1、查壳首先惯例查壳发现lua语言那么可以直接解压得到lua脚本2、lua解密脚本语言如下还发现asserts下面有flag数据seg000:00000000 db 53h ; S seg000:00000001 db 5Eh, 11h, 8 seg000:00000004 dd 45575C11h, 0F061A5Dh, 55736h, 8223046h, 2F4B4515h, 3A1E0F21h seg000:0000001C dd 1D11576Ch, 425B364Bh seg000:00000024 db 0Eh seg000:00000025 db 0Dhmain.lua里面有脚本语言localfunctiongetWinMessage()localcontentniliflove.filesystem.getInfo(assets/flag.dat)thencontentlove.filesystem.read(assets/flag.dat)endifnotcontentorcurrentDifficulty~hardthenreturnYou WIN!endlocalkey52pojielocalkeyLen#keylocalresult{}localbitrequire(bit)fori1,#contentdolocalbstring.byte(content,i)localkstring.byte(key,((i-1)%keyLen)1)table.insert(result,string.char(bit.bxor(b,k)))endreturntable.concat(result)end然后观察逻辑可以看到key “52pojie”然后将data数据和key按个异或可以得到key#includestdio.h#includestring.hintmain(){// 密文数据从汇编代码中提取unsignedcharciphertext[]{0x53,0x5E,0x11,0x08,0x11,0x5C,0x57,0x45,0x5D,0x1A,0x06,0x0F,0x36,0x57,0x05,0x00,0x46,0x30,0x22,0x08,0x15,0x45,0x4B,0x2F,0x21,0x0F,0x1E,0x3A,0x6C,0x57,0x11,0x1D,0x4B,0x36,0x5B,0x42,0x0E,0x0D};intlensizeof(ciphertext);charkey[]52pojie;intkeyLenstrlen(key);printf(密文长度: %d 字节\n,len);printf(解密密钥: %s\n\n,key);printf(解密过程:\n);printf(索引\t密文(hex)\t密钥(char)\tXOR结果(char)\n);printf(------------------------------------------------\n);unsignedcharplaintext[len1];for(inti0;ilen;i){intkeyIndexi%keyLen;unsignedchardecryptedciphertext[i]^key[keyIndex];plaintext[i]decrypted;printf(%d\t0x%02X\t\t%c (0x%02X)\t%c (0x%02X)\n,i,ciphertext[i],key[keyIndex],key[keyIndex],decrypted32decrypted126?decrypted:.,decrypted);}plaintext[len]\0;printf(\n\n);printf(解密结果: %s\n,plaintext);printf(\n);return0;}结果如下flag{52pojie_2026_Happy_New_Year!_w}[/md]