攻防世界--hackme

sub_400F8E函数

  int v17; // [rsp+98h] [rbp-28h]
  char v18; // [rsp+9Fh] [rbp-21h]
  int v19; // [rsp+A0h] [rbp-20h]
  unsigned __int8 v20; // [rsp+A6h] [rbp-1Ah]
  char v21; // [rsp+A7h] [rbp-19h]
  int v22; // [rsp+A8h] [rbp-18h]
  int v23; // [rsp+ACh] [rbp-14h]
  int v24; // [rsp+B0h] [rbp-10h]
  int v25; // [rsp+B4h] [rbp-Ch]
  _BOOL4 v26; // [rsp+B8h] [rbp-8h]
  int i; // [rsp+BCh] [rbp-4h]

  sub_407470((unsigned int)"Give me the password: ", a2, a3, a4, a5, a6, a2);
  sub_4075A0((unsigned int)"%s", (unsigned int)v16, v6, v7, v8, v9, v14);
  for ( i = 0; v16[i]; ++i )
    ;
  v26 = i == 22;
  v25 = 10;
  do
  {
    v10 = (int)sub_406D90() % 22;
    v22 = v10;
    v24 = 0;
    v21 = asc_6B4270[v10];
    v20 = v16[v10];
    v19 = v10 + 1;
    v23 = 0;
    while ( v23 < v19 )
    {
      ++v23;
      v24 = 1828812941 * v24 + 12345;
    }
    v18 = v24 ^ v20;
    if ( v21 != ((unsigned __int8)v24 ^ v20) )
      v26 = 0;
    --v25;
  }
  while ( v25 );
  if ( v26 )
    v17 = sub_407470((unsigned int)"Congras\n", (unsigned int)v16, v24, v10, v11, v12, v15);
  else
    v17 = sub_407470((unsigned int)"Oh no!\n", (unsigned int)v16, v24, v10, v11, v12, v15);
  return 0LL;
}

解密代码

a=[0x5F, 0xF2, 0x5E, 0x8B, 0x4E, 0x0E, 0xA3, 0xAA, 0xC7, 0x93, 0x81, 0x3D, 0x5F, 0x74, 0xA3, 0x09,
    0x91, 0x2B, 0x49, 0x28, 0x93, 0x67]

for i in range(len(a)):
    b = 0
    for j in range(i+1):
      b=1828812941*b+12345
    K=a[i]^(b&0xFF)
    print(chr(K),end='')