Re题目------Enm.exe

Re题目------Enm.exe

文章目录

• • 代码分析
  • • 脚本1
    • 脚本2

代码分析

for ( i = 0; i < 32; i += 8 )
  {
    for ( j = 0; j < 128; ++j )
    {
      v10 = &Str[i];
      if ( *(int *)&Str[i + 4] >= 0 )          
      {
        *(_QWORD *)v10 *= 2i64;                
      }
      else
      {
        *(_QWORD *)v10 *= 2i64;                 
        v3 = *((_DWORD *)v10 + 1) ^ 0xB0004B76;
        v4 = v10;
        *(_DWORD *)v10 ^= 0x79FA26B7u;
        *((_DWORD *)v4 + 1) = v3;
      }
    }
  }
  sub_4010F0(Str);
  v12 = 0;
  if ( sub_4012D5(dword_413000) )
    v5 = sub_401267(std::cout, "No");
  else
    v5 = sub_401267(std::cout, "yeah, got it");
  std::ostream::operator<<(v5, sub_401050);
  system("pause");
  v12 = -1;
  sub_4012CB(v7);

 if ( *(int *)&Str[i + 4] >= 0 ) 
 {*(_QWORD *)v10 *= 2i64;}

代表高4字节的int值是否大于0，大于0的话，最高位符号位就是0，小于0的话，最高位符号位就为1，因为乘以2把符号移出，所以最后进行相与得出。
这里的话写结果为偶数的判断。

else{
        *(_QWORD *)v10 *= 2i64;                 
        v3 = *((_DWORD *)v10 + 1) ^ 0xB0004B76;
        v4 = v10;
        *(_DWORD *)v10 ^= 0x79FA26B7u;
        *((_DWORD *)v4 + 1) = v3;
        }

偶数就代表最低位为0，奇数就代表最低位为1，然后最低位肯定是1，所以下面偶数异或奇数，最后肯定是奇数，if判断中就写结果为奇数的判断,

脚本1

a = [0x6054BB493C0FB65B, 0x11F144F66B5307DD, 0x4ED8899358F90DE1,0x60DF9B37738E1706]
for i in range(len(a)):
    for j in range(128):
        if a[i]%2==0:
            a[i]//=2
        else:
            a[i]^=0xB0004B7679FA26B7
            a[i]//=2
            a[i] |= 0x8000000000000000
for i in range(len(a)):
    print(chr(a[i]&0xff),end='')
    print(chr((a[i]>>8) & 0xff),end='')
    print(chr((a[i]>>8*2) & 0xff),end='')
    print(chr((a[i]>>8*3) & 0xff),end='')
    print(chr((a[i]>>8*4) & 0xff),end='')
    print(chr((a[i]>>8*5) & 0xff),end='')
    print(chr((a[i] >> 8 * 6) & 0xff), end='')
    print(chr((a[i] >> 8 * 7) & 0xff), end='')

f96ea7f314e5834a29930ca76aa0f29f

脚本2

a=[0x3C0FB65B,0x6054BB49,0x6B5307DD,0x11F144F6,0x58F90DE1,0x4ED88993,0x738E1706,0x60DF9B37]
for i in range(0,len(a),2):
    for j in range(128):
        if ((a[i+1]<<32)+a[i])%2==0:
            temp=((a[i+1]<<32)+a[i])//2
            a[i]=temp&0xffffffff
            a[i + 1] = temp>>32
        else:
            a[i]^=0x79FA26B7
            a[i+1]^=0xB0004B76
            temp = (((a[i + 1] << 32) + a[i]) // 2)|0x8000000000000000
            a[i] = temp & 0xffffffff
            a[i + 1] = temp >> 32
for i in range(len(a)):
    print(chr(a[i] & 0xff), end='')
    print(chr((a[i] >> 8) & 0xff), end='')
    print(chr((a[i] >> 8 * 2) & 0xff), end='')
    print(chr((a[i] >> 8 * 3) & 0xff), end='')

f96ea7f314e5834a29930ca76aa0f29f