int __fastcall main(__int64 a1, char **a2, char **a3)
{
size_t v3; // rax
int v5; // [rsp+1Ch] [rbp-104h]
int v6; // [rsp+20h] [rbp-100h]
int i; // [rsp+24h] [rbp-FCh]
unsigned int seed; // [rsp+28h] [rbp-F8h]
unsigned int v9; // [rsp+2Ch] [rbp-F4h]
char v10; // [rsp+30h] [rbp-F0h]
char v11[16]; // [rsp+90h] [rbp-90h]
char v12[32]; // [rsp+A0h] [rbp-80h]
char s; // [rsp+C0h] [rbp-60h]
char s1[40]; // [rsp+E0h] [rbp-40h]
unsigned __int64 v15; // [rsp+108h] [rbp-18h]
v15 = __readfsqword(0x28u);
seed = 0;
puts("Welcome to Pub Zorro!!");
printf("Straight to the point. How many drinks you want?", a2);
__isoc99_scanf("%d", &v5); // scanf 获取输入数字 drinks
if ( v5 <= 0 )
{
printf("You are too drunk!! Get Out!!", &v5);
exit(-1);
}
printf("OK. I need details of all the drinks. Give me %d drink ids:", (unsigned int)v5);
for ( i = 0; i < v5; ++i )
{
__isoc99_scanf("%d", &v6); // scanf 获取输入数字 drink ids
if ( v6 <= 16 || v6 > 65535 ) // drink ids 范围：16-65534
{
puts("Invalid Drink Id.");
printf("Get Out!!", &v6);
exit(-1);
}
seed ^= v6;
}
i = seed;
v9 = 0;
while ( i )
{
++v9;
i &= i - 1;
}
if ( v9 != 10 ) // ids 循环位操作进行计数，最终计数必须为10
{
puts("Looks like its a dangerous combination of drinks right there.");
puts("Get Out, you will get yourself killed");
exit(-1);
}
srand(seed); // 置随机数种子
MD5_Init((__int64)&v10);
for ( i = 0; i <= 29; ++i )
{
v9 = rand() % 1000; // 生成随机数除1000取余
sprintf(&s, "%d", v9);
v3 = strlen(&s);
MD5_Update(&v10, &s, v3);
v12[i] = v9 ^ LOBYTE(dword_6020C0[i]); // V12前30位与6020C0数据异或
}
v12[i] = 0; // V12第30位添0
MD5_Final(v11, &v10);
for ( i = 0; i <= 15; ++i )
sprintf(&s1[2 * i], "%02x", (unsigned __int8)v11[i]);
if ( strcmp(s1, "5eba99aff105c9ff6a1a913e343fec67") )
{
puts("Try different mix, This mix is too sloppy");
exit(-1);
}
return printf("\nYou choose right mix and here is your reward: The flag is nullcon{%s}\n", v12);// flag为V12的内容
}
通过静态分析Main函数流程，发现程序写脚本得到FLAG：
1、程序要求输入：Straight to the point. How many drinks you want?
输入数：V5 >=0，且后续V5并没有引用，所以只要随意输入大于0的数就可以。
2、"OK. I need details of all the drinks. Give me %d drink ids:", (unsigned int)v5
输入ids:变量为v6，seed ^= v6;运行后，ids存入seed中，后续作为生成随机数的种子。
3、对IDS进行较验：
[C] 纯文本查看复制代码
i = seed;
v9 = 0;
while ( i )
{
++v9;
i &= i - 1;
}
if ( v9 != 10 ) // ids 循环位操作进行计数，最终计数必须为10
{
puts("Looks like its a dangerous combination of drinks right there.");
puts("Get Out, you will get yourself killed");
exit(-1);
}
发表于 2019-12-17 20:01
