一. 你见过蓝色的小鲸鱼

• 找到关键加密函数：

• CHAR *__cdecl sub_4577E0(HWND hDlg)
  {CHAR *result; // eaxCHAR *v2; // [esp+10h] [ebp-154h]void *v3; // [esp+24h] [ebp-140h]CHAR *v4; // [esp+114h] [ebp-50h]CHAR *lpString; // [esp+120h] [ebp-44h]HWND DlgItem; // [esp+12Ch] [ebp-38h]HWND hWnd; // [esp+138h] [ebp-2Ch]int v8; // [esp+144h] [ebp-20h]int WindowTextLengthA; // [esp+150h] [ebp-14h]__CheckForDebuggerJustMyCode(&unk_52105E);hWnd = GetDlgItem(hDlg, 1003);DlgItem = GetDlgItem(hDlg, 1004);WindowTextLengthA = GetWindowTextLengthA(hWnd);v8 = GetWindowTextLengthA(DlgItem);lpString = (CHAR *)j__malloc(__CFADD__(WindowTextLengthA, 16) ? -1 : WindowTextLengthA + 16);result = (CHAR *)j__malloc(__CFADD__(v8, 16) ? -1 : v8 + 16);v4 = result;if ( lpString && result ){GetWindowTextA(hWnd, lpString, WindowTextLengthA + 16);GetWindowTextA(DlgItem, v4, v8 + 16);v3 = operator new(0x10u);if ( v3 ){sub_451B43(0x10u);v2 = (CHAR *)sub_450CE3(v3);}else{v2 = 0;}sub_44FC2B(&unk_51D38C, 0x10u);sub_45126F(lpString, WindowTextLengthA, (int)v4, v8);sub_450199(v2);j__free(lpString);j__free(v4);result = v2;if ( v2 )return (CHAR *)sub_44F77B(1);}return result;
  }int __thiscall sub_4571A0(int this, void *Src, size_t a3, void *a4, size_t a5)
  {const void *v5; // eaxint result; // eaxsize_t v7; // [esp-4h] [ebp-12Ch]int v8; // [esp+10h] [ebp-118h]__CheckForDebuggerJustMyCode(&unk_52102F);if ( operator new(0x2Cu) ){sub_451A4E(0x2Cu);v8 = sub_450CBB(Src, a3);}else{v8 = 0;}sub_4521B5(&unk_51C048, &unk_51C000);sub_451F08(a4, a5);*(_DWORD *)(this + 12) = sub_44FEF6(v8);*(_DWORD *)(this + 4) = j_unknown_libname_47(*(_DWORD *)(this + 12));v7 = *(_DWORD *)(this + 12);v5 = (const void *)sub_4505A4(v8);j__memmove(*(void **)(this + 4), v5, v7);result = v8;if ( v8 )return sub_44FF0A(1);return result;
  }sub_4521B5(&unk_51C048, &unk_51C000);//两个都是blowfish的表
  

• 发现为blowfish加密，密钥就是题目用户名（blowfish密钥不定长）

• 在线网站解密

• QHRoZWJsdWVmMXNo

• 也可以脚本解密

• from Crypto.Cipher import Blowfish
  key=b'UzBtZTBuZV9EMGcz'
  bf=Blowfish.new(key,Blowfish.MODE_ECB)
  enc=b"\x11\xA5\x1F\x04\x95\x50\xE2\x50\x8F\x17\xE1\x6C\xF1\x63\x2B\x47"
  print(bf.decrypt(enc))
  

• 则有：D0g3{UzBtZTBuZV9EMGczQHRoZWJsdWVmMXNo}

二. 感觉有点点简单

• 简单题，RC4魔改加base64魔改

• __int64 sub_1400016F0()
  {__int64 v1; // [rsp+20h] [rbp-78h] BYREFPVOID NumberOfBytes_4; // [rsp+28h] [rbp-70h]PVOID P; // [rsp+30h] [rbp-68h]__int64 v4; // [rsp+38h] [rbp-60h]__int64 v5; // [rsp+40h] [rbp-58h]__int64 v6; // [rsp+48h] [rbp-50h] BYREFconst char *v7; // [rsp+50h] [rbp-48h]const char *v8; // [rsp+58h] [rbp-40h]struct _UNICODE_STRING DestinationString; // [rsp+60h] [rbp-38h] BYREFchar v10[40]; // [rsp+70h] [rbp-28h] BYREFHIDWORD(v1) = 4096;memset(&v6, 0, sizeof(v6));RtlInitUnicodeString(&DestinationString, L"\\??\\C:\\Users\\Public\\flag.txt");NumberOfBytes_4 = ExAllocatePool(NonPagedPool, 0x1000ui64);P = ExAllocatePool(NonPagedPool, 0x1000ui64);if ( NumberOfBytes_4 && P ){v4 = HIDWORD(v1);memset(P, 0, HIDWORD(v1));v5 = HIDWORD(v1);memset(NumberOfBytes_4, 0, HIDWORD(v1));qmemcpy(v10, &DestinationString, 0x10ui64);LOBYTE(v1) = sub_140001040(v10, v6, NumberOfBytes_4, (char *)&v1 + 4);if ( (_BYTE)v1 ){if ( HIDWORD(v1) <= 0xC00 ){sub_1400011F0(NumberOfBytes_4, HIDWORD(v1), "the_key_", 8i64, v1);sub_140001360((__int64)P, (__int64)NumberOfBytes_4, SHIDWORD(v1));LOBYTE(v1) = sub_140001560((__int64)P, 56);v8 = "tips: YES, RIGHT FLAG.   you got it!";v7 = "tips: NO , WRONG ANSWER. try again !";if ( (_BYTE)v1 )DbgPrint("tips: %s\n", v8);elseDbgPrint("tips: %s\n", v7);}else{DbgPrint("tips: file to long \n");}}else{DbgPrint("tips: can not read|open file\n");}}else{DbgPrint("tips: can not malloc\n");}if ( NumberOfBytes_4 ){ExFreePoolWithTag(NumberOfBytes_4, 0);NumberOfBytes_4 = 0i64;}if ( P ){ExFreePoolWithTag(P, 0);P = 0i64;}return 0i64;
  }
  

• RC4魔改：

• __int64 __fastcall sub_1400011F0(__int64 a1, unsigned int a2, __int64 a3, unsigned int a4)
  {__int64 result; // raxunsigned __int8 v5; // [rsp+20h] [rbp-18h]unsigned __int8 v6; // [rsp+21h] [rbp-17h]unsigned int i; // [rsp+24h] [rbp-14h]v5 = 0;v6 = 0;sub_1400015B0(a3, a4);for ( i = 0; ; ++i ){result = a2;if ( i >= a2 )break;v5 = (v5 + 1) % 64;v6 = (byte_140003010[v5] + v6) % 64;sub_1400018E0(&byte_140003010[v5], &byte_140003010[v6]);*(_BYTE *)(a1 + i) ^= (v6 ^ v5) & byte_140003010[(unsigned __int8)(((v6 ^ v5)+ byte_140003010[v6]+ byte_140003010[v5])% 64)];}return result;
  }
  

• base64魔改：

• __int64 __fastcall sub_140001360(__int64 a1, __int64 a2, int a3)
  {int v4; // [rsp+0h] [rbp-88h]int v5; // [rsp+4h] [rbp-84h]char v6[80]; // [rsp+10h] [rbp-78h] BYREFstrcpy(v6, "4KBbSzwWClkZ2gsr1qA+Qu0FtxOm6/iVcJHPY9GNp7EaRoDf8UvIjnL5MydTX3eh");v4 = 0;v5 = 0;while ( v4 < a3 ){*(_BYTE *)(a1 + v5) = v6[*(_BYTE *)(a2 + v4) & 0x3F];*(_BYTE *)(a1 + v5 + 1) = v6[(4 * (*(_BYTE *)(a2 + v4 + 1) & 0xF)) | ((*(_BYTE *)(a2 + v4) & 0xC0) >> 6)];*(_BYTE *)(a1 + v5 + 2) = v6[(16 * (*(_BYTE *)(a2 + v4 + 2) & 3)) | ((*(_BYTE *)(a2 + v4 + 1) & 0xF0) >> 4)];*(_BYTE *)(a1 + v5 + 3) = v6[(*(_BYTE *)(a2 + v4 + 2) & 0xFC) >> 2];v4 += 3;v5 += 4;}if ( a3 % 3 == 1 ){*(_BYTE *)(a1 + v5 - 2) = 61;*(_BYTE *)(a1 + v5 - 1) = 61;}else if ( a3 % 3 == 2 ){*(_BYTE *)(a1 + v5 - 1) = 61;}return 0i64;
  }
  

• 检验：

• bool __fastcall sub_140001560(__int64 a1, int a2)
  {return a2 == 56 && !(unsigned int)sub_1400019F0(a1, "6zviISn2McHsa4b108v29tbKMtQQXQHA+2+sTYLlg9v2Q2Pq8SP24Uw=", 56i64);
  }
  

• 编写脚本：

• def KSA(key):key_length = len(key)S = list(range(64))j = 0for i in range(64):j = (j + S[i] + key[i % key_length]) % 64S[i], S[j] = S[j], S[i]return Sdef PRGA(S):i = 0j = 0while True:i = (i + 1) % 64j = (j + S[i]) % 64S[i], S[j] = S[j], S[i]K = (i^j) & S[(((i^j)+S[i] + S[j]) % 64)]yield Kdef RC4(key):S = KSA(key)keystream = PRGA(S)return keystreamif __name__ == '__main__':key = 'the_key_'c = '6zviISn2McHsa4b108v29tbKMtQQXQHA+2+sTYLlg9v2Q2Pq8SP24Uw4'table = '4KBbSzwWClkZ2gsr1qA+Qu0FtxOm6/iVcJHPY9GNp7EaRoplaintextf8UvIjnL5MyplaintextTX3eh'# c = c.replace('=', table[0])plaintext = []for i in range(0, len(c), 4):x = [table.inplaintextex(j) for j in c[i: i + 4]]plaintext.append(x[0] | ((x[1] & 3) << 6))plaintext.append((x[1] >> 2) | ((x[2] & 0xf) << 4))plaintext.append((x[2] >> 4) | (x[3] << 2))print(plaintext)key = key.encode()keystream = RC4(key)ciphertext = []for b in plaintext:ciphertext.append(chr(b ^ next(keystream)))print("".join(ciphertext))
  

• D0g3{608292C4-15400BA4-B3299A5C-704C292D}

• 注意：可以把原密文最后的等号直接替换成table[0]

三. 牢大想你了

• 直接反编译**“\GalgamePro_BackUpThisFolder_ButDontShipItWithYourGame\Managed\Assembly-CSharp.dll”**

• 	public void OnValueChanged(string ABBAAAABBBBAAABABBBABAAABAABAABBABBBBABAABAABAB){uint[] str = new uint[]{286331153U,286331153U,286331153U,286331153U};byte[] strBytes = Encoding.UTF8.GetBytes(ABBAAAABBBBAAABABBBABAAABAABAABBABBBBABAABAABAB);int paddingCount = 8 - strBytes.Length % 8;byte[] paddedArray = new byte[strBytes.Length + paddingCount];Array.Copy(strBytes, paddedArray, strBytes.Length);uint[] uintArray = new uint[paddedArray.Length / 4];Buffer.BlockCopy(paddedArray, 0, uintArray, 0, paddedArray.Length);uint[] encryptedData = new uint[0];AAABAAABABABAAABBABBABAAAABBAABBAABABBBBBABAAAB str2 = new AAABAAABABABAAABBABBABAAAABBAABBAABABBBBBABAAAB(str);for (int i = 0; i < uintArray.Length; i += 2){encryptedData = encryptedData.Concat(str2.BABBBBBBAAAAAABABBBAAAABBABBBAABABAAABABBAAABBA(uintArray[i], uintArray[i + 1])).ToArray<uint>();}uint[] array = new uint[]{3363017039U,1247970816U,549943836U,445086378U,3606751618U,1624361316U,3112717362U,705210466U,3343515702U,2402214294U,4010321577U,2743404694U};MonoBehaviour.print(array);if (array.SequenceEqual(encryptedData)){this.BBBAAAAABABABABBABAAAAABBABBAABBABABABABBBABAAB = 5;this.ABAABAAABABABABABBBBBAAABBAABBBBBAABAAAABBABABB("port");this.BAABAABBABABABABBBABBBBABBBBBBBABABBAABBABABABB("牢大");this.AAAABBABAAAABBAABAABAABAABBBAAABBBABBBBBAABABBA("哈哈，我没有变成耐摔王");return;}this.BBBAAAAABABABABBABAAAAABBABBAABBABABABABBBABAAB = 5;this.ABAABAAABABABABABBBBBAAABBAABBBBBAABAAAABBABABB("耐摔王");this.BAABAABBABABABABBBABBBBABBBBBBBABABBAABBABABABB("狂暴牢大");this.AAAABBABAAAABBAABAABAABAABBBAAABBBABBBBBAABABBA("获得成就“耐摔王”");}
  

• 找到关键加密函数：

• 	// Token: 0x060000AA RID: 170 RVA: 0x000058FC File Offset: 0x00003AFCpublic uint[] BABBBBBBAAAAAABABBBAAAABBABBBAABABAAABABBAAABBA(uint ABBAABAAAAAABAAAABBBBBBABAABAAAABBBABBBAABBABBA, uint BAABBAAAAABABBAABBABBAABABABABABABAAABABBBABABA){uint v0 = ABBAABAAAAAABAAAABBBBBBABAABAAAABBBABBBAABBABBA;uint v = BAABBAAAAABABBAABBABBAABABABABABABAAABABBBABABA;uint sum = 0U;uint delta = 2654435769U;uint[] str2 = this.BBABABBBABBABABAAABBBAABBAAAAAAABBBBBAABBAAAAAA;for (int i = 0; i < 32; i++){sum += delta;v0 += ((v << 4) + str2[0] ^ v + sum ^ (v >> 5) + str2[1]);v += ((v0 << 4) + str2[2] ^ v0 + sum ^ (v0 >> 5) + str2[3]);}return new uint[]{v0,v};}
  

• 这些混淆不去也罢，也能看懂

• tea，直接套脚本解密：

• from ctypes import *def decrypt(v, k):v0 = c_uint32(v[0])v1 = c_uint32(v[1])delta = 2654435769sum1 = c_uint32(delta*32)for i in range(32):v1.value -= ((v0.value << 4) + k[2]) ^ (v0.value + sum1.value) ^ ((v0.value >> 5) + k[3])v0.value -= ((v1.value << 4) + k[0]) ^ (v1.value + sum1.value) ^ ((v1.value >> 5) + k[1])sum1.value -= deltareturn v0.value.to_bytes(4,'little')+v1.value.to_bytes(4,'little')if __name__ == '__main__':a=[3363017039,1247970816]a1=[549943836,445086378]a2=[3606751618,1624361316]a3=[3112717362,705210466]a4=[3343515702,2402214294]a5=[4010321577,2743404694]k=[286331153, 286331153, 286331153, 286331153]res= decrypt(a, k)+decrypt(a1,k)+decrypt(a2,k)+decrypt(a3,k)+decrypt(a4,k)+decrypt(a5,k)print("解密后数据:", res)
  

  • D0g3{it_is_been_a_long_day_without_you_my_friend}

四. mobilego

• MainActivity如下：

• package com.example.mobilego;import android.os.Bundle;
  import android.view.View;
  import android.widget.Button;
  import android.widget.EditText;
  import android.widget.Toast;
  import androidx.appcompat.app.AppCompatActivity;
  import game.Game;/* loaded from: classes3.dex */
  public class MainActivity extends AppCompatActivity {private Button button;private EditText editText;/* JADX INFO: Access modifiers changed from: protected */@Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activitypublic void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);setContentView(R.layout.activity_main);this.editText = (EditText) findViewById(R.id.editText);Button button = (Button) findViewById(R.id.button);this.button = button;button.setOnClickListener(new View.OnClickListener() { // from class: com.example.mobilego.MainActivity$$ExternalSyntheticLambda0@Override // android.view.View.OnClickListenerpublic final void onClick(View view) {MainActivity.this.m44lambda$onCreate$0$comexamplemobilegoMainActivity(view);}});}/* JADX INFO: Access modifiers changed from: package-private *//* renamed from: lambda$onCreate$0$com-example-mobilego-MainActivity  reason: not valid java name */public /* synthetic */ void m44lambda$onCreate$0$comexamplemobilegoMainActivity(View v) {if (Game.checkflag(this.editText.getText().toString()).equals(getResources().getString(R.string.cmp))) {Toast.makeText(this, "yes your flag is right", 0).show();} else {Toast.makeText(this, "No No No", 0).show();}}
  }
  

• 注意checkflag函数为native函数

• frida简单调试一下，发现是一个替换

• cmp='49021}5f919038b440139g74b7Dc88330e5d{6'
  tmp='vIlDoLjtEpkCmyzfqbshucxwiAagKFBdGHJner'
  table='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKL'
  flag=''
  for i in table:for j in tmp:if ord(i)==ord(j):flag+=cmp[tmp.index(j)]else:continue
  print(flag)
  

• D0g3{4c3b5903d11461f94478b7302980e958}

五. 你好PE

• int __cdecl main_0(int argc, const char **argv, const char **envp)
  {int v4; // [esp+4Ch] [ebp-10h] BYREFint v5; // [esp+50h] [ebp-Ch]LPVOID lpAddress; // [esp+54h] [ebp-8h]__CheckForDebuggerJustMyCode(&unk_51E018);v5 = 0;v4 = 0;lpAddress = (LPVOID)sub_450DF0();             // 获取资源文件if ( lpAddress ){v5 = sub_44E753(0, lpAddress, 1, &v4);      // 资源文件进行加密VirtualFree(lpAddress, 0, 0x8000u);return v4;}else{sub_44EA73("find res failed\n");return 0;}
  }
  

• 实现对资源文件的加密操作

• 跟进找资源文件

• int __cdecl sub_455DB0(int a1, int a2, int a3, int a4)
  {__CheckForDebuggerJustMyCode(&unk_51E02A);switch ( a1 ){case 0:return sub_4513F9(a2, a3 != 0, a4);case 1:sub_44F89C(a2);break;case 2:return sub_44F2A7(a2, a3);}return 0;
  }
  

• _DWORD *__cdecl sub_455750(int a1, int a2, _DWORD *a3)
  {void (__stdcall *v4)(_DWORD *); // [esp+4Ch] [ebp-10h]_DWORD *v5; // [esp+50h] [ebp-Ch]int v6; // [esp+58h] [ebp-4h]__CheckForDebuggerJustMyCode(&unk_51E02A);v6 = sub_450FAD();if ( v6 ){v5 = (_DWORD *)(*(int (__stdcall **)(int, int))(v6 + 24))(64, 28);if ( v5 ){v5[3] = v6;v5[4] = a2;v5[5] = 0;v5[6] = 0;if ( sub_44FCC5(v5, a1, a2) ){if ( a3 )*a3 = 0;return v5;}else{if ( a3 )*a3 = v5[6];v4 = *(void (__stdcall **)(_DWORD *))(v6 + 28);v4(v5);v4((_DWORD *)v6);return 0;}}else{if ( a3 )*a3 = 255;return 0;}}else{if ( a3 )*a3 = 255;return 0;}
  }
  

• 注意到此处的a1就是资源文件起始地址

• 跟进

• int __cdecl sub_455870(_DWORD *a1, int a2, int a3)
  {__CheckForDebuggerJustMyCode(&unk_51E02A);if ( !a1 || !a1[3] || !a2 )return 0;a1[6] = 0;if ( !sub_44FED7(a1, a2) )return 0;if ( !sub_44EB77(a1, a2) )return 0;if ( !sub_44F478(a1) )goto LABEL_17;if ( !sub_451057(a1) )goto LABEL_17;a1[2] = sub_450D69(0, *a1, a1[1]);if ( !sub_45016B(a1) )goto LABEL_17;if ( !sub_4509DB(a1) )return 0;if ( !a3 || sub_44ED5C(a1, 1) )return 1;
  LABEL_17:sub_44EFD2(a1);return 0;
  }
  

• 调试发现直到sub_44ED5C函数才出现输入flag

• 跟进

• int __cdecl sub_3A4B40(_DWORD *a1, int a2)
  {void (__cdecl *v3)(_DWORD, int, _DWORD); // [esp+4Ch] [ebp-8h]int v4; // [esp+50h] [ebp-4h]if ( !a1 || !*a1 )return 0;v4 = *(_DWORD *)(*a1 + 60) + *a1;if ( !*(_DWORD *)(v4 + 40) )return 0;v3 = (void (__cdecl *)(_DWORD, int, _DWORD))(*(_DWORD *)(v4 + 40) + *a1);if ( v3 ){v3(*a1, a2, 0);return 1;}else{a1[6] = 6;return 0;}
  }
  

• 实际上是v3对资源文件进行了改动

• 跟进找到加密函数：

• int sub_1005F820()
  {_DWORD *v1; // [esp+D0h] [ebp-8h]sub_1005B16F(&unk_1014000F);kernel32_VirtualAlloc(0, 65548, 12288, 4);v1 = (_DWORD *)sub_1005A260();if ( !v1 )return -1;v1[1] = 0x10000;*v1 = 0;v1[2] = v1 + 3;sub_10059572(v1[2], 0, v1[1]);((void (__cdecl *)(const char *))unk_10058BC7)("[out]: PLZ Input FLag \n");((void (__cdecl *)(const char *))unk_10058BC7)("[in ]: ");((void (__cdecl *)(void *, _DWORD))unk_100581A4)(&unk_10114B68, v1[2]);*v1 = sub_1005B5BB(v1[2]);if ( *v1 == 41 ){*v1 = 48;((void (__cdecl *)(_DWORD *))unk_1005A242)(v1);if ( ((int (__cdecl *)(_DWORD, void *, int))unk_10058AA0)(v1[2], &unk_1013C008, 48) )((void (__cdecl *)(const char *))unk_10058BC7)("[out]: WRONG FLAG\n");else((void (__cdecl *)(const char *))unk_10058BC7)("[out]: RIGHT FLAG\n");kernel32_VirtualFree(v1, 0, 49152);sub_1005A260();return 0;}else{((void (__cdecl *)(const char *))unk_10058BC7)("[out]: len error\n");kernel32_VirtualFree(v1, 0, 49152);sub_1005A260();return -1;}
  }
  

• 把数据p完找到加密函数：

• _DWORD *__cdecl sub_1005F6F0(_DWORD *a1)
  {_DWORD *result; // eaxint v2; // ecxint j; // [esp+D0h] [ebp-30h]unsigned int i; // [esp+DCh] [ebp-24h]__int64 v5; // [esp+E8h] [ebp-18h]int *v6; // [esp+F8h] [ebp-8h]sub_1005B16F(&unk_1014000F);for ( i = 0; ; ++i ){result = a1;if ( i >= *a1 >> 3 )break;v6 = (int *)(a1[2] + 8 * i);v2 = *v6;v5 = *(_QWORD *)v6;for ( j = 0; j < 64; ++j ){LOBYTE(v2) = 1;if ( v5 < 0 )v5 = qword_1013C000 ^ sub_10059F9F(v2, HIDWORD(v5));elsev5 = sub_10059F9F(v2, HIDWORD(v5));}*(_QWORD *)v6 = v5;}return result;
  }
  

• 注意如下汇编代码:

• debug034:1005F738 mov     eax, [ebp+arg_0]
  debug034:1005F73B mov     ecx, [eax+8]
  debug034:1005F73E mov     edx, [ebp+var_24]
  debug034:1005F741 lea     eax, [ecx+edx*8]
  debug034:1005F744 mov     [ebp+var_8], eax
  debug034:1005F747 mov     eax, [ebp+var_8]
  debug034:1005F74A mov     ecx, [eax]
  debug034:1005F74C mov     edx, [eax+4]
  debug034:1005F74F mov     dword ptr [ebp+var_18], ecx
  debug034:1005F752 mov     dword ptr [ebp+var_18+4], edx
  

• 与伪代码有点区别

 LODWORD(v5) = *(_DWORD *)v6;    HIDWORD(v5) = v2;

• 根据这个再去编写脚本（真的是坑www

• #include <stdio.h>
  #include <string.h>
  #include <stdlib.h>
  #include <Windows.h>
  #include <windef.h>int main()
  {__int64 key = 0x54aa4a9;BYTE c[] = {0x4D,0xB8,0x76,0x29,0xF5,0xA9,0x9E,0x59,0x55,0x56,0xB1,0xC4,0x2F,0x21,0x2C,0x30,0xB3,0x79,0x78,0x17,0xA8,0xED,0xF7,0xDB,0xE1,0x53,0xF0,0xDB,0xE9,0x03,0x51,0x5E,0x09,0xC1,0x00,0xDF,0xF0,0x96,0xFC,0xC1,0xB5,0xE6,0x62,0x95,0x01,0x00,0x00,0x00,};__int64 v5;int j, i;for (i = 0; i < 6; i++){v5 = *((__int64*)&c[i * 8]);for (j = 0; j < 64; j++){if (v5 & 1){v5 = ((unsigned __int64)v5 ^ key) >> 1;v5 |= 0x8000000000000000;}else{v5 = (unsigned __int64)v5 >> 1;}}*((__int64*)&c[i * 8]) = v5;}for (i = 0; i < 48; i++)printf("%c", c[i]);return 0;
  }
  

• 还要补全符号位

• D0g3{60E1E72A-576A8BF0-7701CBB9-B02415EC}

总结

• 注意程序实现及脚本编写的细节！！！