[0xGame 2023]

REVERSE

[Week 1]赛博天尊

from z3 import *

flag = [BitVec("num[%d]" % i, 32) for i in range(5)]
s = Solver()
s.add(7 * flag[2] + 5 * (flag[1] + flag[4]) + 2 * (flag[3] + 4 * flag[0]) == 0x12021DE669FC2,
      flag[1] + 2 * (flag[2] + flag[3] + 2 * flag[3] + 2 * (flag[4] + flag[0])) + (
              flag[2] + flag[3] + 2 * flag[3] + 2 * (flag[4] + flag[0])) == 0x159BFFC17D045,
      flag[3] + flag[2] + flag[4] + 2 * flag[2] + 2 * (flag[2] + flag[4] + 2 * flag[2]) + 2 * (
              flag[1] + 4 * flag[0]) == 0xACE320D12501,
      flag[1] + 2 * (flag[0] + flag[4] + flag[2] + 2 * flag[3]) == 0x733FFEB3A4FA,
      flag[1] + 7 * flag[4] + 8 * (flag[2] + flag[3]) + 5 * flag[0] == 0x1935EBA54EB28)
if s.check() == sat:
    s = s.model()
    print(s)
    for i in flag:
        print(hex(s[i].as_long())[2:], end='-')

[Week 3] 代码启示录

[Week 3] 旋转密码城

enc = "_Iv2>6L424c_4c2\\f__5\\7fec\\da32\\3ef2`cgd4b46N"
for i in range(len(enc)):
    if 33 <= ord(enc[i]) <= 126:
        tmp = (ord(enc[i]) - 47)
        if 33 <= tmp <= 125:
            print(chr(tmp), end='')
        else:
            print(chr(tmp + 94), end='')
    else:
        print(enc[i], end='')

[Week 3] 数字幽灵城

import base58

enc = "RmC442S4tDMzc3CvzoCx8toKodL8SE8GRQSmz8M84k6g9jG1vVrf3c5TECZR"
new_table = 'ABCDEFGHJKLMNPQRSTUVWXYZ123456789abcdefghijkmnopqrstuvwxyz'
old_table = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
print(base58.b58decode(enc.translate(str.maketrans(new_table, old_table))))

[Week 3] 变量迷城

求出x

from z3 import *

s = Solver()
x, y = Ints('x y')
s.add(0 == x ** 2 + y ** 2 * 2 + x * 3 + y * 4 - 7384462351178,
      0 == x ** 2 * 5 + y ** 2 * 6 + x * 7 + y * 8 - 22179606057658)
if s.check() == sat:
    s = s.model()
    print(s)

import gmpy2


def BigInteger(value):
    return gmpy2.mpz(value)


def decrypt_flag(encrypted_flag, java_class_version, system_var):
    key = str(java_class_version) + system_var
    flag = []
    for i in range(len(encrypted_flag)):
        flag.append(chr(encrypted_flag[i] ^ ord(key[i % len(key)])))
    return ''.join(flag)


encryptedFlag = [1, 73, 115, 84, 92, 81, 75, 65, 116, 84, 90, 93, 7, 2, 87, 24, 83, 87, 84, 64, 106, 4, 9, 86, 84, 28,
                 4, 5, 9, 82, 29, 74, 119, 85, 93, 1, 3, 84, 0, 0, 1, 0, 3, 5]
java_class_version = BigInteger(114514)
system_var = "0xGame"

decrypted_flag = decrypt_flag(encryptedFlag, java_class_version, system_var)
print(decrypted_flag)

[Week 3] 虚构核心

from pwn import xor
key = b"The0xGameKey"
c = open('encrypted.dex','rb').read()
open('decrypted.dex','wb').write(xor(c, key))

import hashlib
import itertools
import string

enc = ['69b4fa3be19bdf400df34e41b93636a4', '76b662c5c3d6d98035190115d89ef42f', '87fff610a9c97ebbe5a16a6d4865c0e4']
cout = 0
for flag in itertools.product(string.printable, repeat=4):
    dec = ''.join(flag)
    flag = hashlib.md5(dec.encode()).hexdigest()
    if flag == enc[0]:
        enc[0] = str(dec)
        cout += 1
    if flag == enc[1]:
        enc[1] = str(dec)
        cout += 1
    if flag == enc[2]:
        enc[2] = str(dec)
        cout += 1
    if cout == 3:
        break
enc.insert(0, '0xGame{f5bf50a3')
enc.append('f3eddaccb39f}')
print('-'.join(enc))

[Week 4] 序列9-二进制学徒

用010Editor打开

[Week 4] 序列8-代码悟道者

import base64

enc = 'MH7HYWrb4p2oYpYtMcEvLTb8Np2jOD2mMoqqYTauLTatYTarMWYvMp7bMdq='
new = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_"
old = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
print(base64.b64decode(enc.translate(str.maketrans(new, old))))

[Week 4] 序列7-指令神使

def rot13_decrypt(ciphertext: str) -> str:
    plaintext = ""
    for c in ciphertext:
        if c.isalpha():
            if c.isupper():
                new_ascii = (ord(c) - 65 - 13) % 26 + 65
            else:
                new_ascii = (ord(c) - 97 - 13) % 26 + 97
            plaintext += chr(new_ascii)
        else:
            plaintext += c
    return plaintext


enc = "2561p620-9462-6353-rq59-03340n99o7po}"
print("0xGame{" + rot13_decrypt(enc))

[Week 4] 序列5-算法祭司

动调得到iv和key

import base64

from Crypto.Cipher import DES


def decrypt(ciphertext, key):
    iv = b"STV>!'+#"
    cipher = DES.new(key, DES.MODE_CBC, iv)
    plaintext = cipher.decrypt(ciphertext)
    return plaintext


ciphertext = b's7/e+JnJbGEdE9j2g3XHxgym+G6Fu/PjJuW80NeMKgemdqaWG9KVM8Tfcc0eRfaA'
ciphertext = base64.b64decode(ciphertext)
key = b'520XGAME'
plaintext = decrypt(ciphertext, key)
print(plaintext)

[Week 4] 内存星旅者

这题是复现的。
讲一下思路：先判断v5是否等于某个数，然后将解密后的flag输出到一个临时文件夹中，最后还将这个临时文件删了
下面是详细的解题步骤：（因为这题是复现的，所以每个步骤都比较详细）
先来到主函数

进入箭头所指函数

发现有个比较，这决定主函数是否跳转到解密。
不过这不用担心，可以直接修改主函数的跳转和v5的值。
动调

修改完后，按F5来到伪函数，双击v5，转到内存处。

将v5的值修改为0x1CF410

此处下个断点

F5查看伪代码

就可以看见临时文件的存放地址了。

用脚本调出来或者直接找，都行