无壳，32位程序

运行后结果

程序比较简单一共三个函数

根据题目和运行结果可以看出来是a3太小了，没法完全解密密钥

解决该问题可以通过写脚本或动调解决

定位到a3入栈的位置

Push结束后观察栈窗口

F2改变内存中的值

不推荐直接改push 1C为push 5C，可能会改变栈的地址

运行结束得出flag

flag{I_a_M_t_h_e_e_n_C_o_D_i_n_g@flare-on.com}

#include

int __cdecl sub_8A1000(char * a1, char* a2)
{
int v3; // [esp+0h] [ebp-8h]
char v4; // [esp+4h] [ebp-4h]

if ((int)(unsigned \_\_int8)\*a2 >> 3 == 30)  
{  
    v4 = a2\[3\] & 0x3F | ((a2\[2\] & 0x3F) << 6);  
    v3 = 4;  
}  
else if ((int)(unsigned \_\_int8)\*a2 >> 4 == 14)  
{  
    v4 = a2\[2\] & 0x3F | ((a2\[1\] & 0x3F) << 6);  
    v3 = 3;  
}  
else if ((int)(unsigned \_\_int8)\*a2 >> 5 == 6)  
{  
    v4 = a2\[1\] & 0x3F | ((\*a2 & 0x1F) << 6);  
    v3 = 2;  
}  
else  
{  
    v4 = \*a2;  
    v3 = 1;  
}  
\*a1 = v4;  
return v3;  

}
unsigned int __cdecl sub_8A1160(char* a1, int a2, unsigned int a3)
{
unsigned int i; // [esp+4h] [ebp-4h]

for (i = 0; i < a3; ++i)                    // a3 = 28  
{  
    a2 += sub\_8A1000(a1, (char\*)a2);           // a1=text a2=str  
    if (!\*a1++)  
        break;  
}  
return i;  

}
int main()
{
unsigned char ida_chars[] =
{
0xE0, 0x81, 0x89, 0xC0, 0xA0, 0xC1, 0xAE, 0xE0, 0x81, 0xA5,
0xC1, 0xB6, 0xF0, 0x80, 0x81, 0xA5, 0xE0, 0x81, 0xB2, 0xF0,
0x80, 0x80, 0xA0, 0xE0, 0x81, 0xA2, 0x72, 0x6F, 0xC1, 0xAB,
0x65, 0xE0, 0x80, 0xA0, 0xE0, 0x81, 0xB4, 0xE0, 0x81, 0xA8,
0xC1, 0xA5, 0x20, 0xC1, 0xA5, 0xE0, 0x81, 0xAE, 0x63, 0xC1,
0xAF, 0xE0, 0x81, 0xA4, 0xF0, 0x80, 0x81, 0xA9, 0x6E, 0xC1,
0xA7, 0xC0, 0xBA, 0x20, 0x49, 0xF0, 0x80, 0x81, 0x9F, 0xC1,
0xA1, 0xC1, 0x9F, 0xC1, 0x8D, 0xE0, 0x81, 0x9F, 0xC1, 0xB4,
0xF0, 0x80, 0x81, 0x9F, 0xF0, 0x80, 0x81, 0xA8, 0xC1, 0x9F,
0xF0, 0x80, 0x81, 0xA5, 0xE0, 0x81, 0x9F, 0xC1, 0xA5, 0xE0,
0x81, 0x9F, 0xF0, 0x80, 0x81, 0xAE, 0xC1, 0x9F, 0xF0, 0x80,
0x81, 0x83, 0xC1, 0x9F, 0xE0, 0x81, 0xAF, 0xE0, 0x81, 0x9F,
0xC1, 0x84, 0x5F, 0xE0, 0x81, 0xA9, 0xF0, 0x80, 0x81, 0x9F,
0x6E, 0xE0, 0x81, 0x9F, 0xE0, 0x81, 0xA7, 0xE0, 0x81, 0x80,
0xF0, 0x80, 0x81, 0xA6, 0xF0, 0x80, 0x81, 0xAC, 0xE0, 0x81,
0xA1, 0xC1, 0xB2, 0xC1, 0xA5, 0xF0, 0x80, 0x80, 0xAD, 0xF0,
0x80, 0x81, 0xAF, 0x6E, 0xC0, 0xAE, 0xF0, 0x80, 0x81, 0xA3,
0x6F, 0xF0, 0x80, 0x81, 0xAD, 0x00
};

    char Text\[128\]; // \[esp+0h\] \[ebp-84h\] BYREF  
    unsigned int v6; // \[esp+80h\] \[ebp-4h\]

    v6 = sub\_8A1160(Text, (int)&ida\_chars, 0x5Cu);  
    Text\[v6\] = 0;  
    printf("%s", Text);  
    return 0;

}

由于解密过程不复杂，且伪代码需改动不多，直接上C++写比较方便，用python可以写的更简洁但需要时间多一些。