1.先输入6个整数塞进3个 64 位整数得到v6[2]输入a0→ 写入v6[0]的低 32 位输入a1→ 写入v6[0]的高 32 位输入a2→ 写入v6[1]的低 32 位输入a3→ 写入v6[1]的高 32 位输入a4→ 写入v6[2]的低 32 位输入a5→ 写入v6[2]的高 32 位小端存储高 4 字节在前低 4 字节在后v6[0] 2 32 | 1v6[1] 4 32 | 3v6[2] 6 32 | 52.取v6每低4字节和高4字节在sub_400686中进行类TEA分组加密将加密后的v6赋给v73.sub_400770验证v7先根据方程组求出v7# 三个方程对应的常数 A 2225223423 # x - y B 4201428739 # y z C 1121399208 # x - z # 解线性方程组 # x y A # 代入第三式(y A) - z C y - z C - A # 与第二式 y z B 相加得2y B C - A y (B C - A) // 2 x y A z B - y print(fx {x} (0x{x:08X})) print(fy {y} (0x{y:08X})) print(fz {z} (0x{z:08X}))所以sub_400770中a1[6] { 3746099070,550153460,3774025685,1548802262,2652626477,2230518816 };unk_6010600x601060: 02 00 00 00 → a2[0] 0x00000002 20x601064: 02 00 00 00 → a2[1] 0x00000002 20x601068: 03 00 00 00 → a2[2] 0x00000003 30x60106C: 04 00 00 00 → a2[3] 0x00000004 4根据sub_400686解密#include stdio.h int main() { int a1[6] { 3746099070,550153460,3774025685,1548802262,2652626477,2230518816 }; unsigned int a2[4] { 2,2,3,4 }; unsigned int v3; unsigned int v4; int v5; for (unsigned int j 0; j 5; j 2) { v3 v[j]; v4 a1[j 1]; v5 1166789954 * 64; for (unsigned int i 0; i 64; i) { v4 - (v3 v5 20) ^ ((v3 6) a2[2]) ^ ((v3 9) a2[3]) ^ 0x10; v3 - (v4 v5 11) ^ ((v4 6) *a2) ^ ((v4 9) a2[1]) ^ 0x20; v5 - 1166789954; } a1[j] v3; a1[j 1] v4; }//小端序 for (unsigned int i 0; i 6; i) printf(%c%c%c, *((char*)a1[i] 2), *((char*)a1[i] 1), *(char*)a1[i]); }flag{re_is_great!}