Rainbow 逆向分析：一道 C + SDL2 图形题，以及和 33.exe 的对比#

1
int main() {
2
    SDL_Init(SDL_INIT_VIDEO);                      // 初始化视频子系统
3
    window   = SDL_CreateWindow("Rainbow Cannon", 640, 480, ...);
4
    renderer = SDL_CreateRenderer(window, ...);
5
    srand(time(0));                                // 随机种子
6
    hide_flag();                                   // ← 演示加密算法（打印加密 flag）
7
    render_rainbow_cannon(renderer);               // ← 装饰：彩虹大炮动画
8
    SDL_DestroyRenderer/DestroyWindow/SDL_Quit();
9
}

1
unsigned __int64 hide_flag()
2
{
3
  int i; // [rsp+8h] [rbp-38h]
4
  int j; // [rsp+Ch] [rbp-34h]
5
  char s[24]; // [rsp+10h] [rbp-30h] BYREF
6

7
  v4 = __readfsqword(0x28u);
8
  strcpy(s, "flag{this_is_flag}");                // ← 演示 flag（示例，不是答案）
9
  for ( i = 0; i < strlen(s); ++i )
10
    s[i] = xor_encrypt((unsigned __int8)s[i], 90LL);   // 90 = 0x5A
11
  printf("Encrypted Flag: ");
12
  for ( j = 0; j < strlen(s); ++j )
13
    printf("%02X", (unsigned __int8)s[j]);        // 每字节 XOR 0x5A → 转 hex 去掉 0x
14
  putchar(10);
15
  return v4 - __readfsqword(0x28u);
16
}

1
movabs $0x6968747b67616c66, %rax   ; 小端 = 66 6c 61 67 7b 74 68 69 = "flag{thi"
2
movabs $0x616c665f73695f73, %rdx   ; 小端 = 73 5f 69 73 5f 66 6c 61 = "s_is_fla"
3
mov    %rax, -0x30(%rbp)
4
mov    %rdx, -0x28(%rbp)
5
movl   $0x7d6761, -0x21(%rbp)      ; 小端 = 61 67 7d 00 = "ag\0"
6
; 拼起来：flag{this_is_flag}（18 字节，演示用）
7
; 然后逐字节 xor $0x5a 并 printf("%02X")

1
void render_rainbow_cannon(SDL_Renderer *r) {
2
    x = 320; y = 240;                    // 屏幕中心
3
    for (i = 0; i < 300; i++) {
4
        r_ = rand() % 256; g_ = rand() % 256; b_ = rand() % 256;  // 随机颜色
5
        nx = x + rand() % 100 - 50;
6
        ny = y + rand() % 100 - 50;
7
        SDL_SetRenderDrawColor(r, r_, g_, b_, 255);
8
        SDL_RenderDrawLine(r, x, y, nx, ny);   // 从中心向外画随机线段
9
        SDL_RenderPresent(r);
10
        SDL_Delay(20);                   // 20ms → 总动画约 6 秒
11
        x = nx; y = ny;
12
    }
13
}

1
byte xor_decrypt(byte a, byte b) { return a ^ b; }           // 从未被调用
2
uint calculate_key_from_color(uint r, uint g, uint b) {
3
    return r ^ g ^ b;                                        // 从未被调用
4
}

1
unsigned __int64 hide_flag()
2
{
3
  int i; // [rsp+8h] [rbp-38h]
4
  int j; // [rsp+Ch] [rbp-34h]
5
  char s[24]; // [rsp+10h] [rbp-30h] BYREF
6

7
  v4 = __readfsqword(0x28u);
8
  strcpy(s, "flag{this_is_flag}");                  // 演示 flag（18 字节）
9
  for ( i = 0; i < strlen(s); ++i )
10
    s[i] = xor_encrypt((unsigned __int8)s[i], 90LL); // 每字节 XOR 0x5A
11
  printf("Encrypted Flag: ");
12
  for ( j = 0; j < strlen(s); ++j )
13
    printf("%02X", (unsigned __int8)s[j]);           // 转 hex 去掉 0x
14
  putchar(10);
15
  return v4 - __readfsqword(0x28u);
16
}

1
Encrypted Flag: 3C363B3D212E323329053329053C363B3D27

1
ct = bytes.fromhex("3C363B3D212E323329053329053C363B3D27")
2
print(bytes(b ^ 0x5A for b in ct).decode())   # flag{this_is_flag}（演示，不是答案）

1
Encrypted Flag: 3C363B3D2128306F0A34376C0F1D231D1C396A6B183636332C1036331D1320696D3D22023C3B30626F2027

1
ct = bytes.fromhex("3C363B3D2128306F0A34376C0F1D231D1C396A6B183636332C1036331D1320696D3D22023C3B30626F2027")
2
print(bytes(b ^ 0x5A for b in ct).decode())   # flag{rj5Pnm6UGyGFc01BllivJliGIz37gxXfaj85z}

1
Encrypted Flag: 0B12190E1C213B6268686C6B6A69776F3B633B776E3C3B6D773B38393C773E3F3B6E69623B6D393F6D6227

1
ct = bytes.fromhex("0B12190E1C213B6268686C6B6A69776F3B633B776E3C3B6D773B38393C773E3F3B6E69623B6D393F6D6227")
2
print(bytes(b ^ 0x5A for b in ct).decode())   # QHCTF{a8226103-5a9a-4fa7-abcf-dea438a7ce78}（最终答案）

1
选手流程：识别(格式/语言) → 学算法 → 找题目数据 → 解密 → 得 flag
2
出题流程：写逻辑(含 flag) → 选算法 → 加伪装/误导 → 验证可解且不可白嫖

1
// rainbow.c —— 出题模板：SDL 图形外衣 + 演示算法 + 独立数据文件
2
#include <SDL2/SDL.h>
3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <time.h>
7

8
static unsigned char xor_encrypt(unsigned char a, unsigned char b) { return a ^ b; }
9
// 烟雾弹（可加可不加）：
10
static unsigned int calculate_key_from_color(unsigned int r, unsigned int g, unsigned int b) { return r ^ g ^ b; }
11
static void render_rainbow_cannon(SDL_Renderer *r) { /* 300 条随机彩线，见上文 */ }
12

13
static void hide_flag(void) {
14
    char flag[] = "flag{this_is_flag}";   // ← 演示用（示例 flag，不是答案！）
15
    for (int i = 0; flag[i]; i++) flag[i] = xor_encrypt(flag[i], 0x5A);
16
    printf("Encrypted Flag: ");
17
    for (int i = 0; flag[i]; i++) printf("%02X", (unsigned char)flag[i]);  // 转 hex 去 0x
18
    putchar('\n');
19
}
20

21
int main(void) {
22
    SDL_Init(SDL_INIT_VIDEO);
23
    SDL_Window *w = SDL_CreateWindow("Rainbow Cannon", 0, 0, 640, 480, 0);
24
    SDL_Renderer *r = SDL_CreateRenderer(w, -1, 0);
25
    srand(time(0));
26
    hide_flag();                            // 演示加密算法
27
    render_rainbow_cannon(r);
28
    /* 清理... */
29
}

1
# gen.py —— 生成 output.txt（真 flag 的密文，与程序算法严格一致）
2
import sys
3
flag = sys.argv[1].encode()     # 例如 "QHCTF{a8226103-5a9a-4fa7-abcf-dea438a7ce78}"
4
key  = 0x5A                     # 必须与 hide_flag 里的密钥一致
5
ct   = bytes(c ^ key for c in flag)
6
with open("output.txt", "w") as f:
7
    f.write("Encrypted Flag: " + ct.hex().upper() + "\n")
8
print("output.txt written,", len(ct), "bytes")