HugeH4rD

reverse2

0x01

---

Exeinfo PE check

NOT Win EXE - .o - ELF executable [ 64bit obj. Exe file - CPU : AMD x86-64 - OS: unspecified ] 
 -> Compiler : GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4

0x02

---

IDA

分析主函数 main()

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  int stat_loc; // [rsp+4h] [rbp-3Ch] BYREF
  int i; // [rsp+8h] [rbp-38h]
  __pid_t pid; // [rsp+Ch] [rbp-34h]
  char s2[24]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v8; // [rsp+28h] [rbp-18h]

  v8 = __readfsqword(0x28u);
  pid = fork();
  if ( pid )
  {
    waitpid(pid, &stat_loc, 0);
  }
  else
  {
    for ( i = 0; i <= strlen(&flag); ++i ) /* 遍历 flag,将其中的i，r替换为 1 */
    {
      if ( *(&flag + i) == 105 || *(&flag + i) == 114 )
        *(&flag + i) = 49;
    }
  }
  printf("input the flag:");
  __isoc99_scanf("%20s", s2); /*s2 即为我们输入的字符串*/
  if ( !strcmp(&flag, s2) )  /*此处 &flag 是被处理过的flag*/
    result = puts("this is the right flag!");
  else
    result = puts("wrong flag!");
  return result;
}

追踪 &flag

.data:0000000000601080 flag            db 7Bh                  ; DATA XREF: main+34↑r
.data:0000000000601080                                         ; main+44↑r ...
.data:0000000000601081 aHackingForFun  db 'hacking_for_fun}',0

这里的 7B 是 {

完整的 flag{hack1ng_for_fun}