文章总结： 本文详细解析了一道CTF逆向工程题目EasyRE，通过静态分析识别出程序使用Base64编码和RC4加密算法，逆向推导出完整解密流程，最终获取flag{eb3564f89sf45b24oac12db8ec}。文章从文件基本信息、函数结构分析、算法识别到编写解密脚本，提供了完整的逆向工程方法论，包括x86-64汇编分析技巧、常见加密算法识别方法和Python解密脚本实现，是逆向工程初学者的实用教程。
综合评分： 92
文章分类： CTF,逆向分析,二进制安全,代码审计,WEB安全

解析2025古剑山EasyRE

原创

破镜安全

2025年12月5日 08:01
北京

EasyRE：从零到一的CTF逆向工程实战详解

前言

本文详细记录了一道CTF逆向工程题目（EasyRE）的完整分析过程。作为一道入门级的逆向题目，它涉及了多层加密、算法识别、反汇编分析等核心技术。通过本文，你将学习到：

如何系统地分析一个未知的二进制文件
如何通过汇编代码识别常见加密算法
如何从验证逻辑逆推原始数据
如何编写解密脚本获取flag

本文面向逆向工程初学者，会详细解释每一步的原理和方法。即使你没有深厚的汇编基础，也能跟随本文完成分析。

目标文件：easyre.exe（Windows x86-64 PE可执行文件，129KB）

分析环境：Linux + objdump + Python3

第一阶段：初步侦察

1.1 文件基本信息

首先使用file命令查看文件类型：

ounter(lineounter(line$ file easyre.exeeasyre.exe:&nbsp;PE32+&nbsp;executable&nbsp;(console) x86-64,&nbsp;for&nbsp;MS&nbsp;Windows

关键信息：

PE32+：Windows可执行文件（64位）
console：控制台应用程序
x86-64：64位x86架构

1.2 字符串提取

使用strings命令提取可读字符串，寻找线索：

ounter(lineounter(lineounter(lineounter(lineounter(line$&nbsp;strings easyre.exe | grep -i -E&nbsp;"(flag|input|pass|key|success|wrong|error)"plz input:WrongSuccess!flag{do_H

重要发现：

plz input: – 程序需要用户输入
Wrong / Success! – 有输入验证
flag{do_H – 字符串片段，可能是关键信息

字符串flag{do_H很特殊，CTF的flag格式通常是flag{...}，这个不完整的字符串很可能是密钥或提示。

1.3 程序行为测试

在Wine或Windows环境中运行程序：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line$&nbsp;wine easyre.exeplz input:test123Wrong
$ wine easyre.exeplz input:flag{test}Wrong

观察：

程序等待用户输入
输入后立即判断对错
没有其他提示信息

这是典型的”输入验证”型逆向题目，我们需要找出正确的输入。

第二阶段：函数结构分析

2.1 提取函数符号

使用objdump查看符号表，找出所有函数：

ounter(lineounter(lineounter(lineounter(lineounter(line$ objdump -t easyre.exe |&nbsp;grep&nbsp;"F .text"0000000000401450&nbsp;g &nbsp; &nbsp; F .text &nbsp;0000000000000078 main00000000004018b3 g &nbsp; &nbsp; F .text &nbsp;000000000000015c&nbsp;crypt0000000000401a10 g &nbsp; &nbsp; F .text &nbsp;00000000000001d0 first0000000000401740&nbsp;g &nbsp; &nbsp; F .text &nbsp;0000000000000173&nbsp;_init1

函数清单：

| 地址 | 函数名 | 大小 | 推测功能 |
| — | — | — | — |
| 0x401450 | main | 120字节 | 主函数 |
| 0x4018b3 | crypt | 348字节 | 加密函数 |
| 0x401a10 | first | 464字节 | 第一步处理 |
| 0x401740 | _init1 | 371字节 | 初始化函数 |

函数名已经给了我们很好的提示：

first – 第一步处理
crypt – 加密
_init1 – 初始化（可能为crypt准备）

2.2 调用关系推测

ounter(lineounter(lineounter(lineounter(lineounter(linemain()&nbsp; ├─>&nbsp;first() &nbsp; &nbsp;&nbsp;// 第一步转换&nbsp; ├─>&nbsp;crypt() &nbsp; &nbsp;&nbsp;// 加密&nbsp; │ &nbsp; &nbsp; └─> _init1() &nbsp;// 初始化&nbsp; └─> [验证逻辑] &nbsp;&nbsp;// 比对结果

第三阶段：main函数深度分析

3.1 反汇编main函数

ounter(line$&nbsp;objdump -d easyre.exe | sed -n&nbsp;'/^0000000000401450 <main>:/,/^$/p'&nbsp;> main_disasm.txt

main函数很长，我们分段分析。

3.2 发现1：神秘字符串的构建

在地址0x401514到0x40153d发现一段有趣的代码：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line401514: &nbsp;48&nbsp;b8&nbsp;66&nbsp;6c&nbsp;61&nbsp;67&nbsp;7b &nbsp; &nbsp;movabs $0x5f6f647b67616c66,%rax40151b: &nbsp;64&nbsp;6f&nbsp;5f40151e: &nbsp;48&nbsp;89&nbsp;45&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rax,0x0(%rbp)
401522: &nbsp;48&nbsp;b8&nbsp;79&nbsp;6f&nbsp;75&nbsp;5f&nbsp;66&nbsp; &nbsp; movabs $0x646e69665f756f79,%rax401529: &nbsp;69&nbsp;6e&nbsp;6440152c: &nbsp;48&nbsp;89&nbsp;45&nbsp;08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rax,0x8(%rbp)
401530: &nbsp;c7&nbsp;45&nbsp;10&nbsp;5f&nbsp;69&nbsp;74&nbsp;5f &nbsp; &nbsp;movl &nbsp; $0x5f74695f,0x10(%rbp)401537: &nbsp;66&nbsp;c7&nbsp;45&nbsp;14&nbsp;3f&nbsp;7d &nbsp; &nbsp; &nbsp; movw &nbsp; $0x7d3f,0x14(%rbp)

这段代码在构建一个字符串。让我们解码这些十六进制数：

重要概念 – 小端序（Little Endian）： x86-64架构使用小端序，低位字节存储在低地址。例如：

ounter(lineounter(lineounter(line值:&nbsp;0x67616c66内存布局: [66] [6c] [61] [67] &nbsp;（地址从低到高）实际字符:&nbsp;'f'&nbsp;&nbsp;'l'&nbsp;&nbsp;'a'&nbsp;&nbsp;'g'

解码过程：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 第一个movabs>>>&nbsp;bytes.fromhex('666c61677b646f5f')b'flag{do_'
# 第二个movabs>>>&nbsp;bytes.fromhex('796f755f66696e64')b'you_find'
# movl>>>&nbsp;bytes.fromhex('5f69745f')b'_it_'
# movw>>>&nbsp;bytes.fromhex('3f7d')b'?}'

完整字符串：flag{do_you_find_it_?}

这是一个22字节的字符串，看起来像是某种密钥！

3.3 发现2：两个重要常量

继续分析，在0x4015e2发现：

ounter(line4015e2: &nbsp;c7&nbsp;45&nbsp;34&nbsp;56&nbsp;49&nbsp;60&nbsp;90&nbsp; &nbsp; movl &nbsp; $0x90604956,0x34(%rbp)

这是一个32位常量：v12 = 0x90604956

在0x4015e9到0x40162f发现一组连续的mov指令：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line4015e9: &nbsp;c7&nbsp;45&nbsp;20&nbsp;0b d1 a8 fc &nbsp; &nbsp;movl &nbsp; $0xfca8d10b,0x20(%rbp)4015f0: &nbsp;c7&nbsp;45&nbsp;24&nbsp;2c&nbsp;5d&nbsp;22&nbsp;43&nbsp; &nbsp; movl &nbsp; $0x43225d2c,0x24(%rbp)4015f7: &nbsp;c7&nbsp;45&nbsp;28&nbsp;ba&nbsp;00&nbsp;da&nbsp;3d &nbsp; &nbsp;movl &nbsp; $0x3dda00ba,0x28(%rbp)4015fe: &nbsp;c7&nbsp;45&nbsp;2c&nbsp;02&nbsp;28&nbsp;8b&nbsp;7e &nbsp; &nbsp;movl &nbsp; $0x7e8b2802,0x2c(%rbp)401605: &nbsp;c7&nbsp;45&nbsp;30&nbsp;f7&nbsp;89&nbsp;c1&nbsp;61&nbsp; &nbsp; movl &nbsp; $0x61c189f7,0x30(%rbp)40160c: &nbsp;c7&nbsp;45&nbsp;34&nbsp;07&nbsp;af ea e4 &nbsp; &nbsp;movl &nbsp; $0xe4eaaf07,0x34(%rbp)401613: &nbsp;c7&nbsp;45&nbsp;38&nbsp;7f e2&nbsp;0f&nbsp;80&nbsp; &nbsp; movl &nbsp; $0x800fe27f,0x38(%rbp)40161a: &nbsp;c7&nbsp;45&nbsp;3c&nbsp;4f&nbsp;59&nbsp;c3 d6 &nbsp; &nbsp;movl &nbsp; $0xd6c3594f,0x3c(%rbp)401621: &nbsp;c7&nbsp;45&nbsp;40&nbsp;6a f1&nbsp;53&nbsp;56&nbsp; &nbsp; movl &nbsp; $0x5653f16a,0x40(%rbp)401628: &nbsp;c7&nbsp;45&nbsp;44&nbsp;49&nbsp;3f ee&nbsp;22&nbsp; &nbsp; movl &nbsp; $0x22ee3f49,0x44(%rbp)40162f: &nbsp;c7&nbsp;45&nbsp;48&nbsp;c5&nbsp;60&nbsp;37&nbsp;b1 &nbsp; &nbsp;movl &nbsp; $0xb13760c5,0x48(%rbp)

这是一个包含11个32位整数的数组：v6数组

ounter(lineounter(lineounter(lineounter(lineounter(linev6&nbsp;=&nbsp;[&nbsp; &nbsp; 0xfca8d10b, 0x43225d2c, 0x3dda00ba, 0x7e8b2802, 0x61c189f7,&nbsp; &nbsp; 0xe4eaaf07, 0x800fe27f, 0xd6c3594f, 0x5653f16a, 0x22ee3f49,&nbsp; &nbsp; 0xb13760c5]

11个元素 × 4字节 = 44字节，这个长度很重要！

3.4 发现3：函数调用序列

在main函数中部，发现关键的函数调用：

ounter(lineounter(line401570: &nbsp;e8&nbsp;9b&nbsp;04&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp;&nbsp;401a10 <first>40157f: &nbsp;e8&nbsp;2f&nbsp;03&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp;&nbsp;4018b3 <crypt>

程序流程：

ounter(line用户输入 → first() → crypt() → 验证循环

3.5 发现4：验证逻辑剖析

验证循环从0x4016ad开始，这是整个程序的核心。让我们逐行分析：

ounter(lineounter(lineounter(lineounter(line; 循环开始4016ad: &nbsp;8b&nbsp;45&nbsp;cc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;-0x34(%rbp),%eax4016b0: &nbsp;33&nbsp;45&nbsp;34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;xor&nbsp; &nbsp;&nbsp;0x34(%rbp),%eax4016b3: &nbsp;89&nbsp;45&nbsp;cc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%eax,-0x34(%rbp)

第一步操作：读取4字节数据，与v12(0x90604956)进行XOR

ounter(lineounter(linev7&nbsp;= data[i]v7&nbsp;^=&nbsp;0x90604956

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line4016b9: &nbsp;8b&nbsp;45&nbsp;cc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;-0x34(%rbp),%eax4016bc: &nbsp;48&nbsp;98&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cltq4016be: &nbsp;89&nbsp;c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;%eax,%edx4016c0: &nbsp;83&nbsp;7d&nbsp;24&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmpl &nbsp; $0x0,0x24(%rbp)4016c4: &nbsp;7e&nbsp;07&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jle &nbsp; &nbsp;4016cd4016c6: &nbsp;81&nbsp;f0&nbsp;22&nbsp;22&nbsp;22&nbsp;22&nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;$0x22222222,%eax4016cc: &nbsp;89&nbsp;c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;%eax,%edx

第二步操作：条件XOR

cltq – 将eax符号扩展到rax（说明这是有符号数）
cmpl $0x0,0x24(%rbp) – 与0比较
jle 4016cd – 如果 ≤ 0 则跳过
xor $0x22222222,%eax – 否则XOR 0x22222222

ounter(lineounter(lineounter(lineounter(line// 伪代码if&nbsp;((int32_t)v7 >&nbsp;0) {&nbsp; &nbsp; v7 ^=&nbsp;0x22222222;}

ounter(lineounter(lineounter(lineounter(lineounter(line4016ce: &nbsp;8b&nbsp;45&nbsp;20&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x20(%rbp),%eax4016d1: &nbsp;39&nbsp;c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp;%eax,%edx4016d3: &nbsp;74&nbsp;1d &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; je &nbsp; &nbsp;&nbsp;4016f24016d5: &nbsp;48&nbsp;8d&nbsp;0d&nbsp;74&nbsp;09&nbsp;00&nbsp;00&nbsp; &nbsp; lea &nbsp; &nbsp;0x974(%rip),%rcx &nbsp;#&nbsp;"Wrong"4016dc: &nbsp;e8 ff&nbsp;08&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp;&nbsp;401fe0 <puts>

第三步操作：比对

将处理后的v7与v6[i]比较
不相等则输出”Wrong”并退出
相等则继续下一轮循环

完整验证逻辑：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linefor&nbsp;(int&nbsp;i =&nbsp;0; i <&nbsp;11; i++) {&nbsp; &nbsp;&nbsp;// 读取4字节（小端序）&nbsp; &nbsp;&nbsp;uint32_t&nbsp;v7 = *(uint32_t*)(encrypted_data + i *&nbsp;4);
&nbsp; &nbsp;&nbsp;// 第一步XOR&nbsp; &nbsp; v7 ^=&nbsp;0x90604956;
&nbsp; &nbsp;&nbsp;// 条件XOR（有符号比较）&nbsp; &nbsp;&nbsp;if&nbsp;((int32_t)v7 >&nbsp;0) {&nbsp; &nbsp; &nbsp; &nbsp; v7 ^=&nbsp;0x22222222;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;// 验证&nbsp; &nbsp;&nbsp;if&nbsp;(v7 != v6[i]) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("Wrong\n");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; }}printf("Success!\n");

第四阶段：first函数算法识别

4.1 反汇编first函数

ounter(line$&nbsp;objdump -d easyre.exe | sed -n&nbsp;'/^0000000000401a10 <first>:/,/^0000000000401be0/p'&nbsp;> first_disasm.txt

4.2 特征1：除以3的优化

在函数开头发现：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line401a2e: &nbsp;48&nbsp;ba&nbsp;56&nbsp;55&nbsp;55&nbsp;55&nbsp;55&nbsp; &nbsp; movabs $0x5555555555555556,%rdx401a35: &nbsp;55&nbsp;55&nbsp;55401a38: &nbsp;48&nbsp;0f af c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; imul &nbsp; %rdx,%rax401a3c: &nbsp;48&nbsp;c1 e8&nbsp;3f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x3f,%rax401a40: &nbsp;48&nbsp;89&nbsp;c1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rax,%rcx401a43: &nbsp;48&nbsp;d1 f9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sar &nbsp; &nbsp;%rcx401a46: &nbsp;48&nbsp;29&nbsp;c1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sub &nbsp; &nbsp;%rax,%rcx

魔数0x5555555555555556是什么？

这是编译器优化除法的常见技巧。除以3可以优化为：

ounter(linex&nbsp;/&nbsp;3&nbsp;≈ (x *&nbsp;0x55555556) >>&nbsp;32

这表明函数在处理”3字节一组”的数据转换！

4.3 特征2：6位分组的位操作

继续分析，发现大量位移和掩码操作：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line401a86: &nbsp;c1 e8&nbsp;02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x2,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 右移2位401a89: &nbsp;83&nbsp;e0&nbsp;03&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and &nbsp; &nbsp;$0x3,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 保留低2位401a8c: &nbsp;c1 e0&nbsp;04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shl &nbsp; &nbsp;$0x4,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 左移4位
401aa5: &nbsp;c1 e8&nbsp;04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x4,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 右移4位401aa8: &nbsp;83&nbsp;e0&nbsp;0f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and &nbsp; &nbsp;$0xf,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 保留低4位
401ac7: &nbsp;c1 e8&nbsp;06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x6,%eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 右移6位401aca: &nbsp;83&nbsp;e0&nbsp;3f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and &nbsp; &nbsp;$0x3f,%eax &nbsp; &nbsp; &nbsp; &nbsp; ; 保留低6位(0-63)

分析这些位操作：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line原始字节: [AAAAAAAA] [BBBBBBBB] [CCCCCCCC]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (8位) &nbsp; &nbsp; &nbsp;(8位) &nbsp; &nbsp; &nbsp;(8位)
分组为6位:第1组: AAAAAA (前6位)第2组: AABBBB (后2位+前4位)第3组: BBBBCC (后4位+前2位)第4组: CCCCCC (后6位)
每组6位 = 0-63 = 需要64个字符的编码表

这是Base64编码的典型特征！

4.4 特征3：Base64字符表

在位操作后，代码使用查找表：

ounter(line401acc: &nbsp;0f b6&nbsp;80&nbsp;30&nbsp;50&nbsp;40&nbsp;00&nbsp; &nbsp; movzbl&nbsp;0x405030(%rax),%eax

查看地址0x405030的数据：

ounter(lineounter(lineounter(lineounter(lineounter(line$&nbsp;objdump -s -j .rdata easyre.exe | grep&nbsp;"405030"&nbsp;-A 4405030 41424344 45464748 494a4b4c 4d4e4f50 &nbsp;ABCDEFGHIJKLMNOP405040 51525354 55565758 595a6162 63646566 &nbsp;QRSTUVWXYZabcdef405050 6768696a 6b6c6d6e 6f707172 73747576 &nbsp;ghijklmnopqrstuv405060 7778797a 30313233 34353637 38392b2f &nbsp;wxyz0123456789+/

完美！这就是标准的Base64字符表：

ounter(lineABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

4.5 Base64编码原理

Base64将3字节编码为4字节：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line输入: 3 bytes = 24 bits输出: 4 groups × 6 bits = 4 chars
示例:输入: "Man" = 0x4D616E = 01001101 01100001 01101110分组: 010011 | 010110 | 000101 | 101110索引: &nbsp; 19 &nbsp; &nbsp; &nbsp; 22 &nbsp; &nbsp; &nbsp; 5 &nbsp; &nbsp; &nbsp; &nbsp;46字符: &nbsp; T &nbsp; &nbsp; &nbsp; &nbsp;W &nbsp; &nbsp; &nbsp; &nbsp;F &nbsp; &nbsp; &nbsp; &nbsp;u输出: "TWFu"

长度计算：

ounter(line输入32字节 → Base64 → 输出长度 = ⌈32÷3⌉×4 = 44字节

正好是v6数组的长度（11×4=44）！

结论：first函数实现Base64编码

第五阶段：crypt函数算法识别

5.1 反汇编crypt函数

ounter(line$&nbsp;objdump -d easyre.exe | sed -n&nbsp;'/^00000000004018b3 <crypt>:/,/^0000000000401a0f/p'&nbsp;> crypt_disasm.txt

5.2 特征1：256字节数组初始化

函数开头调用_init1：

ounter(line4018f5: &nbsp;e8&nbsp;46&nbsp;fe ff ff &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp;&nbsp;401740&nbsp;<_init1>

查看_init1函数，发现它初始化一个256字节的数组（称为S盒）：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line; _init1 函数401740: &nbsp;<_init1>:&nbsp; ; 第一阶段：S[i] = i&nbsp; 40174d: &nbsp;c6&nbsp;44&nbsp;05&nbsp;a0&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movb &nbsp;&nbsp;$0x0,-0x60(%rbp,%rax,1)&nbsp; ...&nbsp; ; 第二阶段：使用密钥打乱S盒&nbsp; 4017a1: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax&nbsp; 4017a6: &nbsp;01&nbsp;c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;%eax,%edx&nbsp; 4017a8: &nbsp;0f b6&nbsp;04&nbsp;11&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl (%rcx,%rdx,1),%eax&nbsp; ; 密钥&nbsp; 4017ac: &nbsp;01&nbsp;c6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;%eax,%esi&nbsp; ...&nbsp; ; 交换 S[i] 和 S[j]&nbsp; 4017c7: &nbsp;88&nbsp;54&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;%dl,-0x60(%rbp,%rax,1)

这是RC4的KSA（Key Scheduling Algorithm）！

5.3 特征2：PRGA主循环

crypt函数的主循环：

ounter(lineounter(lineounter(lineounter(lineounter(line; i = (i +&nbsp;1) %&nbsp;256401927: &nbsp;8b&nbsp;85&nbsp;bc&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xbc(%rbp),%eax40192d: &nbsp;83&nbsp;c0&nbsp;01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;$0x1,%eax401930: &nbsp;25&nbsp;ff&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp;&nbsp;$0xff,%eax401935: &nbsp;89&nbsp;85&nbsp;bc&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%eax,0xbc(%rbp)

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(line; j = (j + S[i]) %&nbsp;256401941: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax&nbsp; ; S[i]401949: &nbsp;8b&nbsp;85&nbsp;b8&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xb8(%rbp),%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; j40194f: &nbsp;01&nbsp;d0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;%edx,%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; j + S[i]401951: &nbsp;25&nbsp;ff&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp;&nbsp;$0xff,%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; %&nbsp;256401956: &nbsp;89&nbsp;85&nbsp;b8&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%eax,0xb8(%rbp)

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line; swap(S[i], S[j])401962: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax401967: &nbsp;88&nbsp;85&nbsp;af&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%al,0xaf(%rbp) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; temp = S[i]40196d: &nbsp;8b&nbsp;85&nbsp;b8&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xb8(%rbp),%eax401973: &nbsp;0f b6&nbsp;54&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%edx&nbsp; ; S[j]401978: &nbsp;8b&nbsp;85&nbsp;bc&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xbc(%rbp),%eax40197e: &nbsp;88&nbsp;54&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;%dl,-0x60(%rbp,%rax,1) &nbsp;; S[i] = S[j]401982: &nbsp;8b&nbsp;85&nbsp;b8&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xb8(%rbp),%eax401988: &nbsp;0f b6&nbsp;95&nbsp;af&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; movzbl&nbsp;0xaf(%rbp),%edx40198f: &nbsp;88&nbsp;54&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;%dl,-0x60(%rbp,%rax,1) &nbsp;; S[j] = temp

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line; K = S[(S[i] + S[j]) %&nbsp;256]401993: &nbsp;8b&nbsp;85&nbsp;bc&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xbc(%rbp),%eax401999: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax&nbsp; ; S[i]4019a1: &nbsp;8b&nbsp;85&nbsp;b8&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0xb8(%rbp),%eax4019a7: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax&nbsp; ; S[j]4019af: &nbsp;01&nbsp;d0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;%edx,%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; S[i] + S[j]4019b1: &nbsp;25&nbsp;ff&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp;&nbsp;$0xff,%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; %&nbsp;2564019b6: &nbsp;89&nbsp;85&nbsp;b0&nbsp;00&nbsp;00&nbsp;00&nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%eax,0xb0(%rbp) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 保存索引4019e5: &nbsp;0f b6&nbsp;44&nbsp;05&nbsp;a0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl -0x60(%rbp,%rax,1),%eax&nbsp; ; S[K]

ounter(lineounter(lineounter(lineounter(line; output = input ^ K4019dc: &nbsp;0f b6 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzbl (%rax),%ecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; input[i]4019ea: &nbsp;31&nbsp;c8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;xor&nbsp; &nbsp;&nbsp;%ecx,%eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; input[i] ^ K4019ec: &nbsp;88&nbsp;02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%al,(%rdx) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; output[i]

5.4 RC4算法原理

RC4是一种流密码，包含两个阶段：

1. KSA（Key Scheduling Algorithm）- 密钥调度：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// 初始化S盒for&nbsp;(i =&nbsp;0; i <&nbsp;256; i++) {&nbsp; &nbsp; S[i] = i;}
// 使用密钥打乱S盒j =&nbsp;0;for&nbsp;(i =&nbsp;0; i <&nbsp;256; i++) {&nbsp; &nbsp; j = (j + S[i] + key[i % key_length]) %&nbsp;256;&nbsp; &nbsp;&nbsp;swap(S[i], S[j]);}

2. PRGA（Pseudo-Random Generation Algorithm）- 伪随机生成：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linei&nbsp;=&nbsp;j =&nbsp;0;for&nbsp;(each&nbsp;byte&nbsp;in data) {&nbsp; &nbsp; i = (i +&nbsp;1) %&nbsp;256;&nbsp; &nbsp; j = (j + S[i]) %&nbsp;256;&nbsp; &nbsp; swap(S[i], S[j]);&nbsp; &nbsp; K = S[(S[i] + S[j]) %&nbsp;256];&nbsp; &nbsp; output = input ^ K;}

RC4的特点：

对称加密（加密=解密）
流密码（逐字节处理）
密钥长度可变

结论：crypt函数实现RC4流密码，密钥为flag{do_you_find_it_?}

第六阶段：完整加密流程梳理

现在我们完全理解了程序的工作流程：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line┌─────────────────────────────────────────────────────────────┐│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 用户输入 (32&nbsp;bytes) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;例如:&nbsp;"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"&nbsp; &nbsp; │└─────────────────────────────────────────────────────────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓┌─────────────────────────────────────────────────────────────┐│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;【first函数】Base64编码 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp;&nbsp;3字节 →&nbsp;4字节转换 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; 使用字符表: A-Za-z0-9+/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│└─────────────────────────────────────────────────────────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (44&nbsp;bytes)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓┌─────────────────────────────────────────────────────────────┐│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;【crypt函数】RC4加密 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp; 密钥: flag{do_you_find_it_?} &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; KSA初始化S盒 → PRGA生成密钥流 → XOR加密 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │└─────────────────────────────────────────────────────────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;加密后的数据 (44&nbsp;bytes)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓┌─────────────────────────────────────────────────────────────┐│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;【main函数】验证循环 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp; 分为11组，每组4字节: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; for i in&nbsp;0..10: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp; &nbsp; &nbsp; v7 = data[i*4] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; v7 ^=&nbsp;0x90604956 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; if (int32_t)v7 >&nbsp;0: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 ^=&nbsp;0x22222222 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; assert v7 == v6[i] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│└─────────────────────────────────────────────────────────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Success! / &nbsp;Wrong

关键数据：

RC4密钥：flag{do_you_find_it_?} (22字节)
XOR常量v12：0x90604956
验证数组v6：11个32位整数

第七阶段：逆向解密策略

理解了加密流程后，我们需要逆向每一步。

7.1 逆向思路

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linev6数组 (已知)&nbsp; &nbsp; ↓ 逆向XOR变换加密数据 (44&nbsp;bytes)&nbsp; &nbsp; ↓ RC4解密（对称）Base64数据 (44&nbsp;bytes)&nbsp; &nbsp; ↓ Base64解码原始输入 (32&nbsp;bytes) = FLAG

7.2 步骤1：逆向验证逻辑

验证逻辑是：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(linev7 = data[i];v7 ^= v12;if&nbsp;((int32_t)v7 >&nbsp;0) {&nbsp; &nbsp; v7 ^=&nbsp;0x22222222;}// v7 == v6[i]

逆向过程：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linedef&nbsp;reverse_xor_logic():&nbsp; &nbsp;&nbsp;"""从v6数组反推加密数据"""&nbsp; &nbsp; result =&nbsp;bytearray()
&nbsp; &nbsp;&nbsp;for&nbsp;v6_val&nbsp;in&nbsp;v6:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# v6是最终比较值，我们需要反推&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为无符号32位&nbsp; &nbsp; &nbsp; &nbsp; v6_unsigned = v6_val &&nbsp;0xFFFFFFFF
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 尝试假设：执行了条件XOR&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 如果执行了，那么执行前是 v6 ^ 0x22222222&nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored = v6_unsigned ^&nbsp;0x22222222
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 检查这个假设是否成立&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为有符号整数&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;v7_if_xored >=&nbsp;0x80000000:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored_signed = v7_if_xored -&nbsp;0x100000000&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored_signed = v7_if_xored
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 条件是 > 0（有符号），如果成立说明假设正确&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;v7_if_xored_signed >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 = v7_if_xored &nbsp;# 假设正确，使用XOR前的值&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 = v6_unsigned &nbsp;# 假设错误，没有执行XOR
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 逆向第一步XOR：data = v7 ^ v12&nbsp; &nbsp; &nbsp; &nbsp; original = v7 ^ v12
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为小端序字节&nbsp; &nbsp; &nbsp; &nbsp; result.extend([&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; original &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (original >>&nbsp;8) &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (original >>&nbsp;16) &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (original >>&nbsp;24) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; ])
&nbsp; &nbsp;&nbsp;return&nbsp;bytes(result)

关键点：

有符号/无符号转换要正确
条件判断要准确
小端序字节顺序

7.3 步骤2：RC4解密

RC4是对称加密，加密和解密用同一个函数：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linedef&nbsp;rc4_crypt(data, key):&nbsp; &nbsp;&nbsp;"""RC4加密/解密（对称算法）"""&nbsp; &nbsp;&nbsp;# KSA - Key Scheduling Algorithm&nbsp; &nbsp; S =&nbsp;list(range(256))&nbsp; &nbsp; j =&nbsp;0&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i] + key[i %&nbsp;len(key)]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]
&nbsp; &nbsp;&nbsp;# PRGA - Pseudo-Random Generation Algorithm&nbsp; &nbsp; i = j =&nbsp;0&nbsp; &nbsp; output =&nbsp;bytearray()&nbsp; &nbsp;&nbsp;for&nbsp;byte&nbsp;in&nbsp;data:&nbsp; &nbsp; &nbsp; &nbsp; i = (i +&nbsp;1) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]&nbsp; &nbsp; &nbsp; &nbsp; K = S[(S[i] + S[j]) &&nbsp;0xFF]&nbsp; &nbsp; &nbsp; &nbsp; output.append(byte ^ K)
&nbsp; &nbsp;&nbsp;return&nbsp;bytes(output)

7.4 步骤3：Base64解码

Python标准库提供Base64解码：

ounter(lineounter(lineounter(lineounter(lineimport&nbsp;base64
base64_data&nbsp;=&nbsp;rc4_crypt(encrypted_data, key)flag = base64.b64decode(base64_data).decode('utf-8')

第八阶段：编写完整解密脚本

8.1 完整代码

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/usr/bin/env python3"""EasyRE CTF Challenge - 完整解密脚本基于对二进制文件的完整逆向分析"""import&nbsp;base64
print("="&nbsp;*&nbsp;70)print("EasyRE CTF Challenge - 解密脚本")print("="&nbsp;*&nbsp;70)
# ==================== 第一部分：从反汇编提取的常量 ====================print("\n[1] 从反汇编中提取的关键常量...")
# RC4密钥（main函数 0x401514-0x40153d）rc4_key =&nbsp;b"flag{do_you_find_it_?}"print(f" RC4密钥:&nbsp;{rc4_key.decode()}")
# XOR常量v12（main函数 0x4015e2）v12 =&nbsp;0x90604956print(f" v12常量: 0x{v12:08x}")
# 验证数组v6（main函数 0x4015e9-0x40162f）v6_hex = [&nbsp; &nbsp;&nbsp;0xfca8d10b,&nbsp;0x43225d2c,&nbsp;0x3dda00ba,&nbsp;0x7e8b2802,&nbsp;0x61c189f7,&nbsp; &nbsp;&nbsp;0xe4eaaf07,&nbsp;0x800fe27f,&nbsp;0xd6c3594f,&nbsp;0x5653f16a,&nbsp;0x22ee3f49,&nbsp;0xb13760c5]
# 转换为有符号整数（验证逻辑使用有符号比较）v6 = []for&nbsp;val&nbsp;in&nbsp;v6_hex:&nbsp; &nbsp;&nbsp;if&nbsp;val >=&nbsp;0x80000000:&nbsp; &nbsp; &nbsp; &nbsp; v6.append(val -&nbsp;0x100000000)&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; v6.append(val)print(f" v6数组:&nbsp;{len(v6)}&nbsp;个元素")
# ==================== 第二部分：理解验证逻辑 ====================print("\n[2] 验证逻辑分析...")print("验证逻辑（从 main 函数 0x4016ad-0x4016db 分析）：")print(" &nbsp;for each 4-byte block:")print(" &nbsp; &nbsp; &nbsp;v7 = data[i]")print(" &nbsp; &nbsp; &nbsp;v7 ^= v12 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # XOR with 0x90604956")print(" &nbsp; &nbsp; &nbsp;if (int32_t)v7 > 0: # 有符号比较")print(" &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;v7 ^= 0x22222222 # 条件XOR")print(" &nbsp; &nbsp; &nbsp;assert v7 == v6[i]")
# ==================== 第三部分：逆向验证逻辑 ====================print("\n[3] 逆向验证逻辑，从v6反推加密数据...")
def&nbsp;reverse_xor_logic():&nbsp; &nbsp;&nbsp;"""逆向main函数的验证逻辑"""&nbsp; &nbsp; result =&nbsp;bytearray()
&nbsp; &nbsp;&nbsp;for&nbsp;v6_val&nbsp;in&nbsp;v6:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为无符号32位整数&nbsp; &nbsp; &nbsp; &nbsp; v6_unsigned = v6_val &&nbsp;0xFFFFFFFF
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 尝试假设：执行了条件XOR&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 即 v7 = v6 ^ 0x22222222&nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored = v6_unsigned ^&nbsp;0x22222222
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为有符号数检查条件&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;v7_if_xored >=&nbsp;0x80000000:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored_signed = v7_if_xored -&nbsp;0x100000000&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7_if_xored_signed = v7_if_xored
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 如果 v7 > 0（有符号），说明确实执行了条件XOR&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;v7_if_xored_signed >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 = v7_if_xored &nbsp;# 使用XOR前的值&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 = v6_unsigned &nbsp;# 没有执行XOR
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 逆向第一步XOR：encrypted = v7 ^ v12&nbsp; &nbsp; &nbsp; &nbsp; encrypted = v7 ^ v12
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 转换为小端序字节&nbsp; &nbsp; &nbsp; &nbsp; result.extend([&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; encrypted &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (encrypted >>&nbsp;8) &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (encrypted >>&nbsp;16) &&nbsp;0xFF,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (encrypted >>&nbsp;24) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; ])
&nbsp; &nbsp;&nbsp;return&nbsp;bytes(result)
encrypted_data = reverse_xor_logic()print(f" 恢复的加密数据（44字节）:")print(f" &nbsp;{encrypted_data.hex()}")
# ==================== 第四部分：RC4解密 ====================print("\n[4] RC4解密...")print("（RC4是对称加密，加密=解密）")
def&nbsp;rc4_crypt(data, key):&nbsp; &nbsp;&nbsp;"""&nbsp; &nbsp; RC4加密/解密算法（从crypt函数分析得到）
&nbsp; &nbsp; 参数:&nbsp; &nbsp; &nbsp; &nbsp; data: 待加密/解密的数据&nbsp; &nbsp; &nbsp; &nbsp; key: 密钥
&nbsp; &nbsp; 返回:&nbsp; &nbsp; &nbsp; &nbsp; 加密/解密后的数据&nbsp; &nbsp; """&nbsp; &nbsp;&nbsp;# KSA (Key Scheduling Algorithm) - 密钥调度&nbsp; &nbsp; S =&nbsp;list(range(256))&nbsp; &nbsp; j =&nbsp;0&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i] + key[i %&nbsp;len(key)]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]
&nbsp; &nbsp;&nbsp;# PRGA (Pseudo-Random Generation Algorithm) - 伪随机生成&nbsp; &nbsp; i = j =&nbsp;0&nbsp; &nbsp; output =&nbsp;bytearray()&nbsp; &nbsp;&nbsp;for&nbsp;byte&nbsp;in&nbsp;data:&nbsp; &nbsp; &nbsp; &nbsp; i = (i +&nbsp;1) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]&nbsp; &nbsp; &nbsp; &nbsp; K = S[(S[i] + S[j]) &&nbsp;0xFF]&nbsp; &nbsp; &nbsp; &nbsp; output.append(byte ^ K)
&nbsp; &nbsp;&nbsp;return&nbsp;bytes(output)
base64_encoded = rc4_crypt(encrypted_data, rc4_key)print(f" RC4解密结果:")print(f" &nbsp;{base64_encoded.decode('ascii')}")
# ==================== 第五部分：Base64解码 ====================print("\n[5] Base64解码...")print("（从first函数分析得到，使用标准Base64编码）")
flag = base64.b64decode(base64_encoded).decode('utf-8')
# ==================== 结果展示 ====================print("\n"&nbsp;+&nbsp;"="&nbsp;*&nbsp;70)print(f" 最终FLAG:&nbsp;{flag}")print("="&nbsp;*&nbsp;70)
# ==================== 验证流程 ====================print("\n[验证] 完整加密流程验证:")print(f"1. 原始输入:&nbsp;{flag}&nbsp;({len(flag)}&nbsp;bytes)")
# 正向Base64编码flag_base64 = base64.b64encode(flag.encode()).decode()print(f"2. Base64编码:&nbsp;{flag_base64}&nbsp;({len(flag_base64)}&nbsp;bytes)")
# 正向RC4加密flag_encrypted = rc4_crypt(flag_base64.encode(), rc4_key)print(f"3. RC4加密:&nbsp;{flag_encrypted.hex()}")
# 验证是否匹配if&nbsp;flag_encrypted == encrypted_data:&nbsp; &nbsp;&nbsp;print("4. 验证XOR变换: &nbsp;完全匹配！")else:&nbsp; &nbsp;&nbsp;print("4. 验证XOR变换: &nbsp;不匹配")
print("\n 解密成功！完全基于对二进制文件的逆向分析")print(" 分析涉及：反汇编、算法识别、逆向工程、脚本编写")

8.2 运行结果

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line$ python3 decrypt.py======================================================================EasyRE CTF Challenge - 解密脚本======================================================================
[1] 从反汇编中提取的关键常量...&nbsp;RC4密钥: flag{do_you_find_it_?}&nbsp;v12常量:&nbsp;0x90604956&nbsp;v6数组:&nbsp;11&nbsp;个元素
[2] 验证逻辑分析...验证逻辑（从 main 函数&nbsp;0x4016ad-0x4016db&nbsp;分析）：&nbsp;&nbsp;for&nbsp;each&nbsp;4-byte&nbsp;block:&nbsp; &nbsp; &nbsp; v7 = data[i]&nbsp; &nbsp; &nbsp; v7 ^= v12 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# XOR with 0x90604956&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(int32_t)v7 >&nbsp;0:&nbsp;# 有符号比较&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 ^=&nbsp;0x22222222&nbsp;# 条件XOR&nbsp; &nbsp; &nbsp; assert v7 == v6[i]
[3] 逆向验证逻辑，从v6反推加密数据...&nbsp;恢复的加密数据（44字节）:&nbsp;&nbsp;5d98c86c583660f1ce6b988f7643c9cc83e283d351e68a7429ab6f101910a3461e9a11e43d54ac9093295721
[4] RC4解密...（RC4是对称加密，加密=解密）&nbsp;RC4解密结果:&nbsp; ZmxhZ3tlYjM1NjRmODlzZjQ1YjI0b2FjMTJkYjhlY30=
[5] Base64解码...（从first函数分析得到，使用标准Base64编码）
======================================================================&nbsp;最终FLAG: flag{eb3564f89sf45b24oac12db8ec}======================================================================
[验证] 完整加密流程验证:1.&nbsp;原始输入: flag{eb3564f89sf45b24oac12db8ec} (32&nbsp;bytes)2.&nbsp;Base64编码: ZmxhZ3tlYjM1NjRmODlzZjQ1YjI0b2FjMTJkYjhlY30= (44&nbsp;bytes)3.&nbsp;RC4加密:&nbsp;5d98c86c583660f1ce6b988f7643c9cc83e283d351e68a7429ab6f101910a3461e9a11e43d54ac90932957214.&nbsp;验证XOR变换: &nbsp;完全匹配！
&nbsp;解密成功！完全基于对二进制文件的逆向分析&nbsp;分析涉及：反汇编、算法识别、逆向工程、脚本编写

第九阶段：知识点总结

9.1 逆向工程方法论

1. 自顶向下的分析方法

ounter(line程序行为观察 → 函数结构 → 算法识别 → 细节分析 → 脚本验证

2. 信息收集优先级

字符串（strings）
函数符号（objdump -t）
主函数逻辑（main）
关键常量和数据结构

3. 算法识别技巧

通过特征代码模式识别
通过魔数和常量识别
通过数据结构识别（S盒、查找表等）

9.2 Base64编码识别要点

特征代码：

除以3的优化：0x55555556魔数
6位分组：and $0x3f（保留低6位）
64字符表：A-Za-z0-9+/
长度转换：(n/3)*4

编码原理：

ounter(line3&nbsp;bytes (24&nbsp;bits) →&nbsp;4&nbsp;groups (6&nbsp;bits each) →&nbsp;4&nbsp;Base64 chars

9.3 RC4算法识别要点

特征代码：

256字节数组（S盒）
两个索引变量i, j（0-255范围）
交换操作：swap(S[i], S[j])
密钥流：K = S[(S[i] + S[j]) & 0xFF]
XOR加密：output = input ^ K

算法结构：

ounter(lineKSA（初始化） + PRGA（加密） = RC4

9.4 汇编分析技巧

1. 数据类型识别

| 汇编指令后缀 | 数据类型 | 大小 |
| — | — | — |
| movb | byte | 1字节 |
| movw | word | 2字节 |
| movl | long/dword | 4字节 |
| movq | quad | 8字节 |

2. 有符号vs无符号

| 有符号 | 无符号 | 说明 |
| — | — | — |
| jg/jl | ja/jb | 大于/小于 |
| jge/jle | jae/jbe | 大于等于/小于等于 |
| imul | mul | 乘法 |
| idiv | div | 除法 |
| cltq/cdqe | – | 符号扩展 |

3. 小端序处理

x86-64使用小端序：

ounter(lineounter(lineounter(lineounter(lineounter(line值：0x12345678内存：[78] [56] [34] [12]Python转换：&nbsp;&nbsp;bytes.fromhex('78563412')[::-1] 或&nbsp; struct.unpack('<I',&nbsp;bytes.fromhex('78563412'))[0]

9.5 常见陷阱

陷阱1：有符号/无符号混淆

本题验证逻辑中：

ounter(lineounter(linecmpl&nbsp;$0x0,0x24(%rbp)jle &nbsp;4016cd&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 有符号比较（jump if less or equal）

错误理解：当成无符号比较正确处理：在Python中正确转换有符号数

陷阱2：字节序错误

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 错误：直接使用十六进制>>>&nbsp;int.to_bytes(0x67616c66,&nbsp;4,&nbsp;'big')b'flag'&nbsp;&nbsp;# 错误顺序
# 正确：使用小端序>>>&nbsp;int.to_bytes(0x67616c66,&nbsp;4,&nbsp;'little')b'flag'&nbsp;&nbsp;# 正确

陷阱3：数据长度计算

Base64编码后长度：

ounter(lineounter(lineounter(line32&nbsp;bytes&nbsp;→ Base64 → ⌈32/3⌉ ×&nbsp;4&nbsp;=&nbsp;11&nbsp;×&nbsp;4&nbsp;=&nbsp;44&nbsp;bytes&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ^^^&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 注意向上取整（需要填充）

9.6 工具使用技巧

objdump常用选项：

ounter(lineounter(lineounter(lineounter(lineobjdump -t&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 查看符号表objdump -d&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 反汇编代码段objdump -s -j .rdata&nbsp;file&nbsp;# 查看只读数据段objdump -x&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 查看所有头信息

strings有用选项：

ounter(lineounter(lineounter(linestrings -a&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 扫描整个文件strings -t x&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 显示偏移（十六进制）strings -e l&nbsp;file&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 小端序UTF-16

Python逆向常用库：

ounter(lineounter(lineounter(lineounter(lineimport&nbsp;base64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Base64编解码import&nbsp;struct &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 二进制数据打包import&nbsp;binascii &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 十六进制转换from&nbsp;Crypto.Cipher&nbsp;import&nbsp;ARC4 &nbsp;# RC4（可选）

第十阶段：进阶思考

10.1 如果没有符号表怎么办？

很多实际的恶意软件或商业软件会移除符号信息（strip）。此时：

通过交叉引用找主函数

程序入口点会调用__libc_start_main
第一个参数通常是main函数地址

通过字符串引用定位

找到”Wrong”/”Success!”字符串
查看哪些函数引用了这些字符串

通过行为模式识别

调用printf/scanf的可能是main
有复杂循环的可能是加密函数

10.2 动态分析的价值

本题我们只用了静态分析，但动态分析（调试）也很有价值：

使用GDB/x64dbg：

在关键位置下断点
观察寄存器和内存变化
单步执行验证假设

使用strace/ltrace：

追踪系统调用
追踪库函数调用
了解程序行为

10.3 实战中的变化

实际CTF题目可能会：

混淆

加入垃圾代码
使用花指令
控制流平坦化

反调试

检测调试器
时间检测
完整性检查

加壳/保护

UPX等压缩壳
VMProtect等虚拟机保护
代码加密

应对策略：

学习脱壳技术
使用反混淆工具
结合动态分析绕过检测

10.4 深入学习路径

基础：

x86-64汇编语言
C/C++编程
数据结构与算法

进阶：

编译原理
操作系统原理
密码学基础

实战：

CTF逆向题库（pwnable.kr, reversing.kr）
真实软件逆向
恶意软件分析

总结

这道EasyRE题目虽然名为”Easy”，但实际上涵盖了逆向工程的多个核心技能：

静态分析：反汇编、字符串提取、常量识别
算法识别：Base64编码、RC4流密码
逆向思维：从验证逻辑反推原始数据
编程实现：编写解密脚本
调试验证：端到端验证解密流程

通过这道题目，我们学习了：

系统的逆向分析方法
常见加密算法的识别技巧
汇编代码的阅读和理解
有符号/无符号、小端序等细节处理
从理论到实践的完整流程

逆向工程是一门实践性很强的技术，需要大量的练习和积累。希望本文能为你的逆向学习之路提供一个良好的起点！

最终FLAG：flag{eb3564f89sf45b24oac12db8ec}

解密脚本：已包含在”第八阶段”中

附录：常用资源

A. 工具下载

Ghidra: https://ghidra-sre.org/ (免费反编译器)
IDA Free: https://hex-rays.com/ida-free/ (免费版IDA)
x64dbg: https://x64dbg.com/ (Windows调试器)
Radare2: https://rada.re/ (开源逆向框架)

B. 学习资源

书籍：
《逆向工程权威指南》
《加密与解密（第4版）》
《汇编语言（第3版）》王爽
在线课程：
CTF Wiki: https://ctf-wiki.org/
Reverse Engineering for Beginners: https://beginners.re/

C. 练习平台

CTF平台：
pwnable.kr
reversing.kr
crackmes.one
靶机平台：
HackTheBox
TryHackMe

本文所有分析均基于合法的CTF竞赛题目，仅用于学习和教育目的。请勿将相关技术用于非法用途。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：破镜安全破镜安全《解析2025古剑山EasyRE》

Tags: CTF WEB安全二进制安全代码审计逆向分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)