"CTF" Reverse WRITEUP@360CTF

Source: CTF Reverse20

Description: A file that has been encrypted with ReverseMe.exe is given in the compressed package: ciphertext. DB analyze the ReverseMe.exe algorithm, write out the decryption algorithm, decrypt the file to get the key. The EXE has a bug, resulting in EXE can not run;
Tips:
You have two ways to get the key:
1. After finding the Bug,patch, run the program two times to decrypt the file to get the key.
2. Honestly inverse of this simple algorithm, write out a decryption program, decrypt.

Answer: 4a5b8de6f7d3b6f5

?

Problem Solving Ideas:

Use OD load program, run prompt parameter error

Guess the parameter should be a file name, then fill in pass.db here, rerun the exception, this should be the problem mentioned in the bug.

Then open the file directly with ida6.6, press Ctrl+f5 to decompile, get the following main function

You can see that the program reads the data from the file and then calls the sub401000 function for processing.

The intention of the function is obvious, is to use 0x73686974 to the original string to be different or processing, the remainder is used in 0x73 or processing, so you can get the following method to solve the flag

Because in-memory characters are stored in reverse order, it should be written backwards. You can get the answer by running it last.

?

?

@Reference: Zhou Peng (roommate your blog is how much ...) ）

"CTF" Reverse [email protected]