[GDOUCTF 2023]Tea-入土为安的第二十二天

tea

在左边找不到main函数，怎么办，shirt12查找字符串Ctrl+f找flag

一直点进去sub_140011339，得到key

一直点进去 sub_1400112B7，得到tea的加密

怎么能转化为看的懂的加密的

*(_DWORD *)怎么处理

*(_DWORD *)(a1 + 4i64 * i)=a1[i]，我觉得是把4i64舍去，并转成数组，所以*(_DWORD *)(a1 + 4i64 * v3)=a1[v3]

sub_140011352 为密文

写exp

#include <stdio.h>

unsigned int process_arrays(unsigned int a1[], unsigned int a2[]) {
    int i;
    unsigned int v3, v5, v6;

    for (i = 8; i >= 0; --i) {
        v5 = 33; // wheel 值为 33
        v6 = 0xF462900 * (i + v5);
        v3 = i + 1;
        do {
            v6 -= 0xF462900;
            a1[v3] -= (v6 + a2[(v6 >> 11) & 3]) ^ (a1[i] + ((a1[i] >> 5) ^ (16 * a1[i])));
            a1[i] -= v6 ^ (a1[v3] + ((a1[v3] >> 5) ^ (16 * a1[v3]))) ^ (v6 + a2[v6 & 3]);
            --v5;
        } while (v5 > 0); // 确保循环能够正确终止
    }
    return (unsigned int)(i + 1);
}

int main() {
    unsigned int a[10] = {0x1A800BDA, 0xF7A6219B, 0x491811D8, 0xF2013328, 0x156C365B, 0x3C6EAAD8, 0x84D4BF28, 0xF11A7EE7, 0x3313B252, 0xDD9FE279};
    unsigned int key[4] = {2233, 4455, 6677, 8899};
    
    unsigned int result = process_arrays(a, key);

    // 输出修改后的数组
    for (int j = 0; j < 10; ++j) {
        printf("%08X", a[j]); // 以十六进制格式输出，确保输出格式一致
    }

    return 0;
}//485A4354467B687A4374665F39345F726536363666696E6763727935363431710000717D00000000

 16进制转字符串

hex_str = "485A4354467B687A4374665F39345F726536363666696E676372793536343171717D"
bytes_object = bytes.fromhex(hex_str)
string = bytes_object.decode('utf-8')
print(string)  
//HZCTF{hzCtf_94_re666fingcry5641qq}