ISCC Sad Code 200 CTF-Reverse

用die查壳

无壳，且为32位模式

拖入ida

按shifit+f12

找到correct

按ctrl+x交叉引用

编写脚本爆破

from z3 import *
v = [Int(('v%d' % i)) for i in range(8)]
s = Solver()
s.add(v[2] + 7 * v[1] - 4 * v[0] - 2 * v[3] == 0x212278F95)
s.add(5 * v[3] + 3 * v[2] - v[1] - 2 * v[0] == 0x146E7D971)
s.add(2 * v[1] + 8 * v[3] + 10 * v[0] - 5 * v[2] == 0x419AB1349)
s.add(7 * v[0] + 15 * v[1] - 3 * v[3] - 2 * v[2] == 0x7C35A4CA7)
s.add(15 * v[4] + 35 * v[7] - v[5] - v[6] == 0xF867F3C4C)
s.add(38 * v[6] + v[4] + v[7] - 24 * v[5] == 0x7AFCBCA32)
s.add(38 * v[5] + 32 * v[4] - v[6] - v[7] == 0x139360369D)
s.add(v[4] + 41 * v[6] - v[5] - 25 * v[7] == 0x653CABE3E)
s.check()
m = s.model()
result = [0] * 8
k = 0
for i in range(8):
    result[i] = str(hex(int(str(m[v[i]])))).replace("0x", "")

    s = result[i]
    for j in range(0, 8, 2):
        print(chr(int(s[j:j + 2], 16)), end='')
        # int(s[j:j+2], 16)将会将字符串s中的第j和j+1个字符作为十六进制数解析成整数