re学习笔记（70）BUUCTF - re - [羊城杯 2020]Bytecode

BUUCTF - re - [羊城杯 2020]Bytecode

python字节码
官方文档:dis — Python 字节码反汇编器
python-bytecode|python字节码学习

手动查反编译后

en = [3,37,72,9,6,132]
output = [101,96,23,68,112,42,107,62,96,53,176,179,98,53,67,29,41,120,60,106,51,101,178,189,101,48]
flag = raw_input('please input your flag:')
str = flag
a = len(str)
if a>=38:
    print('lenth wrong!')
    exit(0)
if((((ord(str[1])+2020*ord(str[0]))*2020+ord(str[2]))*2020+ord(str[3]))*2020+ord(str[4])!=1182843538814603):
    exit(0)
x=[]
k=5
for i in range(13):
   b=ord(str[k])
   c=ord(str[k+1])
   a11=c^en[i%6]
   a22=b^en[i%6]
   x.append(a11)
   x.append(a22)
   k+=2
if x!=output:
    exit(0)
l=len(str)
a1=ord(str[l-7])
a2=ord(str[l-6])
a3=ord(str[l-5])
a4=ord(str[l-4])
a5=ord(str[l-3])
a6=ord(str[l-2])
if(a1*3+a2*2+a3*5==1003):
   if(a1*4+a2*7+a3*9==2013):
      if(a1+a2*8+a3*2==1109):
         if(a4*3+a5*2+a6*5==671):
            if(a4*4+a5*7+a6*9==1252):
               if(a4+a5*8+a6*2==644):
                  print('congraduation!you get the right flag!')

写脚本

from z3 import *
flag = ""
en = [3, 37, 72, 9, 6, 132]
output = [
    101, 96, 23, 68, 112, 42, 107, 62, 96, 53, 176, 179, 98, 53, 67, 29, 41,
    120, 60, 106, 51, 101, 178, 189, 101, 48
]
s = Solver()
a1 = [Int('a1[' + str(i) + ']') for i in range(5)]
s.add(((((a1[0] * 2020 + a1[1]) * 2020 + a1[2]) * 2020 + a1[3]) * 2020 +
       a1[4]) == 1182843538814603)
for i in range(5):
    s.add(a1[i] < 128)
    s.add(a1[i] > 30)
if s.check():
    print(s.model())
flag1 = [71, 87, 72, 84, 123]
for i in flag1:
    flag += chr(i)
# print()
############## WHT{
j = 0
flag2 = []
for i in range(13):
    flag2.append(chr(output[j + 1] ^ en[i % 6]))
    flag2.append(chr(output[j] ^ en[i % 6]))
    j += 2
for i in flag2:
    flag += i
# print()
ss = Solver()
a2 = [Int('a2[' + str(i) + ']') for i in range(6)]
ss.add((a2[0] * 4 + a2[1] * 7 + a2[2] * 9) == 2013)
ss.add((a2[0] + a2[1] * 8 + a2[2] * 2) == 1109)
ss.add((a2[3] * 3 + a2[4] * 2 + a2[5] * 5) == 671)
ss.add((a2[3] * 4 + a2[4] * 7 + a2[5] * 9) == 1252)
ss.add((a2[3] + a2[4] * 8 + a2[5] * 2) == 644)
for i in range(6):
    ss.add(a2[i] < 128)
    ss.add(a2[i] > 30)
if ss.check():
    print(ss.model())
flag3 = [51, 55, 102, 102, 101, 97]
flag3.reverse()
for i in flag3:
    flag += chr(i)
flag += '}'
print(flag)
# https://buuoj.cn/challenges#[%E7%BE%8A%E5%9F%8E%E6%9D%AF%202020]Bytecode
# GWHT{cfa2b87b3f746a8f0ac5c5963faeff73}

z3安装详见：z3约束器安装