BUU的XXOR

re_halo

已于 2024-05-06 10:03:23 修改

阅读量214

点赞数 3

文章标签：安全网络安全

于 2024-05-05 23:21:19 首次发布

本文链接：https://blog.csdn.net/2302_79135465/article/details/138476120

版权

文章内容展示了如何使用C++中的z3库进行数值计算，并实现了一个名为xxtea的加密函数的逆过程，同时讨论了在处理移位操作时需要考虑的溢出和小端排序问题。

摘要由CSDN通过智能技术生成

from z3 import *

a1, a2, a3, a4, a5, a6 = Ints('a1 a2 a3 a4 a5 a6')
s = Solver()
s.add(a3 - a4 == 2225223423)
s.add(a4 + a5 == 4201428739)
s.add(a3 - a5 == 1121399208)
s.add(a1 == -548868226)
s.add(a6 == -2064448480)
s.add(a2 == 550153460)
if (s.check() == sat):
    print(s.model())
else:
    print("false")
# [a3 = 3774025685,
#  a2 = 550153460,
#  a6 = -2064448480,
#  a1 = -548868226,
#  a4 = 1548802262,
#  a5 = 2652626477]

然后就是逆那个xxtea了

__int64 __fastcall sub_400686(unsigned int *a1, _DWORD *a2)
{
  __int64 result; // rax
  unsigned int v3; // [rsp+1Ch] [rbp-24h]
  unsigned int v4; // [rsp+20h] [rbp-20h]
  int v5; // [rsp+24h] [rbp-1Ch]
  unsigned int i; // [rsp+28h] [rbp-18h]

  v3 = *a1;
  v4 = a1[1];
  v5 = 0;
  for ( i = 0; i <= 0x3F; ++i )
  {
    v5 += 1166789954;
    v3 += (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
    v4 += (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
  }
  *a1 = v3;
  result = v4;
  a1[1] = v4;
  return result;
}

#include <iostream>

#pragma warning(disable:4996)
using namespace std;

int main()
{
    __int64 a[6] = { 3746099070, 550153460, 3774025685, 1548802262, 2652626477, 2230518816 };
    unsigned int a2[4] = { 2,2,3,4 };
    unsigned int v3, v4;
    int v5;
    for (int j = 0; j <= 4; j += 2) {
        v3 = a[j];
        v4 = a[j + 1];
        v5 = 1166789954 * 0x40;
        for (int i = 0; i <= 0x3F; ++i) {
            v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
            v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
            v5 -= 1166789954;
        }
        a[j] = v3;
        a[j + 1] = v4;
    }

    /*将整型数组作为字符输出，注意计算机小端排序*/
    for (int i = 0; i < 6; ++i) {
        cout << *((char*)&a[i] + 2) << *((char*)&a[i] + 1) << *((char*)&a[i]);
    }
    return 0;
}

得到flag

对于移位这些操作，Python可能需要额外考虑溢出和符号问题，故用c++

还有就是端序问题

https://www.ruanyifeng.com/blog/2016/11/byte-order.html