2017湖湘杯复赛writeup
RE100 Re4newer
查壳发现有 UPX,脱掉之后 IDA 分析定位主函数进行逆向,sub_401080
。
- *(_OWORD *)v4 = xmmword_41D740;
- *(_OWORD *)&v4[4] = xmmword_41D730;
- *(_OWORD *)&v4[8] = xmmword_41D7A0;
- *(_OWORD *)&v4[12] = xmmword_41D760;
- v5 = xmmword_41D7D0;
- v6 = xmmword_41D750;
- v7 = xmmword_41D790;
- v8 = xmmword_41D780;
- v9 = xmmword_41D7C0;
- v10 = xmmword_41D7B0;
- v11 = xmmword_41D770;
- if ( a1 == 44 )
- {
- i = 0;
- do
- {
- if ( (a2[i] ^ 0x22) != v4[i] )
- break;
- ++i;
- }
- while ( i < 44 );
- if ( i == 44 )
- printf_1("success!\n", a3);
- else
- printf_1("wrong~\n", a3);
- }
还是异或,抠出来异或一次好了。