re每日一題（20200529）（補）

re每日一題（20200529）（補）

GKCTF2020

Chellys_identity

關鍵比較函數爲sub_411721

int __usercall sub_41B3B0@<eax>(int a1@<xmm0>, int a2)
{
  _DWORD *i; // eax
  int v3; // eax
  int v4; // edx
  int v5; // ST04_4
  int v6; // ST00_4
  int v8; // [esp+D0h] [ebp-60h]
  int v9; // [esp+DCh] [ebp-54h]
  int v10; // [esp+F4h] [ebp-3Ch]
  _DWORD *v11; // [esp+100h] [ebp-30h]
  char v12; // [esp+118h] [ebp-18h]
  int v13; // [esp+12Ch] [ebp-4h]
  int savedregs; // [esp+130h] [ebp+0h]

  sub_4114BF(&unk_42D027);
  sub_4112F8(0x10u);
  sub_4116E0(a1, &v12, 128);
  v11 = sub_411456(a2, a1);
  v10 = sub_411375(a2, a1);
  while ( v11 != v10 )
  {
    v9 = 0;
    v8 = 0;
    for ( i = sub_411325(&v12, a1, 0); *i < *v11; i = sub_411325(&v12, a1, v8) )
      v9 += *sub_411325(&v12, a1, v8++);
    *v11 ^= v9;
    ++v11;
  }
  v3 = sub_4114D3();
  v5 = v4;
  sub_411537(&savedregs, &dword_41B4BC, v3);
  return sub_4114DD(&savedregs ^ v13, v5, 1, v6, a1);
}

while循環中，對2-127中的質數求和，若輸出的ASCII碼在第n-1項和第n項質數之中，則對前n-1項質數求和並於輸入對異或。

函數sub_411852爲比較函數，

  v13 = 0x1B6;
  v14 = 0x498;
  v15 = 0x441;
  v16 = 0x179;
  v17 = 0x179;
  v18 = 0x640;
  v19 = 0x39C;
  v20 = 0x179;
  v21 = 0x64A;
  v22 = 0x39C;
  v23 = 0x27D;
  v24 = 0x27F;
  v25 = 0x178;
  v26 = 0x236;
  v27 = 0x344;
  v28 = 0x33E;

寫出腳本：

prime = [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127]
cipher = [0x1b6,0x498,0x441,0x179,0x179,0x640,0x39c,0x179,0x64a,0x39c,0x27d,0x27f,0x178,0x236,0x344,0x33e]
prime_list = []

for i in range(len(a)):
    sum += a[i]
    prime_list.append(sum)

flag = ''

for x in cipher:
    for y in prime_list:
        if x^y < 256:
            tmp = chr(x^y)
            if tmp in key:
                flag += tmp
				break

其中第13位存在兩個結果，取其中一個就好