Analysis code
Routine questions, but there's a pit
int __cdecl main(int argc, const char **argv, const char **envp) { char v3; // al __int64 v5; // [rsp+0h] [rbp-40h] int i; // [rsp+4h] [rbp-3Ch] FILE *stream; // [rsp+8h] [rbp-38h] char filename[8]; // [rsp+10h] [rbp-30h] unsigned __int64 v9; // [rsp+28h] [rbp-18h] v9 = __readfsqword(0x28u); LODWORD(v5) = 0; while ( (signed int)v5 < strlen(s) ) { if ( v5 & 1 ) v3 = 1; else v3 = -1; *(&t + (signed int)v5 + 10) = s[(signed int)v5] + v3; LODWORD(v5) = v5 + 1; } strcpy(filename, "/tmp/flag.txt"); stream = fopen(filename, "w"); fprintf(stream, "%s\n", u, v5); for ( i = 0; i < strlen(&t); ++i ) { fseek(stream, p[i], 0); fputc(*(&t + p[i]), stream); fseek(stream, 0LL, 0); fprintf(stream, "%s\n", u); } fclose(stream); remove(filename); return 0; }
Analysis of key points:
LODWORD(v5) = 0; while ( (signed int)v5 < strlen(s) ) { if ( v5 & 1 ) v3 = 1; else v3 = -1; *(&t + (signed int)v5 + 10) = s[(signed int)v5] + v3; LODWORD(v5) = v5 + 1; }
Look at the values of s and t variables.
s:
.data:00000000006010A0 s
db 'c61b68366edeb7bdce3c6820314b7498',0
t:
.data:00000000006010E1
aHarifctf???
db 'harifCTF{???}',0
Please watch carefully, t's code composition
python script:
s='c61b68366edeb7bdce3c6820314b7498' t1='harifCTF{????????????????????????????????}' t=[] for x in t1: t.append(x) v6=0 while v6<len(s): if v6&1: v3=1 else: v3=-1 t[v6+10]=str(chr(ord(s[v6])+v3)) v6=v6+1 flag='' for x in t: flag+=x print (flag)
Make a mistake.
There was a pit.
Watch the topic
SharifCTF 2016
And S is missing in t.
No wonder I've been counting fewer than ten. I can't match it.
It was deliberately hidden.
Add S
It's OK.
.