CG CTF RE ReadAsm2

https://cgctf.nuptsast.com/files/2.asm

题解：

int main(int argc, char const *argv[])
{
  char input[] = {0x0,  0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,
                  0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,
                  0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c};
  func(input, 28);
  printf("%s\n",input+1);
  return 0;
}

2.asm文件 

00000000004004e6 <func>:
  4004e6: 55                    push   rbp
  4004e7: 48 89 e5              mov    rbp,rsp
  4004ea: 48 89 7d e8           mov    QWORD PTR [rbp-0x18],rdi
  4004ee: 89 75 e4              mov    DWORD PTR [rbp-0x1c],esi
  4004f1: c7 45 fc 01 00 00 00  mov    DWORD PTR [rbp-0x4],0x1
  4004f8: eb 28                 jmp    400522 <func+0x3c>
  4004fa: 8b 45 fc              mov    eax,DWORD PTR [rbp-0x4]
  4004fd: 48 63 d0              movsxd rdx,eax
  400500: 48 8b 45 e8           mov    rax,QWORD PTR [rbp-0x18]
  400504: 48 01 d0              add    rax,rdx
  400507: 8b 55 fc              mov    edx,DWORD PTR [rbp-0x4]
  40050a: 48 63 ca              movsxd rcx,edx
  40050d: 48 8b 55 e8           mov    rdx,QWORD PTR [rbp-0x18]
  400511: 48 01 ca              add    rdx,rcx
  400514: 0f b6 0a              movzx  ecx,BYTE PTR [rdx]
  400517: 8b 55 fc              mov    edx,DWORD PTR [rbp-0x4]
  40051a: 31 ca                 xor    edx,ecx
  40051c: 88 10                 mov    BYTE PTR [rax],dl
  40051e: 83 45 fc 01           add    DWORD PTR [rbp-0x4],0x1
  400522: 8b 45 fc              mov    eax,DWORD PTR [rbp-0x4]
  400525: 3b 45 e4              cmp    eax,DWORD PTR [rbp-0x1c]
  400528: 7e d0                 jle    4004fa <func+0x14>
  40052a: 90                    nop
  40052b: 5d                    pop    rbp
  40052c: c3                    ret

00000000004004e6 <func>:
;  虚拟地址   ; 对应的计算机指令  ; 汇编语言
  4004e6: 55                    push   rbp                          ; 将寄存器的值压入栈中  /* 这两行是每个函数都会有的，有关函数调用的
  4004e7: 48 89 e5              mov    rbp,rsp                      ; 建立新栈帧           */
  4004ea: 48 89 7d e8           mov    QWORD PTR [rbp-0x18],rdi     ; rdi存第一个参数     //[rbp-0x18] = input[0]
  4004ee: 89 75 e4              mov    DWORD PTR [rbp-0x1c],esi     ; esi存第二个参数 //[rbp-0x1c] = 28
  4004f1: c7 45 fc 01 00 00 00  mov    DWORD PTR [rbp-0x4],0x1      ; 首先将0x1赋值给[rbp-0x4] //i = 1
  4004f8: eb 28                 jmp    400522 <func+0x3c>           ; 无条件跳转到400522
  4004fa: 8b 45 fc              mov    eax,DWORD PTR [rbp-0x4]      ; [rbp-0x4]赋值给eax  // eax=i=1
  4004fd: 48 63 d0              movsxd rdx,eax                      ; eax符号扩展给rdx       // rdx=eax=i=1
  400500: 48 8b 45 e8           mov    rax,QWORD PTR [rbp-0x18]     ; 把input[0]复制给 rax // rax=[rbp-0x18]=input[0]
  400504: 48 01 d0              add    rax,rdx                      ; rax += rdx  // rax=input[0]+=i
  400507: 8b 55 fc              mov    edx,DWORD PTR [rbp-0x4]      ; [rbp-0x4]的值给edx //即令edx=i=1
  40050a: 48 63 ca              movsxd rcx,edx                      ; edx符号扩展给rcx  // rcx=edx=i=1
  40050d: 48 8b 55 e8           mov    rdx,QWORD PTR [rbp-0x18]     ; [rbp-0x18]给rdx //rdx = [rbp-0x18] = *input = input[0]
  400511: 48 01 ca              add    rdx,rcx                      ; rcx += rdx     // rdx = input[1]
  400514: 0f b6 0a              movzx  ecx,BYTE PTR [rdx]           ; 将rdx无符号扩展，并传送至ecx //即ecx=chr(rdx) =chr(input[0])
  400517: 8b 55 fc              mov    edx,DWORD PTR [rbp-0x4]      ; [rbp-0x4]赋值给edx  // edx = i = 1 
  40051a: 31 ca                 xor    edx,ecx                      ; edx ^ ecx结果存到dx    // input[0] ^ i
  40051c: 88 10                 mov    BYTE PTR [rax],dl            ; rax = dl  dx的低8位(dl)存到rax
  40051e: 83 45 fc 01           add    DWORD PTR [rbp-0x4],0x1      ; [rbp-0x4] += 1   // i++
  400522: 8b 45 fc              mov    eax,DWORD PTR [rbp-0x4]      ; 把[rbp-0x4]赋值给eax
  400525: 3b 45 e4              cmp    eax,DWORD PTR [rbp-0x1c]     ; eax和[rbp-0x1c]判断
  400528: 7e d0                 jle    4004fa <func+0x14>           ; 如果eax <= [rbp-0x1c]  跳转到4004fa
  40052a: 90                    nop
  40052b: 5d                    pop    rbp                          ; rbp出栈
  40052c: c3                    ret                                 ; return 返回地址   //取出当前栈顶值，作为返回地址

 C++版本

char * func(char* inputs,int num){
    char * flag=new char[num];
    for(int i=1;i<=28;i++)
        flag[i-1]=(char)(inputs[i-1]^i);
    return flag;
}
int main(){
    char inputs[]={0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c};
    char * flag = func(inputs, 28);
    printf("%s",flag);
}
//flag{read_asm_is_the_basic}

 Python版本

def func(inputs, num):
    flag = ''
    for i in range(1, num):
        flag += chr(inputs[i-1] ^ i)
    return flag

def main():
    inputs = [0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c]
    flag = func(inputs, 28)
    print flag

if __name__=='__main__':
    main()

# flag{read_asm_is_the_basic}