vnctf2022 travel-dfs递归爆破

运行一下

查看主函数
垃圾代码很少，有可读性，有两次字符串输入
关键函数sub_401A6C


很容易异或，所以不要被复杂的代码吓到
dword_405040[i] dump下来

[0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269, 0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9, 0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249, 0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9, 0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229, 0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299, 0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209, 0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279]

动调把dword_404040数组dump下来

[0x0FD07C452, 0x0EC90A488, 0x68D33CD1, 0x96F64587]

脚本得20211205

def ror32Bit(v, shift):
        shift &= 0x1F  # 设置要移动的位数
        if shift == 0:
            return v  # value 右移shift位
        return ((v >> shift) | (v << (32 - shift))) & 0xFFFFFFFF
def rol32bit(v,shift):
        shift &= 0x1F
        if shift == 0:
            return v
        HightBit = v >> (32 - shift)
        LowBit = v << shift
        value = (HightBit | LowBit) & 0xFFFFFFFF
        return value
def sub_401A3B(x):
    return x^(rol32bit(x,13)^ror32Bit(x,9))

lis=[0x0FD07C452, 0x0EC90A488, 0x68D33CD1, 0x96F64587]
word=[0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269, 0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9, 0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249, 0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9, 0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229, 0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299, 0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209, 0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279]
f=[]
for i in range(0,32):
    f.append(sub_401A3B(lis[0]^lis[1]^lis[2]^word[31-i])^lis[3])
    a=lis
    lis=[]
    lis.extend([f[i],a[0],a[1],a[2]])
print(hex(f[31]^0xA3B1BAC6),hex(f[30]^0x56AA3350))
a=hex(f[31]^0xA3B1BAC6)
b=hex(f[30]^0x56AA3350)
for j in [a,b]: #大端序转化为字符串
  for i in range(0,len(j[2:]),2):
    print(chr(int('0x'+(j[2:])[i:i+2],16)),end='')

继续动调


第45-46行的异或有点难搞，因为模的话有很多取值，所以采取爆破的方法
因为字符一环套一环，前一个数依靠后一个数，已知v4[23]，可以用dfs（递归）的方法
然后是关键函数sub_402058
看上去很复杂，实际上不难理解，有点像简易版的aes



脚本先dfs爆破，得到的值进行逆
得到VNCTF{TimeFlightMachine}

def F(v,round):
    vv=int('0x'+((hex(v)[2:]).zfill(8))[2:]+((hex(v)[2:]).zfill(8))[0:2],16)
    return vv^dword_4050C0[round]
def dfs(n):
    if n==0:
        lei_si_aes(f)
        return 0
    for j in range(0xff):
        if v4[n-1] == j ^ ((j % 18 + f[n] + 5) ^ 0x41):
            f[n-1]=j
            dfs(n-1)

def lei_si_aes(q):
 ff=[]
 output=[0]*66
 n=9
 for i in range(0,24,4):
    ff.append(q[i]|q[i+1]<<8|q[i+2]<<16|q[i+3]<<24)
 for i in range(60,66):
    output[i]=ff[i-60]
 for i in range(59,-1,-1):
    if i%6!=0:
        output[i]=output[i+5]^output[i+6]
    else:
        output[i]=output[i+6]^F(output[i+5],n)
        n=n-1
 for i in range(6):
  for j in range(0,8,2):
    print(chr(int('0x'+(hex(output[i])[2:]).zfill(8)[j:j+2],16)),end='')
 print()
dword_4050C0 = [0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000, 0x20000000, 0x40000000, 0x80000000, 0x1B000000, 0x36000000]
v4=[0x25, 0x15, 0xDF, 0xA2, 0xC0, 0x93, 0xAD, 0x14, 0x46, 0xC5, 0x0F, 0x2E, 0x9A, 0xEB, 0x30, 0xF8, 0x20, 0xE9, 0xCB, 0x88, 0xC6, 0xBE, 0x8D, 0xE3]
f=[0]*24
f[23]=0xe3
dfs(23)

最后得到

flag：VNCTF{TimeFl20211205ightMachine}
总结：
学到了递归爆破dfs
进行dword截取字符的时候别忘了.zfill(8) QWQ
((hex(v)[2:]).zfill(8))[2:]
而且面对复杂的代码要慢慢看，逻辑可能是清晰的