[2022年春秋杯]easy_python

分析

下载题目后打开文件查看内容

  3           0 LOAD_CONST               1 (204)
              3 LOAD_CONST               2 (141)
              6 LOAD_CONST               3 (44)
              9 LOAD_CONST               4 (236)
             12 LOAD_CONST               5 (111)
             15 LOAD_CONST               6 (140)
             18 LOAD_CONST               6 (140)
             21 LOAD_CONST               7 (76)
             24 LOAD_CONST               3 (44)
             27 LOAD_CONST               8 (172)
             30 LOAD_CONST               9 (7)
             33 LOAD_CONST               9 (7)
             36 LOAD_CONST              10 (39)
             39 LOAD_CONST              11 (165)
             42 LOAD_CONST              12 (70)
             45 LOAD_CONST               9 (7)
             48 LOAD_CONST              10 (39)
             51 LOAD_CONST              13 (166)
             54 LOAD_CONST              11 (165)
             57 LOAD_CONST              14 (134)
             60 LOAD_CONST              14 (134)
             63 LOAD_CONST               6 (140)
             66 LOAD_CONST               1 (204)
             69 LOAD_CONST              11 (165)
             72 LOAD_CONST               9 (7)
             75 LOAD_CONST              10 (39)
             78 LOAD_CONST              15 (230)
             81 LOAD_CONST               6 (140)
             84 LOAD_CONST              11 (165)
             87 LOAD_CONST              12 (70)
             90 LOAD_CONST               3 (44)
             93 LOAD_CONST               8 (172)
             96 LOAD_CONST              16 (102)
             99 LOAD_CONST              17 (6)
            102 LOAD_CONST               6 (140)
            105 LOAD_CONST               1 (204)
            108 LOAD_CONST              15 (230)
            111 LOAD_CONST              15 (230)
            114 LOAD_CONST               7 (76)
            117 LOAD_CONST              18 (198)
            120 LOAD_CONST              19 (38)
            123 LOAD_CONST              20 (175)
            126 BUILD_LIST              42
            129 STORE_FAST               0 (flag)
  4         132 SETUP_LOOP              54 (to 189)
            135 LOAD_GLOBAL              0 (range)
            138 LOAD_CONST              21 (42)
            141 CALL_FUNCTION            1
            144 GET_ITER            
        >>  145 FOR_ITER                40 (to 188)
            148 STORE_FAST               1 (i)
  5         151 LOAD_FAST                0 (flag)
            154 LOAD_FAST                1 (i)
            157 BINARY_SUBSCR       
            158 LOAD_CONST              22 (5)
            161 BINARY_RSHIFT       
            162 LOAD_FAST                0 (flag)
            165 LOAD_FAST                1 (i)
            168 BINARY_SUBSCR       
            169 LOAD_CONST              23 (3)
            172 BINARY_LSHIFT       
            173 BINARY_OR           
            174 LOAD_CONST              24 (255)
            177 BINARY_AND          
            178 LOAD_FAST                0 (flag)
            181 LOAD_FAST                1 (i)
            184 STORE_SUBSCR        
            185 JUMP_ABSOLUTE          145
        >>  188 POP_BLOCK           
        >>  189 LOAD_CONST               0 (None)
            192 RETURN_VALUE        

首次做这种题没有头绪，使用在线反编译网站发现没有什么内容，然后选取部分内容进行百度，查询到这种是字节码，每一个字节码都进行不同操作

LOAD_CONST ：加载const 变量，比如数值，字符串等等， 一般用于传递给函数作为参数

由此可知前面都是读取内容，即我们所需的明文

SETUP_LOOP表明循环开始
4 132 SETUP_LOOP 54 (to 189)
135 LOAD_GLOBAL 0 (range)
138 LOAD_CONST 21 (42)

字节码偏移189字节的指令结束，即循环到189终止

  5         151 LOAD_FAST                0 (flag)
            154 LOAD_FAST                1 (i)
            157 BINARY_SUBSCR       
            158 LOAD_CONST              22 (5)
            161 BINARY_RSHIFT       
            162 LOAD_FAST                0 (flag)
            165 LOAD_FAST                1 (i)
            168 BINARY_SUBSCR       
            169 LOAD_CONST              23 (3)
            172 BINARY_LSHIFT       
            173 BINARY_OR           
            174 LOAD_CONST              24 (255)
            177 BINARY_AND          
            178 LOAD_FAST                0 (flag)
            181 LOAD_FAST                1 (i)
            184 STORE_SUBSCR        
            185 JUMP_ABSOLUTE          145
        >>  188 POP_BLOCK           
        >>  189 LOAD_CONST               0 (None)

这些就是一个循环中对明文进行处理的字节码，我们进行分析

158 LOAD_CONST 22 (5)
161 BINARY_RSHIFT

上面这两行是将明文右移5位

169 LOAD_CONST 23 (3)
172 BINARY_LSHIFT

再一次读取明文左移3位

173 BINARY_OR

发现这个上面没有LOAD_CONST，所以是将上面右移5位的明文和左移3位的明文进行或运算

然后将这个值和255进行与运算，把值存入flag中

脚本

#include<iostream>
#include<algorithm>
#include<cstdio>
#include<cmath>
#include<map>
#include<vector>
#include<queue>
#include<stack>
#include<set>
#include<string>
#include<cstring>
#include<list>
#include<stdlib.h>
using namespace std;
typedef int status;
typedef int selemtype;
int main ()
{
    int key[] = {
        204, 141, 44, 236, 111, 140, 140, 76, 44, 172, 7, 7, 39, 165, 
        70, 7, 39, 166, 165, 134, 134, 140, 204, 165, 7, 39, 230, 140, 
        165, 70, 44, 172, 102, 6, 140, 204, 230, 230, 76, 198, 38, 175
    };
    for(int i = 0; i < 42; i++)
    {
    key[i] = (key[i] >> 5 | key[i] << 3);
    key[i] = key[i] & 255;
    printf("%c",key[i]);
    }
}
//flag{ddbae889-2895-44df-897d-2ae30df77b61}