[20240318]ezre

分析函数

里面只要是三个加密函数，sub_1492，sub_16B3，sub_1249

其中sub_1492通过aThi51sKey给地址&unk_4160地址创建了一个值

sub_16B3通过&unk_4160地址的值对输入内容进行了加密

最后sub_1249对加密后的输入内容进行了base64加密并用a0123456789xyza进行映射得到了s1

尝试用python进行复现

#sub_1492

a1=[0]*128
v9=['']*128
a2='Thi5_1S_key?'
a3=len(a2)
for i in range(128):
    a1[i]=i
    v9[i]=a2[i % a3]
print(a1)
print(v9)

import ctypes
def hidword_right_shift(v3, n=0):
    # 将v3转换为64位有符号整数
    v3_int = ctypes.c_int64(v3).value
    # 取出高32位部分
    hidword = v3_int >> 32
    # 右移n位
    result = hidword >> n
    return result
v8=0

for j in range(128):
    v3=v8+a1[j]+ord(v9[j])
    v8=((hidword_right_shift(v3,25)+v8+a1[j]+ord(v9[j]))& 0x7F)-(hidword_right_shift(v3,25))
    v5=a1[j]
    a1[j]=a1[v8]
    a1[v8]=v5
print(a1)

#sub_16B3
import ctypes
def hidword_right_shift(v3, n=0):
    # 将v3转换为64位有符号整数
    v3_int = ctypes.c_int64(v3).value
    # 取出高32位部分
    hidword = v3_int >> 32
    # 右移n位
    result = hidword >> n
    return result

x='\x0f<AurBS\x06]L2\x1d*\\I&"Ki"'
print(len(x))
a3=len(x)
a1=[84, 13, 8, 96, 20, 44, 65, 42, 48, 46, 28, 102, 27, 71, 50, 116, 101, 5, 104, 126, 35, 36, 82, 92, 72, 113, 17, 33, 37, 4, 62, 77, 91, 76, 23, 41, 120, 69, 0, 60, 123, 107, 106, 90, 80, 97, 25, 21, 115, 125, 117, 67, 61, 58, 112, 22, 119, 12, 103, 81, 111, 3, 109, 88, 78, 55, 18, 45, 74, 26, 79, 95, 75, 124, 85, 15, 29, 14, 49, 110, 121, 30, 34, 54, 105, 122, 40, 38, 83, 86, 11, 99, 94, 100, 114, 59, 93, 10, 66, 1, 47, 19, 9, 70, 63, 108, 127, 68, 31, 52, 24, 87, 32, 57, 56, 2, 118, 16, 89, 73, 7, 39, 64, 43, 53, 51, 98, 6]
v6=0
v7=0
flag=[]
a2=list(x)
for i in range(a3):
    v6=(v6+1)%128
    v3=a1[v6]+v7
    v7=((hidword_right_shift(v3,25)+a1[v6]+v7%256)& 0x7F)-hidword_right_shift(v3,25)
    v5=a1[v6]
    a1[v6]=a1[v7]
    a1[v7]=v5
    print(a1[(a1[v6]+a1[v7])& 127],end=',')
    a2[i]=(ord(a2[i])^a1[(a1[v6]+a1[v7])& 127])
print(a2)
for i in a2:
    print(chr(i),end='')

#sub_1249
import base64
x='3pn1Ek92hmAEg38EXMn99J9YBf8='
a='0123456789XYZabcdefghijklABCDEFGHIJKLMNOPQRSTUVWmnopqrstuvwxyz+/='
b='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='
flag=''
for i in x:
    k=a.find(i)
    flag+=b[k]
print(flag)
print(base64.b64decode(flag))

最后在中得到#sub_16B3结果flag{Simple_rEvErse}