攻防世界-lgniteMe

放进IDA里，然后看看伪代码，注意到几个关键的地方

所以flag应该是EIS{}的形式，接着看看congratulations上面的if，里面的4011C0函数

bool __cdecl sub_4011C0(char *a1)
{
  size_t v2; // eax
  signed int v3; // [esp+50h] [ebp-B0h]
  char v4[32]; // [esp+54h] [ebp-ACh]
  int v5; // [esp+74h] [ebp-8Ch]
  int v6; // [esp+78h] [ebp-88h]
  size_t i; // [esp+7Ch] [ebp-84h]
  char v8[128]; // [esp+80h] [ebp-80h]

  if ( strlen(a1) <= 4 )
    return 0;
  i = 4;
  v6 = 0;
  while ( i < strlen(a1) - 1 )
    v8[v6++] = a1[i++];
  v8[v6] = 0;
  v5 = 0;
  v3 = 0;
  memset(v4, 0, 0x20u);
  for ( i = 0; ; ++i )
  {
    v2 = strlen(v8);
    if ( i >= v2 )
      break;
    if ( v8[i] >= 'a' && v8[i] <= 'z' )
    {
      v8[i] -= 32;
      v3 = 1;
    }
    if ( !v3 && v8[i] >= 'A' && v8[i] <= 'Z' )
      v8[i] += 32;
    v4[i] = byte_4420B0[i] ^ sub_4013C0(v8[i]);
    v3 = 0;
  }
  return strcmp("GONDPHyGjPEKruv{{pj]X@rF", v4) == 0;
}

可以看到，应该是对v8首先大写字母转小写，小写字母转大写，接着对v8进行sub_4013C0这个函数操作，再进行异或放入v4中，再进行比较

int __cdecl sub_4013C0(int a1)
{
  return (a1 ^ 0x55) + 72;
}

至于byte_4420B0[i]

byt=[0x0d,0x13,0x17,0x11,0x2,0x1,0x20,0x1d,0x0c,0x2,0x19,0x2f,0x17,0x2b,0x24,0x1f,0x1e,0x16,0x9,0x0f,0x15,0x27,0x13,0x26,0x0a,0x2f,0x11,0x1a,0x2d,0x0c,0x22,0x4]

所以要还原v8，只需要对"GONDPHyGjPEKruv{{pj]X@rF"这个字符串进行逆向操作就可以了

用python写一下写的很乱

s=['G','O','N','D','P','H','y','G','j','P','E','K','r','u','v','{','{','p','j',']','X','@','r','F']
byt=[0x0d,0x13,0x17,0x11,0x2,0x1,0x20,0x1d,0x0c,0x2,0x19,0x2f,0x17,0x2b,0x24,0x1f,0x1e,0x16,0x9,0x0f,0x15,0x27,0x13,0x26,0x0a,0x2f,0x11,0x1a,0x2d,0x0c,0x22,0x4]
print(len(byt))
print(len(s))
for i in range(24):
    s[i]=ord(s[i])^byt[i]
    s[i]-=72
    s[i]=s[i]^0x55
    print(chr(s[i]),end="")
print(s)
#unknowstr=['J', '\', 'Y' , 'U' , 'R' , 'I' ,'Y','Z','f','R','\','d','e','^','R','d','e','f','c','R','M','g','a','`']
#print(unknowstr)
ununstr=[87, 65, 68, 88, 95, 84, 68, 71, 75, 95, 65, 73, 72, 67, 95, 73, 72, 75, 78, 95, 80, 74, 76, 77]
uninstr=""
for i in range(24):
    uninstr+=chr(ununstr[i])

for j in range(24):
    print(chr(s[i]),end="")
print(uninstr)
a="WADX_TDGK_AIHC_IHKN_PJLM"
a=a.lower()
print(a)

最后加上EIS{}