攻防世界——EasyRE

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // edx
  char *v4; // esi
  char v5; // al
  unsigned int i; // edx
  int v7; // eax
  char Arglist[16]; // [esp+2h] [ebp-24h] BYREF
  __int64 v10; // [esp+12h] [ebp-14h] BYREF
  int v11; // [esp+1Ah] [ebp-Ch]
  __int16 v12; // [esp+1Eh] [ebp-8h]

  sub_401020(Format);                           // input
  v11 = 0;
  v12 = 0;
  *(_OWORD *)Arglist = 0i64;
  v10 = 0i64;
  sub_401050("%s", (char)Arglist);
  if ( strlen(Arglist) == 24 )
  {
    v3 = 0;
    v4 = (char *)&v10 + 7;
    do
    {
      v5 = *v4--;
      byte_40336C[v3++] = v5;
    }
    while ( v3 < 24 );
    for ( i = 0; i < 0x18; ++i )
      byte_40336C[i] = (byte_40336C[i] + 1) ^ 6;
    v7 = strcmp(byte_40336C, aXircjR2twsv3pt);  // xIrCj~<r|2tWsv3PtI
    if ( v7 )
      v7 = v7 < 0 ? -1 : 1;
    if ( !v7 )
    {
      sub_401020("right\n");
      system("pause");
    }
  }
  return 0;
}

很轻易就找到主代码

可以看见中间就是异或操作然后对比

这里有个特大重点就是

这里读取的字符串是反着的！！！
??????

t="xIrCj~<r|2tWsv3PtI\x7Fzndka"
flag=""
for i in range(24):
    flag+=chr((ord(t[i])^6)-1)
print(flag[::-1])

??flag{xNqU4otPq3ys9wkDsN}