查壳，无壳，64位，ida打开，查看main函数
int __cdecl main_0(int argc, const char **argv, const char **envp)
{size_t v4; // [esp+50h] [ebp-3Ch]char v5[44]; // [esp+54h] [ebp-38h] BYREFchar Str[12]; // [esp+80h] [ebp-Ch] BYREFstrcpy(Str, "gamelab@");v5[0] = -74;v5[1] = 66;v5[2] = -73;v5[3] = -4;v5[4] = -16;v5[5] = -94;v5[6] = 94;v5[7] = -87;v5[8] = 61;v5[9] = 41;v5[10] = 54;v5[11] = 31;v5[12] = 84;v5[13] = 41;v5[14] = 114;v5[15] = -88;v5[16] = 99;v5[17] = 50;v5[18] = -14;v5[19] = 68;v5[20] = -117;v5[21] = -123;v5[22] = -20;v5[23] = 13;v5[24] = -83;v5[25] = 63;v5[26] = -109;v5[27] = -93;v5[28] = -110;v5[29] = 116;v5[30] = -127;v5[31] = 101;v5[32] = 105;v5[33] = -20;v5[34] = -28;v5[35] = 57;v5[36] = -123;v5[37] = -87;v5[38] = -54;v5[39] = -81;v5[40] = -78;v5[41] = -58;v4 = strlen(Str);sub_401005(Str, v4, v5, 42);printf("%s\n", Str);return 0;
}
就是典型的rc4加密，gamelab@是key，v5是密文
上脚本：
from Crypto.Cipher import ARC4
import base64def rc4_decrypt(data, key1): # 解密data = base64.b64decode(data)key = bytes(key1, encoding='utf-8')enc = ARC4.new(key)res = enc.decrypt(data)res = str(res,'gbk')return resif __name__ == "__main__":# data = 'nihao' # 需要加密的内容enc = [0xB6, 0x42, 0xB7, 0xFC, 0xF0, 0xA2, 0x5E, 0xA9, 0x3D, 0x29, 0x36, 0x1F, 0x54, 0x29, 0x72, 0xA8, 0x63, 0x32, 0xF2, 0x44, 0x8B, 0x85, 0xEC, 0x0D, 0xAD, 0x3F, 0x93, 0xA3, 0x92, 0x74, 0x81, 0x65, 0x69, 0xEC, 0xE4, 0x39, 0x85, 0xA9, 0xCA, 0xAF, 0xB2, 0xC6]key = 'gamelab@' # 加密keyrc4 = ARC4.new(key.encode('utf-8'))res = rc4.decrypt(bytes(enc))print(res)
