James Hoi's Blog

MRCTF-2021 writeup

Word count: 389Reading time: 1 min
2021/04/11 Share

前言

师傅们别骂了,我抽空一定努力好好学

Dynamic Debug dynamic_debug

动调进去发现是TEA加密,调试一下发现是DWORD类型,写脚本就出了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#include <iostream>
#include <stdio.h>
#include <Windows.h>

void decrypt(DWORD* v, DWORD* k) {
DWORD v0 = v[0], v1 = v[1], sum = 0xC6EF3720, i; /* set up */
DWORD delta = 0x9E3779B9; /* a key schedule constant */
DWORD k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3]; /* cache key */
for (i = 0; i < 32; i++) { /* basic cycle start */
v1 -= ((v0 >> 5) + k3) ^ (v0 + sum) ^ ((v0 << 4) + k2);
v0 -= ((v1 >> 5) + k1) ^ (v1 + sum) ^ ((v1 << 4) + k0);
sum -= delta;
} /* end cycle */
v[0] = v0; v[1] = v1;
}

int main()
{
unsigned char enflag[32] = {
0x99, 0xA1, 0x85, 0x55, 0x68, 0x5D, 0x82, 0x7E, 0x39, 0x00,
0x4D, 0x94, 0x43, 0x69, 0x72, 0x71, 0x06, 0x43, 0x51, 0x6A,
0x00, 0xAD, 0x14, 0x4B, 0x3F, 0x0D, 0xD2, 0x64, 0x15, 0xDB,
0x37, 0x9F
};
DWORD key[4] = { 0x6B696C69,0x79645F65,0x696D616E,0x67626463 };
for (int i = 0; i < 4; i++)
decrypt((DWORD*)&enflag[i*8], key);
for (int i = 0; i < 32; i++)
printf("%c", enflag[i]);
return 0;
}

MRCTF{Dyn4m1c_d3buG_1s_a_ki11eR}

EzGame EzGame.zip

ce修改然后手玩过去的(师傅别骂了,有空我再复现一下
image.png
发现key是用来最后解密flag的,且每吃到一次token key就进行一次加密
游戏需满足以下条件才能获取flag:

  1. 吃到刚刚好105颗token(一共有106颗,不能吃多,否则key会进行多一次加密)
  2. 找到外星人(修改角色x,y坐标,大约在5,-10的位置,需要角色碰到外星人)
  3. 吃到曲奇(3,4,5都不需手玩,直接修改为1和0即可)
  4. 成功回家(通关)
  5. 死亡次数为零

QQ图片20210411221527.png

CATALOG
  1. 1. 前言
  2. 2. Dynamic Debug dynamic_debug
  3. 3. EzGame EzGame.zip