HugeH4rD

新年快乐

0x01

---

Exeinfo PE Check

UPX -> Markus & Laszlo ver. [ 3.91 ] <- from file. ( sign like UPX packer )  , 
Overlay : 2E6669... Nothing discovered

32位 UPX壳

脱壳

脱壳器下载UPX: the Ultimate Packer for eXecutables - Homepage

upx.exe -d 新年快乐.exe
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2023
UPX 4.0.2       Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 30th 2023

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
     27807 <-     21151   76.06%    win32/pe     新年快乐.exe

Unpacked 1 file.

Dev C++ v5.0 - v5.5 / Mingw32 / GNU C v4.x - [ libgcj-13.dll ] , 
Overlay : 2E6669... Nothing discovered

脱壳成功

0x02

---

IDA

分析主函数 _main()

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  _WORD Str2[8]; // [esp+12h] [ebp-3Ah] BYREF
  char v5[30]; // [esp+22h] [ebp-2Ah] BYREF

  __main();
  strcpy((char *)Str2, "HappyNewYear!"); /* 此处对(const char *)Str2 赋值 */
  Str2[7] = 0;
  memset(v5, 0, sizeof(v5));
  printf("please input the true flag:");
  scanf("%s", &Str2[7]); /* &Str2[7] 是我们输入的字符*/
  if ( !strncmp((const char *)&Str2[7], (const char *)Str2, strlen((const char *)Str2)) ) /* 比较字符串 */
    result = puts("this is true flag!");
  else
    result = puts("wrong!");
  return result;
}

flag为 flag{HappyNewYear}