勒索病毒.exe

打开IDA_main函数里的返回值main_0:

__CheckForDebuggerJustMyCode(&unk_40B027);Str = 0;memset(v19, 0, sizeof(v19));Str1 = 0;memset(v17, 0, sizeof(v17));memset(v15, 0, 0x100u);memset(v14, 0, 0x100u);v11 = 1;do{sub_401037("**************************我的Flag出了什么问题??**************************\n", v4);sub_401037("您的一些重要数据被我们加密了,就算您叫破喉咙来也没有办法恢复。\n", v5);sub_401037("**************************那有没有恢复的方法呢??**************************\n", v6);sub_401037(asc_406CA8, v7);sub_401037("做出你的选择:\n", v8);sub_401037("1.充钱\n2.退出\n", v9);sub_401073("%d", (char)v10);if ( v10[0] == 1 ){v13 = fopen("flag.txt", "r");if ( !v13 ){sub_401037("打开源文件失败!\n", v4);getchar();exit(0);}v12 = fopen("enflag.txt", "w");if ( !v12 ){sub_401037("找不到加密文件!\n", v4);getchar();exit(0);}sub_401037("\n请输入您的密钥:", v4);sub_401073("%s", (char)&Str);

发现关键函数sub_401A70：

char __cdecl sub_401A70(char *Str, char *Str1)
{char v3; // [esp+0h] [ebp-E4h]signed int i; // [esp+D0h] [ebp-14h]signed int v5; // [esp+DCh] [ebp-8h]__CheckForDebuggerJustMyCode(&unk_40B027);v5 = strlen(Str);for ( i = 0; i < v5; ++i )Str1[i] += Str[i] ^ 0x1F;if ( !strcmp(Str1, "DH~mqqvqxB^||zll@Jq~jkwpmvez{") )sub_401037("充值成功.\n", v3);elsesub_401037("Error!\n", v3);return *Str1;
}

写脚本：

str='DH~mqqvqxB^||zll@Jq~jkwpmvez{'
flag=''
for i in str:flag+=chr(ord(i)^31)
print(flag)

运行

[Warnning]Access_Unauthorized