[SWPUCTF 2023 秋季新生赛]Easy SMC

将下述文件拉到kali命令行执行

我的kali是64，所以选linux_server

根据IP和端口填远程调试

在此处打断点

、

按F7进入GetNextNumber函数

按U取消定义

选中0000555555555527到00005555555557B6，此处有retn

按c强制转换为代码

按p转换为函数

按f5查看伪函数

exp

python 复制代码

import re

s = """
.text:0000555555555545 mov     [rbp+var_110], 4Eh ; 'N'
.text:000055555555554F mov     [rbp+var_10C], 52h ; 'R'
.text:0000555555555559 mov     [rbp+var_108], 51h ; 'Q'
.text:0000555555555563 mov     [rbp+var_104], 40h ; '@'
.text:000055555555556D mov     [rbp+var_100], 50h ; 'P'
.text:0000555555555577 mov     [rbp+var_FC], 41h ; 'A'
.text:0000555555555581 mov     [rbp+var_F8], 75h ; 'u'
.text:000055555555558B mov     [rbp+var_F4], 61h ; 'a'
.text:0000555555555595 mov     [rbp+var_F0], 2Bh ; '+'
.text:000055555555559F mov     [rbp+var_EC], 2Ch ; ','
.text:00005555555555A9 mov     [rbp+var_E8], 4Fh ; 'O'
.text:00005555555555B3 mov     [rbp+var_E4], 25h ; '%'
.text:00005555555555BD mov     [rbp+var_E0], 6Ah ; 'j'
.text:00005555555555C7 mov     [rbp+var_DC], 5Ch ; '\'
.text:00005555555555D1 mov     [rbp+var_D8], 34h ; '4'
.text:00005555555555DB mov     [rbp+var_D4], 5Dh ; ']'
.text:00005555555555E5 mov     [rbp+var_D0], 31h ; '1'
.text:00005555555555EF mov     [rbp+var_CC], 65h ; 'e'
.text:00005555555555F9 mov     [rbp+var_C8], 3Ah ; ':'
.text:0000555555555603 mov     [rbp+var_C4], 22h ; '"'
.text:000055555555560D mov     [rbp+var_C0], 4Bh ; 'K'
.text:0000555555555617 mov     [rbp+var_BC], 1Ch
.text:0000555555555621 mov     [rbp+var_B8], 58h ; 'X'
.text:000055555555562B mov     [rbp+var_B4], 5Dh ; ']'
.text:0000555555555635 mov     [rbp+var_B0], 1Bh
.text:000055555555563F mov     [rbp+var_AC], 59h ; 'Y'
.text:0000555555555649 mov     [rbp+var_A8], 4Bh ; 'K'
.text:0000555555555653 mov     [rbp+var_A4], 1Ah
.text:000055555555565D mov     [rbp+var_A0], 58h ; 'X'
.text:0000555555555667 mov     [rbp+var_9C], 4Ch ; 'L'
.text:0000555555555671 mov     [rbp+var_98], 50h ; 'P'
.text:000055555555567B mov     [rbp+var_94], 48h ; 'H'
.text:0000555555555685 mov     [rbp+var_90], 3Fh ; '?'
.text:000055555555568F mov     [rbp+var_8C], 52h ; 'R'
.text:0000555555555699 mov     [rbp+var_88], 11h
.text:00005555555556A3 mov     [rbp+var_84], 0Eh
.text:00005555555556AD mov     [rbp+var_80], 42h ; 'B'
.text:00005555555556B4 mov     [rbp+var_7C], 3Ah ; ':'
.text:00005555555556BB mov     [rbp+var_78], 47h ; 'G'
.text:00005555555556C2 mov     [rbp+var_74], 9
.text:00005555555556C9 mov     [rbp+var_70], 3Ch ; '<'
.text:00005555555556D0 mov     [rbp+var_6C], 8
.text:00005555555556D7 mov     [rbp+var_68], 3Ch ; '<'
.text:00005555555556DE mov     [rbp+var_64], 4Eh ; 'N'
.text:00005555555556E5 mov     [rbp+var_60], 33h ; '3'
.text:00005555555556EC mov     [rbp+var_5C], 36h ; '6'
.text:00005555555556F3 mov     [rbp+var_58], 2
.text:00005555555556FA mov     [rbp+var_54], 35h ; '5'
.text:0000555555555701 mov     [rbp+var_50], 3
.text:0000555555555708 mov     [rbp+var_4C], 2Eh ; '.'
.text:000055555555570F mov     [rbp+var_48], 0FFFFFFFFh
.text:0000555555555716 mov     [rbp+var_44], 5
.text:000055555555571D mov     [rbp+var_40], 23h ; '#'
.text:0000555555555724 mov     [rbp+var_3C], 1Eh
.text:000055555555572B mov     [rbp+var_38], 12h
.text:0000555555555732 mov     [rbp+var_34], 0Dh
.text:0000555555555739 mov     [rbp+var_30], 1Eh
.text:0000555555555740 mov     [rbp+var_2C], 0FFFFFFFAh
.text:0000555555555747 mov     [rbp+var_28], 3Bh ; ';'
.text:000055555555574E mov     [rbp+var_24], 0FFFFFFFCh
.text:0000555555555755 mov     [rbp+var_20], 33h ; '3'
.text:000055555555575C mov     [rbp+var_1C], 6
.text:0000555555555763 mov     [rbp+var_18], 16h
.text:000055555555576A mov     [rbp+var_14], 3Eh ; '>'
"""

# 关键修正：匹配逗号后的数字，可能以 h 结尾，也可能没有 h
pattern = r',\s*([0-9A-Fa-f]+)h?'
data_list = re.findall(pattern, s)
print(len(data_list))  # 应为 64

data_list = [int('0x' + x, 16) for x in data_list]

flag = ''
for i in range(len(data_list)):
    flag += chr((data_list[i] + i) & 0xff)

print(flag)

python 复制代码

import re

s = '''
  v2[0] = 78;
  v2[1] = 82;
  v2[2] = 81;
  v2[3] = 64;
  v2[4] = 80;
  v2[5] = 65;
  v2[6] = 117;
  v2[7] = 97;
  v2[8] = 43;
  v2[9] = 44;
  v2[10] = 79;
  v2[11] = 37;
  v2[12] = 106;
  v2[13] = 92;
  v2[14] = 52;
  v2[15] = 93;
  v2[16] = 49;
  v2[17] = 101;
  v2[18] = 58;
  v2[19] = 34;
  v2[20] = 75;
  v2[21] = 28;
  v2[22] = 88;
  v2[23] = 93;
  v2[24] = 27;
  v2[25] = 89;
  v2[26] = 75;
  v2[27] = 26;
  v2[28] = 88;
  v2[29] = 76;
  v2[30] = 80;
  v2[31] = 72;
  v2[32] = 63;
  v2[33] = 82;
  v2[34] = 17;
  v2[35] = 14;
  v2[36] = 66;
  v2[37] = 58;
  v2[38] = 71;
  v2[39] = 9;
  v2[40] = 60;
  v2[41] = 8;
  v2[42] = 60;
  v2[43] = 78;
  v2[44] = 51;
  v2[45] = 54;
  v2[46] = 2;
  v2[47] = 53;
  v2[48] = 3;
  v2[49] = 46;
  v2[50] = -1;
  v2[51] = 5;
  v2[52] = 35;
  v2[53] = 30;
  v2[54] = 18;
  v2[55] = 13;
  v2[56] = 30;
  v2[57] = -6;
  v2[58] = 59;
  v2[59] = -4;
  v2[60] = 51;
  v2[61] = 6;
  v2[62] = 22;
  v2[63] = 62;
'''

# 正则：匹配 v2[数字] = 数字;
# (-?\d+) 可以匹配负数，比如 -1、-6、-4
nums = re.findall(r'v2\[\d+\]\s*=\s*(-?\d+)\s*;', s)
nums = [int(x) for x in nums]

print(len(nums))  # 64
print(nums)

flag = ''
for i in range(len(nums)):
    flag += chr((nums[i] + i) & 0xff)

print(flag)