{"id":1137,"date":"2024-11-10T18:27:47","date_gmt":"2024-11-10T10:27:47","guid":{"rendered":"https:\/\/blog.shangwendada.top\/?p=1137"},"modified":"2024-11-10T18:43:07","modified_gmt":"2024-11-10T10:43:07","slug":"hkcert-ctf-%e9%83%a8%e5%88%86re%e9%a2%98%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2024\/11\/10\/hkcert-ctf-%e9%83%a8%e5%88%86re%e9%a2%98%e8%a7%a3\/","title":{"rendered":"HKCERT CTF \u90e8\u5206Re\u9898\u89e3"},"content":{"rendered":"

HKCERT CTF \u90e8\u5206Re\u9898\u89e3<\/h1>\n

\u95f2\u6765\u65e0\u4e8b\uff0c\u52fe\u680f\u89e3\u9898\uff0c\u770b\u4e86\u770b\u9999\u6e2f\u7684\u8fd9\u4e2a\u7f51\u5b89\u593a\u65d7\u8d5b\uff0c\u611f\u89c9\u9898\u76ee\u8d28\u91cf\u90fd\u633a\u9ad8\u7684\uff0c\u5199\u4e00\u4e2a\u535a\u5ba2\u8bb0\u5f55\u4e00\u4e0b\u6211\u505a\u7684\u51e0\u9898<\/p>\n

Morph<\/h2>\n

\"file\"<\/div>
\nIDA\u5206\u6790\u62a5\u9519\uff0c\u9700\u8981\u9996\u5148\u67e5\u770b\u5177\u4f53\u4ec0\u4e48\u539f\u56e0
\n
\"file\"<\/div>
\ndecompress\u662f\u5f02\u6216\uff0c\u5176\u5b9e\u4ececompress\u8fd9\u4e2a\u8bcd\u6211\u4eec\u5c31\u77e5\u9053\u5e94\u8be5\u662f\u5bf9\u6570\u636e\u505a\u4e00\u4e9b\u5904\u7406\u4e86\uff0c\u5904\u7406\u7684\u6570\u636e\u6b63\u597d\u5c31\u662f\u4f20\u53c2\u7684verify\u51fd\u6570
\n
\"file\"<\/div>
\n\u770b\u5230verify\u51fd\u6570\u6211\u4eec\u4f1a\u53d1\u73b0\u6709\u5f88\u591a\uff0c\u6240\u4ee5\u4e00\u4e2a\u4e2a\u624b\u52a8\u89e3\u6df7\u6dc6\u82b1\u8d39\u7684\u65f6\u95f4\u6709\u70b9\u591a\uff0c\u6839\u636edecompress\u7684\u4f20\u53c2\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\u6bcf\u4e00\u4e2averify\u7684\u5b57\u8282\u5927\u5c0f\u90fd\u662f86\uff0c\u4f46\u662f\u6bcf\u4e00\u4e2averify\u7684\u4f20\u53c2\u4e0d\u4e00\u81f4\uff0c\u4f46\u662f\u5199\u811a\u672c\u83b7\u53d6\u4f20\u53c2\u8fc7\u4e8e\u9ebb\u70e6\uff0c\u53d1\u73b0\u53c2\u6570\u90fd\u5728-128-128\u4e4b\u95f4\uff0c\u6b63\u786e\u7684\u8bdd\u524d\u56db\u4e2a\u5b57\u8282\u5fc5\u7136\u662fF3 0F 1E FA\uff0c\u76f4\u63a5\u68ad\u5c31\u5b8c\u4e8b\u4e86\uff0c\u5c31\u4e0d\u9700\u8981\u8bfb\u53d6decompress\u4f20\u5165\u7684\u53c2\u6570\u4e86\u3002<\/p>\n
import re\nimport idautils\nimport idaapi\nimport idc\n\ndef find_specific_verify_exports():\n    """\n    \u67e5\u627e\u5bfc\u51fa\u8868\u4e2d\u540d\u79f0\u4ee5 _Z8verify_ \u6216 _Z9verify_ \u5f00\u5934\u4e14\u540e\u9762\u63a5\u4e00\u4e2a\u6570\u5b57\u7684\u51fd\u6570\uff0c\u5e76\u8fd4\u56de\u5176\u540d\u79f0\u548c\u5730\u5740\u3002\n    """\n    verify_exports = []\n    pattern = re.compile(r"^_Z(?:8|9)verify_(\\d+)")  # \u5339\u914d _Z8verify_ \u6216 _Z9verify_ \u540e\u63a5\u6570\u5b57\u7684\u683c\u5f0f\n\n    for i in range(idaapi.get_entry_qty()):\n        ordinal = idaapi.get_entry_ordinal(i)\n        func_name = idaapi.get_entry_name(ordinal)\n\n        # \u68c0\u67e5\u51fd\u6570\u540d\u662f\u5426\u7b26\u5408\u6307\u5b9a\u683c\u5f0f\n        if func_name and pattern.match(func_name):\n            func_addr = idaapi.get_entry(ordinal)\n            verify_exports.append((func_name, func_addr))\n\n    return verify_exports\n\ndef xor_bytes(data, key):\n    """\u5c06\u7ed9\u5b9a\u6570\u636e\u4e2d\u7684\u6bcf\u4e2a\u5b57\u8282\u4e0e\u6307\u5b9a\u7684key\u8fdb\u884c\u5f02\u6216"""\n    return bytes([b ^ key for b in data])\n\ndef patch_memory(address, xor_key):\n    """\u76f4\u63a5\u5bf9\u5185\u5b58\u4e2d\u7684\u6570\u636e\u8fdb\u884c\u8865\u4e01"""\n    original_data = idc.get_bytes(address, 86)  # \u8bfb\u53d6\u4ece address \u5230 address+85 \u7684\u5b57\u8282\n    if not original_data:\n        print(f"\u65e0\u6cd5\u8bfb\u53d6\u5730\u5740 {hex(address)} \u7684\u6570\u636e")\n        return False\n\n    # \u5bf9\u6570\u636e\u8fdb\u884c\u5f02\u6216\n    patched_data = xor_bytes(original_data, xor_key)\n\n    # \u5199\u5165\u8865\u4e01\u6570\u636e\u5230\u5185\u5b58\u4e2d\n    for offset, byte in enumerate(patched_data):\n        idc.patch_byte(address + offset, byte)\n\n    print(f"\u5df2\u5728\u5185\u5b58\u4e2d\u8865\u4e01\u5730\u5740\u8303\u56f4 {hex(address)} \u5230 {hex(address+85)}\uff0c\u4f7f\u7528\u5f02\u6216\u952e {xor_key}")\n    return True\n\ndef process_address_range(address):\n    """\u5904\u7406\u7ed9\u5b9a\u5730\u5740\uff0c\u5c1d\u8bd5\u627e\u5230\u6ee1\u8db3\u6761\u4ef6\u7684\u5f02\u6216\u6570\u5b57\u5e76\u5e94\u7528\u8865\u4e01"""\n    original_data = idc.get_bytes(address, 86)  # \u8bfb\u53d6\u4ece address \u5230 address+85 \u7684\u5b57\u8282\n    if not original_data:\n        print(f"\u65e0\u6cd5\u8bfb\u53d6\u5730\u5740 {hex(address)} \u7684\u6570\u636e")\n        return None\n\n    for xor_key in range(-255, 256):\n        xor_key &= 0xFF  # \u4fdd\u8bc1\u5f02\u6216\u952e\u503c\u5728 0 \u5230 255 \u7684\u8303\u56f4\u5185\n        # \u53d6\u5730\u5740\u5230\u5730\u5740+3\u7684\u6570\u636e\u5e76\u4e0e\u5f53\u524d xor_key \u5f02\u6216\n        test_data = xor_bytes(original_data[:4], xor_key)\n\n        # \u68c0\u67e5\u5f02\u6216\u540e\u7684\u524d\u56db\u4e2a\u5b57\u8282\u662f\u5426\u7b49\u4e8e F3 0F 1E FA\n        if test_data == b'\\xF3\\x0F\\x1E\\xFA':\n            # \u6ee1\u8db3\u6761\u4ef6\u65f6\uff0c\u76f4\u63a5\u8865\u4e01\u5185\u5b58\n            if patch_memory(address, xor_key):\n                print(f"\u6210\u529f\u5bf9\u5730\u5740 {hex(address)} \u5e94\u7528\u8865\u4e01\uff0c\u5f02\u6216\u952e\u4e3a {xor_key}")\n            return xor_key\n\n    print(f"\u5730\u5740 {hex(address)} \u6ca1\u6709\u627e\u5230\u6ee1\u8db3\u6761\u4ef6\u7684\u5f02\u6216\u952e")\n    return None\n\n# \u83b7\u53d6\u7b26\u5408\u6761\u4ef6\u7684\u5730\u5740\u5217\u8868\u5e76\u8fdb\u884c\u8865\u4e01\nfiltered_exports = find_specific_verify_exports()\nif filtered_exports:\n    print("\u5f00\u59cb\u5904\u7406\u7b26\u5408\u6761\u4ef6\u7684 'verify' \u51fd\u6570\u5730\u5740...")\n    for func_name, func_addr in filtered_exports:\n        print(f"Processing function: {func_name} at Address: {hex(func_addr)}")\n        process_address_range(func_addr)\nelse:\n    print("No specific 'verify' functions found in export table.")\n<\/code><\/pre>\n
IDApython\u76f4\u63a5\u8bc6\u522b\u5f00\u59cb\u7206\u7834\uff0c\u4fee\u590d\u540e\u53ef\u80fdIDA\u8fd8\u8bc6\u522b\u4e0d\u8fc7\u6765\uff0c\u8fd9\u4e2a\u65f6\u5019\u53ef\u4ee5\u4fdd\u5b58\u597dpatch\u540e\u7684\u9644\u4ef6\uff0c\u6216\u8005\u8dd1\u4e0b\u9762\u7684IDApython\u4ee3\u7801\u91cd\u65b0\u8bc6\u522b<\/p>\n
import re\nimport idautils\nimport idaapi\nimport idc\n\n# \u6b65\u9aa42\uff1a\u5220\u9664\u6240\u6709\u73b0\u6709\u7684\u51fd\u6570\u5b9a\u4e49\nprint("Starting to undefine all existing functions...")\nfor func_ea in idautils.Functions():\n    func_name = idc.get_func_name(func_ea)\n    print(f"Undefining function {func_name} at {hex(func_ea)}")\n    idc.del_func(func_ea)  # \u5220\u9664\u51fd\u6570\u5b9a\u4e49\n\nprint("All functions have been undefined.")\n\n# \u6b65\u9aa43\uff1a\u5c06\u6240\u6709\u4ee3\u7801\u533a\u57df\u8bbe\u7f6e\u4e3a\u672a\u5b9a\u4e49\u72b6\u6001\uff0c\u4f46\u8df3\u8fc7\u6570\u636e\u6bb5\nprint("Setting all instructions and data to undefined in code segments...")\nfor seg_ea in idautils.Segments():\n    # \u8df3\u8fc7\u6570\u636e\u6bb5\uff0c\u4ec5\u5904\u7406\u4ee3\u7801\u6bb5\n    if idc.get_segm_attr(seg_ea, idc.SEGATTR_TYPE) != idc.SEG_CODE:\n        print(f"Skipping data segment at {hex(seg_ea)}")\n        continue\n\n    start = seg_ea\n    end = idc.get_segm_end(seg_ea)\n\n    # \u904d\u5386\u6bb5\u4e2d\u7684\u6bcf\u4e2a\u5730\u5740\uff0c\u5e76\u5c06\u5176\u8bbe\u7f6e\u4e3a\u672a\u5b9a\u4e49\n    for head in idautils.Heads(start, end):\n        idc.del_items(head, idc.DELIT_SIMPLE)  # \u5c06\u6240\u6709\u6307\u4ee4\u548c\u6570\u636e\u8bbe\u7f6e\u4e3a\u672a\u5b9a\u4e49\n\nprint("All code in code segments set to undefined.")\n\n# \u6b65\u9aa44\uff1a\u91cd\u65b0\u6807\u8bb0\u6574\u4e2a\u7a0b\u5e8f\u7684\u4ee3\u7801\u6bb5\u4ee5\u8fdb\u884c\u91cd\u65b0\u5206\u6790\nprint("Marking all code segments for reanalysis...")\nfor seg_ea in idautils.Segments():\n    if idc.get_segm_attr(seg_ea, idc.SEGATTR_TYPE) == idc.SEG_CODE:\n        ida_auto.auto_mark_range(seg_ea, idc.get_segm_end(seg_ea), ida_auto.AU_CODE)\n\nida_auto.auto_wait()  # \u7b49\u5f85\u91cd\u65b0\u5206\u6790\u5b8c\u6210\n\nprint("Reanalyzed all code segments, excluding data segments.")<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
\u5f04\u597d\u4e4b\u540e\u5c0f\u65f6\u7684\u4ee3\u7801\u90fd\u56de\u6765\u4e86
\n
\"file\"<\/div>
\n\u6bcf\u4e00\u6b21\u90fd\u662f\u524d\u540e\u4e24\u4e2a\u4f4d\u7f6e\u7684\u5f02\u6216\u7b49\u4e8e\u4e00\u4e2a\u503c\uff0c\u7ee7\u7eed\u6413\u811a\u672c\u8f93\u51fa\u4ed6\uff0c\u628a\u6bcf\u4e00\u4f4d\u7ed3\u679c\u8bb0\u5f55\u4e0b\u6765\uff0c\u6784\u5efa\u7ea6\u675f\u5173\u7cfb\uff0c\u7136\u540ez3\u68ad\u54c8
\n
\"file\"<\/div><\/p>\n
import re\nimport idaapi\nimport idautils\nimport idc\n\ndef find_specific_verify_exports():\n    """\n    \u67e5\u627e\u5bfc\u51fa\u8868\u4e2d\u540d\u79f0\u4ee5 _Z8verify_ \u6216 _Z9verify_ \u5f00\u5934\u4e14\u540e\u9762\u63a5\u4e00\u4e2a\u6570\u5b57\u7684\u51fd\u6570\uff0c\u5e76\u8fd4\u56de\u5176\u540d\u79f0\u548c\u5730\u5740\u3002\n    """\n    verify_exports = []\n    pattern = re.compile(r"^_Z(?:8|9)verify_(\\d+)")  # \u5339\u914d _Z8verify_ \u6216 _Z9verify_ \u540e\u63a5\u6570\u5b57\u7684\u683c\u5f0f\n\n    for i in range(idaapi.get_entry_qty()):\n        ordinal = idaapi.get_entry_ordinal(i)\n        func_name = idaapi.get_entry_name(ordinal)\n\n        # \u68c0\u67e5\u51fd\u6570\u540d\u662f\u5426\u7b26\u5408\u6307\u5b9a\u683c\u5f0f\n        if func_name and pattern.match(func_name):\n            func_addr = idaapi.get_entry(ordinal)\n            verify_exports.append((func_name, func_addr))\n\n    return verify_exports\n\ndef extract_equation_from_verify(func_addr):\n    """\n    \u4ece\u6bcf\u4e2a verify \u51fd\u6570\u4e2d\u63d0\u53d6 mov esi \u548c cmp al \u6307\u4ee4\u6765\u751f\u6210\u65b9\u7a0b\u3002\n    """\n    esi_values = []\n    cmp_value = None\n\n    # \u904d\u5386\u51fd\u6570\u6307\u4ee4\uff0c\u76f4\u5230\u627e\u5230\u76ee\u6807\u6307\u4ee4\u6216\u5230\u8fbe\u51fd\u6570\u7ed3\u675f\n    for instr_addr in idautils.FuncItems(func_addr):\n        mnemonic = idc.print_insn_mnem(instr_addr)\n\n        # \u67e5\u627e mov esi, <imm> \u6307\u4ee4\n        if mnemonic == "mov" and "esi" in idc.print_operand(instr_addr, 0):\n            esi_value = idc.get_operand_value(instr_addr, 1)\n            esi_values.append(esi_value)\n\n        # \u67e5\u627e cmp al, <imm> \u6307\u4ee4\n        elif mnemonic == "cmp" and "al" in idc.print_operand(instr_addr, 0):\n            cmp_value = idc.get_operand_value(instr_addr, 1)\n\n        # \u5f53\u627e\u5230\u4e24\u4e2a esi \u503c\u548c\u4e00\u4e2a cmp \u503c\u65f6\uff0c\u53ef\u4ee5\u751f\u6210\u65b9\u7a0b\n        if len(esi_values) == 2 and cmp_value is not None:\n            break\n\n    # \u786e\u4fdd\u6536\u96c6\u5230\u6240\u6709\u6240\u9700\u7684\u503c\n    if len(esi_values) == 2 and cmp_value is not None:\n        equation = f"input[0x{esi_values[0]:X}] ^ input[0x{esi_values[1]:X}] == 0x{cmp_value:X}"\n        return equation\n    else:\n        return None\n\n# \u4e3b\u51fd\u6570\uff0c\u83b7\u53d6\u6240\u6709\u7b26\u5408\u6761\u4ef6\u7684 verify \u51fd\u6570\u5e76\u63d0\u53d6\u65b9\u7a0b\nfiltered_exports = find_specific_verify_exports()\nif filtered_exports:\n    print("\u751f\u6210 verify \u51fd\u6570\u7684\u65b9\u7a0b:")\n    for func_name, func_addr in filtered_exports:\n        equation = extract_equation_from_verify(func_addr)\n        if equation:\n            print(f"{func_name}: {equation}")\n        else:\n            print(f"{func_name}: \u65e0\u6cd5\u751f\u6210\u65b9\u7a0b")\nelse:\n    print("\u672a\u627e\u5230\u7b26\u5408\u6761\u4ef6\u7684 'verify' \u51fd\u6570")\n<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
from z3 import *\n\n# \u521b\u5efa 0x37\uff0855\uff09\u4e2a\u5b57\u8282\u7684\u8f93\u5165\u53d8\u91cf\uff08\u5047\u8bbe\u4ece input[0] \u5230 input[0x36]\uff09\ninput_vars = [BitVec(f'input_{i}', 8) for i in range(0x37)]\n\n# \u521d\u59cb\u5316 Z3 Solver\nsolver = Solver()\n\n# \u6dfb\u52a0\u65b9\u7a0b\u5230 solver\nconstraints = [\n    input_vars[0x0] ^ input_vars[0x1] == 0x3,\n    input_vars[0x1] ^ input_vars[0x2] == 0x8,\n    input_vars[0x2] ^ input_vars[0x3] == 0x6,\n    input_vars[0x3] ^ input_vars[0x4] == 0x17,\n    input_vars[0x4] ^ input_vars[0x5] == 0x6,\n    input_vars[0x5] ^ input_vars[0x6] == 0x46,\n    input_vars[0x6] ^ input_vars[0x7] == 0x6,\n    input_vars[0x7] ^ input_vars[0x8] == 0x4F,\n    input_vars[0x8] ^ input_vars[0x9] == 0x8,\n    input_vars[0x9] ^ input_vars[0xA] == 0x40,\n    input_vars[0xA] ^ input_vars[0xB] == 0x5F,\n    input_vars[0xB] ^ input_vars[0xC] == 0xA,\n    input_vars[0xC] ^ input_vars[0xD] == 0x39,\n    input_vars[0xD] ^ input_vars[0xE] == 0x32,\n    input_vars[0xE] ^ input_vars[0xF] == 0x5D,\n    input_vars[0xF] ^ input_vars[0x10] == 0x54,\n    input_vars[0x10] ^ input_vars[0x11] == 0x55,\n    input_vars[0x11] ^ input_vars[0x12] == 0x57,\n    input_vars[0x12] ^ input_vars[0x13] == 0x1F,\n    input_vars[0x13] ^ input_vars[0x14] == 0x48,\n    input_vars[0x14] ^ input_vars[0x15] == 0x5F,\n    input_vars[0x15] ^ input_vars[0x16] == 0x9,\n    input_vars[0x16] ^ input_vars[0x17] == 0x38,\n    input_vars[0x17] ^ input_vars[0x18] == 0x3C,\n    input_vars[0x18] ^ input_vars[0x19] == 0x53,\n    input_vars[0x19] ^ input_vars[0x1A] == 0x54,\n    input_vars[0x1A] ^ input_vars[0x1B] == 0x57,\n    input_vars[0x1B] ^ input_vars[0x1C] == 0x6C,\n    input_vars[0x1C] ^ input_vars[0x1D] == 0x2B,\n    input_vars[0x1D] ^ input_vars[0x1E] == 0x1C,\n    input_vars[0x1E] ^ input_vars[0x1F] == 0x58,\n    input_vars[0x1F] ^ input_vars[0x20] == 0x6F,\n    input_vars[0x20] ^ input_vars[0x21] == 0x2B,\n    input_vars[0x21] ^ input_vars[0x22] == 0x1C,\n    input_vars[0x22] ^ input_vars[0x23] == 0x59,\n    input_vars[0x23] ^ input_vars[0x24] == 0x4,\n    input_vars[0x24] ^ input_vars[0x25] == 0x6A,\n    input_vars[0x25] ^ input_vars[0x26] == 0x36,\n    input_vars[0x26] ^ input_vars[0x27] == 0x5C,\n    input_vars[0x27] ^ input_vars[0x28] == 0x6A,\n    input_vars[0x28] ^ input_vars[0x29] == 0x31,\n    input_vars[0x29] ^ input_vars[0x2A] == 0x5E,\n    input_vars[0x2A] ^ input_vars[0x2B] == 0x64,\n    input_vars[0x2B] ^ input_vars[0x2C] == 0xB,\n    input_vars[0x2C] ^ input_vars[0x2D] == 0x1E,\n    input_vars[0x2D] ^ input_vars[0x2E] == 0x1E,\n    input_vars[0x2E] ^ input_vars[0x2F] == 0x32,\n    input_vars[0x2F] ^ input_vars[0x30] == 0x59,\n    input_vars[0x30] ^ input_vars[0x31] == 0x58,\n    input_vars[0x31] ^ input_vars[0x32] == 0x1B,\n    input_vars[0x32] ^ input_vars[0x33] == 0x43,\n    input_vars[0x33] ^ input_vars[0x34] == 0x46,\n    input_vars[0x34] ^ input_vars[0x35] == 0x41,\n    input_vars[0x35] ^ input_vars[0x36] == 0x4E\n]\n\n# \u5c06\u6240\u6709\u7ea6\u675f\u6dfb\u52a0\u5230 solver \u4e2d\nfor constraint in constraints:\n    solver.add(constraint)\n\n# \u6dfb\u52a0\u8f93\u5165\u7684\u8303\u56f4\u7ea6\u675f\nfor var in input_vars:\n    solver.add(var >= 0x20, var <= 0x7E)  # \u9650\u5236\u6bcf\u4e2a input \u53d8\u91cf\u5728\u53ef\u89c1 ASCII \u5b57\u7b26\u8303\u56f4\u5185\n\n# \u627e\u5230\u5e76\u5c55\u793a\u6240\u6709\u89e3\nsolutions = []\nwhile solver.check() == sat:\n    model = solver.model()\n    solution = [model[input_vars[i]].as_long() for i in range(0x37)]\n    solutions.append(solution)\n\n    # \u5c06\u89e3\u8f6c\u6362\u4e3a\u6392\u9664\u6761\u4ef6\uff0c\u786e\u4fdd\u5bfb\u627e\u4e0d\u540c\u7684\u89e3\n    solver.add(Or([input_vars[i] != solution[i] for i in range(0x37)]))\n\n# \u8f93\u51fa\u6240\u6709\u89e3\nfor i, solution in enumerate(solutions, 1):\n    readable_solution = ''.join(chr(val) for val in solution)\n    print(f"\u89e3 {i}: {readable_solution}")<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
Void<\/h2>\n
\"file\"<\/div>
\nScript\u8bed\u53e5\u4e2d\u628a\u89e3\u5bc6\u540e\u7684\u6e90\u7801\u6253\u5370\u51fa\u6765\u5373\u53ef
\n
\"file\"<\/div><\/p>\n
Yet another crackme<\/h2>\n
\"file\"<\/div>
\n\u89e3\u5305
\n
\"file\"<\/div>
\n\u968f\u4fbf\u89e3\u5bc6\u5c31\u597d\u4e86\uff1a<\/p>\n
import struct\n\n# \u7ed9\u5b9a\u7684\u6620\u5c04\u6570\u7ec4\narray = [\n    9, 10, 11, 12, 13, 32, 33, 34, 35, 36,\n    37, 38, 39, 40, 41, 42, 43, 44, 45, 46,\n    47, 48, 49, 50, 51, 52, 53, 54, 55, 56,\n    57, 58, 59, 60, 61, 62, 63, 64, 65, 66,\n    67, 68, 69, 70, 71, 72, 73, 74, 75, 76,\n    77, 78, 79, 80, 81, 82, 83, 84, 85, 86,\n    87, 88, 89, 90, 91, 92, 93, 94, 95, 96,\n    97, 98, 99, 100, 101, 102, 103, 104, 105, 106,\n    107, 108, 109, 110, 111, 112, 113, 114, 115, 116,\n    117, 118, 119, 120, 121, 122, 123, 124, 125, 126\n]\narray2 = [\n    58, 38, 66, 88, 78, 39, 80, 125, 64, 106,\n    48, 49, 98, 32, 42, 59, 126, 93, 33, 56,\n    112, 120, 60, 117, 111, 45, 87, 35, 10, 68,\n    61, 77, 11, 55, 121, 74, 107, 104, 65, 63,\n    46, 110, 34, 41, 102, 97, 81, 12, 47, 51,\n    103, 89, 115, 75, 54, 92, 90, 76, 113, 122,\n    114, 52, 72, 70, 50, 94, 91, 73, 84, 95,\n    36, 82, 124, 53, 108, 101, 9, 13, 44, 96,\n    67, 85, 116, 123, 100, 37, 43, 119, 71, 105,\n    118, 69, 99, 79, 86, 109, 62, 83, 40, 57\n]\narray3 = [16684662107559623091, 13659980421084405632, 11938144112493055466, 17764897102866017993, 11375978084890832581, 14699674141193569951]\nnum = 14627333968358193854\nnum2 = 8\n\n# \u751f\u6210\u9006\u6620\u5c04\uff1a\u4ece array2 \u5230 array\nreverse_map = {array2[i]: array[i] for i in range(len(array))}\n\n# \u9006\u5411\u6784\u9020\u5b57\u7b26\u4e32\ndef find_flag():\n    result = []\n    for target in array3:\n        # \u53cd\u5411\u5f02\u6216 num \u548c target\n        num6 = num ^ target\n        # \u5c06\u5f97\u5230\u7684 num6 \u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\n        try:\n            bytes_text = struct.pack("<Q", num6)  # \u5c0f\u7aef\u5b57\u8282\u5e8f\u89e3\u7801\n            decoded_text = "".join(chr(reverse_map.get(b, b)) for b in bytes_text if b in reverse_map)\n            result.append(decoded_text)\n        except KeyError:\n            # \u5982\u679c\u6620\u5c04\u4e0d\u5b8c\u5168\uff0c\u8df3\u8fc7\u6b64\u5b57\u7b26\uff08\u53ef\u4ee5\u8fdb\u4e00\u6b65\u8c03\u8bd5\uff09\n            continue\n\n    return ''.join(result)\n\n# \u8f93\u51fa\u53ef\u80fd\u7684 flag \u503c\nflag = find_flag()\nprint(f"Possible flag: {flag}")\n<\/code><\/pre>\n
MBTI Radar<\/h2>\n
IL2CPP\u7684\u9898\u76ee\uff0c\u6b63\u597d\u4e4b\u524d\u6709\u8fc7\u4e00\u6bb5\u65f6\u95f4\u7684\u7814\u7a76\u3002
\n
\"file\"<\/div>
\n\u7528\u6237\u8f93\u5165\u4ea7\u751fMBTI\u6570\u636e\uff0c\u9700\u8981\u4ea7\u751f\u4e00\u4e00\u5bf9\u5e94\u7684\u6570\u636e
\n\u9996\u5148\u8fd8\u662f\u5229\u7528dumper\u628a\u7b26\u53f7\u8868\u4e4b\u7c7b\u7684dump\u4e0b\u6765
\n\u6062\u590d\u7b26\u53f7\u8868\u5565\u7684\u64cd\u4f5c\u5c31\u4e0d\u7ec6\u8bf4\u4e86\u8be6\u60c5\u53ef\u4ee5\u770bhttps:\/\/bbs.kanxue.com\/thread-282821.htm
\n\u5148\u7528Dnspy\u89c2\u5bdf\uff1a
\n
\"file\"<\/div>
\n\u53ef\u4ee5\u53d1\u73b0\u903b\u8f91\u4e0d\u591a\uff0c\u5206\u6790\u8d77\u6765\u96be\u5ea6\u4e0d\u4f1a\u5f88\u5927
\n\u6839\u636eIl2cpp\u7684\u7279\u6027\uff0c\u6211\u4eec\u77e5\u9053\u65b9\u6cd5\u4f20\u5165\u7684a1\u5176\u5b9e\u5c31\u662f\u8fd9\u4e2a\u7c7b\u91cc\u9762\u4e00\u4e9b\u6210\u5458\u53d8\u91cf\u7ec4\u6210\u7684\u7ed3\u6784\u4f53\u4e4b\u7c7b\u7684\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u504f\u79fb\u6765\u63a8\u65ad\u5230\u5e95\u662f\u4e2a\u4ec0\u4e48\u7c7b\uff1a
\n
\"file\"<\/div>
\n\u50cf\u8fd9\u4e2acharList\u5c31\u662fa1+0x30:
\n\u4e8e\u662f\u6211\u4eec\u5728GameBehaviour__OnClick\u4e2d\u5c31\u53ef\u4ee5\u53d1\u73b0\u5982\u4e0b\u903b\u8f91\u4e86\uff1a<\/p>\n
\"file\"<\/div>
\n\u9996\u5148\u770b\u5230\u504f\u79fb0x48\u5c31\u662fInputName\uff0c\u5728onclick\u4e2d\u67e5\u627e
\n\u4e0d\u96be\u53d1\u73b0\uff1a<\/p>\n
\"file\"<\/div>
\n\u8fd9\u4e00\u6bb5\u5c31\u662f\u83b7\u53d6\u4e86onClick\u548ccharList\uff0c\u505a\u4e00\u4e9b\u57fa\u7840\u7684\u5bf9\u8c61\u7684\u5904\u7406
\n\u4e0b\u9762\u5c31\u662f\u5173\u952e\u903b\u8f91\u4e86\uff1a
\n
\"file\"<\/div><\/p>\n
\u8c03\u8bd5\u53d1\u73b0\uff0c\u8fd9\u91cc\u5229\u7528\u6211\u4eec\u8f93\u5165\u7684\u540d\u5b57\u5728table\u4e2d\u53d6\u4e86\u7d22\u5f15\uff0c\u7136\u540e\u5bf9\u7d22\u5f15\u505a\u4e86\u4e00\u4e2a\u4f3c\u4e4e\u662f0x24\u8fdb\u5236\u7684\u64cd\u4f5c\uff0c\u50a8\u5b58\u5230\u4e00\u4e2a\u503c\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230UnityEngine_Random__InitState\u8fd9\u4e2a\u662fUnity\u7684\u4e00\u4e2a\u8bbe\u7f6e\u968f\u673a\u4e2d\u7684\u7684\u65b9\u6cd5\uff0c\u7c7b\u4f3c\u4e8esrand\u3002
\n\u63a5\u4e0b\u6765\u8fc7\u4e86\u4e00\u4e9b\u57fa\u7840\u64cd\u4f5c\u5c31\u53ef\u4ee5\u770b\u5230\u4e0b\u4e00\u4e2a\u5173\u952e\u903b\u8f91\u4e86\uff1a<\/p>\n
\"file\"<\/div>
\n\u8fd9\u91cc\u76840xc\u5176\u5b9e\u5c31\u662f\u5bf9\u5e94\u9898\u76ee\u768412\u4e2aMBTI
\n\u90a3\u4e48MBTI\u7684\u751f\u6210\u903b\u8f91\u80af\u5b9a\u5728\u91cc\u9762
\n
\"file\"<\/div>
\n\u53d1\u73b0\u5c31\u662f\u5229\u7528seed\u4ea7\u751f\u7684value\u505a\u8fd0\u7b97\u4e86
\n
\"file\"<\/div>
\n\u5230\u8fd9\u91cc\u6bd4\u8f83\u5c31\u5b8c\u4e8b\u4e86\u3002
\n\u6211\u4eec\u65b0\u5efa\u4e00\u4e2aUnity\u9879\u76ee
\n\u7f16\u8f91->\u8d44\u6e90->\u521b\u5efa\u4e00\u4e2aC#\u811a\u672c
\n\u7136\u540e\u70b9\u51fb\u6211\u4eec\u7684Main Camera\uff0c\u7ed9Main Camera\u6dfb\u52a0\u4e00\u4e2a\u7ec4\u4ef6
\n
\"file\"<\/div>
\n\u6dfb\u52a0\u6211\u4eec\u7684\u811a\u672c\u8fdb\u53bb\uff0c\u5c31\u53ef\u4ee5\u6267\u884c\u6211\u4eec\u7684\u811a\u672c\u4e86\uff0c\u6b63\u597d\u4e00\u4e2a\u5f88\u5de7\u7684\u4e8b\u60c5\u53d1\u751f\u4e86\uff0c\u4e00\u5f00\u59cb\u968f\u4fbf\u8f93\u5165\u4e86\u4e00\u4e2a1\uff0c\u7136\u540e\u7a0b\u5e8f\u5c45\u7136\u6b63\u786e\u4e86
\n
\"file\"<\/div>
\n\u8fd9\u6837\u6b63\u597d\u7ed9\u6211\u4eec\u63d0\u4f9b\u4e86\u4e00\u4e2a\u6d4b\u8bd5\u601d\u8def\u7684\u7528\u4f8b\uff0c1\u7684\u7d22\u5f15\u6b63\u597d\u5c31\u662f1\uff0c\u6211\u4eec\u5199\u811a\u672c\u9a8c\u8bc1\u4e00\u4e0b
\n\u8fd9\u91cc\u811a\u672c\u9700\u8981\u6ce8\u610f\uff1a
\n
\"file\"<\/div>
\n\u7ee7\u627f\u7684\u7c7b\u5f97\u662fMonoBehavior<\/p>\n
using UnityEngine;\n\npublic class NewBehaviourScript: MonoBehaviour\n{\n    void Start()\n    {\n        GenerateTypes(12); \/\/ \u751f\u6210\u5e76\u8f93\u51fa12\u4e2a\u5bf9\u5e94\u7c7b\u578b\n    }\n\n    void GenerateTypes(int count)\n    {\n        int seed = 42; \/\/ \u8bbe\u7f6e\u79cd\u5b50\u4ee5\u786e\u4fdd\u6bcf\u6b21\u751f\u6210\u76f8\u540c\u7684\u968f\u673a\u5e8f\u5217\n        Random.InitState(seed);\n\n        for (int i = 0; i < count; i++)\n        {\n            float randomValue = Random.value;\n            float v7 = randomValue * 201.0f;\n            string v8;\n\n            \/\/ \u6839\u636e\u63d0\u4f9b\u7684\u6761\u4ef6\uff0c\u5224\u65ad\u5bf9\u5e94\u7684\u7c7b\u578b\n            if (v7 < 54.0f)\n            {\n                if (v7 < 33.0f)\n                {\n                    if (v7 < 12.0f)\n                    {\n                        v8 = v7 >= 3.0f ? "INFP" : "NIFJ";\n                    }\n                    else\n                    {\n                        v8 = v7 >= 28.0f ? "ENFJ" : "ENFP";\n                    }\n                }\n                else if (v7 < 44.0f)\n                {\n                    v8 = v7 >= 37.0f ? "INTP" : "INTJ";\n                }\n                else\n                {\n                    v8 = v7 >= 50.0f ? "ENTJ" : "ENTP";\n                }\n            }\n            else if (v7 < 147.0f)\n            {\n                if (v7 < 105.0f)\n                {\n                    v8 = v7 >= 77.0f ? "ISFJ" : "ISTJ";\n                }\n                else\n                {\n                    v8 = v7 >= 122.0f ? "ESFJ" : "ESTJ";\n                }\n            }\n            else if (v7 < 176.0f)\n            {\n                v8 = v7 >= 158.0f ? "ISFP" : "ISTP";\n            }\n            else\n            {\n                v8 = v7 >= 184.0f ? "ESFP" : "ESTP";\n            }\n\n            Debug.Log(v8); \/\/ \u8f93\u51fa\u7c7b\u578b\u7ed3\u679c\n        }\n    }\n}\n<\/code><\/pre>\n
\"file\"<\/div>
\n\u5bf9\u5e94\u4e0a\u4e86\uff0c\u6211\u4eec\u5c31\u76f4\u63a5\u5f00\u59cb\u7206\u7834\u4e86<\/p>\n
using System.Collections;\nusing System.Collections.Generic;\nusing UnityEngine;\n\npublic class NewBehaviourScript : MonoBehaviour\n{\n    void Start()\n    {\n        FindMatchingSeed();\n    }\n\n    void FindMatchingSeed()\n    {\n        \/\/ \u5b9a\u4e49\u76ee\u6807 MBTI \u5e8f\u5217\n        string[] targetSequence = { "ESFJ", "ESFJ", "INFP", "ESFJ", "ESFP", "ISFJ", "ESTJ", "ESFJ", "ESTJ", "ISFJ", "ISFP", "ISFJ" };\n\n        \/\/ \u679a\u4e3e\u6240\u6709 a1, a2, a3, a4 \u548c a5 \u7684\u7ec4\u5408\n        for (int a1 = 0; a1 < 36; a1++)\n        {\n\n            for (int a2 = 0; a2 < 36; a2++)\n            {\n                for (int a3 = 0; a3 < 36; a3++)\n                {\n                    for (int a4 = 0; a4 < 36; a4++)\n                    {\n                        for (int a5 = 0; a5 < 36; a5++)\n                        {\n                            for(int a6 = 0;a6 < 36; a6++)\n                            {\n                                int seed = a1 + 0x24 * a2 + 0x24 * 0x24 * a3 + 0x24 * 0x24 * 0x24 * a4 + 0x24 * 0x24 * 0x24 * 0x24 * a5 + 0x24 * 0x24 * 0x24 * 0x24 * 0x24*a6 ;\n\n                                if (CheckMBTISeries(seed, targetSequence))\n                                {\n                                    Debug.Log($"Match found! a1: {a1}, a2: {a2}, a3: {a3}, a4: {a4}, a5: {a5}\uff0ca6:{a6}, seed: {seed}");\n                                    return; \/\/ \u627e\u5230\u5339\u914d\u9879\u540e\u7ec8\u6b62\u641c\u7d22\n                                }\n                            }\n\n                        }\n                    }\n                }\n                Debug.Log(a2);\n            }\n        }\n\n        Debug.Log("No matching seed found.");\n    }\n\n    bool CheckMBTISeries(int seed, string[] targetSequence)\n    {\n        string[] generatedSequence = new string[12];\n\n        \/\/ \u4f7f\u7528\u751f\u6210\u7684\u79cd\u5b50\u521d\u59cb\u5316\u968f\u673a\u6570\u751f\u6210\u5668\n        Random.InitState(seed);\n\n        \/\/ \u751f\u6210 12 \u4e2a MBTI \u7c7b\u578b\n        for (int i = 0; i < 12; i++)\n        {\n            float randomValue = Random.value;\n            float v7 = randomValue * 201.0f;\n            generatedSequence[i] = DetermineMBTI(v7);\n        }\n\n        \/\/ \u68c0\u67e5\u751f\u6210\u7684\u5e8f\u5217\u662f\u5426\u4e0e\u76ee\u6807\u5e8f\u5217\u5339\u914d\n        for (int i = 0; i < 12; i++)\n        {\n            if (generatedSequence[i] != targetSequence[i])\n                return false; \/\/ \u4e00\u65e6\u6709\u4e0d\u5339\u914d\u7684\u60c5\u51b5\uff0c\u8fd4\u56de false\n        }\n\n        return true; \/\/ \u6240\u6709\u503c\u90fd\u5339\u914d\uff0c\u8fd4\u56de true\n    }\n\n    string DetermineMBTI(float v7)\n    {\n        \/\/ \u6839\u636e\u6761\u4ef6\u751f\u6210 MBTI \u7c7b\u578b\n        if (v7 < 54.0f)\n        {\n            if (v7 < 33.0f)\n            {\n                if (v7 < 12.0f)\n                {\n                    return v7 >= 3.0f ? "INFP" : "NIFJ";\n                }\n                else\n                {\n                    return v7 >= 28.0f ? "ENFJ" : "ENFP";\n                }\n            }\n            else if (v7 < 44.0f)\n            {\n                return v7 >= 37.0f ? "INTP" : "INTJ";\n            }\n            else\n            {\n                return v7 >= 50.0f ? "ENTJ" : "ENTP";\n            }\n        }\n        else if (v7 < 147.0f)\n        {\n            if (v7 < 105.0f)\n            {\n                return v7 >= 77.0f ? "ISFJ" : "ISTJ";\n            }\n            else\n            {\n                return v7 >= 122.0f ? "ESFJ" : "ESTJ";\n            }\n        }\n        else if (v7 < 176.0f)\n        {\n            return v7 >= 158.0f ? "ISFP" : "ISTP";\n        }\n        else\n        {\n            return v7 >= 184.0f ? "ESFP" : "ESTP";\n        }\n    }\n}<\/code><\/pre>\n
\u8fd9\u91cc\u6211\u53ea\u5199\u4e86\u516d\u4f4d\u6570\u636e\u7684\u7206\u7834\uff0c\u9700\u8981\u8dd1\u5927\u6982\u534a\u4e2a\u5c0f\u65f6\uff0c\u524d\u97621-5\u4e2a\u957f\u5ea6\u7684\u540d\u5b57\u57fa\u672c\u90fd\u5728\u4e00\u5206\u949f\u5185\uff0c\u4e94\u4e2a\u957f\u5ea6\u9700\u8981\u4e00\u5206\u949f
\n
\"file\"<\/div>
\n\u5199\u4e2a\u811a\u672c\u6574\u7406\u7ed3\u679c\u5c31\u597d\u4e86<\/p>\n
table = "0123456789abcdefghijklmnopqrstuvwxyz"\nindex1 = [[1], [4,22],[24,23,3],[5,29,4,27],[30,23,13,3,27],[12,4,14,1,30,22]]\n\nfor i in index1:\n    for j in i:\n        print(table[j], end='')\n    print("",end="_")\n<\/code><\/pre>\n
\"file\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
HKCERT CTF \u90e8\u5206Re\u9898\u89e3 \u95f2\u6765\u65e0\u4e8b\uff0c\u52fe\u680f\u89e3\u9898\uff0c\u770b\u4e86\u770b\u9999\u6e2f\u7684\u8fd9\u4e2a\u7f51\u5b89\u593a\u65d7\u8d5b\uff0c\u611f\u89c9\u9898\u76ee\u8d28\u91cf\u90fd\u633a\u9ad8\u7684\uff0c\u5199\u4e00 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1137","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=1137"}],"version-history":[{"count":4,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1137\/revisions"}],"predecessor-version":[{"id":1169,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1137\/revisions\/1169"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=1137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=1137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=1137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}