1.查壳
32位文件，加了UPX壳
2.手动脱壳
使用Ollydbg
UPX是一个压缩壳，运行了UPX将我们要运行的已经压缩的程序解压，才是真正的程序入口点OEP
我们需要将跟着汇编代码，找到程序真正的入口点
使用ESP定律可以快速定位
按下F7，单步运行程序
运行了一步之后，发现右侧只有ESP标红了
跟踪，选择任意长的数据，打下硬件断点
按下F9运行，断下来的位置就是程序真正的入口点
在此处重建PE文件
点击dump就可以了
3.IDA分析
Shift+F12打开字符串窗口
跟踪可疑字符串
找到主函数
在数据处按下R,获得了对应的ASCII，是ACTF{}，是一个flag的格式
然后剩余的flag部分减一后如果与存储的v1数组相同就是正确的flag
v1在上面由qmemcpy赋值
获得v1的值，编写脚本
v1 = [42,70,39,34,78,44,34,40,73,63,43,64] //v1数组 byte_402000=[0x7e,0x7d,0x7c,0x7b,0x7a,0x79,0x78,0x77,0x76,0x75,0x74,0x73,0x72,0x71,0x70,0x6f,0x6e,0x6d,0x6c,0x6b,0x6a,0x69,0x68,0x67,0x66,0x65,0x64,0x63,0x62,0x61,0x60,0x5f,0x5e,0x5d,0x5c,0x5b,0x5a,0x59,0x58,0x57,0x56,0x55,0x54,0x53,0x52,0x51,0x50,0x4f,0x4e,0x4d,0x4c,0x4b,0x4a,0x49,0x48,0x47,0x46,0x45,0x44,0x43,0x42,0x41,0x40,0x3f,0x3e,0x3d,0x3c,0x3b,0x3a,0x39,0x38,0x37,0x36,0x35,0x34,0x33,0x32,0x31,0x30,0x2f,0x2e,0x2d,0x2c,0x2b,0x2a,0x29,0x28,0x27,0x26,0x25,0x24,0x23,0x20,0x21,0x22,0x00] //byte_402000 flag="" for i in v1: flag+=chr(byte_402000.index(i)+1) print(flag)
flag{U9X_1S_W6@T?}
