{"id":334,"date":"2022-12-28T15:28:00","date_gmt":"2022-12-28T07:28:00","guid":{"rendered":"https:\/\/shangwendada.co\/?p=334"},"modified":"2022-12-28T17:24:56","modified_gmt":"2022-12-28T09:24:56","slug":"revsersebjdctf2020encode","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2022\/12\/28\/revsersebjdctf2020encode\/","title":{"rendered":"[Revserse][BJDCTF2020]encode"},"content":{"rendered":"<h1><a href=\"https:\/\/ctf.show\/files\/9fb3376135ab33b85bd46d61ecec9372\/encode?token=eyJ1c2VyX2lkIjoyNDMzOCwidGVhbV9pZCI6bnVsbCwiZmlsZV9pZCI6MTU1fQ.Y6s4Lw.hb7YoShODKKRjb6XKGrTVDPscoc\" title=\"[BJDCTF2022]encode(\u70b9\u51fb\u4e0b\u8f7d)\">[BJDCTF2022]encode(\u70b9\u51fb\u4e0b\u8f7d)<\/a><\/h1>\n<h1>\u5206\u6790<\/h1>\n<p>\u6587\u4ef6\u5e26\u6709upx\u58f3\uff0c\u8131\u58f3\u4e4b\u540e,\u8fdb\u5165ida\u5206\u6790<br \/>\n\u6839\u636e\u5b57\u7b26\u4e32\u91cc\u9762\u7684right\u5b57\u7b26\u627e\u5230\u7a97\u53e3<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.co\/wp-content\/uploads\/2022\/12\/image-1672212052140.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.co\/wp-content\/uploads\/2022\/12\/image-1672212052140.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u6587\u4ef6\u5c06\u8f93\u5165\u70b9\u653e\u5728v6\u6570\u7ec4\u7684\u7b2c50\u4e2a\u5730\u5740\u4e0a\u9762\uff0c\u8f93\u5165\u4e4b\u540e\u5224\u65ad\u957f\u5ea6\u4e3a21.<br \/>\n\u7136\u540e\u6587\u4ef6\u8fdb\u5165\u4e86sub_8048AC2\u8fdb\u884c\u4e86\u52a0\u5bc6<\/p>\n<pre><code class=\"language-cpp\">int __cdecl sub_8048AC2(int a1)\n{\n  int v2; \/\/ [esp+8h] [ebp-20h]\n  int v3; \/\/ [esp+Ch] [ebp-1Ch]\n  int v4; \/\/ [esp+10h] [ebp-18h]\n  int v5; \/\/ [esp+18h] [ebp-10h]\n  int v6; \/\/ [esp+1Ch] [ebp-Ch]\n\n  v5 = sub_805BBD0(a1);\n  if ( v5 % 3 )\n    v2 = 4 * (v5 \/ 3 + 1);\n  else\n    v2 = 4 * (v5 \/ 3);\n  v6 = sub_80597A0(v2 + 1);\n  *(_BYTE *)(v2 + v6) = 0;\n  v3 = 0;\n  v4 = 0;\n  while ( v2 - 2 &gt; v3 )\n  {\n    *(_BYTE *)(v6 + v3) = a0123456789Abcd[*(_BYTE *)(v4 + a1) &gt;&gt; 2];\n    *(_BYTE *)(v6 + v3 + 1) = a0123456789Abcd[(16 * (*(_BYTE *)(v4 + a1) &amp; 3)) | (*(_BYTE *)(v4 + 1 + a1) &gt;&gt; 4)];\n    *(_BYTE *)(v6 + v3 + 2) = a0123456789Abcd[(4 * (*(_BYTE *)(v4 + 1 + a1) &amp; 0xF)) | (*(_BYTE *)(v4 + 2 + a1) &gt;&gt; 6)];\n    *(_BYTE *)(v6 + v3 + 3) = a0123456789Abcd[*(_BYTE *)(v4 + 2 + a1) &amp; 0x3F];\n    v4 += 3;\n    v3 += 4;\n  }\n  if ( v5 % 3 == 1 )\n  {\n    *(_BYTE *)(v3 - 2 + v6) = 61;\n    *(_BYTE *)(v3 - 1 + v6) = 61;\n  }\n  else if ( v5 % 3 == 2 )\n  {\n    *(_BYTE *)(v3 - 1 + v6) = 61;\n  }\n  return v6;\n}<\/code><\/pre>\n<p>\u6839\u636e\u903b\u8f91\u53d1\u73b0\u662fBase64<br \/>\n\u5bc6\u7801\u8868\u4e3a:<\/p>\n<pre><code class=\"language-cpp\">0123456789+\/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ<\/code><\/pre>\n<p>sub_80481D0\u662f\u5c06base64\u52a0\u5bc6\u540e\u7684\u6570\u636e\u5b58\u5230v5 + 18 \u7684\u5730\u5740\u4e0a\u9762<br \/>\n\u518d\u4f7f\u7528for\u5faa\u73af\u548cv5\u8fd9\u4e32\u5bc6\u94a5\u5faa\u73af\u5f02\u6216<br \/>\n\u6700\u540e\u8fdb\u5165sub_8048E24<\/p>\n<pre><code class=\"language-cpp\">unsigned int __cdecl sub_8048E24(int a1, unsigned int a2, int a3, int a4)\n{\n  unsigned int result; \/\/ eax\n  char v5; \/\/ [esp+1Bh] [ebp-11Dh]\n  int v6; \/\/ [esp+1Ch] [ebp-11Ch]\n  int v7; \/\/ [esp+20h] [ebp-118h]\n  unsigned int i; \/\/ [esp+24h] [ebp-114h]\n  char v9[256]; \/\/ [esp+2Ch] [ebp-10Ch] BYREF\n  unsigned int v10; \/\/ [esp+12Ch] [ebp-Ch]\n\n  v10 = __readgsdword(0x14u);\n  sub_8048CC2(v9, a3, a4);\n  LOBYTE(v6) = 0;\n  LOBYTE(v7) = 0;\n  for ( i = 0; i &lt; a2; ++i )\n  {\n    v6 = (unsigned __int8)(v6 + 1);\n    v7 = (unsigned __int8)(v9[v6] + v7);\n    v5 = v9[v6];\n    v9[v6] = v9[v7];\n    v9[v7] = v5;\n    *(_BYTE *)(a1 + i) ^= v9[(unsigned __int8)(v9[v6] + v9[v7])];\n  }\n  result = __readgsdword(0x14u) ^ v10;\n  if ( result )\n    sub_806FA00();\n  return result;\n}<\/code><\/pre>\n<p>\u5176\u4e2d\u8c03\u7528\u4e86 sub_8048CC2(v9, a3, a4);<\/p>\n<pre><code class=\"language-cpp\">unsigned int __cdecl sub_8048CC2(int a1, int a2, unsigned int a3)\n{\n  unsigned int result; \/\/ eax\n  char v4; \/\/ [esp+13h] [ebp-115h]\n  int i; \/\/ [esp+14h] [ebp-114h]\n  int j; \/\/ [esp+14h] [ebp-114h]\n  int v7; \/\/ [esp+18h] [ebp-110h]\n  char v8[256]; \/\/ [esp+1Ch] [ebp-10Ch]\n  unsigned int v9; \/\/ [esp+11Ch] [ebp-Ch]\n\n  v9 = __readgsdword(0x14u);\n  for ( i = 0; i &lt;= 255; ++i )\n  {\n    *(_BYTE *)(i + a1) = i;\n    v8[i] = *(_BYTE *)(i % a3 + a2);\n  }\n  v7 = 0;\n  for ( j = 0; j &lt;= 255; ++j )\n  {\n    v7 = (*(unsigned __int8 *)(j + a1) + v7 + (unsigned __int8)v8[j]) % 256;\n    v4 = *(_BYTE *)(j + a1);\n    *(_BYTE *)(a1 + j) = *(_BYTE *)(v7 + a1);\n    *(_BYTE *)(a1 + v7) = v4;\n  }\n  result = __readgsdword(0x14u) ^ v9;\n  if ( result )\n    sub_806FA00();\n  return result;\n}<\/code><\/pre>\n<p>\u5206\u6790\u4e4b\u540e\u53d1\u73b0\u662frc4\u52a0\u5bc6\u3002<\/p>\n<h1>\u9898\u89e3:<\/h1>\n<p>\u9996\u5148\u5c06v6\u5730\u5740\u4e0a\u5b58\u50a8\u7684\u6570\u636e\u8fdb\u884crc4\u89e3\u5bc6\uff0c\u7136\u540e\u5faa\u73af\u5f02\u6216\uff0c\u6700\u540e\u518d\u4f7f\u7528base64\u53d8\u8868\u89e3\u5bc6\uff0c\u5c31\u884c\u4e86\u3002<br \/>\n<strong>\u3010\u6ce8\u610f\u3011<\/strong><br \/>\n\u9898\u76ee\u4e2d\u8fd9\u4e2av6\u7684\u5b57\u7b26\u4e32\uff0c\u7531\u4e8eida\u7684\u539f\u56e0\u662f\u5206\u6790\u9519\u8bef\u4e86\u7684\u3002<br \/>\n\u6240\u4ee5\u6211\u4eec\u9700\u8981\u624b\u52a8\u6539\u9020\u4e00\u4e0b\uff0c\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\u8fd9\u4e00\u6bb5\u8bed\u53e5<\/p>\n<pre><code class=\"language-cpp\">if ( sub_805BBD0(&amp;v6[50]) == 21 )\n    sub_804EAF0(0);<\/code><\/pre>\n<p>\u52a8\u6001\u8c03\u8bd5\u540e\u53d1\u73b0\u8fd9\u4e2asub_805BBD0\u662f\u4e00\u4e2a\u83b7\u53d6\u5b57\u7b26\u4e32\u957f\u7684\u7684\u8bed\u53e5<br \/>\n\u90a3\u4e48flag\u957f\u5ea6\u662f21\u7684\u8bdd\uff0c\u7ecf\u8fc7base64\u52a0\u5bc6\u4e4b\u540e\u5e94\u8be5\u662f28\u4f4d\u6570\uff0c\u4f46\u662fv6\u4e2d\u5b58\u50a8\u7684\u5374\u53ea\u670949\u4f4d\u6570\u5b57\uff0c\u8fd9\u662f\u56e0\u4e3a\u8fd9\u4e2a\u5b57\u7b26\u4e32\u6709\u4e9b01\u6216\u80050E\u88ab\u8bc6\u522b\u6210\u4e861\u548cE<br \/>\n\u6b63\u786e\u7684enc:<\/p>\n<pre><code class=\"language-cpp\">int a[]={\n    0xE8,0xD8,0xBD,0x91,0x87,0x1A,0x01,0x0E,0x56,0x0F\n    ,0x53,0xF4,0x88,0x96,0x82,0xF9,0x61,0x42,0x0A,0xF2,0xAB\n    ,0x08,0xFE,0xD7,0xAC,0xFD,0x5E,0x00\n};<\/code><\/pre>\n<h1>EXP<\/h1>\n<h2>\u76f4\u63a5\u624b\u64b8\u4ee3\u7801\u7248\u672c<\/h2>\n<pre><code class=\"language-cpp\">#include&lt;iostream&gt;\n#include&lt;algorithm&gt;\n#include&lt;cstdio&gt;\n#include&lt;cmath&gt;\n#include&lt;map&gt;\n#include&lt;vector&gt;\n#include&lt;queue&gt;\n#include&lt;stack&gt;\n#include&lt;set&gt;\n#include&lt;string&gt;\n#include&lt;cstring&gt;\n#include&lt;list&gt;\n#include&lt;stdlib.h&gt;\n#include&lt;windows.h&gt;\n#include&lt;iostream&gt;\n#include&lt;cstring&gt;\n#include&lt;bitset&gt;\n#include&lt;vector&gt;\n#include&lt;stdlib.h&gt;\n#include&lt;time.h&gt;\n#include&lt;sstream&gt;\n#include&lt;cstring&gt;\n\/*base64.c*\/  \n#include &quot;base64.h&quot;  \nusing namespace std;\n    \/\/base64.c\n#include&quot;base64.h&quot;\nchar base64char[] = &quot;0123456789+\/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;;\nchar c;\nchar* base64_encode(char* binData, char* base64, int binLength)\n{\n    int i = 0;\n    int j = 0;\n    int current = 0;\n    for (i = 0; i &lt; binLength; i += 3) {\n        \/\/\u83b7\u53d6\u7b2c\u4e00\u4e2a6\u4f4d\n        current = (*(binData + i) &gt;&gt; 2) &amp; 0x3F;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u4e8c\u4e2a6\u4f4d\u7684\u524d\u4e24\u4f4d\n        current = (*(binData + i) &lt;&lt; 4) &amp; 0x30;\n        \/\/\u5982\u679c\u53ea\u6709\u4e00\u4e2a\u5b57\u7b26\uff0c\u90a3\u4e48\u9700\u8981\u505a\u7279\u6b8a\u5904\u7406\n        if (binLength &lt;= (i + 1)) {\n            *(base64 + j++) = base64char[current];\n            *(base64 + j++) = &#039;=&#039;;\n            *(base64 + j++) = &#039;=&#039;;\n            break;\n        }\n        \/\/\u83b7\u53d6\u7b2c\u4e8c\u4e2a6\u4f4d\u7684\u540e\u56db\u4f4d\n        current |= (*(binData + i + 1) &gt;&gt; 4) &amp; 0xf;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u4e09\u4e2a6\u4f4d\u7684\u524d\u56db\u4f4d\n        current = (*(binData + i + 1) &lt;&lt; 2) &amp; 0x3c;\n        if (binLength &lt;= (i + 2)) {\n            *(base64 + j++) = base64char[current];\n            *(base64 + j++) = &#039;=&#039;;\n            break;\n        }\n        \/\/\u83b7\u53d6\u7b2c\u4e09\u4e2a6\u4f4d\u7684\u540e\u4e24\u4f4d\n        current |= (*(binData + i + 2) &gt;&gt; 6) &amp; 0x03;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u56db\u4e2a6\u4f4d\n        current = *(binData + i + 2) &amp; 0x3F;\n        *(base64 + j++) = base64char[current];\n    }\n    *(base64 + j) = &#039;\\0&#039;;\n    return base64;\n}\n\nchar* base64_decode(char const* base64Str, char* debase64Str, int encodeStrLen)\n{\n    int i = 0;\n    int j = 0;\n    int k = 0;\n    char temp[4] = &quot;&quot;;\n\n    for (i = 0; i &lt; encodeStrLen; i += 4) {\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i) == base64char[j]) {\n                temp[0] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 1) == base64char[j]) {\n                temp[1] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 2) == base64char[j]) {\n                temp[2] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 3) == base64char[j]) {\n                temp[3] = j;\n            }\n        }\n\n        *(debase64Str + k++) = ((temp[0] &lt;&lt; 2) &amp; 0xFC) | ((temp[1] &gt;&gt; 4) &amp; 0x03);\n        if (*(base64Str + i + 2) == &#039;=&#039;)\n            break;\n\n        *(debase64Str + k++) = ((temp[1] &lt;&lt; 4) &amp; 0xF0) | ((temp[2] &gt;&gt; 2) &amp; 0x0F);\n        if (*(base64Str + i + 3) == &#039;=&#039;)\n            break;\n\n        *(debase64Str + k++) = ((temp[2] &lt;&lt; 6) &amp; 0xF0) | (temp[3] &amp; 0x3F);\n    }\n    return debase64Str;\n}\n\nunsigned int __cdecl sub_8048CC2(unsigned __int8 * a1, char *a2, unsigned int a3)\n{\n  char v4; \/\/ [esp+13h] [ebp-115h]\n  int i; \/\/ [esp+14h] [ebp-114h]\n  int j; \/\/ [esp+14h] [ebp-114h]\n  int v7; \/\/ [esp+18h] [ebp-110h]\n  unsigned __int8  v8[256]; \/\/ [esp+1Ch] [ebp-10Ch]\n\n  for ( i = 0; i &lt;= 255; ++i )\n  {\n    *(i + a1) = i;\n    v8[i] = *(i % a3 + a2);\n  }\n  v7 = 0;\n  for ( j = 0; j &lt;= 255; ++j )\n  {\n    v7 = (*(unsigned __int8 *)(j + a1) + v7 + (unsigned __int8)v8[j]) % 256;\n    v4 = *(j + a1);\n    *(a1 + j) = *(v7 + a1);\n    *(a1 + v7) = v4;\n  }\n  return 0;\n}\n\nunsigned int __cdecl sub_8048E24(int* a1, unsigned int a2, char * a3, unsigned int a4)\n{\n  char v5; \/\/ [esp+1Bh] [ebp-11Dh]\n  int v6; \/\/ [esp+1Ch] [ebp-11Ch]\n  int v7; \/\/ [esp+20h] [ebp-118h]\n  unsigned int i; \/\/ [esp+24h] [ebp-114h]\n  unsigned __int8 v9[256]; \/\/ [esp+2Ch] [ebp-10Ch] BYREF \/\/ [esp+12Ch] [ebp-Ch]\n\n  sub_8048CC2(v9, a3, a4);\n  v6 = 0;\n  v7 = 0;\n  for ( i = 0; i &lt; a2; ++i )\n  {\n    v6 = (unsigned __int8)(v6 + 1);\n    v7 = (unsigned __int8)(v9[v6] + v7);\n    v5 = v9[v6];\n    v9[v6] = v9[v7];\n    v9[v7] = v5;\n    *(a1 + i) ^= v9[(unsigned __int8)(v9[v6] + v9[v7])];\n  }\n  return 0;\n}\nint a[]={\n    0xE8,0xD8,0xBD,0x91,0x87,0x1A,0x01,0x0E,0x56,0x0F\n    ,0x53,0xF4,0x88,0x96,0x82,0xF9,0x61,0x42,0x0A,0xF2,0xAB\n    ,0x08,0xFE,0xD7,0xAC,0xFD,0x5E,0x00\n};\nchar b[]=&quot;Flag{This_a_Flag}&quot;;\nint main ()\n{\n    char flag[256]=&quot;0&quot;;\n    sub_8048E24(a,28,b,17);\n    for(int i = 0 ; i&lt;28; i ++ )\n    {\n        a[i]^=b[i%17];\n        flag[i]=a[i];\n    }\n    char ans[256]={0};\n    base64_decode(flag,ans,strlen(flag));\n    cout&lt;&lt;ans&lt;&lt;endl;\n}\n<\/code><\/pre>\n<h2>\u52a8\u6001\u8c03\u8bd5\u83b7\u53d6rc4\u5f02\u6216\u503c<\/h2>\n<pre><code class=\"language-cpp\">#include&lt;iostream&gt;\n#include&lt;algorithm&gt;\n#include&lt;cstdio&gt;\n#include&lt;cmath&gt;\n#include&lt;map&gt;\n#include&lt;vector&gt;\n#include&lt;queue&gt;\n#include&lt;stack&gt;\n#include&lt;set&gt;\n#include&lt;string&gt;\n#include&lt;cstring&gt;\n#include&lt;list&gt;\n#include&lt;stdlib.h&gt;\n#include&lt;windows.h&gt;\n#include&lt;iostream&gt;\n#include&lt;cstring&gt;\n#include&lt;bitset&gt;\n#include&lt;vector&gt;\n#include&lt;stdlib.h&gt;\n#include&lt;time.h&gt;\n#include&lt;sstream&gt;\n#include&lt;cstring&gt;\n\/*base64.c*\/  \n#include &quot;base64.h&quot;  \nusing namespace std;\n    \/\/base64.c\n#include&quot;base64.h&quot;\nchar base64char[] = &quot;0123456789+\/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;;\nchar c;\nchar* base64_encode(char* binData, char* base64, int binLength)\n{\n    int i = 0;\n    int j = 0;\n    int current = 0;\n    for (i = 0; i &lt; binLength; i += 3) {\n        \/\/\u83b7\u53d6\u7b2c\u4e00\u4e2a6\u4f4d\n        current = (*(binData + i) &gt;&gt; 2) &amp; 0x3F;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u4e8c\u4e2a6\u4f4d\u7684\u524d\u4e24\u4f4d\n        current = (*(binData + i) &lt;&lt; 4) &amp; 0x30;\n        \/\/\u5982\u679c\u53ea\u6709\u4e00\u4e2a\u5b57\u7b26\uff0c\u90a3\u4e48\u9700\u8981\u505a\u7279\u6b8a\u5904\u7406\n        if (binLength &lt;= (i + 1)) {\n            *(base64 + j++) = base64char[current];\n            *(base64 + j++) = &#039;=&#039;;\n            *(base64 + j++) = &#039;=&#039;;\n            break;\n        }\n        \/\/\u83b7\u53d6\u7b2c\u4e8c\u4e2a6\u4f4d\u7684\u540e\u56db\u4f4d\n        current |= (*(binData + i + 1) &gt;&gt; 4) &amp; 0xf;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u4e09\u4e2a6\u4f4d\u7684\u524d\u56db\u4f4d\n        current = (*(binData + i + 1) &lt;&lt; 2) &amp; 0x3c;\n        if (binLength &lt;= (i + 2)) {\n            *(base64 + j++) = base64char[current];\n            *(base64 + j++) = &#039;=&#039;;\n            break;\n        }\n        \/\/\u83b7\u53d6\u7b2c\u4e09\u4e2a6\u4f4d\u7684\u540e\u4e24\u4f4d\n        current |= (*(binData + i + 2) &gt;&gt; 6) &amp; 0x03;\n        *(base64 + j++) = base64char[current];\n        \/\/\u83b7\u53d6\u7b2c\u56db\u4e2a6\u4f4d\n        current = *(binData + i + 2) &amp; 0x3F;\n        *(base64 + j++) = base64char[current];\n    }\n    *(base64 + j) = &#039;\\0&#039;;\n    return base64;\n}\n\nchar* base64_decode(char const* base64Str, char* debase64Str, int encodeStrLen)\n{\n    int i = 0;\n    int j = 0;\n    int k = 0;\n    char temp[4] = &quot;&quot;;\n\n    for (i = 0; i &lt; encodeStrLen; i += 4) {\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i) == base64char[j]) {\n                temp[0] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 1) == base64char[j]) {\n                temp[1] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 2) == base64char[j]) {\n                temp[2] = j;\n            }\n        }\n\n        for (j = 0; j &lt; 64; j++) {\n            if (*(base64Str + i + 3) == base64char[j]) {\n                temp[3] = j;\n            }\n        }\n\n        *(debase64Str + k++) = ((temp[0] &lt;&lt; 2) &amp; 0xFC) | ((temp[1] &gt;&gt; 4) &amp; 0x03);\n        if (*(base64Str + i + 2) == &#039;=&#039;)\n            break;\n\n        *(debase64Str + k++) = ((temp[1] &lt;&lt; 4) &amp; 0xF0) | ((temp[2] &gt;&gt; 2) &amp; 0x0F);\n        if (*(base64Str + i + 3) == &#039;=&#039;)\n            break;\n\n        *(debase64Str + k++) = ((temp[2] &lt;&lt; 6) &amp; 0xF0) | (temp[3] &amp; 0x3F);\n    }\n    return debase64Str;\n}\n\nint a[]={\n    0xE8,0xD8,0xBD,0x91,0x87,0x1A,0x01,0x0E,0x56,0x0F\n    ,0x53,0xF4,0x88,0x96,0x82,0xF9,0x61,0x42,0x0A,0xF2,0xAB\n    ,0x08,0xFE,0xD7,0xAC,0xFD,0x5E,0x00\n};\nchar b[]=&quot;Flag{This_a_Flag}&quot;;\nint tmp[]={\n    0xcb,0xcd,0x98,0xc2,0x8f,0x0,0x58,0x36,0x44,0x65,\n    0x6a,0xc5,0xaf,0xcd,0x89,0xea,0x72,0x4a,0x56,0xc1,\n    0xa0,0x3d,0x9f,0xd6,0xfd,0xe2,0x4e,0x5c,0x3f,0xd,\n    0xe,0x47,0x8b,0x8a,0x45,0x39,0xcb,0xa4,0xbf,0xf2,\n    0x79,0x7c,0x3a,0x6b,0xe8,0x2c,0x8b,0x1a,0x60,0x60,\n    0x8e,0x7f,0x76,0x83,0x8e,0x1a\n};\nint main ()\n{\n    char flag[256]=&quot;0&quot;;\n    for(int i= 0 ; i&lt; 28; i ++ )\n    {\n        a[i]^=tmp[i];\n    }\n    for(int i = 0 ; i&lt;28; i ++ )\n    {\n        a[i]^=b[i%17];\n        flag[i]=a[i];\n    }\n    char ans[256]={0};\n    base64_decode(flag,ans,strlen(flag));\n    cout&lt;&lt;ans&lt;&lt;endl;\n}\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>[BJDCTF2022]encode(\u70b9\u51fb\u4e0b\u8f7d) \u5206\u6790 \u6587\u4ef6\u5e26\u6709upx\u58f3\uff0c\u8131\u58f3\u4e4b\u540e,\u8fdb\u5165ida\u5206\u6790 \u6839\u636e\u5b57\u7b26\u4e32 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":180,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=334"}],"version-history":[{"count":3,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/334\/revisions"}],"predecessor-version":[{"id":338,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/334\/revisions\/338"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/180"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}