{"id":96,"date":"2022-11-19T02:27:17","date_gmt":"2022-11-18T18:27:17","guid":{"rendered":"https:\/\/www.shangwendada.co\/?p=96"},"modified":"2022-11-21T00:24:54","modified_gmt":"2022-11-20T16:24:54","slug":"reverse2022%e5%bc%b1%e5%8f%a3%e4%bb%a4%e5%ae%89%e5%85%a8%e6%8b%9b%e6%96%b0%e8%b5%9b-tea","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2022\/11\/19\/reverse2022%e5%bc%b1%e5%8f%a3%e4%bb%a4%e5%ae%89%e5%85%a8%e6%8b%9b%e6%96%b0%e8%b5%9b-tea\/","title":{"rendered":"[Reverse]2022\u5f31\u53e3\u4ee4\u5b89\u5168\u62db\u65b0\u8d5b tea"},"content":{"rendered":"

\u9898\u76ee\u4e0b\u8f7d\u5730\u5740:tea<\/a><\/h2>\n

\u6570\u636e\u5904\u7406<\/h2>\n

\u6570\u636e\u5904\u7406\u5206\u6790<\/h3>\n

\u505a\u8fd9\u9053\u9898\u7684\u65f6\u5019\u662f\u7b2c\u4e00\u6b21\u6df1\u5165\u63a5\u89e6tea\u52a0\u5bc6\uff0ctea\u52a0\u5bc6\u540e\u7684\u6570\u636e\u6309\u7406\u6765\u8bf4\u90fd\u5e94\u8be5\u662f32\u4f4d\u7684\u5927\u6570\uff0c\u800c\u6211\u5728\u67e5\u627e\u6570\u636e\u7684\u65f6\u5019\u72af\u4e86\u4e00\u4e2a\u5f88\u4e25\u91cd\u7684\u9519\u8bef:
\n

\"file\"<\/div>
\n\u5c06\u56fe\u4e2d\u7684\u6570\u636e\u5206\u5f00\u6765\u53bbtea\u89e3\u5bc6\uff0c\u663e\u7136\u8fd9\u662f\u9519\u8bef\u7684\u3002
\n\u6211\u4eec\u4e0d\u96be\u53d1\u73b0\u5728tea\u7b97\u6cd5\u4e2d\u6211\u4eec\u9700\u8981\u6709\u4e00\u4e2adelta\u503c\u5982\u56fev4\u6240\u793a
\"file\"<\/div>\u6211\u4eec\u53d1\u73b0\u5176\u4e2d\u7684delta\u503c\u662f8\u4f4d\u768416\u8fdb\u5236\u4e5f\u5c31\u662f32\u4f4d\u7684\u6570\u636e\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u9700\u8981\u624b\u52a8\u5c06str2\u91cc\u9762\u7684\u6570\u636e\u8fdb\u884c\u8fd8\u539f\u4e3a8\u4f4d\u6570\u636e<\/p>\n

\u5c0f\u7aef\u5e8f\u5904\u7406<\/h3>\n

\u5728\u6211\u5904\u7406\u8fd9\u6bb5\u6570\u636e\u7684\u65f6\u5019\uff0c\u6211\u53c8\u72af\u4e86\u4e00\u4e2a\u5f88\u4e25\u91cd\u7684\u9519\u8bef(\u76f4\u63a5\u6309\u7167\u987a\u5e8f\u5408\u5e76)\uff0c\u7a0b\u5e8f\u662f\u5c0f\u7aef\u5e8f\u50a8\u5b58\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u9700\u8981\u53cd\u8fc7\u6765\u5408\u5e76\uff0c\u4f8b\u5982
\n0xAA 0xBB 0xCC 0xDD
\n\u6211\u4eec\u5408\u5e76\u621032\u4f4d\u6570\u636e\u5c31\u662f
\n0xDDCCBBAA
\n\u8fd9\u5c31\u662f\u5c0f\u7aef\u5e8f\u50a8\u5b58
\n\u5f53\u7136\u6211\u4eec\u53ef\u4ee5\u624b\u52a8\u4e00\u4e2a\u4e2a\u5c06\u7a0b\u5e8f\u8fd8\u539f\uff0c\u663e\u7136\u592a\u9ebb\u70e6\u4e86\uff0c\u6211\u9009\u62e9\u4f7f\u7528\u7b97\u6cd5\uff0c\u7b97\u6cd5\u5173\u952e\u4ee3\u7801\u5982\u4e0b:<\/p>\n

int kk[32] =\n{\n  46,162,154,93,216,119,117,77,224,124,80,69,114,165,248,93,109,14,98,20,102,95,216,91,138,93,196,200,116,32,253,101\n};\n    unsigned int F[8]={0};\n    for(int i = 0 ; i < 32 ; i+=4 )\n    {\n        unsigned int wei = 0x1000000;\n        for(int j = 3 ; j >= 0 ; j -- )\n        {\n            F[cd]+=kk[i+j]*wei;\n            wei\/=0x100;\n        }\n        cd++;\n    }<\/code><\/pre>\n
\u5904\u7406\u8fc7\u540eF\u6570\u7ec4\u5185\u50a8\u5b58\u7684\u503c\u5c31\u662f\u6211\u4eec\u6309\u7167\u5c0f\u7aef\u5e8f\u89c4\u5219\u8fd8\u539f\u540e\u7684\u5bc6\u6587\u4e86\u3002<\/p>\n
tea\u7b97\u6cd5<\/h2>\n
tea\u7b97\u6cd5\u7b80\u4ecb<\/h3>\n
TEA\u7b97\u6cd5\u4f7f\u752864\u4f4d\u7684\u660e\u6587\u5206\u7ec4\u548c128\u4f4d\u7684\u5bc6\u94a5\uff0c\u5b83\u4f7f\u7528Feistel\u5206\u7ec4\u52a0\u5bc6\u6846\u67b6\uff0c\u9700\u8981\u8fdb\u884c 64 \u8f6e\u8fed\u4ee3\uff0c\u5c3d\u7ba1\u4f5c\u8005\u8ba4\u4e3a 32 \u8f6e\u5df2\u7ecf\u8db3\u591f\u4e86\u3002\u8be5\u7b97\u6cd5\u4f7f\u7528\u4e86\u4e00\u4e2a\u795e\u79d8\u5e38\u6570\u03b4\u4f5c\u4e3a\u500d\u6570\uff0c\u5b83\u6765\u6e90\u4e8e\u9ec4\u91d1\u6bd4\u7387\uff0c\u4ee5\u4fdd\u8bc1\u6bcf\u4e00\u8f6e\u52a0\u5bc6\u90fd\u4e0d\u76f8\u540c\u3002\u4f46\u03b4\u7684\u7cbe\u786e\u503c\u4f3c\u4e4e\u5e76\u4e0d\u91cd\u8981\uff0c\u8fd9\u91cc TEA \u628a\u5b83\u5b9a\u4e49\u4e3a \u03b4=\u300c(\u221a5 – 1)231\u300d\uff08\u4e5f\u5c31\u662f\u7a0b\u5e8f\u4e2d\u7684 0\u00d79E3779B9\uff09<\/p>\n
tea\u7b97\u6cd5\u52a0\u5bc6\u811a\u672c<\/h3>\n
#include <stdio.h>\n#include <stdint.h>\n\/\/\u52a0\u5bc6\u51fd\u6570\nvoid encrypt(uint32_t* v, uint32_t* k)\n{  \n    uint32_t v0=v[0], v1=v[1], sum=0, i;           \/* set up *\/  \n    uint32_t delta=0x9e3779b9;                     \/* a key schedule constant *\/  \n    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   \/* cache key *\/  \n    for (i=0; i < 32; i++)\n    {                       \/* basic cycle start *\/\n        sum += delta;\n        v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);\n        v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);\n    }                                              \/* end cycle *\/\n    v[0]=v0; v[1]=v1;\n}\n\nint main()  \n{  \n    uint32_t v[2]={1,2},k[4]={2,2,3,4};\n    \/\/ v\u4e3a\u8981\u52a0\u5bc6\u7684\u6570\u636e\u662f\u4e24\u4e2a32\u4f4d\u65e0\u7b26\u53f7\u6574\u6570\n    \/\/ k\u4e3a\u52a0\u5bc6\u89e3\u5bc6\u5bc6\u94a5\uff0c\u4e3a4\u4e2a32\u4f4d\u65e0\u7b26\u53f7\u6574\u6570\uff0c\u5373\u5bc6\u94a5\u957f\u5ea6\u4e3a128\u4f4d\n    printf("\u52a0\u5bc6\u524d\u539f\u59cb\u6570\u636e\uff1a%u %u\\n",v[0],v[1]);\n    encrypt(v, k);\n    printf("\u52a0\u5bc6\u540e\u7684\u6570\u636e\uff1a%u %u\\n",v[0],v[1]);\n    return 0;\n}<\/code><\/pre>\n
tea\u7b97\u6cd5\u89e3\u5bc6\u811a\u672c<\/h3>\n
\u663e\u7136\u5f02\u6216\u5177\u6709\u53ef\u9006\u6027\uff0c\u6211\u4eec\u53ea\u9700\u8981\u5c06\u52a0\u5bc6\u811a\u672c\u53cd\u8fc7\u6765\u5199\uff0c\u5c31\u53ef\u4ee5\u5f97\u5230\u89e3\u5bc6\u811a\u672c<\/p>\n
void decrypt(uint32_t* v, uint32_t* k)\n{\n    uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i;  \/* set up *\/\n    \/\/sum\u7684\u503c\u4e3adelta\u7684\u503c\u4e58\u4ee5\u52a0\u5bc6\u7684\u7ec4\u6570\uff0c\u4f5c\u8005\u63a8\u8350\u52a0\u5bc632\u6b21\uff0c\u8fd9\u91cc\u4e5f\u662f32\u6b21\uff0c\u5219\u6211\u4eec\u5c31\u662f\u4e58\u4ee532\n    uint32_t delta=0x9e3779b9;                     \/* a key schedule constant *\/\n    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   \/* cache key *\/\n    for (i=0; i<32; i++)\n    {                           \/* basic cycle start *\/  \n        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);\n        \/\/v1\u4e0ev0\u987a\u5e8f\u4e92\u6362+=\u6539\u4e3a-=\u7136\u540e\u9010\u6b21\u9012\u51cfsum\n        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);\n        sum -= delta;\n    }                                             \/* end cycle *\/\n    v[0]=v0; v[1]=v1;\n} <\/code><\/pre>\n
\u6b63\u7ecf\u9898\u89e3:<\/h2>\n
\"file\"<\/div>
\n\u770b\u5230\u4e3b\u51fd\u6570\u7684\u5173\u952e\u51fd\u6570\u6bb5,\u8f93\u5165\u7684v9\u8d4b\u503c\u7ed9\u4e86Destination\u6570\u7ec4\u7136\u540e\u5bf9Destination\u6570\u7ec4\u4e24\u4e24\u4e00\u7ec4\u8fdb\u884c\u52a0\u5bc6\uff0c\u663e\u7136\u7531\u4e8e\u7a0b\u5e8f\u5c06\u6211\u4eec\u8f93\u5165\u7684\u5b57\u7b26\u50a8\u5b58\u4e3a\u4e8632\u4f4d\u6570\u636e\uff0c\u6bcf\u4f4d\u6570\u636e\u5360\u7528\u4e864\u4e2a\u5b57\u8282\uff0c\u6240\u4ee5\u5bf9\u5e94\u7684Destination\u5c31\u662f\u6211\u4eec\u8f93\u5165\u7684\u524d\u56db\u4e2a\u5b57\u7b26\uff0c\u548c\u540e\u56db\u4e2a\u5b57\u7b26\uff0c\u56e0\u6b64\u6211\u4eec\u89e3\u5bc6\u7684\u540e\u5e8f\u9700\u8981\u5c06\u5b83\u518d\u6b21\u5206\u5f00\u3002
\n\u8fdb\u5165::k\u53ef\u4ee5\u770b\u5230
\"file\"<\/div>
\n1,2,3,4\u4fbf\u662f\u6211\u4eec\u7684\u5bc6\u94a5
\n\u7136\u540e\u6211\u4eec\u8fdb\u5165encrypt\u51fd\u6570:
\n
\"file\"<\/div>
\n\u89e3\u5bc6\u811a\u672c\u5982\u4f55\u6784\u9020\u5728\u4e0a\u6587\u7684tea\u5206\u6790\u4e2d\u5df2\u7ecf\u63d0\u53ca
\n\u6211\u7684\u89e3\u5bc6\u601d\u60f3\u5982\u4e0b:<\/p>\n
void decrypt(unsigned int *a1,int *a2)\n{\n\/\/  char *result; \/\/ rax\n    int i; \/\/ [rsp+10h] [rbp-10h]\n    unsigned int v4;\n    v4=0xa6768e00;\/\/ [rsp+14h] [rbp-Ch]\n    unsigned int v5; \/\/ [rsp+18h] [rbp-8h]\n    unsigned int v6; \/\/ [rsp+1Ch] [rbp-4h]\n\n    v6 = *a1;\n    v5 = a1[1];\n    for ( i = 0; i <= 31; ++i )\n    {\n        v5 -= (v6 + v4) ^ (a2[2] + 16 * v6) ^ ((v6 >> 5) + a2[3]);\n        v6 -= (v5 + v4) ^ (a2[0] + 16 * v5) ^ ((v5 >> 5) + a2[1]);\n        v4 -= 0xD33B470;    \n    }\n    *a1 = v6;\n    a1[1] = v5;\n}<\/code><\/pre>\n
\u63a5\u4e0b\u6765\u5c31\u53ef\u4ee5\u6784\u9020\u6211\u4eec\u7684\u89e3\u9898\u4ee3\u7801\u4e86\uff0cstr2\u7684\u5904\u7406\u65b9\u5f0f\u5728\u4e0a\u6587\u5c0f\u7aef\u5e8f\u7684\u4ecb\u7ecd\u4e2d\u5df2\u7ecf\u63d0\u53ca
\n\u8fd9\u91cc\u8981\u6ce8\u610f\u7684\u5c31\u662f
\n\u6211\u4eec\u5728\u89e3\u5bc6\u5b8c\u6210\u540e\u4f1a\u83b7\u5f978\u7ec432\u4f4d\u7684\u5927\u6570\uff0c\u6211\u4eec\u9700\u8981\u5c06\u5b83\u4eec\u6309\u7167\u5c0f\u7aef\u5e8f\u7684\u89c4\u5219\u5206\u5f00\u518d\u8fdb\u884c\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u8f93\u51fa,\u6211\u7684\u8f93\u51fa\u601d\u60f3\u5982\u4e0b:<\/p>\n
    for(int i = 0 ; i < 8 ; i ++ )\n    {\n        unsigned temp = flag[i];\/\/flag[i]\u4e3atea\u89e3\u5bc6\u540e\u7559\u4e0b\u76848\u7ec432\u4f4d\u5927\u6570\u636e\n        for(int j = 0 ; j < 4 ; j++ )\n        {\n            int tmp = temp%0x100;\n            temp\/=0x100;\n            printf("%c",tmp);\n        }\n    }<\/code><\/pre>\n
\u6700\u540e\u5c31\u53ef\u4ee5\u76f4\u63a5\u6784\u9020\u811a\u672c\u4e86<\/p>\n
EXP<\/h3>\n
#include<iostream>\n#include<algorithm>\n#include<cstdio>\n#include<cmath>\n#include<map>\n#include<vector>\n#include<queue>\n#include<stack>\n#include<set>\n#include<string>\n#include<cstring>\n#include<list>\n#include<stdlib.h>\n#include<windows.h>\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\n\nint kk[32] =\n{\n  46,162,154,93,216,119,117,77,224,124,80,69,114,165,248,93,109,14,98,20,102,95,216,91,138,93,196,200,116,32,253,101\n};\nint a2[4]={1, 2, 3, 4};\nvoid decrypt(unsigned int *a1,int *a2)\n{\n\/\/  char *result; \/\/ rax\n    int i; \/\/ [rsp+10h] [rbp-10h]\n    unsigned int v4;\n    v4=0xa6768e00;\/\/ [rsp+14h] [rbp-Ch]\n    unsigned int v5; \/\/ [rsp+18h] [rbp-8h]\n    unsigned int v6; \/\/ [rsp+1Ch] [rbp-4h]\n\n    v6 = *a1;\n    v5 = a1[1];\n    for ( i = 0; i <= 31; ++i )\n    {\n        v5 -= (v6 + v4) ^ (a2[2] + 16 * v6) ^ ((v6 >> 5) + a2[3]);\n        v6 -= (v5 + v4) ^ (a2[0] + 16 * v5) ^ ((v5 >> 5) + a2[1]);\n        v4 -= 0xD33B470;    \n    }\n    *a1 = v6;\n    a1[1] = v5;\n}\nint main()\n{\n    unsigned int flag[8],F[8]={0};\n    int cd = 0;\n    for(int i = 0 ; i < 32 ; i ++ )\n    {\n        printf("%X ",kk[i]);\n    }\n    cout<<endl;\n    for(int i = 0 ; i < 32 ; i+=4 )\n    {\n        unsigned int wei = 0x1000000;\n        for(int j = 3 ; j >= 0 ; j -- )\n        {\n            F[cd]+=kk[i+j]*wei;\n            wei\/=0x100;\n        }\n        cd++;\n    }\n    for(int i = 0 ; i < 8 ; i ++ )\n    {\n        printf("0x%X",F[i]);\n        if(i!=7)    cout<<",";\n    }\n\n    cout<<endl;\n    for(int i = 0 ; i<  8 ; i +=2 )\n    {\n        unsigned int tmp[2];\n        tmp[0]=F[i];\n        tmp[1]=F[i+1];\n        decrypt(tmp,a2);\n        flag[i]=tmp[0];\n        flag[i+1]=tmp[1];\n    }\n    cout<<endl;\n    for(int i = 0 ; i < 8 ; i ++ )\n    {\n        unsigned temp = flag[i];\n        for(int j = 0 ; j < 4 ; j++ )\n        {\n            int tmp = temp%0x100;\n            temp\/=0x100;\n            printf("%c",tmp);\n        }\n    }\n}\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u9898\u76ee\u4e0b\u8f7d\u5730\u5740:tea \u6570\u636e\u5904\u7406 \u6570\u636e\u5904\u7406\u5206\u6790 \u505a\u8fd9\u9053\u9898\u7684\u65f6\u5019\u662f\u7b2c\u4e00\u6b21\u6df1\u5165\u63a5\u89e6tea\u52a0\u5bc6\uff0ctea\u52a0\u5bc6\u540e\u7684\u6570\u636e\u6309\u7406 […]<\/p>\n","protected":false},"author":1,"featured_media":153,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-96","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/96","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=96"}],"version-history":[{"count":10,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/96\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/96\/revisions\/111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/153"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=96"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=96"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=96"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}