{"id":2047,"date":"2023-07-10T16:09:31","date_gmt":"2023-07-10T08:09:31","guid":{"rendered":"https:\/\/fushuling.com\/?p=2047"},"modified":"2023-07-31T14:40:49","modified_gmt":"2023-07-31T06:40:49","slug":"%e9%80%86%e5%90%91%e5%88%b7%e9%a2%98%e9%9a%8f%e8%ae%b0%e6%8c%81%e7%bb%ad%e6%9b%b4%e6%96%b0%e4%b8%ad","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2023\/07\/10\/%e9%80%86%e5%90%91%e5%88%b7%e9%a2%98%e9%9a%8f%e8%ae%b0%e6%8c%81%e7%bb%ad%e6%9b%b4%e6%96%b0%e4%b8%ad\/","title":{"rendered":"\u9006\u5411\u5237\u9898\u968f\u8bb0(\u6301\u7eed\u66f4\u65b0\u4e2d)"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">NSS\u5e73\u53f0<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">[SWPUCTF 2021 \u65b0\u751f\u8d5b]re1<\/h2>\n\n\n\n<p>\u76f4\u63a5f5\u53cd\u7f16\u8bd1<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>int __cdecl main(int argc, const char **argv, const char **envp)\r\n{\r\n  char Str2&#91;1008]; \/\/ &#91;rsp+20h] &#91;rbp-60h] BYREF\r\n  char Str1&#91;1000]; \/\/ &#91;rsp+410h] &#91;rbp+390h] BYREF\r\n  int i; \/\/ &#91;rsp+7FCh] &#91;rbp+77Ch]\r\n\r\n  _main();\r\n  strcpy(Str2, \"{34sy_r3v3rs3}\");\r\n  printf(\"please put your flag:\");\r\n  scanf(\"%s\", Str1);\r\n  for ( i = 0; i &lt;= 665; ++i )\r\n  {\r\n    if ( Str1&#91;i] == 101 )\r\n      Str1&#91;i] = 51;\r\n  }\r\n  for ( i = 0; i &lt;= 665; ++i )\r\n  {\r\n    if ( Str1&#91;i] == 97 )\r\n      Str1&#91;i] = 52;\r\n  }\r\n  if ( strcmp(Str1, Str2) )\r\n    printf(\"you are wrong,see again!\");\r\n  else\r\n    printf(\"you are right!\");\r\n  system(\"pause\");\r\n  return 0;\r\n}<\/code><\/pre>\n\n\n\n<p>\u903b\u8f91\u5f88\u7b80\u5355\uff0c\u5c31\u662f\u628a\u8f93\u5165\u4f5c\u4e3aStr1\u7136\u540e\u4e0eStr2\u6bcf\u4e2a\u5b57\u6bcd\u8fdb\u884c\u6bd4\u8f83\uff0cascii\u7801\u5982\u679c\u4e3a101\u5c31\u66ff\u6362\u621051\uff0c\u5982\u679c\u662f97\u5c31\u66ff\u6362\u621052<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>str2=\"{34sy_r3v3rs3}\"\r\nstr1=\"\"\r\nfor i in str2:\r\n    if ord(i)==51:\r\n        str1+=chr(101)\r\n    elif ord(i)==52:\r\n        str1+=chr(97)\r\n    else:\r\n        str1+=i\r\nprint(str1)\n#{easy_reverse}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">[SWPUCTF 2021 \u65b0\u751f\u8d5b]re2<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>int __cdecl main(int argc, const char **argv, const char **envp)\r\n{\r\n  char Str2&#91;64]; \/\/ &#91;rsp+20h] &#91;rbp-90h] BYREF\r\n  char Str&#91;68]; \/\/ &#91;rsp+60h] &#91;rbp-50h] BYREF\r\n  int v7; \/\/ &#91;rsp+A8h] &#91;rbp-8h]\r\n  int i; \/\/ &#91;rsp+ACh] &#91;rbp-4h]\r\n\r\n  _main();\r\n  strcpy(Str2, \"ylqq]aycqyp{\");\r\n  printf(&amp;Format);\r\n  gets(Str);\r\n  v7 = strlen(Str);\r\n  for ( i = 0; i &lt; v7; ++i )\r\n  {\r\n    if ( (Str&#91;i] &lt;= 96 || Str&#91;i] > 98) &amp;&amp; (Str&#91;i] &lt;= 64 || Str&#91;i] > 66) )\r\n      Str&#91;i] -= 2;\r\n    else\r\n      Str&#91;i] += 24;\r\n  }\r\n  if ( strcmp(Str, Str2) )\r\n    printf(&amp;byte_404024);\r\n  else\r\n    printf(aBingo);\r\n  system(\"pause\");\r\n  return 0;\r\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>l = 'ylqq]aycqyp{'\ns = &#91;]\nfor i in l:\n    s.append(ord(i))\nprint(s)\nr=\"\"\nfor i in s:\n    if(i &lt;= 94 or i > 96) and (i &lt;= 62 or i > 64):\n      r+=chr(i+2)\n    else:\n      r+=chr(i-24)\nprint(r)\n#{nss_c{es{r}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"438\" height=\"110\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2048\"  sizes=\"auto, (max-width: 438px) 100vw, 438px\" \/><\/div><\/figure>\n\n\n\n<p>\u5728\u7a0b\u5e8f\u91cca\u53ef\u4ee5\u7528{\u4ee3\u66ff\u6240\u4ee5flag\u5c31\u662f\uff1aNSSCTF{nss_caesar} <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">[GFCTF 2021]wordy<\/h2>\n\n\n\n<p>\u76f4\u63a5f5\u53cd\u7f16\u8bd1main\u51fd\u6570\u53cd\u7f16\u8bd1\u4e0d\u51fa\u6765\uff0c\u56e0\u4e3a\u6709\u82b1\u6307\u4ee4\u6df7\u6dc6\u4e86\uff0c\u6700\u5e38\u89c1\u7684\u5c31\u662f\u5728\u673a\u5668\u7801\u4e2d\u52a0\u5165 E8\uff0cE8 \u52a0\u5165\u540e\u4f1a\u5c06\u6c47\u7f16\u4ee3\u7801\u6539\u53d8\u4e3a CALL\uff0c\u800c\u540e\u7eed\u7684\u673a\u5668\u7801\u4ee3\u8868\u7684\u4e1c\u897f\u662f\u6ca1\u6709\u610f\u4e49\u7684\uff0c\u4e0d\u662f\u4e00\u4e2a\u51fd\u6570\uff0c\u6240\u4ee5 CALL \u4e4b\u540e\u53cd\u7f16\u8bd1\u5668\u65e0\u6cd5\u8bc6\u522b\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-1-1024x509.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"509\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-1-1024x509.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2050\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u627e\u5230\u673a\u68b0\u7801\u4e3aEBFF\u7684\uff0c\u628a\u5b83\u6539\u621090(\u5373\u4e3ano\u7684\u673a\u68b0\u7801\uff09<\/p>\n\n\n\n<p>file-Script-command\u5199\u4ee3\u7801\u4e00\u952e\u4fee\u6539\uff0c\u5373\u4ece\u8d77\u59cb\u5730\u5740\u76840x1135\u5230\u7ed3\u675f\uff0c\u901a\u8fc7\u904d\u5386byte\uff0c\u5224\u65ad\u662f\u5426\u662fEB FF\uff0c\u5373jmp\u7684\u673a\u68b0\u7801\uff0c\u662f\u5219\u6539\u621090\uff0c\u5373nop\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>startaddr = 0x1135\r\nendaddr = 0x3100\r\n\r\nfor i in range(startaddr,endaddr):\r\n    if get_wide_byte(i) == 0xEB:\r\n        if get_wide_byte(i+1) == 0xFF:\r\n            patch_byte(i,0x90)\r\n\r<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-3-1024x586.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"586\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-3-1024x586.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2052\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u5728\u4e2d\u95f4\u627e\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-4-1024x542.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"542\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/07\/1-4-1024x542.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2053\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>GCTF{u_are2wordy}<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NSS\u5e73\u53f0 [SWPUCTF 2021 \u65b0\u751f\u8d5b]re1 \u76f4\u63a5f5\u53cd\u7f16\u8bd1 \u903b\u8f91\u5f88\u7b80\u5355\uff0c\u5c31\u662f\u628a\u8f93\u5165\u4f5c\u4e3aStr1\u7136\u540e [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-2047","post","type-post","status-publish","format-standard","hentry","category-6"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=2047"}],"version-history":[{"count":2,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2047\/revisions"}],"predecessor-version":[{"id":2054,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2047\/revisions\/2054"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=2047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=2047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=2047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}