[RoarCTF2019]polyre WP

先用deflat去以下流平坦化

~/Desktop/re/file                            took 3s │ tools Py │ at 00:43:37 
❯ python ../tools/deflat-master/flat_control_flow/deflat.py ./attachment 0x400620
*******************relevant blocks************************
prologue: 0x400620
main_dispatcher: 0x40063f
pre_dispatcher: 0x4020cc
retn: 0x401f54
relevant_blocks: ['0x4015d4', '0x40201b', '0x401e00', '0x401f2d', '0x401481', '0x401c69', '0x401efa', '0x401830', '0x401642', '0x401f97', '0x40180b', '0x401eb9', '0x401748', '0x4013ef', '0x4012f6', '0x401fb5', '0x402033', '0x40197d', '0x40136c', '0x401a73', '0x401d9a', '0x40204d', '0x402096', '0x4015c5', '0x401567', '0x401909', '0x401f09', '0x401c2b', '0x4014ae', '0x40199b', '0x401435', '0x401fa6', '0x401861', '0x401b34', '0x401b5d', '0x401f3c', '0x401521', '0x401caf', '0x4013cf', '0x4014f7', '0x401f60', '0x401960', '0x4016a0', '0x4018a7', '0x4011de', '0x401739', '0x4020c2', '0x401506', '0x4019e1', '0x4014d2', '0x401d2d', '0x401849', '0x4017fc', '0x4017ab', '0x401b25', '0x402072', '0x401d03', '0x401ad3', '0x4015fc', '0x401926', '0x401b75', '0x401326', '0x4016e6', '0x401e0f', '0x40200c', '0x401e73', '0x4015b6', '0x401a3d', '0x401ff4', '0x401305', '0x401fe5', '0x401d54', '0x401198', '0x4013b2', '0x401c1c', '0x40124f', '0x401c46', '0x401490', '0x401a8d', '0x401b4e', '0x401d45', '0x401765', '0x401bbb', '0x4018fa', '0x401691', '0x401c0d', '0x4015ed', '0x401a4c', '0x401d12', '0x40125e', '0x401fcd', '0x4012a4', '0x401940', '0x401121', '0x4014e8', '0x401e2d', '0x401ed6', '0x4020b3', '0x401117']
*******************symbolic execution*********************
-------------------dse 0x4015d4---------------------
WARNING  | 2024-11-20 00:45:00,434 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing register with an unspecified value. This could indicate unwanted behavior.
WARNING  | 2024-11-20 00:45:00,434 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this 
.........
************************flow******************************
0x4015d4:  ['0x4015ed']
0x40201b:  ['0x4018a7']
0x401e00:  ['0x401e0f']
0x401f2d:  ['0x401f3c']
0x401481:  ['0x401490']
0x401c69:  ['0x401caf', '0x402096']
0x401efa:  ['0x401f3c']
0x401830:  ['0x401849']
0x401642:  ['0x401691', '0x401fe5']
0x401f97:  ['0x4012a4']
0x40180b:  ['0x401830']
0x401eb9:  ['0x401f09', '0x401ed6']
0x401748:  ['0x401765', '0x401d54']
0x4013ef:  ['0x401435', '0x401fb5']
0x4012f6:  ['0x401305']
0x401fb5:  ['0x401435']
0x402033:  ['0x4019e1']
0x40197d:  ['0x40199b']
0x40136c:  ['0x4013b2', '0x401fa6']
0x401a73:  ['0x401a8d']
0x401d9a:  ['0x401e00', '0x4020b3']
0x40204d:  ['0x401ad3']
0x402096:  ['0x401caf']
0x4015c5:  ['0x40125e']
0x401567:  ['0x4015b6', '0x401fcd']
0x401909:  ['0x401926', '0x401c2b']
0x401f09:  ['0x401f2d']
0x401c2b:  ['0x401c46']
0x4014ae:  ['0x4014d2']
0x40199b:  ['0x4019e1', '0x402033']
0x401435:  ['0x401481', '0x401fb5']
0x401fa6:  ['0x40136c']
0x401861:  ['0x4018a7', '0x40201b']
0x401b34:  ['0x401b4e']
0x401b5d:  ['0x401b75']
0x401f3c:  ['0x401f54']
0x401521:  ['0x401567', '0x401fcd']
0x401caf:  ['0x401d03', '0x402096']
0x4013cf:  ['0x4013ef']
0x4014f7:  ['0x401506']
0x401f60:  ['0x4011de']
0x401960:  ['0x40197d', '0x401a73']
0x4016a0:  ['0x4016e6', '0x401ff4']
0x4018a7:  ['0x4018fa', '0x40201b']
0x4011de:  ['0x40124f', '0x401f60']
0x401739:  ['0x401748']
0x4020c2:  ['0x401e73']
0x401506:  ['0x401521']
0x4019e1:  ['0x401a3d', '0x402033']
0x4014d2:  ['0x4014e8']
0x401d2d:  ['0x401d45']
0x401849:  ['0x401861']
0x4017fc:  ['0x40180b']
0x4017ab:  ['0x4017fc', '0x40200c']
0x401b25:  ['0x401b34']
0x402072:  ['0x401bbb']
0x401d03:  ['0x401d12']
0x401ad3:  ['0x401b25', '0x40204d']
0x4015fc:  ['0x401642', '0x401fe5']
0x401926:  ['0x401940']
0x401b75:  ['0x401bbb', '0x402072']
0x401326:  ['0x40136c', '0x401fa6']
0x4016e6:  ['0x401739', '0x401ff4']
0x401e0f:  ['0x401e2d']
0x40200c:  ['0x4017ab']
0x401e73:  ['0x401eb9', '0x4020c2']
0x4015b6:  ['0x4015c5']
0x401a3d:  ['0x401a4c']
0x401ff4:  ['0x4016e6']
0x401305:  ['0x401326']
0x401fe5:  ['0x401642']
0x401d54:  ['0x401d9a', '0x4020b3']
0x401198:  ['0x4011de', '0x401f60']
0x4013b2:  ['0x4013cf', '0x4015d4']
0x401c1c:  ['0x401849']
0x40124f:  ['0x40125e']
0x401c46:  ['0x401c69']
0x401490:  ['0x4014ae', '0x4014f7']
0x401a8d:  ['0x401ad3', '0x40204d']
0x401b4e:  ['0x401b5d']
0x401d45:  ['0x4015fc']
0x401765:  ['0x4017ab', '0x40200c']
0x401bbb:  ['0x401c0d', '0x402072']
0x4018fa:  ['0x401909']
0x401691:  ['0x4016a0']
0x401c0d:  ['0x401c1c']
0x4015ed:  ['0x4015fc']
0x401a4c:  ['0x401b4e']
0x401d12:  ['0x401d2d']
0x40125e:  ['0x4012a4', '0x401f97']
0x401fcd:  ['0x401567']
0x4012a4:  ['0x4012f6', '0x401f97']
0x401940:  ['0x401960']
0x401121:  ['0x401198']
0x4014e8:  ['0x4015d4']
0x401e2d:  ['0x401e73', '0x4020c2']
0x401ed6:  ['0x401efa']
0x4020b3:  ['0x401d9a']
0x401117:  ['0x4015d4']
0x400620:  ['0x401121']
0x401f54:  []
************************patch*****************************
Successful! The recovered file: ./attachment_recovered

__int64 __fastcall main(int a1, char **a2, char **a3)
{signed __int64 v4; // [rsp+1E0h] [rbp-110h]int i; // [rsp+1E8h] [rbp-108h]int v6; // [rsp+1ECh] [rbp-104h]int v7; // [rsp+1ECh] [rbp-104h]char s1[48]; // [rsp+1F0h] [rbp-100h] BYREFchar s[60]; // [rsp+220h] [rbp-D0h] BYREFunsigned int v10; // [rsp+25Ch] [rbp-94h]char *v11; // [rsp+260h] [rbp-90h]int v12; // [rsp+26Ch] [rbp-84h]bool v13; // [rsp+272h] [rbp-7Eh]unsigned __int8 v14; // [rsp+273h] [rbp-7Dh]int v15; // [rsp+274h] [rbp-7Ch]char *v16; // [rsp+278h] [rbp-78h]int v17; // [rsp+284h] [rbp-6Ch]int v18; // [rsp+288h] [rbp-68h]bool v19; // [rsp+28Fh] [rbp-61h]char *v20; // [rsp+290h] [rbp-60h]int v21; // [rsp+298h] [rbp-58h]bool v22; // [rsp+29Fh] [rbp-51h]__int64 v23; // [rsp+2A0h] [rbp-50h]bool v24; // [rsp+2AFh] [rbp-41h]__int64 v25; // [rsp+2B0h] [rbp-40h]__int64 v26; // [rsp+2B8h] [rbp-38h]__int64 v27; // [rsp+2C0h] [rbp-30h]__int64 v28; // [rsp+2C8h] [rbp-28h]int v29; // [rsp+2D0h] [rbp-20h]int v30; // [rsp+2D4h] [rbp-1Ch]char *v31; // [rsp+2D8h] [rbp-18h]int v32; // [rsp+2E0h] [rbp-10h]int v33; // [rsp+2E4h] [rbp-Ch]bool v34; // [rsp+2EBh] [rbp-5h]v10 = 0;memset(s, 0, 0x30uLL);memset(s1, 0, sizeof(s1));printf("Input:");v11 = s;if ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 )goto LABEL_43;while ( 1 ){__isoc99_scanf("%s", v11);v6 = 0;if ( dword_603058 < 10 || ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) == 0 )break;
LABEL_43:__isoc99_scanf("%s", v11);}while ( 1 ){dov12 = v6;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );v13 = v12 < 64;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );if ( !v13 )break;v14 = s[v6];dov15 = v14;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );if ( v15 == 10 ){v16 = &s[v6];*v16 = 0;break;}v17 = v6 + 1;dov6 = v17;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );}for ( i = 0; ; ++i ){dov18 = i;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );dov19 = v18 < 6;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );if ( !v19 )break;dov20 = s;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );v4 = *(_QWORD *)&v20[8 * i];v7 = 0;while ( 1 ){v21 = v7;dov22 = v21 < 64;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );if ( !v22 )break;v23 = v4;v24 = v4 < 0;if ( v4 >= 0 ){v27 = v4;dov28 = 2 * v27;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );v4 = v28;}else{v25 = 2 * v4;dov26 = v25;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );v4 = v26 ^ 0xB0004B7679FA26B3LL;}v29 = v7;dov7 = v29 + 1;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );}v30 = 8 * i;v31 = &s1[8 * i];if ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 )
LABEL_55:*(_QWORD *)v31 = v4;*(_QWORD *)v31 = v4;if ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 )goto LABEL_55;v32 = i + 1;}dov33 = memcmp(s1, &unk_402170, 0x30uLL);while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );v34 = v33 != 0;while ( dword_603058 >= 10 && ((((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054) & 1) != 0 );if ( v34 )puts("Wrong!");elseputs("Correct!");return v10;
}

使用ida新的插件gooMBA
(PS:不知道为啥能化简,偶然发现的,这玩意不是化简公式的吗,怎么能化简这玩意,硬推了半天右键偶然点到的,先搁置)

IDA is analysing the input file...
You may start to explore the input file right now.
[Patching] Loaded v0.1.2 - (c) Markus Gaasedelen - 2022
Propagating type information...
Function argument information has been propagated
The initial autoanalysis has been finished.
400520: using guessed type __int64 __isoc99_scanf(const char *, ...);
603054: using guessed type int dword_603054;
603058: using guessed type int dword_603058;
400620: using guessed type char s[60];
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{5}-#1.1){4}*$dword_603054.1{5}) & #1.1)) == #0.4)), #0.1, @43
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{5}-#1.1){4}*$dword_603054.1{5}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9703 us
Found MBA instruction jz     (($dword_603058.4{8} <s #0xA.4){9} | (xdu.4(((($dword_603054.1{7}-#1.1){6}*$dword_603054.1{7}){13} & #1.1){12}){11} == #0.4){10}), #0.1, @43
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4{8} <s #0xA.4){9}, (xdu.4(((($dword_603054.1{7}-#1.1){6}*$dword_603054.1{7}){13} & #1.1){12}){11} == #0.4){10}, .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9288 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{16}-#1.1)*$dword_603054.1{16}) & #1.1)) == #0.4)), #0.1, @44
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{16}-#1.1)*$dword_603054.1{16}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9218 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{18}-#1.1)*$dword_603054.1{18}) & #1.1)) == #0.4)), #0.1, @45
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{18}-#1.1)*$dword_603054.1{18}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9415 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{20}-#1.1)*$dword_603054.1{20}) & #1.1)) == #0.4)), #0.1, @46
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{20}-#1.1)*$dword_603054.1{20}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9190 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{23}-#1.1)*$dword_603054.1{23}) & #1.1)) == #0.4)), #0.1, @47
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{23}-#1.1)*$dword_603054.1{23}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9031 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{26}-#1.1)*$dword_603054.1{26}) & #1.1)) == #0.4)), #0.1, @48
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{26}-#1.1)*$dword_603054.1{26}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9160 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{28}-#1.1)*$dword_603054.1{28}) & #1.1)) == #0.4)), #0.1, @49
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{28}-#1.1)*$dword_603054.1{28}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9081 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{30}-#1.1)*$dword_603054.1{30}) & #1.1)) == #0.4)), #0.1, @50
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{30}-#1.1)*$dword_603054.1{30}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9567 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{33}-#1.1)*$dword_603054.1{33}) & #1.1)) == #0.4)), #0.1, @51
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{33}-#1.1)*$dword_603054.1{33}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9143 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{37}-#1.1)*$dword_603054.1{37}) & #1.1)) == #0.4)), #0.1, @52
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{37}-#1.1)*$dword_603054.1{37}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9224 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{40}-#1.1)*$dword_603054.1{40}) & #1.1)) == #0.4)), #0.1, @53
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{40}-#1.1)*$dword_603054.1{40}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 8971 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{44}-#1.1)*$dword_603054.1{44}) & #1.1)) == #0.4)), #0.1, @54
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{44}-#1.1)*$dword_603054.1{44}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 8999 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{45}-#1.1)*$dword_603054.1{45}) & #1.1)) == #0.4)), #0.1, @55
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{45}-#1.1)*$dword_603054.1{45}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9083 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{47}-#1.1)*$dword_603054.1{47}) & #1.1)) == #0.4)), #0.1, @55
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{47}-#1.1)*$dword_603054.1{47}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9436 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{51}-#1.1)*$dword_603054.1{51}) & #1.1)) == #0.4)), #0.1, @56
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{51}-#1.1)*$dword_603054.1{51}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 9536 us
Found MBA instruction jz     (($dword_603058.4 <s #0xA.4) | (xdu.4(((($dword_603054.1{52}-#1.1)*$dword_603054.1{52}) & #1.1)) == #0.4)), #0.1, @57
Unhandled opcode in emulator 44
err: Unhandled opcode
Found MBA instruction or     ($dword_603058.4 <s #0xA.4), (xdu.4(((($dword_603054.1{52}-#1.1)*$dword_603054.1{52}) & #1.1)) == #0.4), .1
Testing candidate mov    #1.1, .1
Instruction is probably equivalent to candidate
SMT check result: 0
Time taken: 8979 us
Completed mba optimization pass, improved 17 expressions
400520: using guessed type __int64 __isoc99_scanf(const char *, ...);
603054: using guessed type int dword_603054;
603058: using guessed type int dword_603058;
400620: using guessed type char s[60];

__int64 __fastcall main(int a1, char **a2, char **a3)
{signed __int64 v4; // [rsp+1E0h] [rbp-110h]int j; // [rsp+1E8h] [rbp-108h]int i; // [rsp+1ECh] [rbp-104h]int k; // [rsp+1ECh] [rbp-104h]char s1[48]; // [rsp+1F0h] [rbp-100h] BYREFchar s[60]; // [rsp+220h] [rbp-D0h] BYREFunsigned int v10; // [rsp+25Ch] [rbp-94h]char *v11; // [rsp+260h] [rbp-90h]int v12; // [rsp+26Ch] [rbp-84h]bool v13; // [rsp+272h] [rbp-7Eh]unsigned __int8 v14; // [rsp+273h] [rbp-7Dh]int v15; // [rsp+274h] [rbp-7Ch]char *v16; // [rsp+278h] [rbp-78h]int v17; // [rsp+284h] [rbp-6Ch]int v18; // [rsp+288h] [rbp-68h]bool v19; // [rsp+28Fh] [rbp-61h]char *v20; // [rsp+290h] [rbp-60h]int v21; // [rsp+298h] [rbp-58h]bool v22; // [rsp+29Fh] [rbp-51h]__int64 v23; // [rsp+2A0h] [rbp-50h]bool v24; // [rsp+2AFh] [rbp-41h]__int64 v25; // [rsp+2B0h] [rbp-40h]__int64 v26; // [rsp+2B8h] [rbp-38h]__int64 v27; // [rsp+2C0h] [rbp-30h]__int64 v28; // [rsp+2C8h] [rbp-28h]int v29; // [rsp+2D0h] [rbp-20h]int v30; // [rsp+2D4h] [rbp-1Ch]char *v31; // [rsp+2D8h] [rbp-18h]int v32; // [rsp+2E0h] [rbp-10h]int v33; // [rsp+2E4h] [rbp-Ch]bool v34; // [rsp+2EBh] [rbp-5h]v10 = 0;memset(s, 0, 0x30uLL);memset(s1, 0, sizeof(s1));printf("Input:");v11 = s;__isoc99_scanf("%s", s);for ( i = 0; ; ++i ){v12 = i;v13 = i < 64;if ( i >= 64 )break;v14 = s[i];v15 = v14;if ( v14 == 10 ){v16 = &s[i];*v16 = 0;break;}v17 = i + 1;}for ( j = 0; ; ++j ){v18 = j;v19 = j < 6;if ( j >= 6 )break;v20 = s;v4 = *(_QWORD *)&s[8 * j];for ( k = 0; ; ++k ){v21 = k;v22 = k < 64;if ( k >= 64 )break;v23 = v4;v24 = v4 < 0;if ( v4 >= 0 ){v27 = v4;v28 = 2 * v4;v4 *= 2LL;}else{v25 = 2 * v4;v26 = 2 * v4;v4 = (2 * v4) ^ 0xB0004B7679FA26B3LL;}v29 = k;}v30 = 8 * j;v31 = &s1[8 * j];*(_QWORD *)v31 = v4;v32 = j + 1;}v33 = memcmp(s1, &unk_402170, 0x30uLL);v34 = v33 != 0;if ( v33 )puts("Wrong!");elseputs("Correct!");return v10;
}

int main() {  uint64_t secret[] = {  0xBC8FF26D43536296,  0x520100780530EE16,  0x4DC0B5EA935F08EC,  0x342B90AFD853F450,  0x8B250EBCAA2C3681,  0x55759F81A2C68AE4  };  size_t secret_len = sizeof(secret) / sizeof(secret[0]);  char flag[65];  // 长度64字符 + '\0' = 65    char *flag_ptr = flag;  // 使用 flag_ptr 来遍历 flag 数组  for (size_t i = 0; i < secret_len; i++) {  uint64_t s = secret[i];  // 执行位操作  for (int j = 0; j < 64; j++) {  /*  bin(0xB0004B7679FA26B3)                '0b1011000000000000010010110111011001111001111110100010011010110011'                如果最低为是一说明之前是负数,因为 0 ^ 1 = 1,如果没异或过左移后为0  * */            int sign = s & 1;  if (sign == 1) {  s ^= 0xB0004B7679FA26B3;  }  s >>= 1;  // 右移一位  // 再恢复为负数  if (sign == 1) {  s |= 0x8000000000000000;  }  }  // 转换小端序为大端序  for (int j = 0; j < 8; j++) {  *flag_ptr++ = (char)(s & 0xFF);  s >>= 8;  // 右移8位  }  }  *flag_ptr = '\0';  // 结束字符  printf("Flag: %s\n", flag);  // 输出flag  return 0;  
}

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.mzph.cn/news/886843.shtml

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

STM32设计井下瓦斯检测联网WIFI加Zigbee多路节点协调器传输-分享

STM32设计井下瓦斯检测联网WIFI加Zigbee多路节点协调器传输-分享

目录 目录 前言 一、本设计主要实现哪些很“开门”功能&#xff1f; 二、电路设计原理图 1.电路图采用Altium Designer进行设计&#xff1a; 2.实物展示图片 三、程序源代码设计 四、获取资料内容 前言 本系统基于STM32微控制器和Zigbee无线通信技术&#xff0c;设计了…
阅读更多...
golang通用后台管理系统09(系统操作日志记录)

golang通用后台管理系统09(系统操作日志记录)

1.日志工具类 package log/**** 日志记录 wangwei 2024-11-18 15:30*/ import ("log""os""path/filepath""time" )// 获取以当前日期命名的日志文件路径 func getLogFilePath() string {currentDate : time.Now().Format("2006-…
阅读更多...
100.【C语言】数据结构之二叉树的堆实现 上

100.【C语言】数据结构之二叉树的堆实现 上

目录 1.顺序结构 2.示意图 ​编辑 从物理结构还原为逻辑结构的方法 3.父子节点编号的规律 4.顺序存储的前提条件 5.堆的简介 堆的定义 小根堆和大根堆 6.堆的插入 7.堆的实现及操作堆的函数 堆的结构体定义 堆初始化函数HeapInit 堆插入元素函数HeapPush 堆向上…
阅读更多...
Ubuntu Linux使用前准备动作_使用root登录图形化界面

Ubuntu Linux使用前准备动作_使用root登录图形化界面

Ubuntu默认是不允许使用 root 登录图形化界面的。这是出于安全考虑的设置。但如果有需要&#xff0c;可以通过以下步骤来实现使用 root 登录&#xff1a; 1、设置 root 密码 打开终端&#xff0c;使用当前的管理员账户登录系统。在终端中输入命令sudo passwd root&#xff0c…
阅读更多...
博客摘录「 nvm安装与使用详解(Window11)」2024年4月10日

博客摘录「 nvm安装与使用详解(Window11)」2024年4月10日

nvm -v nvm安装详细教程&#xff08;安装nvm、node、npm、cnpm、yarn及环境变量配置&#xff09;-CSDN博客
阅读更多...
我们来学mysql -- EXPLAIN之type(原理篇)

我们来学mysql -- EXPLAIN之type(原理篇)

EXPLAIN之type 题记示例表type 题记 书接上文《 EXPLAIN之select_type》2024美国大选已定&#xff0c;川普剑登上铁王座&#xff0c;在此过程中出谋划策的幕僚很重要&#xff0c;是他们决定了最终的执行计划在《查询成本之索引选择》中提到&#xff0c;explain的输出&#xff…
阅读更多...
【拥抱AI】对比embedding模型gte-Qwen2-7B-instruct和bge-m3:latest(三)

【拥抱AI】对比embedding模型gte-Qwen2-7B-instruct和bge-m3:latest(三)

为了更全面地评估 gte-Qwen2-7B-instruct 和 bge-m3:latest 的性能&#xff0c;我们可以从以下几个方面进行详细比较&#xff1a; 1. 模型架构和规模 gte-Qwen2-7B-instruct 架构&#xff1a;基于Transformer的大型语言模型。参数量&#xff1a;7B参数&#xff0c;具有较强的…
阅读更多...
HTB：MonitorsTwo[WriteUP]

HTB：MonitorsTwo[WriteUP]

连接至HTB服务器并启动靶机 靶机IP&#xff1a;10.10.11.211 分配IP&#xff1a;10.10.16.7 信息搜集 使用rustscan对靶机TCP端口进行开放扫描 rustscan -a 10.10.11.211 -r 1-65535 使用nmap对靶机开放端口进行脚本、服务扫描 nmap -p 22,80 -sCV 10.10.11.211 漏洞利用 使…
阅读更多...
Keepalived部署

Keepalived部署

Keepalived部署 安装配置单VIP模式配置master节点查看节点IP信息配置 keepalived.conf启动且加入开机自启查看是否生效 配置backup节点配置 keepalived.conf启动且加入开机自启查看是否生效 主备测试 多VIP配置 keepalived.conf查看IP 安装 dnf install -y keepalived配置 单…
阅读更多...
【MySql】实验五 综合练习：学生成绩管理系统

【MySql】实验五 综合练习：学生成绩管理系统

文章目录 数据库设计与查询实践&#xff1a;学生成绩管理系统表结构设计学生信息表 student_info课程信息表 curriculum成绩表 grade1. 查询选修课的人数2. 查询学号为0001、0002、0003、0004的学生的姓名和出生日期3. 向grade表插入一条记录&#xff0c;学号为0004、课程编号为…
阅读更多...
Android U 多任务启动分屏——SystemUI流程（更新中）

Android U 多任务启动分屏——SystemUI流程（更新中）

前文 Android U 多任务启动分屏——Launcher流程&#xff08;下分屏&#xff09; 前文说到通过ISplitScreen接口跨进程调用到了SystemUI进程&#xff0c;我们继续分析分屏在systemui中的实现。 wmshell实现分屏 实现ISplitScreen接口 代码路径&#xff1a;frameworks/base/…
阅读更多...
ASCB1系列APP操控末端回路智能微断 物联网断路器 远程控制开关 学校、工厂、农场、商业大楼等可用

ASCB1系列APP操控末端回路智能微断 物联网断路器 远程控制开关 学校、工厂、农场、商业大楼等可用

安科瑞戴婷 Acrel-Fanny ASCB1系列智能微型断路器是安科瑞电气股份有限公司全新推出的智慧用电产品&#xff0c;产品由智能微型断路器与智能网关两部分组成&#xff0c;可用于对用电线路的关键电气因素&#xff0c;如电压、电流、功率、温度、漏电、能耗等进行实时监测&#x…
阅读更多...
微知-plantuml常用语法和要点以及模板？（note over、create、box,endbox、alt,else,end, autonumber）

微知-plantuml常用语法和要点以及模板？（note over、create、box,endbox、alt,else,end, autonumber）

文章目录 常见语法常用 线条类实线虚线斜箭头或奇数箭头 A ->(10) B: B->(10) A分割线&#xff1a;newpage 颜色类给箭头指定颜色 -[#red]->给某个note加颜色&#xff1a; note over Alice, Bob #FFAAAA: xxx给分组信息着色 alt#red 分组类alt xxx; else xxx; else xx…
阅读更多...
采用python3.12 +django5.1 结合 RabbitMQ 和发送邮件功能,实现一个简单的告警系统 前后端分离 vue-element

采用python3.12 +django5.1 结合 RabbitMQ 和发送邮件功能,实现一个简单的告警系统 前后端分离 vue-element

一、开发环境搭建和配置 #mac环境 brew install python3.12 python3.12 --version python3.12 -m pip install --upgrade pip python3.12 -m pip install Django5.1 python3.12 -m django --version #用于检索系统信息和进程管理 python3.12 -m pip install psutil #集成 pika…
阅读更多...
渗透学习之windows基础

渗透学习之windows基础

引路Windows基础之病毒编写&#xff08;完结&#xff09;_哔哩哔哩_bilibili windows基础&#xff08;2&#xff09; 21 ftp 23 tenlet 80 web 80-89 可能是web 443 ssl心脏滴血漏洞以及一些web漏洞测试 445 smb 1433 msspl 1521 oracle 2082/2083 cpanel 主机管理系…
阅读更多...
Spark RDD sortBy算子执行时进行数据 “采样”是什么意思？

Spark RDD sortBy算子执行时进行数据 “采样”是什么意思？

一、sortBy 和 RangePartitioner sortBy 在 Spark 中会在执行排序时采用 rangePartitioner 进行分区&#xff0c;这会影响数据的分区方式&#xff0c;并且这一步骤是通过对数据进行 “采样” 来计算分区的范围。不过&#xff0c;重要的是&#xff0c;sortBy 本身仍然是一个 tr…
阅读更多...
深入探讨 Puppeteer 如何使用 X 和 Y 坐标实现鼠标移动

深入探讨 Puppeteer 如何使用 X 和 Y 坐标实现鼠标移动

背景介绍 现代爬虫技术中&#xff0c;模拟人类行为已成为绕过反爬虫系统的关键策略之一。无论是模拟用户点击、滚动&#xff0c;还是鼠标的轨迹移动&#xff0c;都可以为爬虫脚本带来更高的“伪装性”。在众多的自动化工具中&#xff0c;Puppeteer作为一个无头浏览器控制库&am…
阅读更多...
【学术论文投稿】JavaScript 前端开发：从入门到精通的奇幻之旅

【学术论文投稿】JavaScript 前端开发：从入门到精通的奇幻之旅

【中文核刊&普刊投稿通道】2024年体育科技与运动表现分析国际学术会议(ICSTPA 2024)_艾思科蓝_学术一站式服务平台 更多学术会议论文投稿请看&#xff1a;https://ais.cn/u/nuyAF3 目录 一、引言 二、JavaScript 基础 &#xff08;一&#xff09;变量与数据类型 &am…
阅读更多...
java实现枚举

java实现枚举

介绍 枚举算法也叫暴力算法&#xff0c;是一种简单直接的问题求解方法&#xff0c;它通过逐一列举问题的所有可能解&#xff0c;并检查每个可能解是否符合问题的条件&#xff0c;直到找到正确的解或者遍历完所有可能的情况。 对于一个问题&#xff0c;首先确定解的范围&#x…
阅读更多...
Leetcode 最长回文子串

Leetcode 最长回文子串

目录 解法1&#xff1a;递归算法 解法2&#xff1a;Map取同字母位置法 解法3&#xff1a;中心扩展法 解法4&#xff1a;动态规划法 解法5: Manacher算法 示例 1&#xff1a; 输入&#xff1a;s "babad" 输出&#xff1a;"bab" 解释&#xff1a;&quo…
阅读更多...
最新文章

Copyright @ 2022~2023