tea
在左边找不到main函数,怎么办,shirt12查找字符串Ctrl+f找flag
一直点进去sub_140011339,得到key
一直点进去 sub_1400112B7,得到tea的加密
怎么能转化为看的懂的加密的
*(_DWORD *)怎么处理
*(_DWORD *)(a1 + 4i64 * i)=a1[i],我觉得是把4i64舍去,并转成数组,所以*(_DWORD *)(a1 + 4i64 * v3)=a1[v3]
sub_140011352 为密文
写exp
#include <stdio.h>
unsigned int process_arrays(unsigned int a1[], unsigned int a2[]) {
int i;
unsigned int v3, v5, v6;
for (i = 8; i >= 0; --i) {
v5 = 33; // wheel 值为 33
v6 = 0xF462900 * (i + v5);
v3 = i + 1;
do {
v6 -= 0xF462900;
a1[v3] -= (v6 + a2[(v6 >> 11) & 3]) ^ (a1[i] + ((a1[i] >> 5) ^ (16 * a1[i])));
a1[i] -= v6 ^ (a1[v3] + ((a1[v3] >> 5) ^ (16 * a1[v3]))) ^ (v6 + a2[v6 & 3]);
--v5;
} while (v5 > 0); // 确保循环能够正确终止
}
return (unsigned int)(i + 1);
}
int main() {
unsigned int a[10] = {0x1A800BDA, 0xF7A6219B, 0x491811D8, 0xF2013328, 0x156C365B, 0x3C6EAAD8, 0x84D4BF28, 0xF11A7EE7, 0x3313B252, 0xDD9FE279};
unsigned int key[4] = {2233, 4455, 6677, 8899};
unsigned int result = process_arrays(a, key);
// 输出修改后的数组
for (int j = 0; j < 10; ++j) {
printf("%08X", a[j]); // 以十六进制格式输出,确保输出格式一致
}
return 0;
}//485A4354467B687A4374665F39345F726536363666696E6763727935363431710000717D00000000
16进制转字符串
hex_str = "485A4354467B687A4374665F39345F726536363666696E676372793536343171717D"
bytes_object = bytes.fromhex(hex_str)
string = bytes_object.decode('utf-8')
print(string)
//HZCTF{hzCtf_94_re666fingcry5641qq}