[FLARE ON7] Challenge1，2，3 ，4

1 - Fidler

python，给了源代码，第一部分为输入密码，直接打印出来

def password_check():
    altered_key = 'hiptu'
    key = ''.join([chr(ord(x) - 1) for x in altered_key])
    print(key)
password_check()

第二部分，胜利后会解密flag，需要传入一个值

def decode_flag(frob):
    last_value = frob
    encoded_flag = [1135, 1038, 1126, 1028, 1117, 1071, 1094, 1077, 1121, 1087, 1110, 1092, 1072, 1095, 1090, 1027,
                    1127, 1040, 1137, 1030, 1127, 1099, 1062, 1101, 1123, 1027, 1136, 1054]
    decoded_flag = []

    for i in range(len(encoded_flag)):
        c = encoded_flag[i]
        val = (c - ((i%2)*1 + (i%3)*2)) ^ last_value
        decoded_flag.append(val)
        last_value = c

    return ''.join([chr(x) for x in decoded_flag])

往上找发现

target_amount = (2**36) + (2**35)
        if current_coins > (target_amount - 2**20):
            while current_coins >= (target_amount + 2**20):
                current_coins -= 2**20
            victory_screen(int(current_coins / 10**8))
            return

算出为1030，解密得flag

2 garbage

题目说文件不全，查看一下发现是upx过的程序，用010editor打开，看看数据目录表

第二个结构指向导入表，查看一下RVA为0x1929c处

发现后面被删掉了，资源也不全，于是要先想办法重建这里，我直接选择自己写了一个小程序加壳，把资源替换了

之后要改一下导入表中的RVA，同时把数据目录表第四个DWORD改为0xF0

之后upx脱壳，发现无法运行，拖进ida，根据字符串找到可疑函数

对数据进行了一些处理后放入一个文件中并运行此文件，写个脚本处理数据

v25=[0x38,0x0e,0x02,0x3B,0x19,0x3b,0x1b,0x34,0x1b,0x0c,0x23,0x3E,0x33,0x08,0x11,0x42,0x39,0x12,0x1e,0x73]
v8="KglPFOsQDxBPXmclOpmsdLDEPMRWbMDzwhDGOyqAkVMRvnBeIkpZIhFznwVylfjrkqprBPAdPuaiVoVugQAlyOQQtxBNsTdPZgDH "
v7="nPTnaGLkIqdcQwvieFQKGcTGOTbfMjDNmvibfBDdFBhoPaBbtfQuuGWYomtqTFqvBSKdUMmciqKSGZaosWCSoZlcIlyQpOwkcAgw "

a=[]

#for i in range(20):
 #   a.append(hex(v25[i]^ord(v8[i])))
#print(a)

v9 =[0x23,0x23,0x33,0x2c,
     0x0e,0x3f,0x64,0x49,
     0x0a,0x1e,0x0a,0x04,
     0x23,0x16,0x02,0x1a,
     0x44,0x66,0x08,0x24,
     0x32,0x11,0x74,0x2c,
     0x2a,0x2d,0x42,0x0f,
     0x3e,0x50,0x64,0x0d,
     0x5d,0x04,0x1b,0x17,
     0x16,0x36,0x03,0x05,
     0x34,0x20,0x09,0x08,
     0x63,0x21,0x24,0x0e,
     0x15,0x14,0x34,0x58,
     0x1a,0x29,0x79,0x3a,
     0x00,0x00,0x56,0x58,
     0x54]

for i in range(len(v9)):
    print(chr(v9[i]^ord(v7[i])),end="")
    

3 wednesday

游戏，提示只逆mydude.exe，经过一番寻找，判断处为

当分数为296时胜利，但如果直接修改分数是无法得到flag的，可以推测，每获得一次分数，会进行一些解密的操作

查看游戏资源，有m的地方要蹲，有f的地方要跳，且每次跳和蹲次序是不变的，可以想到有一张0和1组成的地图，于是寻找

有了地图，第一个想法是控制地图生成，但依然不能获得flag，只好想别的方法

#include<windows.h>

int map[] = {
    0,0,1,1,0,0,0,1,0,1,1,1,0,1,0,0,
    0,1,0,1,1,1,1,1,0,1,1,0,1,0,0,1,
    0,0,1,1,0,1,0,1,0,1,0,1,1,1,1,1,
    0,1,1,1,0,1,1,1,
    0,1,0,0,0,1,0,1,0,1,1,0,0,1,0,0,
    0,1,1,0,1,1,1,0,0,0,1,1,0,0,1,1,
    0,1,1,1,0,0,1,1,0,1,1,0,0,1,0,0,
    0,0,1,1,0,1,0,0,0,1,1,1,1,0,0,1,
    0,1,0,1,1,1,1,1,0,1,1,0,1,1,0,1,
    0,1,0,1,1,0,0,1,0,1,0,1,1,1,1,1,
    0,1,0,0,0,1,0,0,0,1,1,1,0,1,0,1,
    0,1,1,0,0,1,0,0,0,0,1,1,0,0,1,1,
    0,1,1,1,0,0,1,1,0,1,0,0,0,0,0,0,
    0,1,1,0,0,1,1,0,0,1,1,0,1,1,0,0,
    0,1,1,0,0,0,0,1,0,1,1,1,0,0,1,0,
    0,1,1,0,0,1,0,1,0,0,1,0,1,1,0,1,
    0,1,1,0,1,1,1,1,0,1,1,0,1,1,1,0,
    0,0,1,0,1,1,1,0,0,1,1,0,0,0,1,1,
    0,1,1,0,1,1,1,1,0,1,1,0,1,1,0,1,
};
void jump(HWND hwnd) {
    SendMessage(hwnd, WM_KEYUP, VK_DOWN, NULL);
    SendMessage(hwnd, WM_KEYDOWN, VK_UP, NULL);
    SendMessage(hwnd, WM_KEYUP, VK_UP, NULL);
}

int main(void) {
    int length = sizeof(map) / sizeof(map[0]);
    HWND hwnd = FindWindow(NULL, L"Wednesday");
    if (hwnd)
    {
            SendMessage(hwnd, WM_KEYDOWN, VK_DOWN, NULL);
            Sleep(2100);
            int k = 1360;
            for (int i = 0; i < length; i += 2) {
                if (map[i] == 0 && map[i + 1] == 0) {
                    Sleep(k);
                    Sleep(2750);
                }
                if (map[i] == 0 && map[i + 1] == 1) {
                    Sleep(k);
                    jump(hwnd);
                    Sleep(800);
                    SendMessage(hwnd, WM_KEYDOWN, VK_DOWN, NULL);
                    Sleep(1950);
                }
                if (map[i] == 1 && map[i + 1] == 0) {
                    jump(hwnd);
                    Sleep(800);
                    SendMessage(hwnd, WM_KEYDOWN, VK_DOWN, NULL);
                    Sleep(k);
                    Sleep(1950);
                }
                if (map[i] == 1 && map[i + 1] == 1) {
                    jump(hwnd);
                    Sleep(k);
                    jump(hwnd);
                    Sleep(800);
                    SendMessage(hwnd, WM_KEYDOWN, VK_DOWN, NULL);
                    Sleep(1950);
                }
                if (i == 10) k -= 12;
                if (i == 20) k -= 26;
                if (i == 30) k -= 12;
            }
            SendMessage(hwnd, WM_KEYUP, VK_DOWN, NULL);
    }
    return 0;
}

不过失败了，速度总是控制不好，每次到40分左右就死了。。。不过提到速度，我想起了变速齿轮

直接调慢速度，玩出flag

4 report

https://bbs.pediy.com/thread-263048.htm