{"id":361,"date":"2023-02-02T16:52:10","date_gmt":"2023-02-02T08:52:10","guid":{"rendered":"https:\/\/shangwendada.co\/?p=361"},"modified":"2023-02-02T16:52:10","modified_gmt":"2023-02-02T08:52:10","slug":"reversehgamekunmusic","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2023\/02\/02\/reversehgamekunmusic\/","title":{"rendered":"[Reverse][HGAME]kunmusic"},"content":{"rendered":"

\u5206\u6790<\/h1>\n

dll\u6587\u4ef6\u68c0\u67e5\u4e4b\u540e\u53d1\u73b0\u662f.net
\n\u76f4\u63a5\u4f7f\u7528dnspy\u53cd\u7f16\u8bd1
\n

\"file\"<\/div>
\n\u53d1\u73b0\u8fd9\u91cc\u5728\u5bf9\u8fd9\u4e2adata\u505a\u4ec0\u4e48\u5904\u7406
\n\u4e0b\u65ad\u70b9\u52a8\u6001\u8c03\u8bd5\u67e5\u770b\u5185\u5b58
\n
\"file\"<\/div>
\n\u53d1\u73b0mz\u6587\u4ef6\u5934,\u5c06\u6570\u636edump\u51fa\u6765\uff0c\u6784\u6210\u4e00\u4e2a\u65b0\u7684dll\u6587\u4ef6\u518d\u4f7f\u7528dnspy\u53cd\u7f16\u8bd1
\n
\"file\"<\/div>
\nmusic\u7c7b\u4e2d\u53d1\u73b0\u4e86\u7ea6\u675f\u6c42\u89e3\u7684\u903b\u8f91\uff0c\u63ed\u79d8\u4e4b\u540e\u5728\u548cenc\u5f02\u6216\u5c31\u53ef\u4ee5\u5f97\u5230flag<\/p>\n

EXP<\/h1>\n

\u89e3\u5bc6key<\/h2>\n
from z3 import*\nflag=[BitVec("num[%d]"%i,32) for i in range(13)]\ns=Solver()\ns.add(flag[0] + 52296 + flag[1] - 26211 + flag[2] - 11754 + (flag[3] ^ 41236) + flag[4] * 63747 + flag[5] - 52714 + flag[6] - 10512 + flag[7] * 12972 + flag[8] + 45505 + flag[9] - 21713 + flag[10] - 59122 + flag[11] - 12840 + (flag[12] ^ 21087) == 12702282)\ns.add(flag[0] - 25228 + (flag[1] ^ 20699) + (flag[2] ^ 8158) + flag[3] - 65307 + flag[4] * 30701 + flag[5] * 47555 + flag[6] - 2557 + (flag[7] ^ 49055) + flag[8] - 7992 + (flag[9] ^ 57465) + (flag[10] ^ 57426) + flag[11] + 13299 + flag[12] - 50966 == 9946829 )\ns.add(flag[0] - 64801 + flag[1] - 60698 + flag[2] - 40853 + flag[3] - 54907 + flag[4] + 29882 + (flag[5] ^ 13574) + (flag[6] ^ 21310) + flag[7] + 47366 + flag[8] + 41784 + (flag[9] ^ 53690) + flag[10] * 58436 + flag[11] * 15590 + flag[12] + 58225 == 2372055 )\ns.add(flag[0] + 61538 + flag[1] - 17121 + flag[2] - 58124 + flag[3] + 8186 + flag[4] + 21253 + flag[5] - 38524 + flag[6] - 48323 + flag[7] - 20556 + flag[8] * 56056 + flag[9] + 18568 + flag[10] + 12995 + (flag[11] ^ 39260) + flag[12] + 25329 == 6732474 )\ns.add(flag[0] - 42567 + flag[1] - 17743 + flag[2] * 47827 + flag[3] - 10246 + (flag[4] ^ 16284) + flag[5] + 39390 + flag[6] * 11803 + flag[7] * 60332 + (flag[8] ^ 18491) + (flag[9] ^ 4795) + flag[10] - 25636 + flag[11] - 16780 + flag[12] - 62345 == 14020739)\ns.add(flag[0] - 10968 + flag[1] - 31780 + (flag[2] ^ 31857) + flag[3] - 61983 + flag[4] * 31048 + flag[5] * 20189 + flag[6] + 12337 + flag[7] * 25945 + (flag[8] ^ 7064) + flag[9] - 25369 + flag[10] - 54893 + flag[11] * 59949 + (flag[12] ^ 12441) == 14434062)\ns.add(flag[0] + 16689 + flag[1] - 10279 + flag[2] - 32918 + flag[3] - 57155 + flag[4] * 26571 + flag[5] * 15086 + (flag[6] ^ 22986) + (flag[7] ^ 23349) + (flag[8] ^ 16381) + (flag[9] ^ 23173) + flag[10] - 40224 + flag[11] + 31751 + flag[12] * 8421 == 7433598 )\ns.add(flag[0] + 28740 + flag[1] - 64696 + flag[2] + 60470 + flag[3] - 14752 + (flag[4] ^ 1287) + (flag[5] ^ 35272) + flag[6] + 49467 + flag[7] - 33788 + flag[8] + 20606 + (flag[9] ^ 44874) + flag[10] * 19764 + flag[11] + 48342 + flag[12] * 56511 == 7989404 )\ns.add((flag[0] ^ 28978) + flag[1] + 23120 + flag[2] + 22802 + flag[3] * 31533 + (flag[4] ^ 39287) + flag[5] - 48576 + (flag[6] ^ 28542) + flag[7] - 43265 + flag[8] + 22365 + flag[9] + 61108 + flag[10] * 2823 + flag[11] - 30343 + flag[12] + 14780 == 3504803 )\ns.add(flag[0] * 22466 + (flag[1] ^ 55999) + flag[2] - 53658 + (flag[3] ^ 47160) + (flag[4] ^ 12511) + flag[5] * 59807 + flag[6] + 46242 + flag[7] + 3052 + (flag[8] ^ 25279) + flag[9] + 30202 + flag[10] * 22698 + flag[11] + 33480 + (flag[12] ^ 16757) == 11003580 )\ns.add(flag[0] * 57492 + (flag[1] ^ 13421) + flag[2] - 13941 + (flag[3] ^ 48092) + flag[4] * 38310 + flag[5] + 9884 + flag[6] - 45500 + flag[7] - 19233 + flag[8] + 58274 + flag[9] + 36175 + (flag[10] ^ 18568) + flag[11] * 49694 + (flag[12] ^ 9473) == 25546210 )\ns.add(flag[0] - 23355 + flag[1] * 50164 + (flag[2] ^ 34618) + flag[3] + 52703 + flag[4] + 36245 + flag[5] * 46648 + (flag[6] ^ 4858) + (flag[7] ^ 41846) + flag[8] * 27122 + (flag[9] ^ 42058) + flag[10] * 15676 + flag[11] - 31863 + flag[12] + 62510 == 11333836 )\ns.add(flag[0] * 30523 + (flag[1] ^ 7990) + flag[2] + 39058 + flag[3] * 57549 + (flag[4] ^ 53440) + flag[5] * 4275 + flag[6] - 48863 + (flag[7] ^ 55436) + (flag[8] ^ 2624) + (flag[9] ^ 13652) + flag[10] + 62231 + flag[11] + 19456 + flag[12] - 13195 == 13863722)\n\nprint(s.check())\nfor i in flag:\n    print(s.model()[i].as_long(),end=",")\n<\/code><\/pre>\n
\u89e3\u5bc6flag<\/h2>\n
#include<iostream>\nusing namespace std;\nint enc[] = {\n    132,\n    47,\n    180,\n    7,\n    216,\n    45,\n    68,\n    6,\n    39,\n    246,\n    124,\n    2,\n    243,\n    137,\n    58,\n    172,\n    53,\n    200,\n    99,\n    91,\n    83,\n    13,\n    171,\n    80,\n    108,\n    235,\n    179,\n    58,\n    176,\n    28,\n    216,\n    36,\n    11,\n    80,\n    39,\n    162,\n    97,\n    58,\n    236,\n    130,\n    123,\n    176,\n    24,\n    212,\n    56,\n    89,\n    72\n};\nlong long key[13]={2147483884,221970504,2310176981,106,189,86,1745846334,53,120,1090715847,2147483663,2147483741,1073741957};\nint main ()\n{\n    for (int i  = 0 ; i < 47 ; i ++ )\n    {\n        printf("%c",key[i%13]^enc[i]);\n    }\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u5206\u6790 dll\u6587\u4ef6\u68c0\u67e5\u4e4b\u540e\u53d1\u73b0\u662f.net \u76f4\u63a5\u4f7f\u7528dnspy\u53cd\u7f16\u8bd1 \u53d1\u73b0\u8fd9\u91cc\u5728\u5bf9\u8fd9\u4e2adata\u505a\u4ec0\u4e48\u5904\u7406 \u4e0b\u65ad\u70b9\u52a8 […]<\/p>\n","protected":false},"author":1,"featured_media":199,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-361","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=361"}],"version-history":[{"count":1,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/361\/revisions"}],"predecessor-version":[{"id":365,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/361\/revisions\/365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/199"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}