32位，无壳
main函数按下F5反汇编，编译失败，直接看汇编
观察并动调验证了一下，byte_2D12C0中存储的就是输入字符串，上述代码就是关键部分
将输入的字符串与cl异或，然后与已经存储好的字符串byte_2CEA08进行比较，如果都相同就是正确的字符串
获取存储好的数据byte_2CEA08
0x4d,0x53,0x41,0x57,0x42,0x7e,0x46,0x58,0x5a,0x3a,0x4a,0x3a,0x60,0x74,0x51,0x4a,0x22,0x4e,0x40,0x20,0x62,0x70,0x64,0x64,0x7d,0x38,0x67
与输入的flag进行异或的是eax寄存器的低八位，观察看出
xor eax, eax
将eax清空了然后开始循环，每次循环
inc eax
eax自增1
可以知道每次与flag异或的数据是0,1,2,3,4......（个数为flag长度）
编写WP
data=[0x4d,0x53,0x41,0x57,0x42,0x7e,0x46,0x58,0x5a,0x3a,0x4a,0x3a,0x60,0x74,0x51,0x4a,0x22,0x4e,0x40,0x20,0x62,0x70,0x64,0x64,0x7d,0x38,0x67] flag="" for i in range(0,len(data)): flag+=chr(data[i]^i) print(flag)
