Reverse
0x00 str_leak
题目给出一个cpp文件，这是使用的c++模板编程，分析代码。
_fun1是相当于开根号，fun4是求10000以内的素数个数 ，具体代码分析，参看文章：https://blog.csdn.net/liuhuiyan_2014/article/details/46276689
https://www.cnblogs.com/devymex/archive/2013/09/17/3326793.html
将注释的结果开方，算出10000以内的素数，按题目要求链接得到flag
#-*- coding:utf-8 -*-
n=10000
a=[i for i in range(10001)]
k=2
start = time.clock()
while(k*k<=n):
for j in range(k,n):
while(0==a[j] and j<n):
j+=1
if 0==a[j]%k and k!=a[j]:
a[j]=0
if 0==(k-1)%6:
k+=4
elif 0==(k-5)%6:
k+=2
else:
k+=1
q=0
for i in range(2,n):
if 0!=a[i]:
q =q+1
print("flag{",end='')
print("{0}-{1}-{2}-{3}-{4}-{5}".format(pow(963,2),pow(4396,2),pow(6666,2),pow(1999,2),pow(3141,2),q),end='')
print('}')
#flag{927369-19324816-44435556-3996001-9865881-1229}
0x01 flat
IDA打开，耐心分析代码，首先分析程序逻辑：输入字符串，经过五个check函数验证字符满足条件。
跟进fun_check1()
这里判断输入的字符长度在0到50之间。
image.png
跟进fun_check2()
判断开头为 "flag{"
image.png
image.png
跟进fun_check3()
判断字符最后一个为 “}”
跟进fun_check4()
判断 四个 ‘ - ' 的位置。
image.png
跟进fun_check5()
首先找到dest的值，得到dest数组为 “ J2261C63-3I2I-EGE4-IBCC-IE41A5I5F4HB”
image.png
这里对dest分类计算，将0-9 的ascll加17，’a'-'z'的ascll减48，其他字符不变。所以逆计算，0-9加17对应的是A-J , a-z 减 48 对应的是 1-9和A-J。
while ( v11 == -1771681815 )
{
v6 = 1740029224;
if ( v15[v12] >= 'a' )
v6 = -1207418117;
v11 = v6;
}
if ( v11 != -1490231676 )
break;
++v12;
v11 = -768723158;
}
if ( v11 != -1407902233 )
break;
v4 = -1188300396;
if ( v15[v12] <= '9' )
v4 = -478229440;
v11 = v4;
}
if ( v11 != -1207418117 )
break;
v7 = 1740029224;
if ( v15[v12] <= 'z' )
v7 = 2096910144;
v11 = v7;
}
if ( v11 != -1188300396 )
break;
v5 = -1771681815;
if ( v15[v12] == '-' )
v5 = -1167333891;
v11 = v5;
}
if ( v11 != -1167333891 )
break;
v13[v12] = v15[v12];
v11 = -118846692;
}
if ( v11 != -995934932 )
break;
v3 = -1188300396;
if ( v15[v12] >= '0' )
v3 = -1407902233;
v11 = v3;
}
if ( v11 != -991718889 )
break;
v11 = -1490231676;
}
if ( v11 != -768723158 )
break;
v8 = 1681851953;
if ( v12 < 36 )
v8 = 434013166;
v11 = v8;
}
if ( v11 != -624695604 )
break;
v2 = 659899916;
if ( v12 < 36 )
v2 = -995934932;
v11 = v2;
}
if ( v11 != -478229440 )
break;
v13[v12] = v15[v12] + 17;//这里将0-9的加上17
v11 = 1926387427;
}
if ( v11 != -451717645 )
break;
++v12;
v11 = -624695604;
}
if ( v11 != -118846692 )
break;
v11 = 1926387427;
}
if ( v11 != 329160926 )
break;
v16 = 0;
v11 = 1269730414;
}
if ( v11 != 434013166 )
break;
v9 = -991718889;
if ( v13[v12] != v14[v12] )
v9 = 329160926;
v11 = v9;
}
if ( v11 != 659899916 )
break;
v12 = 0;
v11 = -768723158;
}
if ( v11 == 1269730414 )
break;
switch ( v11 )
{
case 1681851953:
v16 = 1;
v11 = 1269730414;
break;
case 1740029224:
v11 = -118846692;
break;
case 1926387427:
v11 = -451717645;
break;
case 2096910144:
v13[v12] = v15[v12] - 1347911315 + 1347911267;//这里将a-z的加上48
v11 = 1740029224;
break;
脚本得到flag
a='J2261C63-3I2I-EGE4-IBCC-IE41A5I5F4HB'
flag = "flag{"
for i in a:
if i>='0' and i<='9':
flag += chr(ord(i)+48)
elif i>='A' and i<='J':
flag += chr(ord(i)-17)
else:
flag +=i
print (flag,end='')
print("}")
#flag{9bbfa2fc-c8b8-464d-8122-84da0e8e5d71}
