chaye的博客

8.20

RE

hello

入口 00415890

python deflat.py -f hello.exe –addr 0x415890

找到main函数入口（一般）

出现warning没关系

4574a0还得去平坦化

crackme

nsp脱壳

a = [0x12, 0x4, 0x8, 0x14, 0x24, 0x5C, 0x4A, 0x3D, 0x56, 0xA, 0x10, 0x67, 0x0, 0x41, 0x0, 0x1, 0x46, 0x5A, 0x44, 0x42, 0x6E, 0xC, 0x44, 0x72, 0xC, 0xD, 0x40, 0x3E, 0x4B, 0x5F, 0x2, 0x1, 0x4C, 0x5E, 0x5B, 0x17, 0x6E, 0xC, 0x16, 0x68, 0x5B, 0x12]
b = 'this_is_not_flag'   #还有前面的

for i in range(42):  # 只需要前42个字符
    print(chr(ord(b[i % 16]) ^ a[i]), end='')

更新: 2025-08-20 16:13:15
原文: https://www.yuque.com/chaye-apqbl/vsc85q/enefsc3udfizhr87