{"id":695,"date":"2023-11-29T21:22:18","date_gmt":"2023-11-29T13:22:18","guid":{"rendered":"https:\/\/shangwendada.top\/?p=695"},"modified":"2023-11-29T21:22:41","modified_gmt":"2023-11-29T13:22:41","slug":"reverseisctf-writeup","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2023\/11\/29\/reverseisctf-writeup\/","title":{"rendered":"[Reverse]ISCTF-WriteUP"},"content":{"rendered":"

crakme[Shangwendada ,wakappxc done]<\/h3>\n

\u6cd51<\/h4>\n

\u5176\u5b9e\u5e94\u8be5\u672c\u6765\u60f3\u8003\u7684\u662fupx\u58f3\uff0c\u4f46\u662f\u4f3c\u4e4e\u51fa\u9898\u4eba\u6ca1\u60f3\u5230\u53ef\u4ee5\u76f4\u63a5\u8fd0\u884c\u7684\u95ee\u9898….<\/p>\n

\"file\"<\/div><\/p>\n

\u6cd52<\/h4>\n

\u9996\u5148\u67e5\u58f3<\/p>\n

\"file\"<\/div><\/p>\n

\u8131\u58f3\u53d1\u73b0\u8131\u4e0d\u4e86 \u653e\u5165010Editor\u67e5\u770b\u5e76\u6539\u7279\u5f81\u7801<\/p>\n

\"file\"<\/div><\/p>\n

\u8f7d\u5165ida\u91cc\u9762<\/p>\n

\"file\"<\/div><\/p>\n

\u9a8c\u8bc1flag\u6b63\u786e<\/p>\n

mfx_re[Shangwendada done]<\/h3>\n

\"file\"<\/div><\/p>\n

\u8fd9\u73a9\u610f\u7785\u7740\u771f\u719f\u6089<\/p>\n

\"file\"<\/div><\/p>\n

UPX\u8001\u54e5\uff0c\u6539\u4e86\u7279\u5f81\u7801<\/p>\n

\u4fee\u590d\u6587\u4ef6<\/p>\n

file_path = 'mfx_re'  # \u66ff\u6362\u6210\u4f60\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u8def\u5f84\n\nwith open(file_path, 'rb') as file:\n    content = file.read()\n\n# \u5c06\u6240\u6709\u7684 "mfx" \u66ff\u6362\u4e3a "upx"\uff0c\u4e0d\u533a\u5206\u5927\u5c0f\u5199\ncontent = content.replace(b'upx', b'mfx')\ncontent = content.replace(b'UPX', b'MFX')\n\n# \u5c06\u4fee\u6539\u540e\u7684\u5185\u5bb9\u5199\u56de\u6587\u4ef6\nwith open(file_path, 'wb') as file:\n    file.write(content)\n\nprint("\u66ff\u6362\u5b8c\u6210\uff01")<\/code><\/pre>\n
\u518dupx\u8131\u58f3<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  size_t v3; \/\/ rbx\n  int v5; \/\/ [rsp+0h] [rbp-A0h] BYREF\n  int i; \/\/ [rsp+4h] [rbp-9Ch]\n  int v7; \/\/ [rsp+8h] [rbp-98h]\n  int v8; \/\/ [rsp+Ch] [rbp-94h]\n  char s[8]; \/\/ [rsp+10h] [rbp-90h] BYREF\n  __int64 v10; \/\/ [rsp+18h] [rbp-88h]\n  __int64 v11; \/\/ [rsp+20h] [rbp-80h]\n  __int64 v12; \/\/ [rsp+28h] [rbp-78h]\n  __int64 v13; \/\/ [rsp+30h] [rbp-70h]\n  __int64 v14; \/\/ [rsp+38h] [rbp-68h]\n  __int16 v15; \/\/ [rsp+40h] [rbp-60h]\n  char s2[44]; \/\/ [rsp+50h] [rbp-50h] BYREF\n  int v17; \/\/ [rsp+7Ch] [rbp-24h]\n  __int16 v18; \/\/ [rsp+80h] [rbp-20h]\n  unsigned __int64 v19; \/\/ [rsp+88h] [rbp-18h]\n\n  v19 = __readfsqword(0x28u);\n  setbuf((FILE *)&dword_0, 0LL);\n  setbuf((FILE *)&dword_0, 0LL);\n  puts("Welcome To MFx_Reverse!");\n  puts("I have two questions. You need guess the flag from the first question.");\n  v7 = 1;\n  v8 = 2;\n  printf("a=%d, b=%d\\n", 1LL, 2LL);\n  puts("The first question is a + b = ?");\n  printf("a + b = ");\n  v5 = 0;\n  scanf("%d", &v5);\n  if ( v5 == 3 )\n    puts("Good!");\n  else\n    puts("Wrong!");\n  puts("The second question is flag = ?");\n  printf("flag = ");\n  *(_QWORD *)s = 0LL;\n  v10 = 0LL;\n  v11 = 0LL;\n  v12 = 0LL;\n  v13 = 0LL;\n  v14 = 0LL;\n  v15 = 0;\n  scanf("%s", s);\n  strcpy(s2, "HRBSEz0627c4ee,`026,367a,`2b\/,03\/bcba5ea7\/|");\n  v17 = 0;\n  v18 = 0;\n  for ( i = 0; ; ++i )\n  {\n    v3 = i;\n    if ( v3 >= strlen(s) )\n      break;\n    --s[i];\n  }\n  strcmp(s, s2);\n  puts("Now you know your flag!");\n  return 0;\n}<\/code><\/pre>\n
\u5bc6\u6587\u6bcf\u4e00\u4f4d+1\u5c31\u6709flag<\/p>\n
WHRER[Shangwendada done]<\/h3>\n
AddVectoredExceptionHandler\u51fd\u6570\uff1a<\/h4>\n
\"file\"<\/div><\/p>\n
\u8bed\u6cd5<\/h5>\n
C++\u590d\u5236<\/p>\n
PVOID AddVectoredExceptionHandler(\n  ULONG                       First,\n  PVECTORED_EXCEPTION_HANDLER Handler\n);<\/code><\/pre>\n
\u53c2\u6570<\/h5>\n
First<\/code><\/h6>\n
\u5904\u7406\u7a0b\u5e8f\u7684\u8c03\u7528\u987a\u5e8f\u3002 \u5982\u679c\u53c2\u6570\u4e3a\u975e\u96f6\u503c\uff0c\u5219\u5904\u7406\u7a0b\u5e8f\u662f\u8981\u8c03\u7528\u7684\u7b2c\u4e00\u4e2a\u5904\u7406\u7a0b\u5e8f\u3002 \u5982\u679c \u53c2\u6570\u4e3a\u96f6\uff0c\u5219\u5904\u7406\u7a0b\u5e8f\u662f\u6700\u540e\u4e00\u4e2a\u8981\u8c03\u7528\u7684\u5904\u7406\u7a0b\u5e8f\u3002<\/p>\n
Handler<\/code><\/h6>\n
\u6307\u5411\u8981\u8c03\u7528\u7684\u5904\u7406\u7a0b\u5e8f\u7684\u6307\u9488\u3002 \u6709\u5173\u8be6\u7ec6\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605 VectoredHandler<\/a>\u3002<\/p>\n
\u89e3\u6790<\/h4>\n
AddVectoredExceptionHandler\u51fd\u6570\u52a0\u8f7d\u4e86\u4e24\u4e2a\u51fd\u6570<\/p>\n
\"file\"<\/div><\/p>\n
\"file\"<\/div><\/p>\n
\u5206\u522b\u662fRC4,\u4e0eTEA.\u90fd\u5b58\u5728\u9b54\u6539\u3002<\/p>\n
\u7a0b\u5e8f\u6267\u884c\u6d41\u4e3a->RC4->TEA->\u5750\u6807\u7cfb\u5224\u65ad<\/p>\n
\u90a3\u4e48\u89e3\u5bc6\u90e8\u5206\u9996\u5148\u4e3a\u5750\u6807\u7cfb\u5224\u65ad<\/p>\n
\"file\"<\/div><\/p>\n
\u5728\u6b64\u5904\u5750\u6807\u7cfb\u5224\u65ad<\/p>\n
\"file\"<\/div><\/p>\n
\u4fdd\u8bc1\u5750\u6807\u5411\u4e0b\u9012\u589e\uff0c\u540c\u65f6\u653e\u5165byte_434d3c\u4e2d\uff0c\u6bd4\u8f83byte_41C0A0\uff0c\u90a3\u4e48byte_41C0A0\u4fdd\u5b58\u7684\u5c31\u662f\u6211\u4eec\u7684\u5750\u6807<\/p>\n
\u4f7f\u7528idapython\u626b\u63cf\u4e00\u904d<\/p>\n
addr = 0x41C0A0\nfor i in range(0,300):\n    for j in range(0,300):\n        if(get_wide_byte(addr+i*300+j)==1):\n            print(i,end=',')\n            print(j,end=',')<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
\u8fd9\u5c31\u662f\u6211\u4eec\u7684\u5750\u6807\u4e86\uff0c\u7136\u540e\u5c06\u5176\u5f02\u6216\u56de\u53bb<\/p>\n
\u5c31\u80fd\u5f97\u5230\u5230tea\u52a0\u5bc6\u91cc\u9762\u7684\u5185\u5bb9<\/p>\n
\"file\"<\/div><\/p>\n
TEA\u7684\u52a0\u5bc6\u6d41\u7a0b\u4e3a\u52a0\u5bc6\u4e00\u53f7\u4f4d\u548c\u4e8c\u53f7\u4f4d\u65f6\u53d6\u4e09\u53f7\u4f4d\uff0c\u6700\u540e\u4e24\u4f4d\u53d6\u7b2c\u4e00\u4f4d\u4f5c\u4e3akey\u3002<\/p>\n
\u90a3\u4e48\u4f1a\u53d1\u73b0\u5f53\u52a0\u5bc678\u4f4d\u65f6\uff0c\u4f7f\u7528\u7684key\u662f\u52a0\u5bc6\u540e\u76841\u4f4d\uff0c\u56e0\u6b64\u6211\u4eec\u9700\u8981\u5012\u5e8f\u89e3\u5bc6\u3002<\/p>\n
\"file\"<\/div><\/p>\n
void tea_decrypt(unsigned int *a1, unsigned char *v9, int index) {\n        unsigned int sum = 0;\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                sum -= 559038737;\n                \/\/printf("SUM:%X\\n", sum);\n        }\n        printf("SUM:%X\\n", sum);\n\/\/\n\/\/        printf("%X\\n", a1[0]);\n\/\/        printf("%X\\n", v9[0]);\n        unsigned int v5 = a1[0], v4 = a1[1];\n        for (int j = 0 ; j < 8 ; j ++ ) {\n                printf("%X,", a1[j - index]);\n        }\n        printf("\\n%X,%X,%X,%X\\n", v9[(4 * index + 8) % 32 + 0], v9[(4 * index + 8) % 32 + 1], v9[(4 * index + 8) % 32 + 2], v9[(4 * index + 8) % 32 + 3]);\n\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                v4 -= (v9[(4 * index + 8) % 32 + 3] + (v5 >> 5)) ^ (sum + v5) ^ (v9[(4 * index + 8) % 32 + 2] + 16 * v5);\n                v5 -= (v9[(4 * index + 8) % 32 + 1] + (v4 >> 5)) ^ (sum + v4) ^ (v9[(4 * index + 8) % 32] + 16 * v4);\n                sum += 559038737;\n        }\n\n        a1[0] = v5;\n        a1[1] = v4;\n}\nfor (int i = 6 ; i >= 0 ; i -= 2 ) {\n    tea_decrypt((unsigned int *)(flag + 4 * i), flag, i);\n}<\/code><\/pre>\n
\u7136\u540e\u662fRC4\uff1a<\/p>\n
\u65ad\u70b9\u8c03\u51fakeystream\uff0c\u7136\u540e\u8fd8\u539f\u6700\u540e\u4e00\u4e2a\u51fd\u6570\u4e00\u628a\u68ad<\/p>\n
unsigned char keystream[] = {\n        0xFB, 0x95, 0x14, 0x16, 0x23, 0xCA, 0x8E, 0x3F, 0xB3, 0xB2,\n        0x94, 0x54, 0x25, 0xA2, 0xF1, 0xDD, 0x4F, 0xF4, 0x5B, 0xC0,\n        0xF4, 0xDA, 0xD9, 0x20, 0x0F, 0x83, 0xAA, 0xCF, 0x99, 0xAB,\n        0x52, 0x10, 0x98, 0xF6, 0x7A, 0xDE, 0xD3, 0x81, 0x70, 0xE0,\n        0x59, 0x5A, 0x10, 0x62, 0x3D, 0xA0, 0x58, 0x91, 0xFA, 0x4D,\n        0x15, 0x69, 0xE3, 0x1F, 0xD7, 0x66, 0x99, 0x41, 0x29, 0x15,\n        0x62, 0x82, 0x93, 0xB1, 0xE1, 0x1D, 0x61, 0x6F, 0x8F, 0x49,\n        0x11, 0x71, 0xA1, 0x27, 0xE3, 0x55, 0xF2, 0x28, 0x49, 0x6D,\n        0x27, 0x9A, 0x7B, 0x5B, 0xA3, 0x27, 0x9A, 0x35, 0x9E, 0x72,\n        0xC8, 0x9E, 0x1A, 0x5C, 0xF1, 0x54, 0x73, 0xB4, 0xF6, 0xBF,\n        0x09, 0xE8, 0x75, 0xB9, 0x3B, 0x32, 0x80, 0xD1, 0xFB, 0x94,\n        0x57, 0x2E, 0xCE, 0xC2, 0x24, 0xCE, 0xDE, 0xED, 0x74, 0xB9,\n        0x4E, 0xFA, 0x5D, 0x65, 0xD8, 0x3D, 0xA0, 0x3B, 0x79, 0x40,\n        0x7D, 0xF7, 0x27, 0x98, 0x50, 0xFF, 0xBE, 0x0E, 0x8F, 0x44,\n        0x6B, 0x33, 0x2E, 0x8D, 0x8D, 0x2D, 0x4D, 0x10, 0xC6, 0x93,\n        0xCE, 0x2F, 0xA3, 0xE9, 0x04, 0x4D, 0xD5, 0xB5, 0xCF, 0x10,\n        0x33, 0xF7, 0xEB, 0x17, 0xEF, 0xD2, 0x34, 0x6E, 0xD9, 0x5A,\n        0x82, 0x0E, 0x22, 0x29, 0x31, 0x7D, 0x52, 0xAD, 0x47, 0x59,\n        0x08, 0xE3, 0xAA, 0x80, 0xE0, 0x80, 0xCE, 0x48, 0xDD, 0x44,\n        0xC4, 0xA4, 0xF4, 0xD1, 0xB9, 0x83, 0x63, 0xBC, 0x4E, 0xC2,\n        0x6A, 0x89, 0xCE, 0x8D, 0xF4, 0x0E, 0x43, 0x93, 0x87, 0x62,\n        0xAB, 0x62, 0x52, 0x01, 0xFE, 0x69, 0x5E, 0xBB, 0xE1, 0xF4,\n        0xBD, 0xD5, 0x1F, 0x0F, 0xFD, 0xD1, 0x18, 0xE0, 0xCC, 0x1F,\n        0x74, 0xE9, 0x60, 0x86, 0x75, 0x0E, 0xBD, 0x44, 0x7A, 0x29,\n        0xB1, 0x8B, 0xB9, 0xC6, 0x02, 0x0A, 0x18, 0x0B, 0xD5, 0x03,\n        0x3E, 0x34, 0x73, 0xC3, 0xC5, 0xA9\n};\nunsigned char ans[256] = {0};\n\nfor (int i = 0 ; i < 32 ; i ++ ) {\n        if (i == 0) {\n                ans[i] = flag[i] ^ keystream[i];\n        } else {\n                ans[i] = (flag[i] ^ flag[keystream[i]%i]^keystream[i]);\n        }\n}\nprintf("\\n%s", ans);<\/code><\/pre>\n
\u672c\u9898\u6700\u5f00\u59cb\u8fd8\u9700\u8981\u7206\u7834\u4e00\u4e2a\u8f93\u5165\uff0cEXP\u7684main\u51fd\u6570\u7684\u524d\u51e0\u884c\u5c31\u662f\u5728\u7206\u7834<\/p>\n
exp<\/h4>\n
#include <stdio.h>\n#include <bits\/stdc++.h>\n#include <Windows.h>\n\nusing namespace std;\nint v3; \/\/ eax\nint v4; \/\/ eax\nint v5; \/\/ [esp-Ch] [ebp-FCh]\nint v7; \/\/ [esp-8h] [ebp-F8h]\nint v8; \/\/ [esp-4h] [ebp-F4h]\nchar v13; \/\/ [esp+CFh] [ebp-21h]\nint v14; \/\/ [esp+D0h] [ebp-20h]\nint v15; \/\/ [esp+D4h] [ebp-1Ch]\nint v16; \/\/ [esp+D8h] [ebp-18h]\nint v17; \/\/ [esp+DCh] [ebp-14h] BYREF\nint v18; \/\/ [esp+E0h] [ebp-10h]\nsize_t v19; \/\/ [esp+E4h] [ebp-Ch]\nchar *v20; \/\/ [esp+E8h] [ebp-8h]\nint v21; \/\/ [esp+ECh] [ebp-4h]\nunsigned char Destination[256]; \/\/ [esp+158h] [ebp-400h] BYREF\n\/\/char key[256]; \/\/ [esp+258h] [ebp-300h] BYREF\nunsigned char box1[256]; \/\/ [esp+358h] [ebp-200h] BYREF\nunsigned char box2[256]; \/\/ [esp+458h] [ebp-100h] BYREF\nint __cdecl sub_401390(int a1, int a2) {\n        return ~(a2 + ~a1);\n}\n\nvoid tea_decrypt(unsigned int *a1, unsigned char *v9, int index) {\n        unsigned int sum = 0;\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                sum -= 559038737;\n                \/\/printf("SUM:%X\\n", sum);\n        }\n        printf("SUM:%X\\n", sum);\n\/\/\n\/\/        printf("%X\\n", a1[0]);\n\/\/        printf("%X\\n", v9[0]);\n        unsigned int v5 = a1[0], v4 = a1[1];\n        for (int j = 0 ; j < 8 ; j ++ ) {\n                printf("%X,", a1[j - index]);\n        }\n        printf("\\n%X,%X,%X,%X\\n", v9[(4 * index + 8) % 32 + 0], v9[(4 * index + 8) % 32 + 1], v9[(4 * index + 8) % 32 + 2], v9[(4 * index + 8) % 32 + 3]);\n\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                v4 -= (v9[(4 * index + 8) % 32 + 3] + (v5 >> 5)) ^ (sum + v5) ^ (v9[(4 * index + 8) % 32 + 2] + 16 * v5);\n                v5 -= (v9[(4 * index + 8) % 32 + 1] + (v4 >> 5)) ^ (sum + v4) ^ (v9[(4 * index + 8) % 32] + 16 * v4);\n                sum += 559038737;\n        }\n\n        a1[0] = v5;\n        a1[1] = v4;\n}\n\nunsigned char xorr[] = {\n        0xCA, 0x6D, 0xED, 0x4F, 0x59, 0x11, 0xE0, 0xCD, 0xC5, 0x4E,\n        0x60, 0xAB, 0x7B, 0x76, 0x8B, 0x40, 0x38, 0x2C, 0x0F, 0x1C,\n        0x9C, 0x2D, 0xF6, 0x5A, 0x7A, 0x55, 0x16, 0xF8, 0xD6, 0x8C,\n        0x95, 0x1A\n};\nunsigned char xorrr[] = {\n        0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x31,\n        0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x31,\n        0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x31,\n        0x31, 0x32\n};\n\nint main() {\n\n        for (int i = 0 ; i < 0xFFFFFFFF ; i++ ) {\n                v17 = i;\n                v16 = v17 \/ 10000;\n                v15 = v17 % 10000 \/ 100;\n                v14 = v17 % 10000 % 100;\n                v5 = v15;\n                v3 = sub_401390(7 * v15, 1);\n                v4 = sub_401390(11 * (13 * v3 + v14 + 3), v5);\n                v18 = ((v4 - v14) \/ 10 + 11) ^ 0x104B4;\n                if ( (v17 & 1) != 0 || v17 < 233 || v16 > 9999 || v15 > 12 || v14 > 32 || v18 * (v15 + v14 + v16) != 0x821472C ) {\n                        continue;\n                } else {\n                        printf("%d\\n", i);\n                        break;\n                }\n        }\n        unsigned char ida_chars[] = {\n                0xF1, 0xEF, 0x61, 0xBB, 0xC9, 0x45, 0x57, 0x43, 0x36, 0xEB,\n                0xC3, 0xF5, 0x61, 0x1F, 0xE0, 0xED, 0x5F, 0x19, 0xC3, 0x83,\n                0x0B, 0x67, 0x5B, 0x44, 0x7A, 0x9D, 0xB2, 0x7E, 0xF5, 0xB5,\n                0x22, 0x65\n        };\n\n        unsigned char flag[] = {   30, 15, 43, 28, 86, 5, 97, 100, 120, 21, 135, 89, 138, 28, 154, 250, 180, 99, 189, 100, 200, 1, 220, 213, 225, 54, 235, 235, 246, 66, 255, 255};\n\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                flag[i] ^= ida_chars[i];\n                printf("0x%X,", flag[i]);\n        }\n        puts("");\n        for (int i = 6 ; i >= 0 ; i -= 2 ) {\n                tea_decrypt((unsigned int *)(flag + 4 * i), flag, i);\n        }\n        for (int i = 0 ; i < 8 ; i ++) {\n                unsigned int *p = (unsigned int *)(flag + 4 * i);\n                printf("0x%X,", *p);\n        }\n        puts("");\n        unsigned char keystream[] = {\n                0xFB, 0x95, 0x14, 0x16, 0x23, 0xCA, 0x8E, 0x3F, 0xB3, 0xB2,\n                0x94, 0x54, 0x25, 0xA2, 0xF1, 0xDD, 0x4F, 0xF4, 0x5B, 0xC0,\n                0xF4, 0xDA, 0xD9, 0x20, 0x0F, 0x83, 0xAA, 0xCF, 0x99, 0xAB,\n                0x52, 0x10, 0x98, 0xF6, 0x7A, 0xDE, 0xD3, 0x81, 0x70, 0xE0,\n                0x59, 0x5A, 0x10, 0x62, 0x3D, 0xA0, 0x58, 0x91, 0xFA, 0x4D,\n                0x15, 0x69, 0xE3, 0x1F, 0xD7, 0x66, 0x99, 0x41, 0x29, 0x15,\n                0x62, 0x82, 0x93, 0xB1, 0xE1, 0x1D, 0x61, 0x6F, 0x8F, 0x49,\n                0x11, 0x71, 0xA1, 0x27, 0xE3, 0x55, 0xF2, 0x28, 0x49, 0x6D,\n                0x27, 0x9A, 0x7B, 0x5B, 0xA3, 0x27, 0x9A, 0x35, 0x9E, 0x72,\n                0xC8, 0x9E, 0x1A, 0x5C, 0xF1, 0x54, 0x73, 0xB4, 0xF6, 0xBF,\n                0x09, 0xE8, 0x75, 0xB9, 0x3B, 0x32, 0x80, 0xD1, 0xFB, 0x94,\n                0x57, 0x2E, 0xCE, 0xC2, 0x24, 0xCE, 0xDE, 0xED, 0x74, 0xB9,\n                0x4E, 0xFA, 0x5D, 0x65, 0xD8, 0x3D, 0xA0, 0x3B, 0x79, 0x40,\n                0x7D, 0xF7, 0x27, 0x98, 0x50, 0xFF, 0xBE, 0x0E, 0x8F, 0x44,\n                0x6B, 0x33, 0x2E, 0x8D, 0x8D, 0x2D, 0x4D, 0x10, 0xC6, 0x93,\n                0xCE, 0x2F, 0xA3, 0xE9, 0x04, 0x4D, 0xD5, 0xB5, 0xCF, 0x10,\n                0x33, 0xF7, 0xEB, 0x17, 0xEF, 0xD2, 0x34, 0x6E, 0xD9, 0x5A,\n                0x82, 0x0E, 0x22, 0x29, 0x31, 0x7D, 0x52, 0xAD, 0x47, 0x59,\n                0x08, 0xE3, 0xAA, 0x80, 0xE0, 0x80, 0xCE, 0x48, 0xDD, 0x44,\n                0xC4, 0xA4, 0xF4, 0xD1, 0xB9, 0x83, 0x63, 0xBC, 0x4E, 0xC2,\n                0x6A, 0x89, 0xCE, 0x8D, 0xF4, 0x0E, 0x43, 0x93, 0x87, 0x62,\n                0xAB, 0x62, 0x52, 0x01, 0xFE, 0x69, 0x5E, 0xBB, 0xE1, 0xF4,\n                0xBD, 0xD5, 0x1F, 0x0F, 0xFD, 0xD1, 0x18, 0xE0, 0xCC, 0x1F,\n                0x74, 0xE9, 0x60, 0x86, 0x75, 0x0E, 0xBD, 0x44, 0x7A, 0x29,\n                0xB1, 0x8B, 0xB9, 0xC6, 0x02, 0x0A, 0x18, 0x0B, 0xD5, 0x03,\n                0x3E, 0x34, 0x73, 0xC3, 0xC5, 0xA9\n        };\n        unsigned char ans[256] = {0};\n\n        for (int i = 0 ; i < 32 ; i ++ ) {\n                if (i == 0) {\n                        ans[i] = flag[i] ^ keystream[i];\n                } else {\n                        ans[i] = (flag[i] ^ flag[keystream[i]%i]^keystream[i]);\n                }\n        }\n        printf("\\n%s", ans);\n}\n\n\/*\n30,15\n43,28\n86,5\n97,100\n120,21\n135,89\n138,28\n154,250\n180,99\n189,100\n200,1\n220,213\n225,54\n235,235\n246,66\n255,255\n*\/<\/code><\/pre>\n
babyre[Shangwendada done]<\/h3>\n
\u7531Pyinstaller\u6253\u5305\u7684py\u7a0b\u5e8f\u76f4\u63a5\u4f7f\u7528<\/p>\n
\"file\"<\/div><\/p>\n
pyinstxtractor\u89e3\u5305<\/p>\n
\"file\"<\/div><\/p>\n
unconpyle6\u53cd\u7f16\u8bd1<\/p>\n
# uncompyle6 version 3.9.0\n# Python bytecode version base 3.7.0 (3394)\n# Decompiled from: Python 3.8.6 (tags\/v3.8.6:db45529, Sep 23 2020, 15:52:53) [MSC v.1927 64 bit (AMD64)]\n# Embedded file name: babyRe.py\nimport libnum\nfrom crypto.Util.number import *\nflag = 'ISCTF{******************}'\nflags = flag.encode()\ne = 65537\np = libnum.generate_prime(1024)\nq = libnum.generate_prime(1024)\nn = p * q\nm = bytes_to_long(flags)\nc = pow(m, e, n)\noutput = open('output.txt', 'w')\noutput.write('p+q =' + str(p + q) + '\\n')\noutput.write('(p+1)*(q+1)=' + str((p + 1) * (q + 1)) + '\\n')\noutput.write('c=' + str(c) + '\\n')\noutput.close()\n# okay decompiling .\\babyRe.pyc<\/code><\/pre>\n
\u4e00\u9053RSA\u6211\u4eec\u5df2\u77e5p+q\u4e0e(p+1)*(q+1) \u4f7f\u7528\u6c42\u6839\u516c\u5f0f\u89e3\u4e8c\u6b21\u65b9\u7a0b\u7136\u540e\u89e3RSA<\/p>\n
from sympy import Symbol, Eq, solve\nimport libnum\nfrom Crypto.Util.number import *\nimport gmpy2\n\n# \u5df2\u77e5\u7684\u503c\np_plus_q = 292884018782106151080211087047278002613718113661882871562870811030932129300110050822187903340426820507419488984883216665816506575312384940488196435920320779296487709207011656728480651848786849994095965852212548311864730225380390740637527033103610408592664948012814290769567441038868614508362013860087396409860\np_q_plus_1 = 21292789073160227295768319780997976991300923684414991432030077313041762314144710093780468352616448047534339208324518089727210764843655182515955359309813600286949887218916518346391288151954579692912105787780604137276300957046899460796651855983154616583709095921532639371311099659697834887064510351319531902433355833604752638757132129136704458119767279776712516825379722837005380965686817229771252693736534397063201880826010273930761767650438638395019411119979149337260776965247144705915951674697425506236801595477159432369862377378306461809669885764689526096087635635247658396780671976617716801660025870405374520076160\n\n# \u8ba1\u7b97\u4e8c\u6b21\u65b9\u7a0b\u7684\u7cfb\u6570\na = 1\nb = -p_plus_q\nc = p_q_plus_1 - (p_plus_q + 1)\n\n# \u8ba1\u7b97\u4e8c\u6b21\u65b9\u7a0b\u7684\u6839\ndelta = gmpy2.isqrt(b * b - 4 * a * c)\np = (-b + delta) \/\/ (2 * a)\nq = (-b - delta) \/\/ (2 * a)\n\nprint("p =", p)\nprint("q =", q)\n# \u5df2\u77e5\u7684\u503c\ne = 65537\nc = 5203005542361323780340103662023144468501161788183930759975924790394097999367062944602228590598053194005601497154183700604614648980958953643596732510635460233363517206803267054976506058495592964781868943617992245808463957957161100800155936109928340808755112091651619258385206684038063600864669934451439637410568700470057362554045334836098013308228518175901113235436257998397401389511926288739759268080251377782356779624616546966237213737535252748926042086203600860251557074440685879354169866206490962331203234019516485700964227924668452181975961352914304357731769081382406940750260817547299552705287482926593175925396\n\nn = p * q\nphi = (p - 1) * (q - 1)\nd = inverse(e, phi)\n\nm = pow(c, d, n)\nprint("Decrypted message:", long_to_bytes(m))<\/code><\/pre>\n
Easyre[\u4f59\uff0cShangwendada done]<\/h3>\n
\"file\"<\/div><\/p>\n
\u5f02\u6216\u540e\u5982\u679c\u7b49\u4e8e’B’\u6216\u8005’X’\uff0c\u6216\u8005\u76f4\u63a5\u6ee1\u8db3\u7b49\u4e8ev4\uff0c\u4f46\u662f\u51fa\u9898\u4eba\u672a\u8003\u8651\u90fd\u6ee1\u8db3\u60c5\u51b5<\/p>\n
0 : 73\n0 : 82\n1 : 72\n1 : 83\n2 : 67\n3 : 84\n4 : 70\n5 : 72\n5 : 83\n6 : 78\n7 : 88\n8 : 74\n9 : 72\n9 : 83\n10 : 73\n10 : 82\n11 : 65\n12 : 79\n13 : 87\n14 : 67\n15 : 66\n16 : 88\n17 : 78\n18 : 65\n19 : 76<\/code><\/pre>\n
\u53d1\u73b0\u67095\u4e2a\u5730\u65b9\u51fa\u73b0\u91cd\u590d\u503c\uff0chint\u7ed9\u51fa\u4e86\u6b63\u786e\u7b54\u6848\u7684md5\uff0c\u90a3\u4e48\u6211\u4eec\u6392\u5217\u7ec4\u5408\u4ea7\u751f32\u7ec4\u6570\u636e\u5224\u65ad\u54c8\u5e0c<\/p>\n
import hashlib\nfrom itertools import product\n\ns = "]P_ISRF^PCY[I_YWERYC"\nnew_s = [ord(s[i]) for i in range(len(s)-1, -1, -1)]\n\ndata = {}\nfor i in range(len(new_s)):\n    values = []\n    for j in range(32, 128):\n        a = j ^ 0x11\n        if a == ord('B') or a == ord('X'):\n            b = 0x9b - a\n            if b == new_s[i]:\n                values.append(j)\n        else:\n            b = a\n            if b == new_s[i]:\n                values.append(j)\n    data[i] = values\n\nresult = []\n\nfor values in product(*(data[i] for i in sorted(data.keys()))):\n    combination_str = ''.join(chr(value) for value in values)\n    md5_hash = hashlib.md5(combination_str.encode()).hexdigest()\n    if md5_hash == "d26628cceedb1f8bdb3535913c82d959":\n        result.append(combination_str)\n\n# \u8f93\u51faMD5\u503c\u7b49\u4e8e\u7ed9\u5b9a\u5b57\u7b26\u4e32\u7684\u7ec4\u5408\nfor combination in result:\n    print(combination)<\/code><\/pre>\n
easy_flower_tea[Shangwendada done]<\/h3>\n
#include <stdio.h>\n#include <stdint.h>  \/\/ \u4f7f\u7528uint32_t\u6570\u636e\u7c7b\u578b\u9700\u8981\u5305\u542b\u6b64\u5934\u6587\u4ef6\n#include <string.h>\n\n\/\/ \u5b9a\u4e49\u52a0\u5bc6\u51fd\u6570\nvoid tea_encrypt(uint32_t *v, uint32_t *k) {\n    uint32_t v0 = v[0], v1 = v[1], sum = 0, i;\n    uint32_t delta = 0x9e3779b9;\n\n    for (i = 0; i < 32; i++) {\n        sum += delta;\n        v0 += ((v1 << 4) + k[0]) ^ (v1 + sum) ^ ((v1 >> 5) + k[1]);\n        v1 += ((v0 << 4) + k[2]) ^ (v0 + sum) ^ ((v0 >> 5) + k[3]);\n    }\n\n    v[0] = v0;\n    v[1] = v1;\n}\n\n\/\/ \u5b9a\u4e49\u89e3\u5bc6\u51fd\u6570\nvoid tea_decrypt(uint32_t *v, uint32_t *k) {\n    uint32_t v0 = v[0], v1 = v[1], sum = 0xC6EF3720, i;  \/\/ \u6839\u636eTEA\u7b97\u6cd5\uff0c\u89e3\u5bc6\u8f6e\u6b21\u7684\u8ba1\u7b97\u9700\u8981\u521d\u59cb\u5316sum\n    uint32_t delta = 0x9e3779b9;\n\n    for (i = 0; i < 32; i++) {\n        v1 -= ((v0 << 4) + k[2]) ^ (v0 + sum) ^ ((v0 >> 5) + k[3]);\n        v0 -= ((v1 << 4) + k[0]) ^ (v1 + sum) ^ ((v1 >> 5) + k[1]);\n        sum -= delta;\n    }\n\n    v[0] = v0;\n    v[1] = v1;\n}\n\nint main() {\n    unsigned int key[] = {12,34,56,78};\n    unsigned int flag[] = {0x42777AFA,0x781A30CA};\n    tea_decrypt(flag,key);\n    for(int i = 0 ; i < 2 ; i ++ ){\n                printf("%d ",flag[i]);\n        }\n        \/\/cout<<endl;\n}<\/code><\/pre>\n
easy_z3[Shangwendada done]<\/h3>\n
# print("Please input flag:")\n# flag = input()\n# if len(flag)!=42:\n#  print("Check your length!")\n#  exit()\n#\n# l=[]\n# for i in range(6):\n#  s=""\n#  for j in flag[i*7:i*7+7]:\n#     s+=hex(ord(j))[2:]\n#  l.append(int(s,16))\n# if (\n# (593*l[5] + 997*l[0] + 811*l[1] + 258*l[2] + 829*l[3] + 532*l[4])== 0x54eb02012bed42c08 and \\\n# (605*l[4] + 686*l[5] + 328*l[0] + 602*l[1] + 695*l[2] + 576*l[3])== 0x4f039a9f601affc3a and \\\n# (373*l[3] + 512*l[4] + 449*l[5] + 756*l[0] + 448*l[1] + 580*l[2])== 0x442b62c4ad653e7d9 and \\\n# (560*l[2] + 635*l[3] + 422*l[4] + 971*l[5] + 855*l[0] + 597*l[1])== 0x588aabb6a4cb26838 and \\\n# (717*l[1] + 507*l[2] + 388*l[3] + 925*l[4] + 324*l[5] + 524*l[0])== 0x48f8e42ac70c9af91 and \\\n# (312*l[0] + 368*l[1] + 884*l[2] + 518*l[3] + 495*l[4] + 414*l[5])== 0x4656c19578a6b1170):\n#  print("Good job!")\n# else:\n#  print("Wrong\\nTry again!!!")\n#  exit()\n\nfrom z3 import *\n\n# \u521b\u5efa6\u4e2a\u672a\u77e5\u6570\nl = [Int('l{}'.format(i)) for i in range(6)]\n\n# \u521b\u5efa6\u4e2a\u65b9\u7a0b\ns = Solver()\ns.add(\n    (593 * l[5] + 997 * l[0] + 811 * l[1] + 258 * l[2] + 829 * l[3] + 532 * l[4]) == 0x54eb02012bed42c08,\n    (605 * l[4] + 686 * l[5] + 328 * l[0] + 602 * l[1] + 695 * l[2] + 576 * l[3]) == 0x4f039a9f601affc3a,\n    (373 * l[3] + 512 * l[4] + 449 * l[5] + 756 * l[0] + 448 * l[1] + 580 * l[2]) == 0x442b62c4ad653e7d9,\n    (560 * l[2] + 635 * l[3] + 422 * l[4] + 971 * l[5] + 855 * l[0] + 597 * l[1]) == 0x588aabb6a4cb26838,\n    (717 * l[1] + 507 * l[2] + 388 * l[3] + 925 * l[4] + 324 * l[5] + 524 * l[0]) == 0x48f8e42ac70c9af91,\n    (312 * l[0] + 368 * l[1] + 884 * l[2] + 518 * l[3] + 495 * l[4] + 414 * l[5]) == 0x4656c19578a6b1170\n)\n\nimport struct\n\n# \u68c0\u67e5\u662f\u5426\u6709\u89e3\u5e76\u8f93\u51fa\nif s.check() == sat:\n   m = s.model()\n   solution = [m.evaluate(l[i]).as_long() for i in range(6)]  # \u5c06\u89e3\u8f6c\u6362\u4e3a\u6574\u6570\n\n   # \u5c06\u6574\u6570\u8f6c\u6362\u4e3a\u5b57\u8282\u8868\u793a\n   byte_solution = bytearray()\n   for val in solution:\n      byte_solution.extend(val.to_bytes((val.bit_length() + 7) \/\/ 8, 'big'))\n\n   # \u89e3\u7801\u5b57\u8282\u8868\u793a\u4e3a ASCII \u5b57\u7b26\u4e32\n   ascii_solution = byte_solution.decode('ascii', 'ignore')\n\n   print("Solution as integers:", solution)\n   print("Solution as ASCII string:", ascii_solution)\nelse:\n   print("No solution found.")<\/code><\/pre>\n
z3_revenge[Shangwendada done]<\/h3>\n
\u4e00\u773c\u7ea6\u675f\u6761\u4ef6\uff0c\u66f4\u6539\u5bc4\u5b58\u5668 int\u6539\u4e3achar<\/p>\n
\u8fd9\u662f\u66f4\u6539\u4e4b\u540e\u7684\u56fe\u7247\uff01<\/p>\n
\"file\"<\/div><\/p>\n
\u62ff\u5230\u6b63\u5e38\u7684\u6570\u7ec4,\u68ad\u4e86<\/p>\n
from z3 import *\n\nv4 = [Int(f"v4_{i}") for i in range(44)]\n\ns = Solver()\n\ns.add(\n    v4[43] == 0,\n    v4[0] - 683 - (v4[1] + 765) == -1458,\n    v4[1] + 993 - (v4[2] + 801) == 208,\n    v4[2] - 395 - 834 * v4[3] == -70384,\n    v4[3] + 854 + 950 * v4[4] == 67438,\n    222 * v4[4] - (177 - v4[5]) == 15486,\n    v4[6] + 226 + 301 * v4[5] == 37304,\n    v4[6] - 373 - (889 - v4[7]) == -1108,\n    896 * v4[7] - (v4[8] + 148) == 88455,\n    v4[8] - 458 - (881 - v4[9]) == -1140,\n    v4[9] + 551 + 110 * v4[10] == 6369,\n    v4[10] - 245 + v4[11] + 773 == 636,\n    466 * v4[11] + 972 - v4[12] == 27015,\n    721 * v4[12] - (v4[13] + 848) == 37317,\n    552 * v4[13] - (381 - v4[14]) == 26160,\n    v4[14] - 698 - 494 * v4[15] == -49559,\n    v4[15] + 940 + v4[16] + 150 == 1239,\n    v4[16] + 972 + 362 * v4[17] == 19484,\n    v4[17] - 966 + 225 * v4[18] == 11910,\n    v4[18] - 549 - (v4[19] + 526) == -1063,\n    v4[20] + 706 + 260 * v4[19] == 12458,\n    v4[20] + 390 + 801 - v4[21] == 1142,\n    v4[21] - 271 - (653 - v4[22]) == -770,\n    v4[22] + 416 - (v4[23] + 912) == -493,\n    566 * v4[23] - (518 - v4[24]) == 27827,\n    v4[24] + 589 + v4[25] + 254 == 985,\n    v4[25] - 268 - (720 - v4[26]) == -839,\n    883 * v4[26] - (344 - v4[27]) == 45629,\n    v4[27] - 245 + v4[28] + 996 == 905,\n    129 * v4[28] + v4[29] + 907 == 13465,\n    v4[29] - 492 + v4[30] + 765 == 368,\n    725 * v4[30] - (v4[31] + 194) == 35957,\n    v4[31] - 553 - 469 * v4[32] == -26718,\n    v4[32] + 694 + 649 - v4[33] == 1347,\n    v4[33] + 135 - (449 - v4[34]) == -212,\n    v4[34] + 651 - (v4[35] + 620) == -17,\n    v4[35] + 716 + 813 * v4[36] == 46342,\n    273 * v4[36] - (v4[37] + 556) == 14679,\n    558 * v4[37] - (v4[38] + 538) == 28939,\n    v4[38] - 776 - (914 - v4[39]) == -1494,\n    v4[39] + 605 + 809 * v4[40] == 46008,\n    v4[40] - 816 - 789 * v4[41] == -43366,\n    v4[42] + 391 + 616 * v4[41] == 33780,\n    v4[42] - 200 - 758 * v4[0] == -55409\n)\n\nif s.check() == sat:\n    m = s.model()\n    result = ''.join([chr(m[v4[i]].as_long()) for i in range(43)])\n    print("Solution found:")\n    print(result)\nelse:\n    print("No solution found.")<\/code><\/pre>\n
FlowerRSA[Shangwendada done]<\/h3>\n
\u53bb\u6389\u82b1\u4e4b\u540e\u957f\u8fd9\u6837<\/p>\n
\"file\"<\/div><\/p>\n
\u77e5\u9053\u4e86e\u548cn<\/p>\n
e = 465 n = 3162244531<\/p>\n
\u5206\u89e3n\u5f97\u5230pq<\/p>\n
http:\/\/factordb.com\/index.php?showid=1100000004799187287<\/a><\/p>\n
\"file\"<\/div><\/p>\n
\u7136\u540e\u5c31\u662f\u559c\u95fb\u4e50\u89c1\u7684\u89e3RSA\u4e86<\/p>\n
import gmpy2\nfrom sympy import Symbol, Eq, solve\nimport libnum\nfrom Crypto.Util.number import *\nimport gmpy2\n\np = 56099\nq = 56369\ne = 465\nciphertexts = [\n    1966878405,\n    2375075638,\n    2166893744,\n    2129446000,\n    2488145363,\n    746243878,\n    1904115824,\n    818668601,\n    2983811740,\n    1840670651,\n    306202172,\n    2009857636,\n    299417177\n]\n\nn = p * q\nphi = (p - 1) * (q - 1)\n\nd = gmpy2.invert(e, phi)\n\nfor ciphertext in ciphertexts:\n    plaintext = pow(ciphertext, d, n)\n    print(long_to_bytes(plaintext).decode(),end='')<\/code><\/pre>\n
Ezrust[Shangwendada done]<\/h3>\n
\u5148\u8c03\u8bd5<\/p>\n
\"file\"<\/div><\/p>\n
\"file\"<\/div><\/p>\n
\u770b\u5230\u5355\u5b57\u8282\u5224\u65ad\u70b9\uff0c\u4e0b\u65ad<\/p>\n
\"file\"<\/div><\/p>\n
cmp\u4e0b\u65ad\u6253\u6761\u4ef6\u65ad\u70b9<\/p>\n
from idaapi import get_reg_val\n\nprint(chr(get_reg_val('al')),':',chr(get_reg_val('cl')),end='\\n')<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
\"file\"<\/div><\/p>\n
\u53cd\u8c03\u4e5f\u8981nop\u6389<\/p>\n
\"file\"<\/div><\/p>\n
\u53d1\u73b0\u6211\u4eec\u8f93\u5165\u4e2d\u6240\u6709\u7684\u5b57\u7b26\u90fd\u88ab-1\u4e86<\/p>\n
int main () {\n        char flag[] = "HRBSEzQt4s^3mc^0msdfdq^\/u2qeknv|";\n        for(int i = 0 ; i < 32 ; i ++ ){\n                printf("%c",flag[i]+1);\n        }\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
crakme[Shangwendada ,wakappxc done] \u6cd51 \u5176\u5b9e\u5e94\u8be5\u672c\u6765\u60f3\u8003\u7684\u662fupx\u58f3\uff0c\u4f46 […]<\/p>\n","protected":false},"author":1,"featured_media":691,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-695","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/695","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=695"}],"version-history":[{"count":1,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/695\/revisions"}],"predecessor-version":[{"id":726,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/695\/revisions\/726"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/691"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}