Replace
查壳是upx的壳
在这里插入图片描述
脱壳后，放进IDA查看main函数，第一个if语句是判断字符长度，第二个if是调用sub_401090

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Buffer; // [esp+4h] [ebp-2Ch] BYREF
  char v5[39]; // [esp+5h] [ebp-2Bh] BYREF

  Buffer = 0;
  memset(v5, 0, sizeof(v5));
  printf("Welcome The System\nPlease Input Key:");
  gets_s(&Buffer, 0x28u);
  if ( strlen(&Buffer) - 35 <= 2 )
  {
    if ( sub_401090(&Buffer) == 1 )
      printf("Well Done!\n");
    else
      printf("Your Wrong!\n");
  }
  return 0;
}

查看sub_401090：while里面三个if分别对应着三个数组，并相应地对数组进行处理

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
int __fastcall sub_401090(int a1, int a2)
{
  int v4; // edx
  char v5; // al
  int v6; // esi
  int v7; // edi
  char v8; // al
  int v9; // eax
  char v10; // cl
  int v11; // eax
  int v12; // ecx

  if ( a2 != 35 )
    return -1;
  v4 = 0;
  while ( 1 )
  {
    v5 = *(_BYTE *)(v4 + a1);
    v6 = (v5 >> 4) % 16;
    v7 = ((16 * v5) >> 4) % 16;
    v8 = byte_402150[2 * v4];
    if ( v8 < 48 || v8 > 57 )
      v9 = v8 - 87;
    else
      v9 = v8 - 48;
    v10 = byte_402151[2 * v4];
    v11 = 16 * v9;
    if ( v10 < 48 || v10 > 57 )
      v12 = v10 - 87;
    else
      v12 = v10 - 48;
    if ( (unsigned __int8)byte_4021A0[16 * v6 + v7] != ((v11 + v12) ^ 25) )
      break;
    if ( ++v4 >= 35 )
      return 1;
  }
  return -1;
}

跟进去看各个数组的具体值
在这里插入图片描述
可以得到byte_402150以及byte_402151：

1
2a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6
1
a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6

和十六进制代码byte_4021A0：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
63 7C 77 7B F2 6B 6F C5  30 01 67 2B FE D7 AB 76
CA 82 C9 7D FA 59 47 F0  AD D4 A2 AF 9C A4 72 C0
B7 FD 93 26 36 3F F7 CC  34 A5 E5 F1 71 D8 31 15
04 C7 23 C3 18 96 05 9A  07 12 80 E2 EB 27 B2 75
09 83 2C 1A 1B 6E 5A A0  52 3B D6 B3 29 E3 2F 84
53 D1 00 ED 20 FC B1 5B  6A CB BE 39 4A 4C 58 CF
D0 EF AA FB 43 4D 33 85  45 F9 02 7F 50 3C 9F A8
51 A3 40 8F 92 9D 38 F5  BC B6 DA 21 10 FF F3 D2
CD 0C 13 EC 5F 97 44 17  C4 A7 7E 3D 64 5D 19 73
60 81 4F DC 22 2A 90 88  46 EE B8 14 DE 5E 0B DB
E0 32 3A 0A 49 06 24 5C  C2 D3 AC 62 91 95 E4 79
E7 C8 37 6D 8D D5 4E A9  6C 56 F4 EA 65 7A AE 08
BA 78 25 2E 1C A6 B4 C6  E8 DD 74 1F 4B BD 8B 8A
70 3E B5 66 48 03 F6 0E  61 35 57 B9 86 C1 1D 9E
E1 F8 98 11 69 D9 8E 94  9B 1E 87 E9 CE 55 28 DF
8C A1 89 0D BF E6 42 68  41 99 2D 0F B0 54 BB 16

写脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
a='2a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6'
b='a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6'
c=[0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76,
0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0,
0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15,
0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75,
0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84,
0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF,
0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8,
0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2,
0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73,
0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB,
0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79,
0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08,
0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A,
0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E,
0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF,
0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16]
flag=[]
v4=0
while (True):
    v8 = ord(a[2 * v4])
    if v8 < 48 or v8 > 57:
       v9 = v8 - 87
    else:
        v9 = v8 - 48
    v10 = ord(b[2 * v4])
    v11 = 16 * v9
    if v10 < 48 or v10 > 57 :
       v12 = v10 - 87
    else:
       v12 = v10 - 48
    for v5 in range(32,127):
        v6 = (v5 >> 4) % 16
        v7 = ((16 * v5) >> 4) % 16
        if ( c[16 * v6 + v7] == ((v11 + v12) ^ 25) ):
            flag.append(chr(v5))
            break
    v4+=1
    if v4 >= 35:break
print(''.join(flag))

运行：

1
flag{Th1s_1s_Simple_Rep1ac3_Enc0d3}