西湖论剑reverse第三题

  memset(Str, 0, sizeof(Str));
  memset(Buf2, 0, sizeof(Buf2));
  sub_401650("Input:", v4);
  sub_4016A0("%40s", (char)Str);
  if ( strlen(Str) != 40 )
    exit(0);
  for ( i = 0; i < 0x28; i += 8 )  //循环5次
  {
    for ( j = 0; j < 8; ++j )//每8个为一组做一次循环
    {
      v5 = ((v6[j] & Str[i + 3]) << (8 - (3 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 3]) >> ((3 - j) % 8u)) | ((v6[j] & Str[i + 2]) << (8 - (2 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 2]) >> ((2 - j) % 8u)) | ((v6[j] & Str[i + 1]) << (8 - (1 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 1]) >> ((1 - j) % 8u)) | ((v6[j] & (unsigned __int8)Str[i]) << (8 - -j % 8u)) | ((v6[j] & (unsigned int)Str[i]) >> (-j % 8u));
      Buf2[j + i] = byte_405000[(unsigned __int8)(((v6[j] & (unsigned __int8)Str[i + 7]) << (8 - (7 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 7]) >> ((7 - j) % 8u)) | ((v6[j] & Str[i + 6]) << (8 - (6 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 6]) >> ((6 - j) % 8u)) | ((v6[j] & Str[i + 5]) << (8 - (5 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 5]) >> ((5 - j) % 8u)) | ((v6[j] & Str[i + 4]) << (8 - (4 - j) % 8u)) | ((v6[j] & (unsigned int)Str[i + 4]) >> ((4 - j) % 8u)) | v5)];
    }
  }   //字符做左右偏移
  if ( memcmp(&unk_405100, Buf2, 0x28u) )
  {   //memcmp函数的原型为 int memcmp(const void *str1, const void *str2, size_t n));其功能是把存储区 str1 和存储区 str2 的前 n 个字节进行比较。该函数是按字节比较的,位于string.h。
    puts("Wrong");
    exit(0);
  }
  puts("Congratulations");
  puts("flag is DASCTF{your input}");
  return 0;
}
 if ( memcmp(&unk_405100, Buf2, 40u) )
  {
    puts("Wrong");
    exit(0);

memcmp函数的原型为 int memcmp(const void *str1, const void *str2, size_t n));其功能是把存储区 str1 和存储区 str2 的前 n 个字节进行比较。该函数是按字节比较的,位于string.h。&unk_405100Buf2进行比较,比较前40位

根据unk对应调用index打印出byte的下标

st2=[0x65,0x55,0x24,0x36,0x9D,0x71,0xB8,0xC8,0x65,0xFB,0x87,0x7F,0x9A,0x9C,0xB1,0xDF,
0x65,0x8F,0x9D,0x39,0x8F,0x11,0xF6,0x8E,0x65,0x42,0xDA,0xB4,0x8C,0x39,0xFB,0x99,
0x65,0x48,0x6A,0xCA,0x63,0xE7,0xA4,0x79,0xFF,0xFF,0xFF,0xFF,0x01,0x00,0x00,0x00,
0xB1,0x19,0xBF,0x44,0x4E,0xE6,0x40,0xBB,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00]


byte=[0x65,0x08,0xF7,0x12,0xBC,0xC3,0xCF,0xB8,0x83,0x7B,0x02,0xD5,0x34,0xBD,0x9F,0x33,
0x77,0x76,0xD4,0xD7,0xEB,0x90,0x89,0x5E,0x54,0x01,0x7D,0xF4,0x11,0xFF,0x99,0x49,
0xAD,0x57,0x46,0x67,0x2A,0x9D,0x7F,0xD2,0xE1,0x21,0x8B,0x1D,0x5A,0x91,0x38,0x94,
0xF9,0x0C,0x00,0xCA,0xE8,0xCB,0x5F,0x19,0xF6,0xF0,0x3C,0xDE,0xDA,0xEA,0x9C,0x14,
0x75,0xA4,0x0D,0x25,0x58,0xFC,0x44,0x86,0x05,0x6B,0x43,0x9A,0x6D,0xD1,0x63,0x98,
0x68,0x2D,0x52,0x3D,0xDD,0x88,0xD6,0xD0,0xA2,0xED,0xA5,0x3B,0x45,0x3E,0xF2,0x22,
0x06,0xF3,0x1A,0xA8,0x09,0xDC,0x7C,0x4B,0x5C,0x1E,0xA1,0xB0,0x71,0x04,0xE2,0x9B,
0xB7,0x10,0x4E,0x16,0x23,0x82,0x56,0xD8,0x61,0xB4,0x24,0x7E,0x87,0xF8,0x0A,0x13,
0xE3,0xE4,0xE6,0x1C,0x35,0x2C,0xB1,0xEC,0x93,0x66,0x03,0xA9,0x95,0xBB,0xD3,0x51,
0x39,0xE7,0xC9,0xCE,0x29,0x72,0x47,0x6C,0x70,0x15,0xDF,0xD9,0x17,0x74,0x3F,0x62,
0xCD,0x41,0x07,0x73,0x53,0x85,0x31,0x8A,0x30,0xAA,0xAC,0x2E,0xA3,0x50,0x7A,0xB5,
0x8E,0x69,0x1F,0x6A,0x97,0x55,0x3A,0xB2,0x59,0xAB,0xE0,0x28,0xC0,0xB3,0xBE,0xCC,
0xC6,0x2B,0x5B,0x92,0xEE,0x60,0x20,0x84,0x4D,0x0F,0x26,0x4A,0x48,0x0B,0x36,0x80,
0x5D,0x6F,0x4C,0xB9,0x81,0x96,0x32,0xFD,0x40,0x8D,0x27,0xC1,0x78,0x4F,0x79,0xC8,
0x0E,0x8C,0xE5,0x9E,0xAE,0xBF,0xEF,0x42,0xC5,0xAF,0xA0,0xC2,0xFA,0xC7,0xB6,0xDB,
0x18,0xC4,0xA6,0xFE,0xE9,0xF5,0x6E,0x64,0x2F,0xF1,0x1B,0xFB,0xBA,0xA7,0x37,0x8F]

x = [128, 64, 32, 16, 8, 4, 2, 1]
ind = []
for i in st2:
        ind.append(byte.index(i))
print(ind)

字符左右偏移代码

for i in range(0,len(st2),8):
        t = 0
        c=0
        for j in x:
                out = "s.add(%d == ((%d & n7) << %d) | ((%d & n7) >> %d) | ((%d & n6) << %d) | ((%d & n6) >> %d) | ((%d & n5) << %d) "\
                      "| ((%d & n5) >> %d)| ((%d & n4) << %d) | ((%d & n4) >> %d) | ((%d & n3) << %d) | ((%d & n3) >> %d) "\
                      "| ((%d & n2) << %d) | ((%d & n2) >> %d) | ((%d & n1) << %d) | ((%d & n1) >> %d) | ((%d & n0) << %d) | ((%d & n0) >> %d))"
                print(out%(ind[i+t],j,(8-(7-c))%8,j,(7-c)%8, j,(8-(6-c))%8 ,j,(6-c)%8, j,(8-(5-c))%8,j,(5-c)%8, j,(8-(4-c))%8,j,(4-c)%8, j,(8-(3-c))%8,j,(3-c)%8,  j,(8-(2-c))%8, j,(2-c)%8,  j,(8-(1-c))%8,j,(1-c)%8, j,(8-(0-c))%8,j,(0-c)%8))
                t += 1
                c+=1

        print("")

运行

[0, 181, 122, 206, 37, 108, 7, 223, 0, 251, 124, 38, 75, 62, 134, 154, 0, 255, 37, 144, 255, 28, 56, 176, 0, 231, 60, 121, 225, 144, 251, 30, 0, 204, 179, 51, 78, 145, 65, 222, 29, 29, 29, 29, 25, 50, 50, 50, 134, 55, 229, 70, 114, 130, 216, 141, 25, 50, 50, 50, 25, 50, 50, 50]
s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(181 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(122 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(206 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(37 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(108 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(7 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(223 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(251 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(124 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(38 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(75 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(62 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(134 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(154 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(255 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(37 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(144 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(255 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(28 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(56 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(176 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(231 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(60 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(121 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(225 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(144 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(251 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(30 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(204 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(179 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(51 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(78 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(145 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(65 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(222 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(29 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(29 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(29 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(29 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(25 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(50 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(50 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(50 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(134 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(55 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(229 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(70 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(114 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(130 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(216 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(141 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

s.add(25 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(50 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(50 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(50 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(25 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(50 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(50 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(50 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))


用z3解方程组,每组单独 打印

from z3 import*
n0= BitVec('n0', 8)
n1 = BitVec('n1', 8)
n2 = BitVec('n2', 8)
n3 = BitVec('n3', 8)
n4 = BitVec('n4', 8)
n5 = BitVec('n5', 8)
n6 = BitVec('n6', 8)
n7 = BitVec('n7', 8)
s=Solver()


s.add(0 == ((128 & n7) << 1) | ((128 & n7) >> 7) | ((128 & n6) << 2) | ((128 & n6) >> 6) | ((128 & n5) << 3) | ((128 & n5) >> 5)| ((128 & n4) << 4) | ((128 & n4) >> 4) | ((128 & n3) << 5) | ((128 & n3) >> 3) | ((128 & n2) << 6) | ((128 & n2) >> 2) | ((128 & n1) << 7) | ((128 & n1) >> 1) | ((128 & n0) << 0) | ((128 & n0) >> 0))
s.add(251 == ((64 & n7) << 2) | ((64 & n7) >> 6) | ((64 & n6) << 3) | ((64 & n6) >> 5) | ((64 & n5) << 4) | ((64 & n5) >> 4)| ((64 & n4) << 5) | ((64 & n4) >> 3) | ((64 & n3) << 6) | ((64 & n3) >> 2) | ((64 & n2) << 7) | ((64 & n2) >> 1) | ((64 & n1) << 0) | ((64 & n1) >> 0) | ((64 & n0) << 1) | ((64 & n0) >> 7))
s.add(124 == ((32 & n7) << 3) | ((32 & n7) >> 5) | ((32 & n6) << 4) | ((32 & n6) >> 4) | ((32 & n5) << 5) | ((32 & n5) >> 3)| ((32 & n4) << 6) | ((32 & n4) >> 2) | ((32 & n3) << 7) | ((32 & n3) >> 1) | ((32 & n2) << 0) | ((32 & n2) >> 0) | ((32 & n1) << 1) | ((32 & n1) >> 7) | ((32 & n0) << 2) | ((32 & n0) >> 6))
s.add(38 == ((16 & n7) << 4) | ((16 & n7) >> 4) | ((16 & n6) << 5) | ((16 & n6) >> 3) | ((16 & n5) << 6) | ((16 & n5) >> 2)| ((16 & n4) << 7) | ((16 & n4) >> 1) | ((16 & n3) << 0) | ((16 & n3) >> 0) | ((16 & n2) << 1) | ((16 & n2) >> 7) | ((16 & n1) << 2) | ((16 & n1) >> 6) | ((16 & n0) << 3) | ((16 & n0) >> 5))
s.add(75 == ((8 & n7) << 5) | ((8 & n7) >> 3) | ((8 & n6) << 6) | ((8 & n6) >> 2) | ((8 & n5) << 7) | ((8 & n5) >> 1)| ((8 & n4) << 0) | ((8 & n4) >> 0) | ((8 & n3) << 1) | ((8 & n3) >> 7) | ((8 & n2) << 2) | ((8 & n2) >> 6) | ((8 & n1) << 3) | ((8 & n1) >> 5) | ((8 & n0) << 4) | ((8 & n0) >> 4))
s.add(62 == ((4 & n7) << 6) | ((4 & n7) >> 2) | ((4 & n6) << 7) | ((4 & n6) >> 1) | ((4 & n5) << 0) | ((4 & n5) >> 0)| ((4 & n4) << 1) | ((4 & n4) >> 7) | ((4 & n3) << 2) | ((4 & n3) >> 6) | ((4 & n2) << 3) | ((4 & n2) >> 5) | ((4 & n1) << 4) | ((4 & n1) >> 4) | ((4 & n0) << 5) | ((4 & n0) >> 3))
s.add(134 == ((2 & n7) << 7) | ((2 & n7) >> 1) | ((2 & n6) << 0) | ((2 & n6) >> 0) | ((2 & n5) << 1) | ((2 & n5) >> 7)| ((2 & n4) << 2) | ((2 & n4) >> 6) | ((2 & n3) << 3) | ((2 & n3) >> 5) | ((2 & n2) << 4) | ((2 & n2) >> 4) | ((2 & n1) << 5) | ((2 & n1) >> 3) | ((2 & n0) << 6) | ((2 & n0) >> 2))
s.add(154 == ((1 & n7) << 0) | ((1 & n7) >> 0) | ((1 & n6) << 1) | ((1 & n6) >> 7) | ((1 & n5) << 2) | ((1 & n5) >> 6)| ((1 & n4) << 3) | ((1 & n4) >> 5) | ((1 & n3) << 4) | ((1 & n3) >> 4) | ((1 & n2) << 5) | ((1 & n2) >> 3) | ((1 & n1) << 6) | ((1 & n1) >> 2) | ((1 & n0) << 7) | ((1 & n0) >> 1))

print (s.check())
ans = s.model()
so = [n0, n1, n2, n3, n4, n5, n6, n7]
for i in so:
    print(ans[i], end=", ")

五组合并打印成字符串

n = [81, 53, 108, 97, 53, 95, 51, 75,
    67, 104, 116, 101, 109, 54, 95, 72,
     89, 72, 107, 95, 78, 108, 72, 104,
     78, 90, 122, 55, 51, 97, 67, 90,
     101, 75, 48, 53, 73, 73, 57, 54]
for i in n:
    print(chr(i), end="")

运行

Q5la5_3KChtem6_HYHk_NlHhNZz73aCZeK05II96

在这里插入图片描述
DASCTF{Q5la5_3KChtem6_HYHk_NlHhNZz73aCZeK05II96}

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值