tqlctf reverse wp: Tale of the Arrow & quantum

Tale of the Arrow

题目给了源码, 把输入转成二进制串, 每一位都会打出三个数字, 数字正确和错误可能各一半, 但是其中有一个一定是正确的. 因此利用flag是可见字符最高位必为0 以及 一组三个有两个错误时剩下那个一定正确 两个条件可以直接还原出flag

with open('output.txt','r') as f:
    con = f.read().splitlines()[2:]

con =[ int(x) for x in con]

torf = [0] * len(con)  # 1 for T, 0 for UNDF, -1 for F
a = []
for i in range(1,137,8):
    a.append(-i)

for _ in range(10): 
    for i in range(len(con)):
        if con[i] in a:
            torf[i] = 1
        elif con[i] in [-x for x in a]:
            torf[i] = -1 

    for i in range(0,len(torf),3):
        if sum(torf[i:i+3])==-2:
            tmp = torf[i:i+3].index(0)
            torf[i+tmp] = 1
            a.append(con[i+tmp])


o = ['2']*136
for i in range(len(con)):
    tmp = torf[i]*con[i]
    if(tmp>0):
        o[tmp-1] = '1'
    elif(tmp<0):
        o[-tmp-1] = '0'
o = ''.join(o)
print(o)
for i in range(0,len(o),8):
    if '2' in o[i:i+8]:
        print(chr(int(bytes(o[i:i+8].replace('2','0'),"ascii"),2)),' or ',chr(int(bytes(o[i:i+8].replace('2','1'),"ascii"),2)))
    else:
        print(chr(int(bytes(o[i:i+8],"ascii"),2)))```

比赛时候因为少打一个负号和以为要带tqlctf{}输入flag而痛失一血 我的冰墩墩呜呜

quantum

是一道优化题, 给了一个看似运行不完的程序, 本意应该是类似于”未来程序“的优化题. 但是通过简单的分析以后我们发现耗费时间最长的部分是复数矩阵乘法. 因此是一个大常数的O(N^2) 复杂度.
所以我们只是简单的暴力跑了12h… 直接dump出final和p数组. 之后的比较逻辑就很简单了

final_bytes = open('final.txt', 'rb').read()
p_bytes = open('p.txt', 'rb').read()

from struct import unpack
def parse_cp(buf, cnt):
    assert len(buf) == cnt * 2 * 8
    cps = []
    data = list(unpack('<%dd' % (2 * cnt), buf))
    print("ok")
    for i in range(cnt):
        if i % 0x10000 == 0:
            print(i)
        cp = data[2 * i:2 * i + 2]
        cps.append(cp)
    return cps

final = parse_cp(final_bytes, 22)
p = parse_cp(p_bytes, 0x1000000)
print(final)

def verify(x, y):
    return abs(x/y - 1.0) < 0.000001

def check(a, b):
    return verify(a[0], b[0]) and verify(a[1], b[1])

print("hello")
ans = []
for v in final:
    for i in range(len(p)):
        if check(p[i], v):
            ans.append(i >> 16)
            ans.append((i >> 8) & 0xff)
            ans.append(i & 0xff)
            break
    print(bytes(ans))
# TQLCTF{5Peci4llY_dEs19n3d_QUaNTUM_c0mPU7In9_5ImU1at1ON_ALG0rithMS}