FFunction

ida打开my_plugin.dll

在my_plugin.dll的f函数断下，f函数先将第⼀个参数的数值分成2个word，然后tea加密并与第⼆个参数的值⽐较。第⼀个参数的值是输⼊经过位置变换然后base64

第二个参数

1
2

[+] Dump 0x1ECA101B060 - 0x1ECA101B0B0 (80 bytes) :
[0x5C15754C, 0xD1D781E7, 0x501BF173, 0xCB4DB222, 0x215D61F5, 0x3FCA9EE7, 0x7C76B5C7, 0xC7DD8CB9, 0x990D23FA, 0x0BAB1AD3, 0x8E12C932, 0xD307BAF2, 0xE52DD123, 0xFBB68F2C, 0xBDD853E3, 0x892E1E4E, 0x39DD66FA, 0x87FEEC65, 0x307C5E60, 0x340C6C00]

tea解密



#include <stdio.h>
#include <windows.h>
void Decrypt(UINT32 *v, UINT32 *k)
{
    unsigned long n = 32, sum, y = v[0], z = v[1];
    unsigned long delta = 0x79B99E37;
    sum = delta << 5;
    while (n-- > 0)
    {
        z += ((y << 4) + k[2]) ^ (y + sum) ^ ((y >> 5) + k[3]);
        y += ((z << 4) + k[0]) ^ (z + sum) ^ ((z >> 5) + k[1]);
        sum -= delta;
    }
    v[0] = y;
    v[1] = z;
}
int main()
{
    UINT32 key[4] = {0x0BABEC0FE,
                     0x0DEADBEEF,
                     0x0FACEB00C,
                     0xDEADC0DE};
    UINT32 enc[21] = {1544910156, 3520561639, 1344008563, 3410866722,
                      559768053, 1070243559, 2088154567, 3353185465,
                      2567775226, 195762899, 2383595826, 3540499186,
                      3844985123, 4223045420, 3185071075, 2301501006,
                      970811130, 2281630821, 813456992, 873229312, 0};
    Decrypt(enc, key);
    Decrypt(enc + 2, key);
    Decrypt(enc + 4, key);
    Decrypt(enc + 6, key);
    Decrypt(enc + 8, key);
    Decrypt(enc + 10, key);
    Decrypt(enc + 12, key);
    Decrypt(enc + 14, key);
    Decrypt(enc + 16, key);
    Decrypt(enc + 18, key);
    Decrypt(enc + 20, key);
    for (int i = 0; i < 20 * 4; i++)
    {
        printf("%02x", ((char *)enc)[i]);
    }
    
}

再经过base64解码

import base64

a="30014006400460044007500230035008600c400a600e6003600c300930016004300340025004400d7007500250086002600f5006300050083007400e3000500a600840055007400970033001600e500a"
import re
ccc=re.findall(".{2}",a)
ccc=[int(i,16) for i in ccc]
fl=""
for index in range(0,len(ccc),2):
    fl+=(chr(ccc[index]+ccc[index+1]))
print(fl[::-1])
print(base64.b64decode(fl[::-1]).decode())

还原

flag="f}l!a!gC{_Ehmtp10ww_erre_tFt1u"
print(len(flag))
f1=""
f2=""
for index in range(len(flag)):
    if index%2==0:
        f1+=flag[index]
    else:
        f2+=flag[index]
print(f1+f2)

1	flag{Emp0wer_F1}!!C_ht1w_rettu

再把后部分逆序

1	flag{Emp0wer_F1utter_w1th_C!!}

参考dsctf2022 wp - FW_ltlly - 博客园 (cnblogs.com)