无壳
查看ida
这里应该运行就可以得flag，但是这个程序不能直接点击运行
按照伪代码写exp
完整exp：
key=list('gamelab@')
content=[0xB6,0x42,0xB7,0xFC,0xF0,0xA2,0x5E,0xA9,0x3D,0x29,0x36,0x1F,0x54,0x29,0x72,0xA8, 0x63,0x32,0xF2,0x44,0x8B,0x85,0xEC,0x0D,0xAD,0x3F,0x93,0xA3,0x92,0x74,0x81,0x65,0x69,0xEC,0xE4,0x39,0x85,0xA9,0xCA,0xAF,0xB2,0xC6]
rc4number=0x100
s=[0]*rc4number
flag=''def rc4_init(s,key,rc4number):for i in range(rc4number):s[i]=ij=0for i in range(rc4number):j=(j+s[i]+ord(key[i%len(key)]))%rc4numbertemp=s[i]s[i]=s[j]s[j]=tempdef rc4_endecode(s,content,rc4number):i=0j=0for k in range(len(content)):i=(i+1)%rc4numberj=(j+s[i])%rc4numbertemp=s[i]s[i]=s[j]s[j]=tempt=(s[i]+s[j])%rc4numbercontent[k]=chr(content[k]^s[t])content=''.join(content)print(content)rc4_init(s,key,rc4number)
rc4_endecode(s,content,rc4number)
