亿天一道RE题（XCTF&&buuoj）

int is_ok = 1;
for (i = 0; i < FLAG_LEN; i++) {
    if (generated_string[i] != just_a_string[i])  //必须相等
        return 0;
}
return 1;

for (i = 0; i < FLAG_LEN; i++) {
    pthread_join(*(thread+i), &result);
    generated_string[i] = *(char *)result + just_a_string[i];  //ressul必须为0
    free(result);
    free(arguments[i]);
}

char *arguments[20];
for (i = 0; i < FLAG_LEN; i++) {
    arguments[i] = (char *)malloc(3*sizeof(char));
    arguments[i][0] = first_letter;    //生成的随机数
    arguments[i][1] = differences[i];  //给定的字符串
    arguments[i][2] = user_string[i];  //你的输入

    pthread_create((pthread_t*)(thread+i), NULL, checking, arguments[i]);
}

void * checking(void *arg) {
    char *result = malloc(sizeof(char));
    char *argument = (char *)arg;
    *result = (argument[0]+argument[1]) ^ argument[2];  //相同则异或为0
    return result;
}

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  __pid_t v3; // eax
  size_t v4; // rax
  ssize_t v5; // rbx
  bool v6; // al
  bool bCheckPtrace; // [rsp+13h] [rbp-1BDh]
  ssize_t numRead; // [rsp+18h] [rbp-1B8h]
  ssize_t numReada; // [rsp+18h] [rbp-1B8h]
  char bufWrite[200]; // [rsp+20h] [rbp-1B0h]
  char bufParentRead[200]; // [rsp+F0h] [rbp-E0h]
  unsigned __int64 v12; // [rsp+1B8h] [rbp-18h]

  v12 = __readfsqword(0x28u);
  bCheckPtrace = detectDebugging();
  if ( pipe(pParentWrite) == -1 )
    exit(1);
  if ( pipe(pParentRead) == -1 )
    exit(1);
  v3 = fork();
  if ( v3 != -1 )
  {
    if ( v3 )
    {
      close(pParentWrite[0]);
      close(pParentRead[1]);
      while ( 1 )
      {
        printf("Input key : ");
        memset(bufWrite, 0, 0xC8uLL);
        gets(bufWrite);                         // 输入
        v4 = strlen(bufWrite);
        v5 = write(pParentWrite[1], bufWrite, v4);// 把bufwrite写入pparentwrite
        if ( v5 != strlen(bufWrite) )
          printf("parent - partial/failed write");// v5==bufwrite长度则表示无差错写入
        do
        {
          memset(bufParentRead, 0, 0xC8uLL);
          numReada = read(pParentRead[0], bufParentRead, 0xC8uLL);// 从pParentRead中读取长度为0xc8长度的数据到bufParentRead
          v6 = bCheckPtrace || checkDebuggerProcessRunning();
          if ( v6 )
          {
            puts("Wrong !!!\n");                // 反反编译
          }
          else if ( !checkStringIsNumber(bufParentRead) )
          {
            puts("Wrong !!!\n");                
          }
          else
          {
            if ( atoi(bufParentRead) )          // 非空&可以转换为整形
            {
              puts("True");
              if ( close(pParentWrite[1]) == -1 )
                exit(1);
              exit(0);
            }
            puts("Wrong !!!\n");
          }
        }
        while ( numReada == -1 );
      }
    }
    close(pParentWrite[1]);
    close(pParentRead[0]);
    while ( 1 )
    {
      memset(bufParentRead, 0, 0xC8uLL);
      numRead = read(pParentWrite[0], bufParentRead, 0xC8uLL);
      if ( numRead == -1 )
        break;
      if ( numRead )
      {
        if ( childCheckDebugResult() )
        {
          responseFalse();
        }
        else if ( bufParentRead[0] == '{' )
        {
          if ( strlen(bufParentRead) == 42 )
          {
            if ( !strncmp(&bufParentRead[1], "53fc275d81", 0xAuLL) )
            {
              if ( bufParentRead[strlen(bufParentRead) - 1] == '}' )
              {
                if ( !strncmp(&bufParentRead[31], "4938ae4efd", 0xAuLL) )
                {
                  if ( !confuseKey(bufParentRead, 42) )// 关键乱序函数
                  {
                    responseFalse();
                  }
                  else if ( !strncmp(bufParentRead, "{daf29f59034938ae4efd53fc275d81053ed5be8c}", 0x2AuLL) )
                  {
                    responseTrue();
                  }
                  else
                  {
                    responseFalse();
                  }
                }
                else
                {
                  responseFalse();
                }
              }
              else
              {
                responseFalse();
              }
            }
            else
            {
              responseFalse();
            }
          }
          else
          {
            responseFalse();
          }
        }
        else
        {
          responseFalse();
        }
      }
    }
    exit(1);
  }
  exit(1);
}

strncpy(szPart1, szKey + 1, 0xAuLL);          // 除开首位的'{'和'}'，其余每10位一组
strncpy(szPart2, szKey + 11, 0xAuLL);
strncpy(szPart3, szKey + 21, 0xAuLL);
strncpy(szPart4, szKey + 31, 0xAuLL);
memset(szKey, 0, 0x2AuLL);
*szKey = '{';                                 // 加上首部
strcat(szKey, szPart3);                       // 顺序为3，4，1，2。还原就可以了
strcat(szKey, szPart4);
strcat(szKey, szPart1);
strcat(szKey, szPart2);
szKey[41] = '}';                              // 加上尾部

printf("Gimme: ", argv, envp);
__isoc99_scanf((__int64)"%d", (__int64)&v4);  // 给一个输入，为int
not_the_flag(v4);                             // 关键判断

if ( a1 == 42 )
  puts("Cipher from Bill \nSubmit without any tags\n#kdudpeh");// 注意格式
else
  puts("YOUSUCK");                            // 你爬

unsigned int __cdecl sub_401000(const char *a1)
{
  _BYTE *v1; // ecx
  unsigned int v2; // edi
  unsigned int result; // eax
  const char *v4; // ebx

  v2 = 0;
  result = strlen(a1);
  if ( result )
  {
    v4 = (const char *)(a1 - v1);               // 改写为：v1 + v4 = a1 
                                                // 随着v1的递增，遍历整个输入
    do
    {
      *v1 = byte_402FF8[(char)v1[(_DWORD)v4]];  // *(v1[v4]) 相当于 *(v1 + v4)
                                                // 把输入的字符作为索引在byte_402ff8里查表转换
      ++v2;
      ++v1;
      result = strlen(a1);
    }
    while ( v2 < result );
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  HANDLE v4; // eax
  DWORD NumberOfBytesWritten; // [esp+4h] [ebp-24h]
  char input_; // [esp+8h] [ebp-20h]

  sub_401370((int)aPleaseInputFla);
  scanf(a31s, &input_);
  if ( strlen(&input_) == 19 )
  {
    sub_401220();
    v4 = CreateFileA(FileName, 0x40000000u, 0, 0, 2u, 0x80u, 0);
    WriteFile(v4, &input_, 0x13u, &NumberOfBytesWritten, 0);
    sub_401240(&input_, &NumberOfBytesWritten); // number要为1
    if ( NumberOfBytesWritten == 1 )
      sub_401370((int)aRightFlagIsYou);
    else
      sub_401370((int)aWrong);
    system(aPause);
    result = 0;
  }
  else
  {
    sub_401370((int)aWrong);
    system(aPause);
    result = 0;
  }
  return result;
}

int sub_401220()
{
  HMODULE v0; // eax
  DWORD v2; // eax

  v2 = GetCurrentProcessId();
  hProcess = OpenProcess(0x1F0FFFu, 0, v2);
  v0 = LoadLibraryA(LibFileName);               // 获取HOOK模块输入表的起始地址
  hook_id = (int)GetProcAddress(v0, ProcName);  // 获取目标函数地址
  lpAddress = (LPVOID)hook_id;
  if ( !hook_id )
    return sub_401370((int)&unk_40A044);
  hool_re = *(_DWORD *)lpAddress;
  *((_BYTE *)&hool_re + 4) = *((_BYTE *)lpAddress + 4);
  byte_40C9BC = -23;
  dword_40C9BD = (char *)sub_401080 - (char *)lpAddress - 5;   //没看懂
  return sub_4010D0();
}

int __stdcall sub_401080(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
{
  signed int v5; // ebx

  v5 = sub_401000((int)lpBuffer, nNumberOfBytesToWrite);
  sub_401140();
  WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, lpNumberOfBytesWritten, lpOverlapped);
  if ( v5 )
    *lpNumberOfBytesWritten = 1;
  return 0;
}

signed int __cdecl sub_401000(int input, signed int num)
{
  char v2; // al
  char v3; // bl
  char v4; // cl
  int v5; // eax

  v2 = 0;
  if ( num > 0 )
  {
    do
    {
      if ( v2 == 18 )
      {
        *(_BYTE *)(input + 18) ^= 0x13u;
      }
      else
      {
        if ( v2 % 2 )
          v3 = *(_BYTE *)(v2 + input) - v2;
        else
          v3 = *(_BYTE *)(v2 + input + 2);
        *(_BYTE *)(v2 + input) = v2 ^ v3;
      }
      ++v2;
    }
    while ( v2 < num );
  }
  v4 = 0;
  if ( num <= 0 )
    return 1;
  v5 = 0;
  while ( after_change[v5] == *(_BYTE *)(v5 + input) )
  {
    v5 = ++v4;
    if ( v4 >= num )
      return 1;
  }
  return 0;
}

int __cdecl sub_401500(signed int a1)
{
  int result; // eax
  _BYTE *i; // [esp+1Ch] [ebp-Ch]

  if ( a1 <= 9 )
    return sub_401500(a1 + 1);
  for ( i = (_BYTE *)dword_40AD94; ; ++i )
  {
    result = dword_40ADA0;
    if ( (unsigned int)i >= dword_40ADA0 )
      break;
    *i ^= 1u;
  }
  return result;
}

void __cdecl __noreturn sub_40157F(int a1)
{
  char v1; // [esp+18h] [ebp-20h]
  int v2; // [esp+2Ch] [ebp-Ch]

  v2 = *(_DWORD *)(*(_DWORD *)(a1 + 4) + 184);
  if ( v2 == dword_40ADA8 + 6 )
  {
    scanf("%20s", &v1);
    if ( !sub_401547(&v1, (_BYTE *)dword_40AD98) )// 返回0
      puts(dword_40ADA4);                       // you win congratulations
  }
  ExitProcess(0);
}

signed int __cdecl sub_401547(_BYTE *a1, _BYTE *a2)
{
  while ( *a2 != 2 )
  {
    if ( *a1 != (*a2 ^ 2) )
      return 1;
    ++a1;
    ++a2;
  }
  return 0;
}

int __cdecl sub_4015EA(signed int a1)
{
  if ( a1 <= 9 )
    return sub_4015EA(a1 + 1);
  puts(dword_40AD90);
  dword_40ADA8 = 0x401619;
  __debugbreak();
  return 0;
}