1
package defpackage;
2

3
import java.util.ArrayList;
4
import java.util.Scanner;
5

6
/* loaded from: Reverse.class */
7
public class Reverse {
8
    public static void main(String[] args) {
9
        Scanner s = new Scanner(System.in);
10
        System.out.println("Please input the flag ：");
11
        String str = s.next();
12
        System.out.println("Your input is ：");
13
        System.out.println(str);
14
        char[] stringArr = str.toCharArray();
15
        Encrypt(stringArr);
16
    }
17
    public static void Encrypt(char[] arr) {
18
        ArrayList<Integer> Resultlist = new ArrayList<>();
19
        for (char c : arr) {
20
            int result = (c + '@') ^ 32;
21
            Resultlist.add(Integer.valueOf(result));
22
        }
23
        int[] KEY = {180, 136, 137, 147, 191, 137, 147, 191, 148, 136, 133, 191, 134, 140, 129, 135, 191, 65};
24
        ArrayList<Integer> KEYList = new ArrayList<>();
25
        for (int i : KEY) {
26
            KEYList.add(Integer.valueOf(i));
27
        }
28
        System.out.println("Result:");
29
        if (Resultlist.equals(KEYList)) {
30
            System.out.println("Congratulations！");
31
        } else {
32
            System.err.println("Error！");
33
        }
34
    }
35
}

1
---
2

3
3.[GXYCTF2019]luck_guy
4
题目给了一个附件，"C:\Users\G1731\Downloads\attachment\luck_guy"
5
先用pe看一下
6
![alt text](/images/QQ20251111-205049.png)
7
很正常，没壳，打开ida，扔进去
8
![alt text](/images/QQ20251111-205216.png)
9

10

11
```int __fastcall main(int argc, const char **argv, const char **envp)
12
{
13
  int v4; // [rsp+14h] [rbp-Ch] BYREF
14
  unsigned __int64 v5; // [rsp+18h] [rbp-8h]
15

16
  v5 = __readfsqword(0x28u);
17
  welcome();
18
  puts("_________________");
19
  puts("try to patch me and find flag");
20
  v4 = 0;
21
  puts("please input a lucky number");
22
  __isoc99_scanf("%d", &v4);
23
  patch_me(v4);
24
  puts("OK,see you again");
25
  return 0;
26
}

1
int __fastcall patch_me(int a1)
2
{
3
  if ( a1 % 2 == 1 )
4
    return puts("just finished");
5
  else
6
    return get_flag();
7
}```
8

9
又有一个get_flag，再点点看
10

11
```unsigned __int64 get_flag()
12
{
13
  unsigned int v0; // eax
14
  int i; // [rsp+4h] [rbp-3Ch]
15
  int j; // [rsp+8h] [rbp-38h]
16
  __int64 s; // [rsp+10h] [rbp-30h] BYREF
17
  char v5; // [rsp+18h] [rbp-28h]
18
  unsigned __int64 v6; // [rsp+38h] [rbp-8h]
19

20
  v6 = __readfsqword(0x28u);
21
  v0 = time(0);
22
  srand(v0);
23
  for ( i = 0; i <= 4; ++i )
24
  {
25
    switch ( rand() % 200 )
26
    {
27
      case 1:
28
        puts("OK, it's flag:");
29
        memset(&s, 0, 0x28u);
30
        strcat((char *)&s, f1);
31
        strcat((char *)&s, &f2);
32
        printf("%s", (const char *)&s);
33
        break;
34
      case 2:
35
        printf("Solar not like you");
36
        break;
37
      case 3:
38
        printf("Solar want a girlfriend");
39
        break;
40
      case 4:
41
        s = 0x7F666F6067756369LL;
42
        v5 = 0;
43
        strcat(&f2, (const char *)&s);
44
        break;
45
      case 5:
46
        for ( j = 0; j <= 7; ++j )
47
        {
48
          if ( j % 2 == 1 )
49
            *(&f2 + j) -= 2;
50
          else
51
            --*(&f2 + j);
52
        }
53
        break;
54
      default:
55
        puts("emmm,you can't find flag 23333");
56
        break;
57
    }
58
  }
59
  return __readfsqword(0x28u) ^ v6;
60
}```
61

62

63
三个代码只要看一个就好了，最后一个。
64
rand() % 200 == 1，看到这个了吧，随机case，只有先4，后5，再1，才有flag，真是考验运气。
65
所以我选择直接静态分析，case4的初值为0x7F666F6067756369LL，反编译这个要反着看，然后转化成字符，得到icugof\x7F
66
```在通过case 5:
67
        for ( j = 0; j <= 7; ++j )
68
        {
69
          if ( j % 2 == 1 )
70
            *(&f2 + j) -= 2;
71
          else
72
            --*(&f2 + j);
73
        }