i春秋春季赛2023

最新推荐文章于 2024-05-21 23:37:57 发布

UmVfX1BvaW50

最新推荐文章于 2024-05-21 23:37:57 发布

阅读量585

点赞数 1

分类专栏： CTF 文章标签：汇编 c++

本文链接：https://blog.csdn.net/qq_59700927/article/details/130774108

版权

CTF 专栏收录该内容

21 篇文章 0 订阅

订阅专栏

只有两道逆向和一道misc，其他的有时间再写

wordle

不断筛有什么和没什么字母猜就行了

[6x] Guess a 5-letter word : first
first
[5x] Guess a 5-letter word : ideas
Please enter a real English word that exists.
[5x] Guess a 5-letter word : icily
first
icily
[4x] Guess a 5-letter w                 
Please enter a 5-letter word.                                                        
[4x] Guess a 5-letter word : ibdly                                                   
Please enter a real English word that exi                                            sts.                                                                                 
[4x] Guess a 5-letter word : ibely                                                   
Please enter a real English word that exi                                            sts.                                                                                 
[4x] Guess a 5-letter word : ibfly^[[D^[[                                                                                                                                 
Please enter a 5-letter word.                                                        
[4x] Guess a 5-letter word : idely
Please enter a real English word that exists.
[4x] Guess a 5-letter word : above
first
icily
above
[3x] Guess a 5-letter word : mudkg
Please enter a real English word that exists.
[3x] Guess a 5-letter word : Mixed
first
icily
above
mixed
[2x] Guess a 5-letter word : imply
first
icily
above
mixed
imply
You win!
flag{7df67764-b5d0-4a8b-b550-6bf767d07ec5}

Poisoned_Tea

列几个点

不可动调，只能附加
dump无果，整个流程类似于运行时读取数据区
猜测

solve

虽然不能dump，但通过给的函数基本可以分析完整的运行流程，且加密方式已知
tea

__int64 __fastcall sub_847(int a1, unsigned int *a2, __int64 a3)
{
  __int64 result; // rax
  int i; // [rsp+24h] [rbp-14h]
  unsigned int v5; // [rsp+28h] [rbp-10h]
  unsigned int v6; // [rsp+2Ch] [rbp-Ch]
  unsigned int v7; // [rsp+30h] [rbp-8h]

  v5 = *a2;
  v6 = a2[1];
  v7 = 0;
  for ( i = 0; i < a1; ++i )
  {
    v5 += (v6 + ((v6 >> 5) ^ (16 * v6))) ^ (*(4LL * (v7 & 3) + a3) + v7);
    v7 -= 1091584273;
    v6 += (v5 + ((v5 >> 5) ^ (16 * v5))) ^ (*(4LL * ((v7 >> 11) & 3) + a3) + v7);
  }
  *a2 = v5;
  result = v6;
  a2[1] = v6;
  return result;
}

enc & cmp

v18 = __readfsqword(0x28u);
  v5 = 1;
  key[0] = 5;                                   // key
  key[1] = 2;
  key[2] = dword_3464;
  key[3] = dword_3454;
  key[4] = 0;
  memset(v17, 0, 0x400uLL);
  sub_524(&unk_144C, a2, v17);
  sub_554(&unk_145B);
  v2 = v17;
  sub_594(&unk_1469, v17);
  sub_574();
  v8 = 0;
  v9 = 0;
  v10 = 0;
  for ( i = 0; v17[i]; i += 2 )                 // encrypt
  {
    v8 = v17[i];
    v9 = v17[i + 1];
    v2 = &v8;
    tea(dword_3474, &v8, key);
    v17[i] = v8;
    v3 = (i + 1);
    v17[v3] = v9;
  }
  v12 = 0;
  v13 = 0;
  v14 = 0;
  v15 = 0;
  v16 = 0;
  for ( j = 0; v17[j]; j += 2 )                 // cmp
  {
    v12 = dword_3624[j];
    v13 = dword_3624[j + 1];
    v14 = v17[j];
    v15 = v17[j + 1];
    v3 = v12;
    if ( v12 == v14 )
    {
      v3 = v13;
      if ( v13 == v15 )
        continue;
    }
    v5 = 0;
    break;
  }

所以我们要做的就是通过进程附加捕获完整key以及比对的密文，最后解密
附加直接进的时libc，出了libc会到debug，然后先加载的是key，在最后要输出正误的指令上方可以翻找到密文，这个还是靠经验
直接dump动调状态然后强制分析代码也可以

在这里插入图片描述

遇到的插曲
- 一开始附加时候用的windows本机文件，导致在后续加载文件时系统找不到，直接忽略了
- 最后的结果就是在后续调试过程中数据显示错误

BWBA

加密是傅里叶变换，通过加密过程的到64元一次方程组z3求解
方程生成


#include<bits/stdc++.h>
#include <cmath>
using namespace std;
double a1[64] = {0};
int main()
{
  double flag[64] = {370.75,234.362,-58.0834,59.8212,88.8221,-30.2406,21.8316,49.9781,-33.5259,2.69675,43.5386,-30.2925,-28.0754,27.593,-2.53962,-27.1883,-5.60777,-0.263937,6.80326,8.03022,-6.34681,-0.89506,-6.80685,-13.6088,27.0958,29.8439,-21.7688,-20.6925,-13.2155,-37.0994,2.23679,37.6699,-3.5,9.85188,57.2806,13.5715,-20.7184,8.6816,3.59369,-4.5302,4.22203,-28.8166,-23.695,31.2268,6.58823,-39.9966,-20.7877,-19.7624,-22.031,16.3285,2.07557,-26.2521,16.1914,18.3976,-26.9295,3.03769,41.0412,20.2598,14.991,6.99392,-22.3752,-7.24466,8.96299,-10.4874}, v10 = 0, v9 = 0;
  int i, j, cnt = 64;
  for ( i = 0; i < cnt; ++i )
  {
    cout <<endl <<"s.add((";
    double tempi = i;
    for ( j = 0; j < cnt; ++j )
    {
      double tempj = j;
      v9 = cos((tempj + 0.5) * (3.141592653589793 * tempi) / cnt);
      if (j == 63){
        cout <<"(";
        printf("%lf",v9);
        cout<<" * flag" <<j<<")";
      }
      else{
        cout <<"(";
        printf("%lf",v9);
        cout<<" * flag" <<j<<")" <<"+";
      }
    }
    if ( i )
      v10 = sqrt(2.0 / cnt);
    else
      v10 = sqrt(1.0 / cnt);
    flag[i] /= v10;
    cout <<")";
    cout <<" ==";
    printf("%lf",flag[i]);
    //
     
    cout<<")";
  }
}

z3求解

from z3 import *

flag0 = Real('flag0')
flag1 = Real('flag1')
flag2 = Real('flag2')
flag3 = Real('flag3')

# ...

flag63 = Real('flag63')
s = Solver()

s.add(((1.000000 * flag0)+(1.000000 * flag1)+(1.000000 * flag2)+(1.000000 * flag3)+(1.000000 * flag4)+(1.000000 * flag5)+(1.000000 * flag6)+(1.000000 * flag7)+(1.000000 * flag8)+(1.000000 * flag9)+(1.000000 * flag10)+(1.000000 * flag11)+(1.000000 * flag12)+(1.000000 * flag13)+(1.000000 * flag14)+(1.000000 * flag15)+(1.000000 * flag16)+(1.000000 * flag17)+(1.000000 * flag18)+(1.000000 * flag19)+(1.000000 * flag20)+(1.000000 * flag21)+(1.000000 * flag22)+(1.000000 * flag23)+(1.000000 * flag24)+(1.000000 * flag25)+(1.000000 * flag26)+(1.000000 * flag27)+(1.000000 * flag28)+(1.000000 * flag29)+(1.000000 * flag30)+(1.000000 * flag31)+(1.000000 * flag32)+(1.000000 * flag33)+(1.000000 * flag34)+(1.000000 * flag35)+(1.000000 * flag36)+(1.000000 * flag37)+(1.000000 * flag38)+(1.000000 * flag39)+(1.000000 * flag40)+(1.000000 * flag41)+(1.000000 * flag42)+(1.000000 * flag43)+(1.000000 * flag44)+(1.000000 * flag45)+(1.000000 * flag46)+(1.000000 * flag47)+(1.000000 * flag48)+(1.000000 * flag49)+(1.000000 * flag50)+(1.000000 * flag51)+(1.000000 * flag52)+(1.000000 * flag53)+(1.000000 * flag54)+(1.000000 * flag55)+(1.000000 * flag56)+(1.000000 * flag57)+(1.000000 * flag58)+(1.000000 * flag59)+(1.000000 * flag60)+(1.000000 * flag61)+(1.000000 * flag62)+(1.000000 * flag63)) ==2966.000000)
s.add(((0.999699 * flag0)+(0.997290 * flag1)+(0.992480 * flag2)+(0.985278 * flag3)+(0.975702 * flag4)+(0.963776 * flag5)+(0.949528 * flag6)+(0.932993 * flag7)+(0.914210 * flag8)+(0.893224 * flag9)+(0.870087 * flag10)+(0.844854 * flag11)+(0.817585 * flag12)+(0.788346 * flag13)+(0.757209 * flag14)+(0.724247 * flag15)+(0.689541 * flag16)+(0.653173 * flag17)+(0.615232 * flag18)+(0.575808 * flag19)+(0.534998 * flag20)+(0.492898 * flag21)+(0.449611 * flag22)+(0.405241 * flag23)+(0.359895 * flag24)+(0.313682 * flag25)+(0.266713 * flag26)+(0.219101 * flag27)+(0.170962 * flag28)+(0.122411 * flag29)+(0.073565 * flag30)+(0.024541 * flag31)+(-0.024541 * flag32)+(-0.073565 * flag33)+(-0.122411 * flag34)+(-0.170962 * flag35)+(-0.219101 * flag36)+(-0.266713 * flag37)+(-0.313682 * flag38)+(-0.359895 * flag39)+(-0.405241 * flag40)+(-0.449611 * flag41)+(-0.492898 * flag42)+(-0.534998 * flag43)+(-0.575808 * flag44)+(-0.615232 * flag45)+(-0.653173 * flag46)+(-0.689541 * flag47)+(-0.724247 * flag48)+(-0.757209 * flag49)+(-0.788346 * flag50)+(-0.817585 * flag51)+(-0.844854 * flag52)+(-0.870087 * flag53)+(-0.893224 * flag54)+(-0.914210 * flag55)+(-0.932993 * flag56)+(-0.949528 * flag57)+(-0.963776 * flag58)+(-0.975702 * flag59)+(-0.985278 * flag60)+(-0.992480 * flag61)+(-0.997290 * flag62)+(-0.999699 * flag63)) ==1325.751676)

# ...

s.add(((0.024541 * flag0)+(-0.073565 * flag1)+(0.122411 * flag2)+(-0.170962 * flag3)+(0.219101 * flag4)+(-0.266713 * flag5)+(0.313682 * flag6)+(-0.359895 * flag7)+(0.405241 * flag8)+(-0.449611 * flag9)+(0.492898 * flag10)+(-0.534998 * flag11)+(0.575808 * flag12)+(-0.615232 * flag13)+(0.653173 * flag14)+(-0.689541 * flag15)+(0.724247 * flag16)+(-0.757209 * flag17)+(0.788346 * flag18)+(-0.817585 * flag19)+(0.844854 * flag20)+(-0.870087 * flag21)+(0.893224 * flag22)+(-0.914210 * flag23)+(0.932993 * flag24)+(-0.949528 * flag25)+(0.963776 * flag26)+(-0.975702 * flag27)+(0.985278 * flag28)+(-0.992480 * flag29)+(0.997290 * flag30)+(-0.999699 * flag31)+(0.999699 * flag32)+(-0.997290 * flag33)+(0.992480 * flag34)+(-0.985278 * flag35)+(0.975702 * flag36)+(-0.963776 * flag37)+(0.949528 * flag38)+(-0.932993 * flag39)+(0.914210 * flag40)+(-0.893224 * flag41)+(0.870087 * flag42)+(-0.844854 * flag43)+(0.817585 * flag44)+(-0.788346 * flag45)+(0.757209 * flag46)+(-0.724247 * flag47)+(0.689541 * flag48)+(-0.653173 * flag49)+(0.615232 * flag50)+(-0.575808 * flag51)+(0.534998 * flag52)+(-0.492898 * flag53)+(0.449611 * flag54)+(-0.405241 * flag55)+(0.359895 * flag56)+(-0.313682 * flag57)+(0.266713 * flag58)+(-0.219101 * flag59)+(0.170962 * flag60)+(-0.122411 * flag61)+(0.073565 * flag62)+(-0.024541 * flag63)) ==-59.325693)

print(s.check())
print(s.model())

取整输出

flag = [0 for i in range(64)]
flag[
    55] = 221527137955783113048387578098669691852696472163174363992368587140468072862920727666475906867404888638838351318494490704211264388450373808157143523413409650950475194124966447357784178278474314607876795718871850895314347485314725170589326708258271512005230085206855375465185961941426128822017371048964561623152284829085198599876666124694211060913327259311235999626439130457424039519987122749459176262 / 4393949489366013141326163371687704628053876930668323418191072958216729857094949839067603311586792854232854294729192049148923892216475097051452982099673208220975632436415151212496411611956992817991807078659939201284753446394195432061555651948215760845094198788857248533383339796074398574229674880933341286069968842091882649229346271093965887550163210225244116603976086342392436567094267576310818570886085
flag[
    32] = 1687279396917760686256775837450156537810376211966209118713889456264098294438023380830097733539434047032147127492810004743931813776323691257487629314860358703386692057998366248033741285251060976444886928995003306048059584076838156029948315773458988690200028145397390874043032135199067245841270264782772413546558083597284157959212565958078116842012101046869288077937458487761020750491219956365179541224993959 / 35151595914928105130609306973501637024431015445346587345528583665733838856759598712540826492694342833862834357833536393191391137731800776411623856797385665767805059491321209699971292895655942543934456629279513610278027571153563456492445215585726086760753590310857988267066718368595188593837399047466730288559750736735061193834770168751727100401305681801952932831808690739139492536754140610486548567088680


# ...

flag[
    26] = 7170921423120406134452068759100082419053673782981918591779303332725381751713223477702469650712602475303035621426578259606409522642372892852081452455753207582821725938452118491738552068892503760852475907805364856515936237811647835538337671975355462756861657530521173108999585739612050593385888410823160809684081128580452765679381516405015784498511345136923293313107025304624821870346710591020483644332361041 / 70303191829856210261218613947003274048862030890693174691057167331467677713519197425081652985388685667725668715667072786382782275463601552823247713594771331535610118982642419399942585791311885087868913258559027220556055142307126912984890431171452173521507180621715976534133436737190377187674798094933460577119501473470122387669540337503454200802611363603905865663617381478278985073508281220973097134177360
flag[
    16] = 861213459618800635980908762431887453130690039744021489676272811252339111506547068326575312581482641230115288118062762058810601836638224532023901869148002712207608878099715831214905749629077894633991833351216771043843037338219613551234098593505551504978788179664358071455377274133270389363464604100908033564647036460300697073894865437645538471236181203672538362517067280984107395984610847492259850454653687 / 17575797957464052565304653486750818512215507722673293672764291832866919428379799356270413246347171416931417178916768196595695568865900388205811928398692832883902529745660604849985646447827971271967228314639756805139013785576781728246222607792863043380376795155428994133533359184297594296918699523733365144279875368367530596917385084375863550200652840900976466415904345369569746268377070305243274283544340
flag[
    50] = 5389532113412151751299492060732273506518184376927034892632825060270115663910131858165879826910364623085516402239499563714301946910479121309695970873212193419808425757856749399267199805874274962872794906415079644252333229564204011386698056058032425290562078339180963131641291131179791821069055657674420630383090229680767184468506535062020111993855418757917802204733786495755701316418542412964134684989 / 70303191829856210261218613947003274048862030890693174691057167331467677713519197425081652985388685667725668715667072786382782275463601552823247713594771331535610118982642419399942585791311885087868913258559027220556055142307126912984890431171452173521507180621715976534133436737190377187674798094933460577119501473470122387669540337503454200802611363603905865663617381478278985073508281220973097134177360



for i in range(64):
    print(chr(round(flag[i])),end='')