[MoeCTF 2022]fake_key-入土为安的第二十天

知识点：动调，伪随机数

伪随机数

发现：：str少一部分动调

动调注意的点，F5后，fn+F8动调，动调一两步，点点想要的函数

找到加密后的密文

把加码转化为自己能看懂的

已知Str=yunzh1junTCL,tracKYYDS
  
  scanf("%s", flag );
  v5 = strlen(flag );
  for ( i = 0; i < v5; ++i )
    flag [i] ^= Str[i % v6];
  for ( j = 0; j < v5; ++j )
    flag [j] += rand() % 10;
 printf(flag)
 //flag =0x15, 0x21, 0x0F, 0x19, 0x25, 0x5B, 0x19, 0x39,  0x5F, 0x3A, 0x3B, 0x30, 0x74, 0x07, 0x43, 0x3F, 0x09, 0x5A, 0x34, 0x0C, 0x74, 0x3F, 0x1E, 0x2D, 0x27, 0x21, 0x12, 0x16, 0x1F

exp:

# 已知的加密数据
encrypted_str = [0x15, 0x21, 0x0F, 0x19, 0x25, 0x5B, 0x19, 0x39, 0x5F, 0x3A, 0x3B, 0x30, 0x74, 0x07, 0x43, 0x3F, 0x09,
                 0x5A, 0x34, 0x0C, 0x74, 0x3F, 0x1E, 0x2D, 0x27, 0x21, 0x12, 0x16, 0x1F]

# 密钥
Str = [ord(c) for c in "yunzh1junTCL,tracKYYDS"]  # 密钥字符转换为整数
key_length = len(Str)

# 伪随机数序列
random_numbers = [1, 7, 4, 0, 9, 4, 8, 8, 2, 4, 5, 5, 1, 7, 1, 1, 5, 2, 7, 6, 1, 4, 2, 3, 2, 2, 1, 6, 8]

# 逆向处理加密数据
def reverse_random_addition(encrypted_data, random_numbers):
    if len(random_numbers) != len(encrypted_data):
        raise ValueError("随机数序列长度与加密数据长度不匹配")

    intermediate = [encrypted_data[i] - random_numbers[i] for i in range(len(encrypted_data))]
    return intermediate

def reverse_xor(data, key):
    return [x ^ key[i % len(key)] for i, x in enumerate(data)]

# 解密步骤
intermediate_data = reverse_random_addition(encrypted_str, random_numbers)
decrypted_flag = reverse_xor(intermediate_data, Str)

# 打印结果
decrypted_str = ''.join(chr(c) if 32 <= c <= 126 else '.' for c in decrypted_flag)
print("Decrypted flag:", decrypted_str)
//moectf{D3bug_t0_g3t_7he_Key!}