Tag Archives: buuctf re [MRCTF2020]Xor

How to Solve Error: buuctf re [MRCTF2020]Xor

Direct IDA without shell

Errors found

The main function cannot F5, so just enter the error reporting line, F5, and then exit

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int i; // eax

  sub_401020((int)"Give Me Your Flag String:\n");
  sub_401050("%s", byte_4212C0);
  if ( strlen(byte_4212C0) != 27 )
  {
LABEL_6:
    sub_401020((int)"Wrong!\n");
    sub_404B7E("pause");
    _loaddll(0);
    __debugbreak();
  }
  for ( i = 0; i < 0x1B; ++i )
  {
    if ( ((unsigned __int8)i ^ (unsigned __int8)byte_4212C0[i]) != byte_41EA08[i] )
      goto LABEL_6;
  }
  sub_401020((int)"Right!\n");
  sub_404B7E("pause");
  return 0;
}

View byte_41ea08 content

.rdata:0041EA08 byte_41EA08     db 4Dh                  ; DATA XREF: _main+48↑r
.rdata:0041EA09 aSawbFxzJTqjNBp db 'SAWB~FXZ:J:`tQJ"N@ bpdd}8g',0

Isochronize byte_41EA08 by bit back

a = "MSAWB~FXZ:J:`tQJ\"N@ bpdd}8g"
flag = ''
for i in range(len(a)):
    flag += chr(i ^ord(a[i]))
print(flag)