[CISCN2018]2ex
四处游走寻找关键代码
int __fastcall sub_400430(int a1, unsigned int a2, int a3)
{unsigned int v3; // $v0int v4; // $v0int v5; // $v0int v6; // $v0unsigned int i; // [sp+8h] [+8h]unsigned int v9; // [sp+8h] [+8h]int v10; // [sp+Ch] [+Ch]v10 = 0;for ( i = 0; i < a2; ++i ){v3 = i % 3;if ( i % 3 == 1 ){v5 = v10++;*(_BYTE *)(a3 + v5) = byte_410200[16 * (*(_BYTE *)(a1 + i - 1) & 3) + ((*(unsigned __int8 *)(a1 + i) >> 4) & 0xF)];}else if ( v3 == 2 ){*(_BYTE *)(a3 + v10) = byte_410200[4 * (*(_BYTE *)(a1 + i - 1) & 0xF) + ((*(unsigned __int8 *)(a1 + i) >> 6) & 3)];v6 = v10 + 1;v10 += 2;*(_BYTE *)(a3 + v6) = byte_410200[*(_BYTE *)(a1 + i) & 0x3F];}else if ( !v3 ){v4 = v10++;*(_BYTE *)(a3 + v4) = byte_410200[(*(unsigned __int8 *)(a1 + i) >> 2) & 0x3F];}}v9 = i - 1;if ( v9 % 3 ){if ( v9 % 3 == 1 ){*(_BYTE *)(a3 + v10) = byte_410200[4 * (*(_BYTE *)(a1 + v9) & 0xF)];*(_BYTE *)(a3 + v10 + 1) = 61;}}else{*(_BYTE *)(a3 + v10) = byte_410200[16 * (*(_BYTE *)(a1 + v9) & 3)];*(_BYTE *)(a3 + v10 + 1) = 61;*(_BYTE *)(a3 + v10 + 2) = 61;}return 0;
}
变表base64, 拿板子秒了
import base64encodestr = '_r-+_Cl5;vgq_pdme7#7eC0='changebase64 = '@,.1fgvw#`/2ehux$~\"3dity%_;4cjsz^+{5bkrA&=}6alqB*-[70mpC()]89noD'
# print(len(changebase64))
originbase64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"trans_encodestr = encodestr.translate(str.maketrans(changebase64,originbase64))
flag = base64.b64decode(trans_encodestr)print(flag)
[watevrCTF 2019]Timeout
打开发现是一大堆数据, 打开方式不对, 尝试ELF64格式再打开
得到反编译伪码
int __cdecl main(int argc, const char **argv, const char **envp)
{signal(14, sig);alarm(1u);delay(6000000LL);can_continue = 1337;return 0;
}unsigned __int64 generate()
{char s[131]; // [rsp+0h] [rbp-B0h] BYREFchar v2[14]; // [rsp+83h] [rbp-2Dh] BYREFchar v3[31]; // [rsp+91h] [rbp-1Fh] BYREF*(_QWORD *)&v3[23] = __readfsqword(0x28u);if ( can_continue == 1337 ){s[64] = 35;s[65] = 60;s[66] = 73;s[67] = 100;s[68] = 85;s[69] = 46;s[70] = 119;s[71] = 32;s[72] = 45;s[73] = 115;s[74] = 63;s[75] = 125;s[76] = 44;s[77] = 56;s[78] = 108;s[79] = 83;s[80] = 84;s[81] = 42;s[82] = 90;s[83] = 106;s[84] = 87;s[85] = 58;s[86] = 102;s[87] = 94;s[88] = 77;s[89] = 54;s[90] = 101;s[91] = 110;s[92] = 112;s[93] = 104;s[94] = 99;s[95] = 47;s[96] = 79;s[97] = 118;s[98] = 37;s[99] = 75;s[100] = 11;s[101] = 52;s[102] = 76;s[103] = 82;s[104] = 103;s[105] = 96;s[106] = 95;s[107] = 69;s[108] = 123;s[109] = 114;s[110] = 59;s[111] = 126;s[112] = 74;s[113] = 10;s[114] = 107;s[115] = 113;s[116] = 67;s[117] = 36;s[118] = 92;s[119] = 40;s[120] = 34;s[121] = 64;s[122] = 50;s[123] = 68;s[124] = 98;s[125] = 80;s[126] = 13;s[127] = 38;s[128] = 49;s[129] = 55;s[130] = 12;qmemcpy(v2, "]y>=xaVYA[BF3", 13);v2[13] = (unsigned __int8)&unk_400BB4;strcpy(v3, "!tQHu0Xi5|\t9N+zmG)o");strcpy(s, "watevr{3ncrytion_is_overrated_youtube.com/watch?v=OPf0YbXqDm0}");puts(s);}return __readfsqword(0x28u) ^ *(_QWORD *)&v3[23];
}
主要逻辑就是经过delay(6000000LL);一大段时间, 最后generate函数直接给flag
[RoarCTF2019]polyre
main函数直接就是控制流平坦化
用修复后的脚本去混淆, 参考 https://ylcao.top/2022/01/16/%E7%AC%A6%E5%8F%B7%E6%89%A7%E8%A1%8C%E5%8E%BB%E6%8E%A7%E5%88%B6%E6%B5%81%E5%B9%B3%E5%9D%A6%E5%8C%96/
>python deflat.py attachment 0x400620
*******************relevant blocks************************
prologue: 0x400620
main_dispatcher: 0x40063f
pre_dispatcher: 0x4020cc
retn: 0x401f54
relevant_blocks: ['0x4015d4', '0x40201b', '0x401e00', '0x401f2d', '0x401481', '0x401c69', '0x401efa', '0x401830', '0x401642', '0x401f97', '0x40180b', '0x401eb9', '0x401748', '0x4013ef', '0x4012f6', '0x401fb5', '0x402033', '0x40197d', '0x40136c', '0x401a73', '0x401d9a', '0x40204d', '0x402096', '0x4015c5', '0x401567', '0x401909', '0x401f09', '0x401c2b', '0x4014ae', '0x40199b', '0x401435', '0x401fa6', '0x401861', '0x401b34', '0x401b5d', '0x401f3c', '0x401521', '0x401caf', '0x4013cf', '0x4014f7', '0x401f60', '0x401960', '0x4016a0', '0x4018a7', '0x4011de', '0x401739', '0x4020c2', '0x401506', '0x4019e1', '0x4014d2', '0x401d2d', '0x401849', '0x4017fc', '0x4017ab', '0x401b25', '0x402072', '0x401d03', '0x401ad3', '0x4015fc', '0x401926', '0x401b75', '0x401326', '0x4016e6', '0x401e0f', '0x40200c', '0x401e73', '0x4015b6', '0x401a3d', '0x401ff4', '0x401305', '0x401fe5', '0x401d54', '0x401198', '0x4013b2', '0x401c1c', '0x40124f', '0x401c46', '0x401490', '0x401a8d', '0x401b4e', '0x401d45', '0x401765', '0x401bbb', '0x4018fa', '0x401691', '0x401c0d', '0x4015ed', '0x401a4c', '0x401d12', '0x40125e', '0x401fcd', '0x4012a4', '0x401940', '0x4014e8', '0x401121', '0x401e2d', '0x401ed6', '0x4020b3', '0x401117']
*******************symbolic execution*********************
-------------------dse 0x4015d4---------------------
WARNING | 2023-09-25 22:23:16,740 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing register with an unspecified value. This could indicate unwanted behavior.
...
...
...
0x4012a4: ['0x4012f6', '0x401f97']
0x401940: ['0x401960']
0x4014e8: ['0x4015d4']
0x401121: ['0x401198']
0x401e2d: ['0x401e73', '0x4020c2']
0x401ed6: ['0x401efa']
0x4020b3: ['0x401d9a']
0x401117: ['0x4015d4']
0x400620: ['0x401121']
0x401f54: []
************************patch*****************************
Successful! The recovered file: attachment_recovered
打开之后, 发现还有不少花指令
IDApython去花, IDA API版本是7.4+
参考API更新文档进行脚本编写 https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
from idc import *st = 0x0000000000401117
end = 0x0000000000402144def patch_nop(start,end):for i in range(start,end):patch_byte(i, 0x90) def next_instr(addr):return addr + get_item_size(addr)addr = st
while(addr<end):next = next_instr(addr)if "ds:dword_603054" in GetDisasm(addr):while(True):addr = nextnext = next_instr(addr)if "jnz" in GetDisasm(addr):dest = get_operand_value(addr, 0)patch_byte(addr, 0xe9)patch_byte(addr+5, 0x90) offset = dest - (addr + 5)patch_dword(addr + 1, offset)print("patch bcf: 0x%x"%addr)addr = nextbreakelse:addr = nextprint('---- patching done ----')
最后还原出主要代码
__int64 __fastcall main(int a1, char **a2, char **a3)
{__int64 v3; // raxunsigned __int64 v4; // rcx__int64 v6; // [rsp+1E0h] [rbp-110h]int v7; // [rsp+1E8h] [rbp-108h]int v8; // [rsp+1ECh] [rbp-104h]char s1[48]; // [rsp+1F0h] [rbp-100h] BYREFchar s[60]; // [rsp+220h] [rbp-D0h] BYREFunsigned int v11; // [rsp+25Ch] [rbp-94h]char *v12; // [rsp+260h] [rbp-90h]int v13; // [rsp+288h] [rbp-68h]bool v14; // [rsp+28Fh] [rbp-61h]char *v15; // [rsp+290h] [rbp-60h]int v16; // [rsp+298h] [rbp-58h]bool v17; // [rsp+29Fh] [rbp-51h]__int64 v18; // [rsp+2A0h] [rbp-50h]bool v19; // [rsp+2AFh] [rbp-41h]__int64 v20; // [rsp+2B0h] [rbp-40h]__int64 v21; // [rsp+2B8h] [rbp-38h]__int64 v22; // [rsp+2C0h] [rbp-30h]__int64 v23; // [rsp+2C8h] [rbp-28h]int v24; // [rsp+2D0h] [rbp-20h]int v25; // [rsp+2D4h] [rbp-1Ch]char *v26; // [rsp+2D8h] [rbp-18h]int v27; // [rsp+2E0h] [rbp-10h]int v28; // [rsp+2E4h] [rbp-Ch]bool v29; // [rsp+2EBh] [rbp-5h]v11 = 0;memset(s, 0, 0x30uLL);memset(s1, 0, sizeof(s1));printf("Input:");v12 = s;v3 = 3824974737LL;v4 = 3788079310LL;
LABEL_7:v6 = v4 ^ v3;
LABEL_9:v24 = v8++;while ( 1 ){v16 = v8;v17 = v8 < 64;if ( v8 < 64 ){v18 = v6;v19 = v6 < 0;if ( v6 < 0 ){v20 = 2 * v6;v21 = 2 * v6;v3 = 2 * v6;v4 = 0xB0004B7679FA26B3LL;goto LABEL_7;}v22 = v6;v23 = 2 * v6;v6 *= 2LL;goto LABEL_9;}v25 = 8 * v7;v26 = &s1[8 * v7];*(_QWORD *)v26 = v6;v27 = ++v7;v13 = v7;v14 = v7 < 6;if ( v7 >= 6 )break;v15 = s;v6 = *(_QWORD *)&s[8 * v7];v8 = 0;}v28 = memcmp(s1, &unk_402170, 0x30uLL);v29 = v28 != 0;if ( v28 )puts("Wrong!");elseputs("Correct!");return v11;
}
CRC32编码, 输入 48 字节，平分 6 组，将每组 8 字节转化为 long 类型的值，对每组进行加密，先判断正负，然后将值乘 2，随后根据正负异或 0xB0004B7679FA26B3，循环 64 次，最后进行比较
checklist = ['96','62','53','43','6D','F2','8F','BC','16','EE','30','05','78','00','01','52','EC','08','5F','93','EA','B5','C0','4D','50','F4','53','D8','AF','90','2B','34','81','36','2C','AA','BC','0E','25','8B','E4','8A','C6','A2','81','9F','75','55'
]idx = 0
flag = ''
for i in range(6):v4 = '0x' + checklist[idx + 7] + checklist[idx + 6] + \checklist[idx + 5] + checklist[idx + 4] + checklist[idx + 3] + \checklist[idx + 2] + checklist[idx + 1] + checklist[idx]s = int(v4, 16)for j in range(64): if s & 1 == 1:s = ((s ^ int('0xB0004B7679FA26B3', 16)) >> 1) | 0x8000000000000000else:s = s >> 1idx = idx + 8j = 0while j < 8:flag += chr(s & 0xFF)s >>= 8j += 1print(flag)
[ACTF新生赛2020]fungame
int __cdecl sub_401340(int a1)
{char i; // [esp+1Fh] [ebp-9h]printf("Please input:");scanf("%s", a1);for ( i = 0; i <= 15; ++i ){if ( (*(_BYTE *)(i + a1) ^ *((_BYTE *)y1 + i)) != y2[i] )exit(0);}return 0;
}
逆
#include <stdio.h>unsigned char y2[] = {113, 4, 97, 88, 39, 30, 75, 34, 94, 100, 3, 38, 94, 23, 60, 122, 255, 255, 255, 255, 0, 64, 0, 0
};unsigned char y1[] = {35, 97, 62, 105, 84, 65, 24, 77, 110, 59, 101, 83, 48, 121, 69, 91
};int main() {char flag[17] = {0};for (int i = 0; i <= 15; ++i) {flag[i] = y1[i] ^ y2[i];}printf("%s\n", flag);
}
[羊城杯 2020]Bytecode
4 0 LOAD_CONST 0 (3)3 LOAD_CONST 1 (37)6 LOAD_CONST 2 (72)9 LOAD_CONST 3 (9)12 LOAD_CONST 4 (6)15 LOAD_CONST 5 (132)18 BUILD_LIST 621 STORE_NAME 0 (en)5 24 LOAD_CONST 6 (101)27 LOAD_CONST 7 (96)30 LOAD_CONST 8 (23)33 LOAD_CONST 9 (68)36 LOAD_CONST 10 (112)39 LOAD_CONST 11 (42)42 LOAD_CONST 12 (107)45 LOAD_CONST 13 (62)48 LOAD_CONST 7 (96)51 LOAD_CONST 14 (53)54 LOAD_CONST 15 (176)57 LOAD_CONST 16 (179)60 LOAD_CONST 17 (98)63 LOAD_CONST 14 (53)66 LOAD_CONST 18 (67)69 LOAD_CONST 19 (29)72 LOAD_CONST 20 (41)75 LOAD_CONST 21 (120)78 LOAD_CONST 22 (60)81 LOAD_CONST 23 (106)84 LOAD_CONST 24 (51)87 LOAD_CONST 6 (101)90 LOAD_CONST 25 (178)93 LOAD_CONST 26 (189)96 LOAD_CONST 6 (101)99 LOAD_CONST 27 (48)102 BUILD_LIST 26105 STORE_NAME 1 (output)7 108 LOAD_CONST 28 ('welcome to GWHT2020')111 PRINT_ITEM 112 PRINT_NEWLINE 9 113 LOAD_NAME 2 (raw_input)116 LOAD_CONST 29 ('please input your flag:')119 CALL_FUNCTION 1122 STORE_NAME 3 (flag)10 125 LOAD_NAME 3 (flag)128 STORE_NAME 4 (str)12 131 LOAD_NAME 5 (len)134 LOAD_NAME 4 (str)137 CALL_FUNCTION 1140 STORE_NAME 6 (a)13 143 LOAD_NAME 6 (a)146 LOAD_CONST 30 (38)149 COMPARE_OP 0 (<)152 POP_JUMP_IF_FALSE 17314 155 LOAD_CONST 31 ('lenth wrong!')158 PRINT_ITEM 159 PRINT_NEWLINE 15 160 LOAD_NAME 7 (exit)163 LOAD_CONST 32 (0)166 CALL_FUNCTION 1169 POP_TOP 170 JUMP_FORWARD 0 (to 173)17 >> 173 LOAD_NAME 8 (ord)176 LOAD_NAME 4 (str)179 LOAD_CONST 32 (0)182 BINARY_SUBSCR 183 CALL_FUNCTION 1186 LOAD_CONST 33 (2020)189 BINARY_MULTIPLY 190 LOAD_NAME 8 (ord)193 LOAD_NAME 4 (str)196 LOAD_CONST 34 (1)199 BINARY_SUBSCR 200 CALL_FUNCTION 1203 BINARY_ADD 204 LOAD_CONST 33 (2020)207 BINARY_MULTIPLY 208 LOAD_NAME 8 (ord)211 LOAD_NAME 4 (str)214 LOAD_CONST 35 (2)217 BINARY_SUBSCR 218 CALL_FUNCTION 1221 BINARY_ADD 222 LOAD_CONST 33 (2020)225 BINARY_MULTIPLY 226 LOAD_NAME 8 (ord)229 LOAD_NAME 4 (str)232 LOAD_CONST 0 (3)235 BINARY_SUBSCR 236 CALL_FUNCTION 1239 BINARY_ADD 240 LOAD_CONST 33 (2020)243 BINARY_MULTIPLY 244 LOAD_NAME 8 (ord)247 LOAD_NAME 4 (str)250 LOAD_CONST 36 (4)253 BINARY_SUBSCR 254 CALL_FUNCTION 1257 BINARY_ADD 258 LOAD_CONST 37 (1182843538814603)261 COMPARE_OP 2 (==)264 POP_JUMP_IF_FALSE 27518 267 LOAD_CONST 38 ('good!continue\xe2\x80\xa6\xe2\x80\xa6')270 PRINT_ITEM 271 PRINT_NEWLINE 272 JUMP_FORWARD 15 (to 290)20 >> 275 LOAD_CONST 39 ('bye~')278 PRINT_ITEM 279 PRINT_NEWLINE 21 280 LOAD_NAME 7 (exit)283 LOAD_CONST 32 (0)286 CALL_FUNCTION 1289 POP_TOP 23 >> 290 BUILD_LIST 0293 STORE_NAME 9 (x)24 296 LOAD_CONST 40 (5)299 STORE_NAME 10 (k)25 302 SETUP_LOOP 128 (to 433)305 LOAD_NAME 11 (range)308 LOAD_CONST 41 (13)311 CALL_FUNCTION 1314 GET_ITER >> 315 FOR_ITER 114 (to 432)318 STORE_NAME 12 (i)26 321 LOAD_NAME 8 (ord)324 LOAD_NAME 4 (str)327 LOAD_NAME 10 (k)330 BINARY_SUBSCR 331 CALL_FUNCTION 1334 STORE_NAME 13 (b)27 337 LOAD_NAME 8 (ord)340 LOAD_NAME 4 (str)343 LOAD_NAME 10 (k)346 LOAD_CONST 34 (1)349 BINARY_ADD 350 BINARY_SUBSCR 351 CALL_FUNCTION 1354 STORE_NAME 14 (c)28 357 LOAD_NAME 14 (c)360 LOAD_NAME 0 (en)363 LOAD_NAME 12 (i)366 LOAD_CONST 4 (6)369 BINARY_MODULO 370 BINARY_SUBSCR 371 BINARY_XOR 372 STORE_NAME 15 (a11)29 375 LOAD_NAME 13 (b)378 LOAD_NAME 0 (en)381 LOAD_NAME 12 (i)384 LOAD_CONST 4 (6)387 BINARY_MODULO 388 BINARY_SUBSCR 389 BINARY_XOR 390 STORE_NAME 16 (a22)30 393 LOAD_NAME 9 (x)396 LOAD_ATTR 17 (append)399 LOAD_NAME 15 (a11)402 CALL_FUNCTION 1405 POP_TOP 31 406 LOAD_NAME 9 (x)409 LOAD_ATTR 17 (append)412 LOAD_NAME 16 (a22)415 CALL_FUNCTION 1418 POP_TOP 32 419 LOAD_NAME 10 (k)422 LOAD_CONST 35 (2)425 INPLACE_ADD 426 STORE_NAME 10 (k)429 JUMP_ABSOLUTE 315>> 432 POP_BLOCK 33 >> 433 LOAD_NAME 9 (x)436 LOAD_NAME 1 (output)439 COMPARE_OP 2 (==)442 POP_JUMP_IF_FALSE 45334 445 LOAD_CONST 38 ('good!continue\xe2\x80\xa6\xe2\x80\xa6')448 PRINT_ITEM 449 PRINT_NEWLINE 450 JUMP_FORWARD 15 (to 468)36 >> 453 LOAD_CONST 42 ('oh,you are wrong!')456 PRINT_ITEM 457 PRINT_NEWLINE 37 458 LOAD_NAME 7 (exit)461 LOAD_CONST 32 (0)464 CALL_FUNCTION 1467 POP_TOP 39 >> 468 LOAD_NAME 5 (len)471 LOAD_NAME 4 (str)474 CALL_FUNCTION 1477 STORE_NAME 18 (l)40 480 LOAD_NAME 8 (ord)483 LOAD_NAME 4 (str)486 LOAD_NAME 18 (l)489 LOAD_CONST 43 (7)492 BINARY_SUBTRACT 493 BINARY_SUBSCR 494 CALL_FUNCTION 1497 STORE_NAME 19 (a1)41 500 LOAD_NAME 8 (ord)503 LOAD_NAME 4 (str)506 LOAD_NAME 18 (l)509 LOAD_CONST 4 (6)512 BINARY_SUBTRACT 513 BINARY_SUBSCR 514 CALL_FUNCTION 1517 STORE_NAME 20 (a2)42 520 LOAD_NAME 8 (ord)523 LOAD_NAME 4 (str)526 LOAD_NAME 18 (l)529 LOAD_CONST 40 (5)532 BINARY_SUBTRACT 533 BINARY_SUBSCR 534 CALL_FUNCTION 1537 STORE_NAME 21 (a3)43 540 LOAD_NAME 8 (ord)543 LOAD_NAME 4 (str)546 LOAD_NAME 18 (l)549 LOAD_CONST 36 (4)552 BINARY_SUBTRACT 553 BINARY_SUBSCR 554 CALL_FUNCTION 1557 STORE_NAME 22 (a4)44 560 LOAD_NAME 8 (ord)563 LOAD_NAME 4 (str)566 LOAD_NAME 18 (l)569 LOAD_CONST 0 (3)572 BINARY_SUBTRACT 573 BINARY_SUBSCR 574 CALL_FUNCTION 1577 STORE_NAME 23 (a5)45 580 LOAD_NAME 8 (ord)583 LOAD_NAME 4 (str)586 LOAD_NAME 18 (l)589 LOAD_CONST 35 (2)592 BINARY_SUBTRACT 593 BINARY_SUBSCR 594 CALL_FUNCTION 1597 STORE_NAME 24 (a6)46 600 LOAD_NAME 19 (a1)603 LOAD_CONST 0 (3)606 BINARY_MULTIPLY 607 LOAD_NAME 20 (a2)610 LOAD_CONST 35 (2)613 BINARY_MULTIPLY 614 BINARY_ADD 615 LOAD_NAME 21 (a3)618 LOAD_CONST 40 (5)621 BINARY_MULTIPLY 622 BINARY_ADD 623 LOAD_CONST 44 (1003)626 COMPARE_OP 2 (==)629 POP_JUMP_IF_FALSE 80747 632 LOAD_NAME 19 (a1)635 LOAD_CONST 36 (4)638 BINARY_MULTIPLY 639 LOAD_NAME 20 (a2)642 LOAD_CONST 43 (7)645 BINARY_MULTIPLY 646 BINARY_ADD 647 LOAD_NAME 21 (a3)650 LOAD_CONST 3 (9)653 BINARY_MULTIPLY 654 BINARY_ADD 655 LOAD_CONST 45 (2013)658 COMPARE_OP 2 (==)661 POP_JUMP_IF_FALSE 80748 664 LOAD_NAME 19 (a1)667 LOAD_NAME 20 (a2)670 LOAD_CONST 46 (8)673 BINARY_MULTIPLY 674 BINARY_ADD 675 LOAD_NAME 21 (a3)678 LOAD_CONST 35 (2)681 BINARY_MULTIPLY 682 BINARY_ADD 683 LOAD_CONST 47 (1109)686 COMPARE_OP 2 (==)689 POP_JUMP_IF_FALSE 80449 692 LOAD_NAME 22 (a4)695 LOAD_CONST 0 (3)698 BINARY_MULTIPLY 699 LOAD_NAME 23 (a5)702 LOAD_CONST 35 (2)705 BINARY_MULTIPLY 706 BINARY_ADD 707 LOAD_NAME 24 (a6)710 LOAD_CONST 40 (5)713 BINARY_MULTIPLY 714 BINARY_ADD 715 LOAD_CONST 48 (671)718 COMPARE_OP 2 (==)721 POP_JUMP_IF_FALSE 80150 724 LOAD_NAME 22 (a4)727 LOAD_CONST 36 (4)730 BINARY_MULTIPLY 731 LOAD_NAME 23 (a5)734 LOAD_CONST 43 (7)737 BINARY_MULTIPLY 738 BINARY_ADD 739 LOAD_NAME 24 (a6)742 LOAD_CONST 3 (9)745 BINARY_MULTIPLY 746 BINARY_ADD 747 LOAD_CONST 49 (1252)750 COMPARE_OP 2 (==)753 POP_JUMP_IF_FALSE 79851 756 LOAD_NAME 22 (a4)759 LOAD_NAME 23 (a5)762 LOAD_CONST 46 (8)765 BINARY_MULTIPLY 766 BINARY_ADD 767 LOAD_NAME 24 (a6)770 LOAD_CONST 35 (2)773 BINARY_MULTIPLY 774 BINARY_ADD 775 LOAD_CONST 50 (644)778 COMPARE_OP 2 (==)781 POP_JUMP_IF_FALSE 79552 784 LOAD_CONST 51 ('congraduation!you get the right flag!')787 PRINT_ITEM 788 PRINT_NEWLINE 789 JUMP_ABSOLUTE 795792 JUMP_ABSOLUTE 798>> 795 JUMP_ABSOLUTE 801>> 798 JUMP_ABSOLUTE 804>> 801 JUMP_ABSOLUTE 807>> 804 JUMP_FORWARD 0 (to 807)>> 807 LOAD_CONST 52 (None)810 RETURN_VALUE
bytecode 逆向, 直接读字节码, 人工还原到python源码, 没有现成的工具(有机会可以写一个), 唯硬逆一途
en = [3, 37, 72, 9, 6, 132]
output = [101, 96, 23, 68, 112, 42, 107, 62, 96, 53, 176, 179,98, 53, 67, 29, 41, 120, 60, 106, 51, 101, 178, 189, 101, 48]print('welcome to GWHT2020')flag = input('please input your flag:')
str = flaga = len(str)
if a < 38:print('lenth wrong!')exit(0)if ord(str[0]) + 2020 * ord(str[1]) + 2020 * ord(str[3]) + 2020 * ord(str[4]) == 1182843538814603:print('good!continue\xe2\x80\xa6\xe2\x80\xa6')
else:print('bye~')exit(0)x = []
k = 5
for i in range(13):b = ord(str[k])c = ord(str[k + 1])a11 = c ^ en[i % 6]a22 = b ^ en[i % 6]x.append(a11)x.append(a22)k += 2
if x == output:print('good!continue\xe2\x80\xa6\xe2\x80\xa6')
else:print('oh,you are wrong!')exit(0)l = len(str)
a1 = ord(str[l - 7])
a2 = ord(str[l - 6])
a3 = ord(str[l - 5])
a4 = ord(str[l - 4])
a5 = ord(str[l - 3])
a6 = ord(str[l - 2])
if a1 * 3 + a2 * 2 + a3 * 5 == 1003:if a1 * 4 + a2 * 7 + a3 * 9 == 2013:if a1 + a2 * 8 + a3 * 2 == 1109:if a1 * 3 + a5 * 2 + a6 * 5 == 671:if a4 * 4 + a5 * 7 + a6 * 9 == 1252:if a4 + a5 * 8 + a6 * 2 == 644:print('congraduation!you get the right flag!')
z3解方程
import z3
s = z3.Solver()en = [3, 37, 72, 9, 6, 132]
output = [101, 96, 23, 68, 112, 42, 107, 62, 96, 53, 176, 179,98, 53, 67, 29, 41, 120, 60, 106, 51, 101, 178, 189, 101, 48]flag = [z3.Int(f'a{x}') for x in range(45)]
t1 = flag[0] * 2020 + flag[1]
t2 = t1 * 2020 + flag[2]
t3 = t2 * 2020 + flag[3]
t4 = t3 * 2020 + flag[4]
s.add(t4 == 1182843538814603)for i in range(5):s.add(flag[i] > 0)s.add(flag[i] < 128)k = 5
for i in range(13):s.add(flag[k+1] == output[2*i] ^ en[i % 6])s.add(flag[k] == output[2*i+1] ^ en[i % 6])k += 2l = len(flag)
a1 = flag[l - 7]
a2 = flag[l - 6]
a3 = flag[l - 5]
a4 = flag[l - 4]
a5 = flag[l - 3]
a6 = flag[l - 2]
s.add((a1 * 3 + a2 * 2 + a3 * 5) == 1003)
s.add((a1 * 4 + a2 * 7 + a3 * 9) == 2013)
s.add((a1 + a2 * 8 + a3 * 2) == 1109)
s.add((a4 * 3 + a5 * 2 + a6 * 5) == 671)
s.add((a4 * 4 + a5 * 7 + a6 * 9) == 1252)
s.add((a4 + a5 * 8 + a6 * 2) == 644)for i in flag:s.add(i > 0)s.add(i < 128)c = s.check()
if c == z3.unsat:print('fail')
else:model = s.model()result = {}for x in model:key = int(str(x).replace('a', ''))result[key] = model[x]flag_result = [result[x].as_long() for x in sorted(result)]flag_result = [chr(x) for x in flag_result]print(''.join(flag_result))
# GWHT{cfa2b87b3f746a8f0ac5c5963faeff73
