The second session of ctf.360.cn, the second question of reverse part writeup--

Topic: see attachment

The problem was prompted to run twice.

OD load, set the command line parameter pass.db.

From F8 to the VirtualAlloc function, it is found that the size parameter is 0, causing the function call to fail.

According to the pass.db length, set the size=0x10,F8 to continue.

It is found that the FileName parameter of CreateFileA is still pass.db, which is modified to pas1.db.

F9 runs normally and gets the pas1.db file.

In fact, the content of pas1.db here is already the answer, and it is affected by the prompt that "patch runs twice after bug is dropped", so after getting pas2.db, it is wrong to submit it. Later, it is found that the content of pas2.db is the same as that of pass.db. I suddenly realized that it was an XOR algorithm.

In fact, this so-called encryption algorithm is XOR with the string "shit".

Attachment: http://down.51cto.com/data/2365125