        ++dword_428D5C;
      byte_428C54[dword_428C50++] = 50;
      break;
    default:
      return 0;
  }
  return 0;
}

可以看到是通过特定的消息  让缓冲区赋值 1 2 3


再看
[Asm] 纯文本查看 复制代码
.text:004018CB loc_4018CB:                             ; CODE XREF: .text:004018B8↑j
.text:004018CB                 push    offset byte_428C54 ; 1
.text:004018D0                 call    _strlen
.text:004018D5                 add     esp, 4
.text:004018D8                 test    eax, eax
.text:004018DA                 jbe     loc_401A80
.text:004018E0                 push    100h
.text:004018E5                 push    0
.text:004018E7                 lea     edx, [ebp-1ECh]
.text:004018ED                 push    edx
.text:004018EE                 call    _memset         ; 初始化
.text:004018F3                 add     esp, 0Ch        ; 0x100
.text:004018F6                 push    offset byte_428C54
.text:004018FB                 call    _strlen
.text:00401900                 add     esp, 4
.text:00401903                 push    eax
.text:00401904                 push    offset byte_428C54
.text:00401909                 lea     eax, [ebp-1ECh]
.text:0040190F                 push    eax
.text:00401910                 call    _memcpy
.text:00401915                 add     esp, 0Ch
.text:00401918                 push    offset byte_428C54
.text:0040191D
.text:0040191D loc_40191D:                             ; CODE XREF: .text:0040193D↓j
.text:0040191D                 push    offset byte_428C54
.text:00401922                 call    _strlen
.text:00401927                 add     esp, 4
.text:0040192A                 push    eax
.text:0040192B                 push    offset byte_428C54
.text:00401930                 call    j_md5_en        ; 加密后再放到c54
.text:00401935                 add     esp, 0Ch
.text:00401938                 nop
.text:00401939                 jz      short loc_401948
.text:0040193B                 jnz     short loc_401948
.text:0040193D                 jmp     short near ptr loc_40191D+2
.text:0040193F ; ---------------------------------------------------------------------------
.text:0040193F                 push    eax
.text:00401940                 mov     eax, ds:MessageBoxA
.text:00401945                 call    eax ; MessageBoxA
.text:00401947                 pop     eax
.text:00401948
.text:00401948 loc_401948:                             ; CODE XREF: .text:00401939↑j
.text:00401948                                         ; .text:0040193B↑j
.text:00401948                 nop
.text:00401949                 mov     ecx, 8
.text:0040194E                 mov     esi, offset a0kkD1a55k222k2 ; "0kk`d1a`55k222k2a776jbfgd`06cjjb"
.text:00401953                 lea     edi, [ebp-2ECh] ;
.text:00401959                 rep movsd
.text:0040195B                 movsb
.text:0040195C                 mov     ecx, 37h        ; 55
.text:00401961                 xor     eax, eax
.text:00401963                 lea     edi, [ebp-2CBh] ; 2cb清0
.text:00401969                 rep stosd
.text:0040196B                 stosw
.text:0040196D                 stosb
.text:0040196E                 mov     cx, ds:word_423048 ; 0x5353
.text:00401975                 mov     [ebp-2F8h], cx
.text:0040197C                 mov     dl, ds:byte_42304A ; 0
.text:00401982                 mov     [ebp-2F6h], dl
.text:00401988                 xor     eax, eax
.text:0040198A                 mov     [ebp-2F5h], eax ; 0
.text:00401990                 mov     [ebp-2F1h], ax
.text:00401997                 mov     [ebp-2EFh], al
.text:0040199D                 lea     ecx, [ebp-2ECh]
.text:004019A3                 push    ecx
.text:004019A4                 call    _strlen
.text:004019A9                 add     esp, 4
.text:004019AC                 push    eax             ; len
.text:004019AD                 lea     edx, [ebp-2ECh]
.text:004019B3                 push    edx
.text:004019B4                 lea     eax, [ebp-2F8h]
.text:004019BA                 push    eax
.text:004019BB                 call    sub_401005      ; 异或
.text:004019C0                 add     esp, 0Ch
.text:004019C3                 lea     ecx, [ebp-2ECh]
.text:004019C9                 push    ecx
.text:004019CA                 push    offset byte_428C54
.text:004019CF                 call    __strcmpi
.text:004019D4                 add     esp, 8
.text:004019D7                 test    eax, eax
.text:004019D9                 jnz     short loc_401A37
.text:004019DB                 push    32h
.text:004019DD                 push    offset unk_423030
.text:004019E2                 lea     edx, [ebp-3F8h]
.text:004019E8                 push    edx
.text:004019E9                 call    _memcpy
.text:004019EE                 add     esp, 0Ch
.text:004019F1                 lea     eax, [ebp-3F8h]
.text:004019F7                 push    eax
.text:004019F8                 call    _strlen
.text:004019FD                 add     esp, 4
.text:00401A00                 push    eax
.text:00401A01                 lea     ecx, [ebp-3F8h]
.text:00401A07                 push    ecx
.text:00401A08                 lea     edx, [ebp-1ECh]
.text:00401A0E                 push    edx
.text:00401A0F                 call    sub_401005      ; 异或
.text:00401A14                 add     esp, 0Ch
.text:00401A17                 mov     esi, esp
.text:00401A19                 push    32h
.text:00401A1B                 push    0
.text:00401A1D                 lea     eax, [ebp-3F8h]
.text:00401A23                 push    eax
.text:00401A24                 mov     ecx, [ebp+8]
.text:00401A27                 push    ecx
.text:00401A28                 call    ds:MessageBoxA
.text:00401A2E                 cmp     esi, esp
.text:00401A30                 call    __chkesp
.text:00401A35                 jmp     short loc_401A80

发现会调用缓冲区的数据 判断是不是6位
在传入一个函数
[Asm] 纯文本查看 复制代码
int __cdecl md5_en(BYTE *pbData, DWORD dwDataLen, LPSTR lpString1)
{
  int result; // eax
  DWORD i; // [esp+4Ch] [ebp-24h]
  CHAR String2; // [esp+50h] [ebp-20h]
  BYTE v6[16]; // [esp+54h] [ebp-1Ch]
  DWORD pdwDataLen; // [esp+64h] [ebp-Ch]
  HCRYPTHASH phHash; // [esp+68h] [ebp-8h]
  HCRYPTPROV phProv; // [esp+6Ch] [ebp-4h]

  if ( !CryptAcquireContextA(&phProv, 0, 0, 1u, 0xF0000000) )
    return 0;
  if ( CryptCreateHash(phProv, 0x8003u, 0, 0, &phHash) )
  {
    if ( CryptHashData(phHash, pbData, dwDataLen, 0) )
    {
      CryptGetHashParam(phHash, 2u, v6, &pdwDataLen, 0);
      *lpString1 = 0;
      for ( i = 0; i < pdwDataLen; ++i )
      {
        wsprintfA(&String2, "%02X", v6[i]);
        lstrcatA(lpString1, &String2);
      }
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      result = 1;
    }
    else
    {
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      result = 0;
    }
  }
  else
  {
    CryptReleaseContext(phProv, 0);
    result = 0;
  }
  return result;
}

查文档 发现它应该是windows提供的一个加密库
看CryptCreateHash 的参数应该是MD5加密

后边的代码
[Asm] 纯文本查看 复制代码
.text:00401949                 mov     ecx, 8
.text:0040194E                 mov     esi, offset a0kkD1a55k222k2 ; "0kk`d1a`55k222k2a776jbfgd`06cjjb"
.text:00401953                 lea     edi, [ebp-2ECh]
.text:00401959                 rep movsd
.text:0040195B                 movsb
.text:0040195C                 mov     ecx, 37h        ; 55
.text:00401961                 xor     eax, eax
.text:00401963                 lea     edi, [ebp-2CBh] ; 2cb清0
.text:00401969                 rep stosd
.text:0040196B                 stosw
.text:0040196D                 stosb
.text:0040196E                 mov     cx, ds:word_423048 ; 0x5353
.text:00401975                 mov     [ebp-2F8h], cx
.text:0040197C                 mov     dl, ds:byte_42304A ; 0
.text:00401982                 mov     [ebp-2F6h], dl
.text:00401988                 xor     eax, eax
.text:0040198A                 mov     [ebp-2F5h], eax ; 0
.text:00401990                 mov     [ebp-2F1h], ax
.text:00401997                 mov     [ebp-2EFh], al
.text:0040199D                 lea     ecx, [ebp-2ECh]
.text:004019A3                 push    ecx
.text:004019A4                 call    _strlen
.text:004019A9                 add     esp, 4
.text:004019AC                 push    eax             ; len
.text:004019AD                 lea     edx, [ebp-2ECh]
.text:004019B3                 push    edx
.text:004019B4                 lea     eax, [ebp-2F8h]
.text:004019BA                 push    eax
.text:004019BB                 call    sub_401005      ; 异或

程序中的一串字符  会传入sub_401005 这个函数 和字符"SS"异或
得到一串md5  c8837b23ff8aaa8a2dde915473ce0991

解密之后是123321

此时 可以下断点  修改程序逻辑 让程序运行到上边的函数  然后byte_428C54这个缓冲区里边的数据改成123321  就可以弹出flag了
2.png
本来以为是错误的  没想到提交对了。。


CrackRTF

[Asm] 纯文本查看 复制代码
int main_0()
{
  DWORD password_len; // eax
  DWORD v1; // eax
  CHAR String; // [esp+4Ch] [ebp-310h]
  int v4; // [esp+150h] [ebp-20Ch]
  CHAR String1; // [esp+154h] [ebp-208h]
  BYTE password; // [esp+258h] [ebp-104h]

  memset(&password, 0, 0x104u);
  memset(&String1, 0, 0x104u);
  v4 = 0;
  printf("pls input the first passwd(1): ");
  scanf("%s", &password);
  if ( strlen((const char *)&password) != 6 )
  {
    printf("Must be 6 characters!\n");
    ExitProcess(0);
  }
  v4 = atoi((const char *)&password);
  if ( v4 < 100000 )                            // 大于100000
    ExitProcess(0);
  strcat((char *)&password, "@DBApp");
  password_len = strlen((const char *)&password);
  sub_40100A(&password, password_len, &String1);
  if ( !_strcmpi(&String1, "6E32D0943418C2C33385BC35A1470250DD8923A9") )// shal加密
  {
    printf("continue...\n\n");
    printf("pls input the first passwd(2): ");
    memset(&String, 0, 0x104u);
    scanf("%s", &String);
    if ( strlen(&String) != 6 )
    {
      printf("Must be 6 characters!\n");
      ExitProcess(0);
    }
    strcat(&String, (const char *)&password);
    memset(&String1, 0, 0x104u);
    v1 = strlen(&String);
    sub_401019((BYTE *)&String, v1, &String1);
    if ( !_strcmpi("27019e688a4e62a649fd99cadaafdb4e", &String1) )// md5加密
    {
      if ( !sub_40100F(&String) )
      {
        printf("Error!!\n");
        ExitProcess(0);
      }
      printf("bye ~~\n");
    }
  }
  return 0;
}


先输入第一个密码 必须是6数字 并且要大于100000
在后边加字符串"@DBApp"后再传入 sub_40100A 加密
[Asm] 纯文本查看 复制代码
int __cdecl sub_401230(BYTE *pbData, DWORD dwDataLen, LPSTR lpString1)
{
  int result; // eax
  DWORD i; // [esp+4Ch] [ebp-28h]
  CHAR String2; // [esp+50h] [ebp-24h]
  char v6[20]; // [esp+54h] [ebp-20h]
  DWORD pdwDataLen; // [esp+68h] [ebp-Ch]
  HCRYPTHASH phHash; // [esp+6Ch] [ebp-8h]
  HCRYPTPROV phProv; // [esp+70h] [ebp-4h]

  if ( !CryptAcquireContextA(&phProv, 0, 0, 1u, 0xF0000000) )
    return 0;
  if ( CryptCreateHash(phProv, 0x8004u, 0, 0, &phHash) )
  {
    if ( CryptHashData(phHash, pbData, dwDataLen, 0) )
    {
      CryptGetHashParam(phHash, 2u, (BYTE *)v6, &pdwDataLen, 0);
      *lpString1 = 0;
      for ( i = 0; i < pdwDataLen; ++i )
      {
        wsprintfA(&String2, "%02X", (unsigned __int8)v6[i]);
        lstrcatA(lpString1, &String2);
      }
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      result = 1;
    }
    else
    {
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      result = 0;
    }
  }
  else
  {
    CryptReleaseContext(phProv, 0);
    result = 0;
  }
  return result;
}


应该是shal加密

直接写脚本爆破
[Asm] 纯文本查看 复制代码
import hashlib

flag2 = "@DBApp"

for i in range(100000,999999):
        h2 = hashlib.sha1(str(i)+flag2)
        flags = h2.hexdigest()
        if "6e32d0943418c2c" in flags:
                print (str(i)+flag2)
                print flags

得到123321@DBApp

然后在输入第二个密码  但是没有限制这个密码的范围
在第二个密码后边加上123321@DBApp后经过md5加密
传入sub_40100F 函数    6位不确定范围字符爆破太久  

可以看看 sub_40100F这个函数
[Asm] 纯文本查看 复制代码
char __cdecl sub_4014D0(LPCSTR lpString)
{
  LPCVOID lpBuffer; // [esp+50h] [ebp-1Ch]
  DWORD NumberOfBytesWritten; // [esp+58h] [ebp-14h]
  DWORD nNumberOfBytesToWrite; // [esp+5Ch] [ebp-10h]
  HGLOBAL hResData; // [esp+60h] [ebp-Ch]
  HRSRC hResInfo; // [esp+64h] [ebp-8h]
  HANDLE hFile; // [esp+68h] [ebp-4h]

  hFile = 0;
  hResData = 0;
  nNumberOfBytesToWrite = 0;
  NumberOfBytesWritten = 0;
  hResInfo = FindResourceA(0, (LPCSTR)0x65, "AAA");
  if ( !hResInfo )
    return 0;
  nNumberOfBytesToWrite = SizeofResource(0, hResInfo);
  hResData = LoadResource(0, hResInfo);
  if ( !hResData )
    return 0;
  lpBuffer = LockResource(hResData);
  sub_401005(lpString, (int)lpBuffer, nNumberOfBytesToWrite);
  hFile = CreateFileA("dbapp.rtf", 0x10000000u, 0, 0, 2u, 0x80u, 0);
  if ( hFile == (HANDLE)-1 )
    return 0;
  if ( !WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, &NumberOfBytesWritten, 0) )
    return 0;
  CloseHandle(hFile);
  return 1;
}

里边查找名为“AAA”的资源
取出数值 并跟 输入的密码2+输入的密码1+“@DBApp” 异或

并生成.rtf文件  最终的flag应该就在.rtf文件里边
用ResourceHacer 软件查看资源
3.png
取出里边的数据 虽然猜一个6位的密码2异或试试
[Asm] 纯文本查看 复制代码
i = [0x05,0x7D,0x41,0x15,0x26,0x01,0x6D,0x53,0x5D,0x40,0x5B,0x6D,0x21,0x2A,0x31,0x28,0x13,0x00,0x19,0x18,0x00,0x57,0x1C,0x54,0x54,0x54,0x55,0x03,0x6E,0x55,0x25,0x22,
0x2E,0x20,0x1E,0x17,0x4F,0x11,0x00,0x52,0x1C,0x54,0x54,0x54,0x5F,0x52,0x5C,0x56,0x26,0x21,0x70,0x71,0x45,0x42,0x05,0x7D,0x55,0x0E,0x2E,0x44,0x45,0x50,0x5F,0x48,
0x6E,0x57,0x70,0x18,0x24,0x2C,0x1F,0x14,0x1B,0x53,0x5D,0x3D,0x26,0x40,0x43,0x43,0x05,0x6F,0x54,0x52,0x28,0x25,0x30,0x32,0x15,0x04,0x4F,0x12,0x07,0x41,0x1C,0x17,
0x52,0x50,0x6F,0x14,0x51,0x54,0x1C,0x63,0x21,0x22,0x2C,0x57,0x1B,0x14,0x08,0x1C,0x3D,0x3D,0x3B,0x49,0x6F,0x19,0x6E,0x56,0x25,0x2A,0x27,0x33,0x11,0x04,0x11,0x53,
0x13,0x2C,0x33,0x56,0x45,0x57,0x57,0x5A,0x46,0x11,0x75,0x6A,0x76,0x70,0x5E,0x41,0x4B,0x0F,0x02,0x54,0x71,0x05,0x0A,0x4F,0x6F,0x45,0x5B,0x54,0x37,0x2F,0x2B,0x2F,
0x14,0x44,0x22,0x54,0x50,0x50,0x1C,0x40,0x50,0x40,0x57,0x6F,0x5E,0x50,0x2E,0x23,0x70,0x71,0x45,0x42,0x22,0x47,0x03,0x3D,0x26,0x43,0x03,0x02,0x13,0x75,0x5E,0x50,
0x27,0x18,0x39,0x0F,0x40,0x2F,0x33,0x11,0x41,0x04,0x1F,0x76,0x43,0x57,0x56,0x6C,0x70,0x44,0x27,0x37,0x1E,0x3C,0x2C,0x00,0x1F,0x53,0x3E,0x6B,0x3D,0x3D,0x3B,0x32]

flag = "123321123321@DBApp"
cout = len(flag)
for q in range(len(i)):
        i[q] ^= ord(flag[q%cout])
flags= ""
for q in i:
        flags += chr(q)
print i
print flags

4.png
有flag了 但是不完整

此时 可以从本地中搜索.rtf的文件 查看格式
5.png
前面6位的格式应该是{\rtf1
逆推的到密码2  ~!3a@0

再异或
[Asm] 纯文本查看 复制代码
i = [0x05,0x7D,0x41,0x15,0x26,0x01,0x6D,0x53,0x5D,0x40,0x5B,0x6D,0x21,0x2A,0x31,0x28,0x13,0x00,0x19,0x18,0x00,0x57,0x1C,0x54,0x54,0x54,0x55,0x03,0x6E,0x55,0x25,0x22,
0x2E,0x20,0x1E,0x17,0x4F,0x11,0x00,0x52,0x1C,0x54,0x54,0x54,0x5F,0x52,0x5C,0x56,0x26,0x21,0x70,0x71,0x45,0x42,0x05,0x7D,0x55,0x0E,0x2E,0x44,0x45,0x50,0x5F,0x48,
0x6E,0x57,0x70,0x18,0x24,0x2C,0x1F,0x14,0x1B,0x53,0x5D,0x3D,0x26,0x40,0x43,0x43,0x05,0x6F,0x54,0x52,0x28,0x25,0x30,0x32,0x15,0x04,0x4F,0x12,0x07,0x41,0x1C,0x17,
0x52,0x50,0x6F,0x14,0x51,0x54,0x1C,0x63,0x21,0x22,0x2C,0x57,0x1B,0x14,0x08,0x1C,0x3D,0x3D,0x3B,0x49,0x6F,0x19,0x6E,0x56,0x25,0x2A,0x27,0x33,0x11,0x04,0x11,0x53,
0x13,0x2C,0x33,0x56,0x45,0x57,0x57,0x5A,0x46,0x11,0x75,0x6A,0x76,0x70,0x5E,0x41,0x4B,0x0F,0x02,0x54,0x71,0x05,0x0A,0x4F,0x6F,0x45,0x5B,0x54,0x37,0x2F,0x2B,0x2F,
0x14,0x44,0x22,0x54,0x50,0x50,0x1C,0x40,0x50,0x40,0x57,0x6F,0x5E,0x50,0x2E,0x23,0x70,0x71,0x45,0x42,0x22,0x47,0x03,0x3D,0x26,0x43,0x03,0x02,0x13,0x75,0x5E,0x50,
0x27,0x18,0x39,0x0F,0x40,0x2F,0x33,0x11,0x41,0x04,0x1F,0x76,0x43,0x57,0x56,0x6C,0x70,0x44,0x27,0x37,0x1E,0x3C,0x2C,0x00,0x1F,0x53,0x3E,0x6B,0x3D,0x3D,0x3B,0x32]

flag = "~!3a@0123321@DBApp"
cout = len(flag)
for q in range(len(i)):
        i[q] ^= ord(flag[q%cout])
flags= ""
for q in i:
        flags += chr(q)
print i
print flags

得到flag
6.png

免费评分

参与人数 12威望 +1 吾爱币 +17 热心值 +12 收起 理由
qdam + 1 + 1 用心讨论，共获提升！
Hotspur + 1 + 1 谢谢@Thanks！
Hmily + 1 + 7 + 1 感谢发布原创作品，吾爱破解论坛因你更精彩！
Akesudia + 1 + 1 用心讨论，共获提升！
SpongeB0B + 1 + 1 我很赞同！
lihaohua + 1 + 1 我很赞同！
sunnylds7 + 1 + 1 热心回复！
神奇king + 1 + 1 我很赞同！
笙若 + 1 + 1 谢谢@Thanks！
青春的岁月如歌 + 1 我很赞同！
林晓初 + 1 + 1 我很赞同！
韩喻V + 1 + 1 我很赞同！

查看全部评分

发帖前要善用【论坛搜索】功能，那里可能会有你要找的答案或者已经有人发布过相同内容了，请勿重复发帖。
回复

举报

姚小宝
 楼主| 姚小宝 发表于 2019-4-3 16:43
qdam 发表于 2019-4-3 16:07
请问如何快速判断一个加密函数是常用的加密方式呢，例如md5，sha

作者自己写的加密源码就看特征值或者加密方式。帖子中的题目调用加密库的话就看参数的值，不同的参数代表不同的加密。
【吾爱破解论坛总版规】 - [让你充分了解吾爱破解论坛行为规则]
回复 支持

举报

姚小宝
 楼主| 姚小宝 发表于 2019-4-1 22:50
吾爱破解论坛没有任何官方QQ群，禁止留联系方式，禁止任何商业交易。
qdam 发表于 2019-4-1 22:32
请问为什么要从DialogBoxParamA 函数中定位处理函数，是就这个程序单独而言还是说所有带有消息窗口程序都是 ...

针对DialogBoxParamA这个api，可以看看这个api的定义
如何升级？如何获得积分？积分对应解释说明！
回复 支持

举报

韩喻V
韩喻V 发表于 2019-3-28 17:52
《站点帮助文档》有什么问题来这里看看吧，这里有你想知道的内容！
提前点赞666
呼吁大家发布原创作品添加吾爱破解论坛标识！
回复 支持

举报

bdpqnumw
bdpqnumw 发表于 2019-3-28 21:01
感谢分享，支持一下。
如何快速判断一个文件是否为病毒！
回复 支持

举报

萌牛工厂
萌牛工厂 发表于 2019-3-28 21:15
谢谢分享 学习学习
回复 支持

举报

ri5e
ri5e 发表于 2019-3-28 21:49
tql 谢谢分享
回复 支持

举报

17679286631
17679286631 发表于 2019-3-28 22:08
感谢分享0
回复 支持

举报

夜步城
夜步城 发表于 2019-3-28 22:29
来学习一下
回复 支持

举报

rememory
rememory 发表于 2019-3-28 23:13
打卡，滴滴
回复 支持

举报

ts0001
ts0001 发表于 2019-3-29 05:51
学习了、谢谢楼主发帖分享
回复 支持

举报

hcoolman33
hcoolman33 发表于 2019-3-29 08:07
谢谢LZ分享。
回复 支持

举报

下一页 »
1234下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-11-16 16:42

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表