buuoj rev xx

Posted on

buuoj [rev] xx

知识点：xxtea

程序流程：

  1. 输入至input
  2. 利用Code检测input格式是否正确
  3. 生成xxtea加密所需的 key = new uint32_t [4]{'galf', 0, 0, 0};
  4. 进行xxtea加密
  5. 对密文进行shuffle
  6. 再进行异或加密
  7. 比对
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
.text:00007FF63C3311A0
.text:00007FF63C3311A0 ; Attributes: bp-based frame
.text:00007FF63C3311A0
.text:00007FF63C3311A0 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:00007FF63C3311A0 main            proc near               ; CODE XREF: __scrt_common_main_seh(void)+107↓p
.text:00007FF63C3311A0                                         ; DATA XREF: .rdata:00007FF63C333BA4↓o ...
.text:00007FF63C3311A0
.text:00007FF63C3311A0 Size            = qword ptr -48h
.text:00007FF63C3311A0 var_40          = xmmword ptr -40h
.text:00007FF63C3311A0 var_30          = dword ptr -30h
.text:00007FF63C3311A0 var_2C          = dword ptr -2Ch
.text:00007FF63C3311A0 input           = dword ptr -28h
.text:00007FF63C3311A0 var_18          = dword ptr -18h
.text:00007FF63C3311A0 var_10          = qword ptr -10h
.text:00007FF63C3311A0 var_8           = qword ptr -8
.text:00007FF63C3311A0 arg_0           = qword ptr  18h
.text:00007FF63C3311A0 arg_8           = qword ptr  20h
.text:00007FF63C3311A0 arg_10          = qword ptr  28h
.text:00007FF63C3311A0
.text:00007FF63C3311A0 ; __unwind { // __GSHandlerCheck
.text:00007FF63C3311A0                 push    rbp
.text:00007FF63C3311A2                 push    rbx
.text:00007FF63C3311A3                 mov     rbp, rsp
.text:00007FF63C3311A6                 sub     rsp, 68h
.text:00007FF63C3311AA                 mov     rax, cs:__security_cookie
.text:00007FF63C3311B1                 xor     rax, rsp
.text:00007FF63C3311B4                 mov     [rbp+var_10], rax
.text:00007FF63C3311B8                 mov     rcx, cs:?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ; std::istream std::cin
.text:00007FF63C3311BF                 lea     r8, [rbp+input]
.text:00007FF63C3311C3                 xorps   xmm0, xmm0
.text:00007FF63C3311C6                 xor     eax, eax
.text:00007FF63C3311C8                 movups  xmmword ptr [rbp+input], xmm0
.text:00007FF63C3311CC                 mov     [rbp+var_18], eax
.text:00007FF63C3311CF                 call    sub_7FF63C3318C0 ; 输入到input
.text:00007FF63C3311D4                 mov     rbx, 0FFFFFFFFFFFFFFFFh
.text:00007FF63C3311DB                 lea     rcx, [rbp+input]
.text:00007FF63C3311DF                 mov     rax, rbx
.text:00007FF63C3311E2
.text:00007FF63C3311E2 loc_7FF63C3311E2:                       ; CODE XREF: main+49↓j
.text:00007FF63C3311E2                 inc     rax             ; 计算input长度
.text:00007FF63C3311E5                 cmp     byte ptr [rcx+rax], 0
.text:00007FF63C3311E9                 jnz     short loc_7FF63C3311E2 ; 计算input长度
.text:00007FF63C3311EB                 cmp     rax, 19
.text:00007FF63C3311EF                 jz      short loc_7FF63C33120F ; input长度正确
.text:00007FF63C3311F1                 mov     rcx, cs:?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; std::ostream std::cout
.text:00007FF63C3311F8                 lea     rdx, aError     ; "error\n"
.text:00007FF63C3311FF                 call    sub_7FF63C331620
.text:00007FF63C331204                 lea     rcx, [rbp+input] ; Code
.text:00007FF63C331208                 call    cs:__imp__exit
.text:00007FF63C331208 ; ---------------------------------------------------------------------------
.text:00007FF63C33120E                 db 0CCh
.text:00007FF63C33120E ; } // starts at 7FF63C3311A0
.text:00007FF63C33120F ; ---------------------------------------------------------------------------
.text:00007FF63C33120F
.text:00007FF63C33120F loc_7FF63C33120F:                       ; CODE XREF: main+4F↑j
.text:00007FF63C33120F                                         ; DATA XREF: .rdata:00007FF63C333BA4↓o ...
.text:00007FF63C33120F ; __unwind { // __GSHandlerCheck        ; input长度正确
.text:00007FF63C33120F                 mov     [rsp+68h+arg_0], rsi
.text:00007FF63C331217                 mov     ecx, 5          ; Size
.text:00007FF63C33121C                 mov     [rsp+68h+arg_8], rdi
.text:00007FF63C331224                 mov     [rsp+68h+arg_10], r14
.text:00007FF63C33122C                 mov     [rsp+68h+var_8], r15
.text:00007FF63C331231                 call    j_??2@YAPEAX_K@Z ; operator new(unsigned __int64)
.text:00007FF63C331231                                         ; 申请五个字节空间
.text:00007FF63C331236                 mov     r11, cs:Code
.text:00007FF63C33123D                 lea     r15, [rbp+input]
.text:00007FF63C331241                 sub     r15, rax
.text:00007FF63C331244                 mov     r14, rax
.text:00007FF63C331247                 xor     edi, edi
.text:00007FF63C331249                 mov     rsi, rax
.text:00007FF63C33124C                 nop     dword ptr [rax+00h]
.text:00007FF63C331250
.text:00007FF63C331250 loc_7FF63C331250:                       ; CODE XREF: main+109↓j
.text:00007FF63C331250                 movzx   r10d, byte ptr [r15+rsi]
.text:00007FF63C331255                 mov     edx, edi
.text:00007FF63C331257                 mov     [rsi], r10b
.text:00007FF63C33125A                 mov     r8, rdi
.text:00007FF63C33125D                 mov     rcx, rbx
.text:00007FF63C331260
.text:00007FF63C331260 loc_7FF63C331260:                       ; CODE XREF: main+C7↓j
.text:00007FF63C331260                 inc     rcx
.text:00007FF63C331263                 cmp     [r11+rcx], dl
.text:00007FF63C331267                 jnz     short loc_7FF63C331260
.text:00007FF63C331269                 mov     r9, r11
.text:00007FF63C33126C                 test    rcx, rcx
.text:00007FF63C33126F                 jz      short loc_7FF63C331284
.text:00007FF63C331271
.text:00007FF63C331271 loc_7FF63C331271:                       ; CODE XREF: main+E2↓j
.text:00007FF63C331271                 cmp     r10b, [r11+r8]
.text:00007FF63C331275                 jz      short loc_7FF63C331284
.text:00007FF63C331277                 inc     edx
.text:00007FF63C331279                 inc     r8
.text:00007FF63C33127C                 movsxd  rax, edx
.text:00007FF63C33127F                 cmp     rax, rcx
.text:00007FF63C331282                 jb      short loc_7FF63C331271
.text:00007FF63C331284
.text:00007FF63C331284 loc_7FF63C331284:                       ; CODE XREF: main+CF↑j
.text:00007FF63C331284                                         ; main+D5↑j
.text:00007FF63C331284                 mov     rcx, rbx
.text:00007FF63C331287
.text:00007FF63C331287 loc_7FF63C331287:                       ; CODE XREF: main+EE↓j
.text:00007FF63C331287                 inc     rcx
.text:00007FF63C33128A                 cmp     [r9+rcx], dil
.text:00007FF63C33128E                 jnz     short loc_7FF63C331287
.text:00007FF63C331290                 movsxd  rax, edx
.text:00007FF63C331293                 cmp     rax, rcx
.text:00007FF63C331296                 jz      loc_7FF63C33150C
.text:00007FF63C33129C                 inc     rsi
.text:00007FF63C33129F                 mov     rax, rsi
.text:00007FF63C3312A2                 sub     rax, r14
.text:00007FF63C3312A5                 cmp     rax, 4
.text:00007FF63C3312A9                 jl      short loc_7FF63C331250 ; 重复4次
.text:00007FF63C3312AB                 mov     [r14+4], dil    ; 将[4]元素置为0
.text:00007FF63C3312AF                 lea     rax, [rbp+input]
.text:00007FF63C3312B3
.text:00007FF63C3312B3 loc_7FF63C3312B3:                       ; CODE XREF: main+11A↓j
.text:00007FF63C3312B3                 inc     rbx
.text:00007FF63C3312B6                 cmp     [rax+rbx], dil
.text:00007FF63C3312BA                 jnz     short loc_7FF63C3312B3
.text:00007FF63C3312BC                 movups  xmm0, xmmword ptr [r14]
.text:00007FF63C3312C0                 mov     rax, rdi
.text:00007FF63C3312C3                 movups  [rbp+var_40], xmm0
.text:00007FF63C3312C7
.text:00007FF63C3312C7 loc_7FF63C3312C7:                       ; CODE XREF: main+14B↓j
.text:00007FF63C3312C7                 cmp     byte ptr [rbp+rax+var_40], dil
.text:00007FF63C3312CC                 jz      short loc_7FF63C3312FE
.text:00007FF63C3312CE                 cmp     byte ptr [rbp+rax+var_40+1], dil
.text:00007FF63C3312D3                 jz      short loc_7FF63C3312FB
.text:00007FF63C3312D5                 cmp     byte ptr [rbp+rax+var_40+2], dil
.text:00007FF63C3312DA                 jz      short loc_7FF63C3312F5
.text:00007FF63C3312DC                 cmp     byte ptr [rbp+rax+var_40+3], dil
.text:00007FF63C3312E1                 jz      short loc_7FF63C3312EF
.text:00007FF63C3312E3                 add     rax, 4
.text:00007FF63C3312E7                 cmp     rax, 10h
.text:00007FF63C3312EB                 jb      short loc_7FF63C3312C7
.text:00007FF63C3312ED                 jmp     short loc_7FF63C3312FE
.text:00007FF63C3312EF ; ---------------------------------------------------------------------------
.text:00007FF63C3312EF
.text:00007FF63C3312EF loc_7FF63C3312EF:                       ; CODE XREF: main+141↑j
.text:00007FF63C3312EF                 add     rax, 3
.text:00007FF63C3312F3                 jmp     short loc_7FF63C3312FE
.text:00007FF63C3312F5 ; ---------------------------------------------------------------------------
.text:00007FF63C3312F5
.text:00007FF63C3312F5 loc_7FF63C3312F5:                       ; CODE XREF: main+13A↑j
.text:00007FF63C3312F5                 add     rax, 2
.text:00007FF63C3312F9                 jmp     short loc_7FF63C3312FE
.text:00007FF63C3312FB ; ---------------------------------------------------------------------------
.text:00007FF63C3312FB
.text:00007FF63C3312FB loc_7FF63C3312FB:                       ; CODE XREF: main+133↑j
.text:00007FF63C3312FB                 inc     rax
.text:00007FF63C3312FE
.text:00007FF63C3312FE loc_7FF63C3312FE:                       ; CODE XREF: main+12C↑j
.text:00007FF63C3312FE                                         ; main+14D↑j ...
.text:00007FF63C3312FE                 inc     rax
.text:00007FF63C331301                 cmp     rax, 10h
.text:00007FF63C331305                 jnb     short loc_7FF63C33131E
.text:00007FF63C331307                 nop     word ptr [rax+rax+00000000h]
.text:00007FF63C331310
.text:00007FF63C331310 loc_7FF63C331310:                       ; CODE XREF: main+17C↓j
.text:00007FF63C331310                 mov     byte ptr [rbp+rax+var_40], dil
.text:00007FF63C331315                 inc     rax
.text:00007FF63C331318                 cmp     rax, 10h
.text:00007FF63C33131C                 jb      short loc_7FF63C331310
.text:00007FF63C33131E
.text:00007FF63C33131E loc_7FF63C33131E:                       ; CODE XREF: main+165↑j
.text:00007FF63C33131E                 lea     r9, [rbp+Size]
.text:00007FF63C331322                 mov     rdx, rbx
.text:00007FF63C331325                 lea     r8, [rbp+var_40]
.text:00007FF63C331329                 lea     rcx, [rbp+input]
.text:00007FF63C33132D                 call    sub_7FF63C331AB0
.text:00007FF63C331332                 mov     rsi, [rbp+Size]
.text:00007FF63C331336                 mov     rbx, rax
.text:00007FF63C331339                 mov     rcx, rsi        ; Size
.text:00007FF63C33133C                 call    j_??2@YAPEAX_K@Z ; operator new(unsigned __int64)
.text:00007FF63C331341                 movzx   ecx, byte ptr [rbx+2]
.text:00007FF63C331345                 mov     r9, rax
.text:00007FF63C331348                 mov     r11d, 1
.text:00007FF63C33134E                 mov     [rax], cl       ; 将密文打乱
.text:00007FF63C331350                 lea     r8, [rax+1]
.text:00007FF63C331354                 movzx   ecx, byte ptr [rbx]
.text:00007FF63C331357                 mov     [r8], cl
.text:00007FF63C33135A                 movzx   ecx, byte ptr [rbx+3]
.text:00007FF63C33135E                 mov     [rax+2], cl
.text:00007FF63C331361                 movzx   ecx, byte ptr [rbx+1]
.text:00007FF63C331365                 mov     [rax+3], cl
.text:00007FF63C331368                 movzx   ecx, byte ptr [rbx+6]
.text:00007FF63C33136C                 mov     [rax+4], cl
.text:00007FF63C33136F                 movzx   ecx, byte ptr [rbx+4]
.text:00007FF63C331373                 mov     [rax+5], cl
.text:00007FF63C331376                 movzx   ecx, byte ptr [rbx+7]
.text:00007FF63C33137A                 mov     [rax+6], cl
.text:00007FF63C33137D                 movzx   eax, byte ptr [rbx+5]
.text:00007FF63C331381                 mov     [r9+7], al
.text:00007FF63C331385                 movzx   eax, byte ptr [rbx+0Ah]
.text:00007FF63C331389                 mov     [r9+8], al
.text:00007FF63C33138D                 movzx   eax, byte ptr [rbx+8]
.text:00007FF63C331391                 mov     [r9+9], al
.text:00007FF63C331395                 movzx   eax, byte ptr [rbx+0Bh]
.text:00007FF63C331399                 mov     [r9+0Ah], al
.text:00007FF63C33139D                 movzx   eax, byte ptr [rbx+9]
.text:00007FF63C3313A1                 mov     [r9+0Bh], al
.text:00007FF63C3313A5                 movzx   eax, byte ptr [rbx+0Eh]
.text:00007FF63C3313A9                 mov     [r9+0Ch], al
.text:00007FF63C3313AD                 movzx   eax, byte ptr [rbx+0Ch]
.text:00007FF63C3313B1                 mov     [r9+0Dh], al
.text:00007FF63C3313B5                 movzx   eax, byte ptr [rbx+0Fh]
.text:00007FF63C3313B9                 mov     [r9+0Eh], al
.text:00007FF63C3313BD                 movzx   eax, byte ptr [rbx+0Dh]
.text:00007FF63C3313C1                 mov     [r9+0Fh], al
.text:00007FF63C3313C5                 movzx   eax, byte ptr [rbx+12h]
.text:00007FF63C3313C9                 mov     [r9+10h], al
.text:00007FF63C3313CD                 movzx   eax, byte ptr [rbx+10h]
.text:00007FF63C3313D1                 mov     [r9+11h], al
.text:00007FF63C3313D5                 movzx   eax, byte ptr [rbx+13h]
.text:00007FF63C3313D9                 mov     [r9+12h], al
.text:00007FF63C3313DD                 movzx   eax, byte ptr [rbx+11h]
.text:00007FF63C3313E1                 mov     [r9+13h], al
.text:00007FF63C3313E5                 movzx   eax, byte ptr [rbx+16h]
.text:00007FF63C3313E9                 mov     [r9+14h], al
.text:00007FF63C3313ED                 movzx   eax, byte ptr [rbx+14h]
.text:00007FF63C3313F1                 mov     [r9+15h], al
.text:00007FF63C3313F5                 movzx   eax, byte ptr [rbx+17h]
.text:00007FF63C3313F9                 mov     [r9+16h], al
.text:00007FF63C3313FD                 movzx   eax, byte ptr [rbx+15h]
.text:00007FF63C331401                 mov     [r9+17h], al
.text:00007FF63C331405                 cmp     rsi, r11
.text:00007FF63C331408                 jbe     short loc_7FF63C33144D ; 生成真正的密文，以备接下来的比较
.text:00007FF63C33140A                 nop     word ptr [rax+rax+00h]
.text:00007FF63C331410
.text:00007FF63C331410 loc_7FF63C331410:                       ; CODE XREF: main+2AB↓j
.text:00007FF63C331410                 mov     eax, 55555556h  ; 异或加密
.text:00007FF63C331415                 mov     rcx, rdi
.text:00007FF63C331418                 imul    r11d
.text:00007FF63C33141B                 mov     eax, edx
.text:00007FF63C33141D                 shr     eax, 1Fh
.text:00007FF63C331420                 add     edx, eax
.text:00007FF63C331422                 movsxd  r10, edx
.text:00007FF63C331425                 test    edx, edx
.text:00007FF63C331427                 jle     short loc_7FF63C33143F
.text:00007FF63C331429                 movzx   eax, byte ptr [r8]
.text:00007FF63C33142D                 nop     dword ptr [rax]
.text:00007FF63C331430
.text:00007FF63C331430 loc_7FF63C331430:                       ; CODE XREF: main+29D↓j
.text:00007FF63C331430                 xor     al, [rcx+r9]
.text:00007FF63C331434                 inc     rcx
.text:00007FF63C331437                 mov     [r8], al
.text:00007FF63C33143A                 cmp     rcx, r10
.text:00007FF63C33143D                 jl      short loc_7FF63C331430
.text:00007FF63C33143F
.text:00007FF63C33143F loc_7FF63C33143F:                       ; CODE XREF: main+287↑j
.text:00007FF63C33143F                 inc     r11d
.text:00007FF63C331442                 inc     r8
.text:00007FF63C331445                 movsxd  rax, r11d
.text:00007FF63C331448                 cmp     rax, rsi
.text:00007FF63C33144B                 jb      short loc_7FF63C331410 ; 异或加密
.text:00007FF63C33144D
.text:00007FF63C33144D loc_7FF63C33144D:                       ; CODE XREF: main+268↑j
.text:00007FF63C33144D                 lea     rax, [rbp+var_40] ; 生成真正的密文，以备接下来的比较
.text:00007FF63C331451                 mov     dword ptr [rbp+var_40], 6B40BCCEh
.text:00007FF63C331458                 sub     r9, rax
.text:00007FF63C33145B                 mov     dword ptr [rbp+var_40+4], 0C0953A7Ch
.text:00007FF63C331462                 mov     dword ptr [rbp+var_40+8], 20209BEFh
.text:00007FF63C331469                 mov     rdx, rdi
.text:00007FF63C33146C                 mov     dword ptr [rbp+var_40+0Ch], 3502F791h
.text:00007FF63C331473                 mov     [rbp+var_30], 0C8021823h
.text:00007FF63C33147A                 mov     [rbp+var_2C], 0FA5656E7h
.text:00007FF63C331481                 nop     dword ptr [rax+00h]
.text:00007FF63C331485                 db      66h, 66h
.text:00007FF63C331485                 nop     word ptr [rax+rax+00000000h]
.text:00007FF63C331490
.text:00007FF63C331490 loc_7FF63C331490:                       ; CODE XREF: main+309↓j
.text:00007FF63C331490                 lea     rcx, [rbp+var_40]
.text:00007FF63C331494                 add     rcx, rdx
.text:00007FF63C331497                 movzx   eax, byte ptr [r9+rcx]
.text:00007FF63C33149C                 cmp     [rcx], al       ; 比较input生成的密文和真正的密文
.text:00007FF63C33149E                 jnz     short loc_7FF63C331500
.text:00007FF63C3314A0                 inc     edi
.text:00007FF63C3314A2                 inc     rdx
.text:00007FF63C3314A5                 cmp     rdx, 18h
.text:00007FF63C3314A9                 jl      short loc_7FF63C331490
.text:00007FF63C3314AB                 mov     rcx, cs:?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; std::ostream std::cout
.text:00007FF63C3314B2                 lea     rdx, aYouWin    ; "You win!"
.text:00007FF63C3314B9                 call    sub_7FF63C331620
.text:00007FF63C3314BE                 mov     rcx, rax
.text:00007FF63C3314C1                 lea     rdx, sub_7FF63C3317F0
.text:00007FF63C3314C8                 call    cs:??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ; std::ostream::operator<<(std::ostream & (*)(std::ostream &))
.text:00007FF63C3314CE                 mov     r14, [rsp+68h+arg_10]
.text:00007FF63C3314D6                 xor     eax, eax
.text:00007FF63C3314D8                 mov     rdi, [rsp+68h+arg_8]
.text:00007FF63C3314E0                 mov     rsi, [rsp+68h+arg_0]
.text:00007FF63C3314E8                 mov     r15, [rsp+68h+var_8]
.text:00007FF63C3314ED                 mov     rcx, [rbp+var_10]
.text:00007FF63C3314F1                 xor     rcx, rsp        ; StackCookie
.text:00007FF63C3314F4                 call    __security_check_cookie
.text:00007FF63C3314F9                 add     rsp, 68h
.text:00007FF63C3314FD                 pop     rbx
.text:00007FF63C3314FE                 pop     rbp
.text:00007FF63C3314FF                 retn
.text:00007FF63C3314FF ; } // starts at 7FF63C33120F
.text:00007FF63C331500 ; ---------------------------------------------------------------------------
.text:00007FF63C331500
.text:00007FF63C331500 loc_7FF63C331500:                       ; CODE XREF: main+2FE↑j
.text:00007FF63C331500                                         ; DATA XREF: .pdata:00007FF63C336048↓o ...
.text:00007FF63C331500 ; __unwind { // __GSHandlerCheck
.text:00007FF63C331500                 imul    edi, edi
.text:00007FF63C331503                 mov     ecx, edi        ; Code
.text:00007FF63C331505                 call    cs:__imp__exit
.text:00007FF63C331505 ; ---------------------------------------------------------------------------
.text:00007FF63C33150B                 align 4
.text:00007FF63C33150C
.text:00007FF63C33150C loc_7FF63C33150C:                       ; CODE XREF: main+F6↑j
.text:00007FF63C33150C                 mov     ecx, r9d        ; Code
.text:00007FF63C33150F                 call    cs:__imp__exit
.text:00007FF63C33150F ; ---------------------------------------------------------------------------
.text:00007FF63C331515                 db 0CCh
.text:00007FF63C331515 ; } // starts at 7FF63C331500
.text:00007FF63C331515 main            endp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
secret = [0x0CE, 0x0BC, 0x40, 0x6B, 0x7C, 0x3A, 0x95, 0x0C0,
          0x0EF, 0x9B, 0x20, 0x20, 0x91, 0x0F7, 0x02, 0x35,
          0x23, 0x18, 0x02, 0x0C8, 0x0E7, 0x56, 0x56, 0x0FA]
newSecret = [0] * len(secret)

for i in range(len(secret) - 1, -1, -1):
    for j in range(i // 3):
        secret[i] ^= secret[j]

for i in secret:
    print(hex(i), end=',')
print()

newSecret[2] = secret[0] & 0xff
newSecret[0] = secret[1] & 0xff
newSecret[3] = secret[2] & 0xff
newSecret[1] = secret[3] & 0xff
newSecret[6] = secret[4] & 0xff
newSecret[4] = secret[5] & 0xff
newSecret[7] = secret[6] & 0xff
newSecret[5] = secret[7] & 0xff
newSecret[10] = secret[8] & 0xff
newSecret[8] = secret[9] & 0xff
newSecret[11] = secret[10] & 0xff
newSecret[9] = secret[11] & 0xff
newSecret[14] = secret[12] & 0xff
newSecret[12] = secret[13] & 0xff
newSecret[15] = secret[14] & 0xff
newSecret[13] = secret[15] & 0xff
newSecret[18] = secret[16] & 0xff
newSecret[16] = secret[17] & 0xff
newSecret[19] = secret[18] & 0xff
newSecret[17] = secret[19] & 0xff
newSecret[22] = secret[20] & 0xff
newSecret[20] = secret[21] & 0xff
newSecret[23] = secret[22] & 0xff
newSecret[21] = secret[23] & 0xff

for i in newSecret:
    print(hex(i), end=',')

newSecret即为C++代码中的enc数组。

1
2
3
4
5
6
7
8
9
10
11
12
13
#include <iostream>
#include <string>
#include "xxtea.h"

int main() {
    uint8_t enc[] = {0xbc,0xa5,0xce,0x40,0xf4,0xb2,0xb2,0xe7,0xa9,0x12,0x9d,0x12,0xae,0x10,0xc8,0x5b,0x3d,0xd7,0x6,0x1d,0xdc,0x70,0xf8,0xdc};
    size_t n = 0;
    auto *key = new uint32_t [4]{'galf', 0, 0, 0};
    auto *result = static_cast<uint8_t *>(xxtea_decrypt(&enc, 24, key, &n));
    std::string str(reinterpret_cast<const char *>(result), n);
    std::cout << str << std::endl;
    return 0;
}