Geek Challenge 2023 RE reserve AES! AES?

题解

......

用ida解析

大量的数据赋值

它输出的字符串都是在这一起

程序流程

输出提示字符串

再输入字符串，并作长度比较

现对开初始化的数据通过S数组生成一个数组，会与输入的数据进行运算

数组S

接下来就是对输入的数据进行加密了

先通过把输入的数据当下标去取S的元素

这个外循环只有一次，相当于没有

再就是对v5和v6进行ShiftRow，和tansform函数操作（v6就是v5的后16个字节，一起32个字节）

再与之前生成的数组的前16个字节进行异或

又进行了一次值当下标取元素

再ShiftRow一下

现与之前生成的数组的后16个字节进行异或

然后就是比较，判断是不否是对的了

ShiftRow

这个函数是把数据按4个分组移动，第一组把前0个元素放后面，第一组把前1个元素放后面.....

即

处理前

处理后

transform

把数组行列互换再当做下标取S的元素

ok正向完了，再用的解一遍就行了

解题脚本

from ctypes import *
r_box=[  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 
  0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 
  0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 
  0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 
  0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 
  0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 
  0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 
  0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 
  0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 
  0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 
  0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 
  0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 
  0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 
  0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 
  0x64, 0x5D, 0x19, 0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 
  0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 
  0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 
  0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 
  0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 
  0xAE, 0x08, 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 
  0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 
  0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 
  0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 
  0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 
  0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 
  0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16]

def shitfrow(data):
    t=0
    for i in range(1,4):
       for j in range(i):
        t=data[i*4+3]
        for  k in range(3):
             data[i*4+3-k]=data[i*4+3-k-1]
        data[i*4]=t
    return data  
def tansform(data):
   k=0
   t=[i.value for i in data]

   for i in range(4):
      for j in range(4):
         data[k].value=r_box.index(t[j*4+i])
         k+=1
   return data
key=[0x6E,0x79,0x69,0x83,0x79,0x7F,0x69,0x75,0x79,0x78,0x81,0x69,0x5D,0x63,0x4D,0x49]
box=[0 for i in range(192)]
#box=[0x64,0x6F,0x5F,0x79,0x6F,0x75,0x5F,0x6B,0x6F,0x6E,0x77,0x5F,0x53,0x59,0x43,0x3F,0x27,0xC7,0x90,0xCF,0xC7,0xE8,0x90,0x14,0xC7,0xF1,0x82,0x90,0xBE,0x92,0x59,0x4A]
c=[c_int(224),c_int(4294967045),c_int(4294967150),c_int(4294967234),c_int(4294967150),c_int(4294967193),c_int(4294967144),c_int(69),c_int(4294967165),c_int(4294967071),c_int(4294967103),c_int(4294967289),c_int(4294967191),c_int(4294967158),c_int(59),c_int(146),c_int(47),c_int(4294967108),c_int(4294967046),c_int(4294967143),c_int(4294967208),c_int(4294967275),c_int(4294967276),c_int(74),c_int(4294967151),c_int(4294967272),c_int(4294967093),c_int(4294967289),c_int(4294967212),c_int(4294967207),c_int(140),c_int(113)]


for i in range(len(key)):
    key[i]-=10
    box[i]=key[i]
for m  in range(1,11):
    for n in range(32): 
      box[16 * m + n] = box[16 * m - 16 + n] ^ r_box[box[16 * m - 16 + n]]

for i in range(16):
   c[i].value^=box[16+i]
   c[i+16].value^=box[16+i]

c1=shitfrow(c[:16])
c2=shitfrow(c[16:])
c=c1+c2
print

for i in range(32):
   c[i].value=r_box.index(c[i].value&0xff)

for i in range(16):
   c[i].value^=box[i]
   c[i+16].value^=box[i]

c1=tansform(c[:16])
c2=tansform(c[16:])
c=c1+c2
c1=shitfrow(c[:16])
c2=shitfrow(c[16:])
c=c1+c2
for i in range(32):
   c[i].value=r_box.index(c[i].value)

for i in c:
   print(chr(i.value),end='')
print()

结语

这题我是写的真累，之前脚本就写好了，但就是一对，搞了一天才发现是python的列表复制问题t=[i.value for i in data]这一句，我只前写的是t=data，但修改data时t也会修改,因为这样只会data的数据地址给t,并不是把数据拷贝一份复制给t，就这个问题浪费了我一天时间啊啊啊<_>，开始一直没发现

(本人是菜鸟，想找对CTF感兴趣的CTFer,一起交流学习,共同进步，迈向星辰大海!!!!^_^(有兴趣的加扣群:470196890))