[ACTF新生赛2020]easyre

先脱壳

Main函数

将找到的字符在_data_start_数组中的索引加1

*F'\"N,\"(I?+@的ASCII是{ 42, 70, 39, 34, 78, 44, 34, 40, 73, 63, 43, 64, 0 }

这是判断flag是否是ACTF{}的形式

Shift+f12找字符串

提取数据

126, 125, 124, 123, 122, 121, 120, 119, 118, 117,

116, 115, 114, 113, 112, 111, 110, 109, 108, 107,

106, 105, 104, 103, 102, 101, 100, 99, 98, 97,

96, 95, 94, 93, 92, 91, 90, 89, 88, 87,

86, 85, 84, 83, 82, 81, 80, 79, 78, 77,

76, 75, 74, 73, 72, 71, 70, 69, 68, 67,

66, 65, 64, 63, 62, 61, 60, 59, 58, 57,

56, 55, 54, 53, 52, 51, 50, 49, 48, 47,

46, 45, 44, 43, 42, 41, 40, 39, 38, 37,

36, 35, 32, 33, 34, 0

#include <stdio.h> #include <string.h> int main() {     char v4[] = { 42, 70, 39, 34, 78, 44, 34, 40, 73, 63, 43, 64, 0 };     int X;     unsigned char _data_start_[] =     {         126, 125, 124, 123, 122, 121, 120, 119, 118, 117,         116, 115, 114, 113, 112, 111, 110, 109, 108, 107,         106, 105, 104, 103, 102, 101, 100, 99, 98, 97,         96, 95, 94, 93, 92, 91, 90, 89, 88, 87,         86, 85, 84, 83, 82, 81, 80, 79, 78, 77,         76, 75, 74, 73, 72, 71, 70, 69, 68, 67,         66, 65, 64, 63, 62, 61, 60, 59, 58, 57,         56, 55, 54, 53, 52, 51, 50, 49, 48, 47,         46, 45, 44, 43, 42, 41, 40, 39, 38, 37,         36, 35, 32, 33, 34, 0     };     int v4_length = sizeof(v4) / sizeof(v4[0]);     int data_start_length = sizeof(_data_start_) / sizeof(_data_start_[0]);     for (int i = 0; i < v4_length; i++)     {         for (int j = 0; j < data_start_length; j++)         {             if (v4[i] == _data_start_[j])             {                 X = j + 1;                 printf("%c", X);             }         }     }     return 0; }