buuctf re [MRCTF2020]Xor

沒殼直接IDA

發現報錯

主函數沒辦法F5 是以進入報錯行進行F5再退出來就好了

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int i; // eax

  sub_401020((int)"Give Me Your Flag String:\n");
  sub_401050("%s", byte_4212C0);
  if ( strlen(byte_4212C0) != 27 )
  {
LABEL_6:
    sub_401020((int)"Wrong!\n");
    sub_404B7E("pause");
    _loaddll(0);
    __debugbreak();
  }
  for ( i = 0; i < 0x1B; ++i )
  {
    if ( ((unsigned __int8)i ^ (unsigned __int8)byte_4212C0[i]) != byte_41EA08[i] )
      goto LABEL_6;
  }
  sub_401020((int)"Right!\n");
  sub_404B7E("pause");
  return 0;
}
           

檢視byte_41EA08内容

.rdata:0041EA08 byte_41EA08     db 4Dh                  ; DATA XREF: _main+48↑r
.rdata:0041EA09 aSawbFxzJTqjNBp db 'SAWB~FXZ:J:`tQJ"N@ bpdd}8g',0
           

即将byte_41EA08按位異或回去

a = "MSAWB~FXZ:J:`tQJ\"N@ bpdd}8g"
flag = ''
for i in range(len(a)):
    flag += chr(i ^ord(a[i]))
print(flag)