2021大吉杯逆向wp

最新推荐文章于 2023-12-04 19:20:47 发布

北风~

最新推荐文章于 2023-12-04 19:20:47 发布

阅读量2.4k

点赞数 3

分类专栏： CTF 逆向与保护

本文链接：https://blog.csdn.net/weixin_45055269/article/details/113144830

版权

逆向与保护同时被 2 个专栏收录

66 篇文章 10 订阅

订阅专栏

CTF

31 篇文章 6 订阅

订阅专栏

A-Maze-In

结合题目名字分析知这是一个地图题，找起点终点和走法
看了看判断走法，写的挺常规的，32个一行，就是每次你输入的字符不同，校验的字符偏移的基址不一样，可抽象成4个为一组，起点32 *0+ 4 * 3，终点32*7+4*4，所以你需要提取32*8个字符，也能说是一种游戏，四个为一个小组合块，从左到右控制着上下左右，在这里插入图片描述
那个值为1意味着这步允许走，给你一种选择，0就不允许走，地图展开是这样的
map
也能看出出题人的心思，利用0来围取边界，所以就开尝试，最终只有一条路可以走通

LLDRRDLLLDRDLDDDRRULURRULURRDDDLDR
flag{a79e8ebc-809e-4647-b77e-2fd94bc22c98}

Matara Okina

安卓逆向，JEB打开，算法部分不难

tmp=bytearray(b'@lgvjocWzihodmXov[EWO')
print(len(tmp))
for i in range(11):
	v5=i+1
	tmp[i]=tmp[i]^v5
	v3=21-1-i
	tmp[v3]=tmp[v3]^v5
print(tmp)
#Android_scheme_is_FUN

安装程序后提示你找输入的地方，
在这里插入图片描述

这个之前是没见过，找到了相关文章
Android 中Scheme协议的使用详解
发现其中是有个界面可以通过Android 中Scheme协议打开，进一步观察jeb反编译的结果可知

结合刚才文章，html也可以执行Android 中Scheme协议向里传参，

<a href="sh0w://p4th/70/1nput?serect=Android_scheme_is_FUN">打开源程序指定页面</a>

在模拟器打开app，点击这个html文件，跳转到成功界面
app
flag{sh0w://p4th/70/1nput?serect=Android_scheme_is_FUN_1635b71e036d}

UnrealFlag

UE4逆向，umodel_win32直接打开提示有AES加密，结合https://blog.jamie.holdings/2019/03/23/reverse-engineering-aes-keys-from-unreal-engine-4-projects/，文章根据Corrupted index offset in pak file字符串提示，在条件判断后下断点，接着分析有几个小跳转进而确定到关键函数。

找到aes秘钥（最后一张图红框）B9 91 67 8A C1 A6 F4 01 5D 43 68 46 04 C4 4A 9B 7F 3E 2C 04 A1 82 46 C4 30 93 A7 F1 BB FF 6A B7
根据提示在http://www.tomeko.net/online_tools/hex_to_base64.php?lang=en转成base64格式得到uZFnisGm9AFdQ2hGBMRKm38+LAShgkbEMJOn8bv/arc=
下载UE4中很大，利用UE4的原生解压器，解压

{
    "$types": {
    "UnrealBuildTool.EncryptionAndSigning+CryptoSettings, UnrealBuildTool, Version=4.0.0.0, Culture=neutral, PublicKeyToken=null": "1",
    "UnrealBuildTool.EncryptionAndSigning+EncryptionKey, UnrealBuildTool, Version=4.0.0.0, Culture=neutral, PublicKeyToken=null": "2"
    },
    "$type": "1",
    "EncryptionKey": {
    "$type": "2",
    "Name": null,
    "Guid": null,
    "Key": "uZFnisGm9AFdQ2hGBMRKm38+LAShgkbEMJOn8bv/ardlyTt3r3QAAC0="
    },
    "SigningKey": null,
    "bEnablePakSigning": false,
    "bEnablePakIndexEncryption": true,
    "bEnablePakIniEncryption": true,
    "bEnablePakUAssetEncryption": false,
    "bEnablePakFullAssetEncryption": false,
    "bDataCryptoRequired": true,
    "SecondaryEncryptionKeys": []
}

UnrealPak FindFlag-WindowsNoEditor.pak -Extract ExtractDir -cryptokeys=crypto.json

https://github.com/blcm/blcmods/wiki/accessing-borderlands-3-data
找到john-wick-parse

john-wick-parse serialize flag

john-wick-parse texture flag

得到flag

anniu

灰色按钮，利用windows的消息机制，向按钮传入按下弹起的消息
winspy找到父窗口，在找到子窗口（button:flag）,传消息

import win32gui, win32api, win32con
handle=win32gui.FindWindow("WTWindow",None)
handle0=win32gui.FindWindowEx(handle,0,"Button","flag")
#handle1=win32gui.SendMessage(handle0, win32con.WM_LBUTTONDOWN, win32con.MK_LBUTTON,0)
handle1=win32gui.SendMessage(handle0, win32con.WM_LBUTTONDOWN,win32con.MK_LBUTTON,0)
handle2=win32gui.SendMessage(handle0, win32con.WM_LBUTTONUP,win32con.MK_LBUTTON,0)
print(handle)
print(handle0)
print(handle1)
print(handle2)

flag{huiseanniuyeyoukexing}

warmup

利用数独给出最后的比较结果，github上找一个解16宫格的数独脚本
https://github.com/jtortorelli/sudoku16
贴几个脚本

temp=[0x8,0xe,0xff,0xc,0x9,0xd,0xff,0x1,0xa,0xf,0x3,0xb,0x0,0x2,0xff,0x4,0x1,0x6,0x3,0x2,0x5,0xa,0x7,0x0,0x8,0x9,0xff,0x4,0xf,0xe,0xb,0xd,0xa,0x0,0xff,0xd,0x4,0xf,0x3,0xb,0x7,0x5,0xe,0x2,0x6,0x8,0xc,0x1,0x4,0xb,0x5,0xf,0xff,0x2,0xff,0xc,0x6,0xd,0x1,0x0,0xff,0xa,0x3,0x9,0x2,0xa,0xff,0x3,0xd,0x0,0xb,0x5,0xc,0xff,0x9,0x1,0xff,0xf,0x7,0xe,0xd,0x7,0xc,0xb,0xf,0xe,0xa,0x8,0x0,0xff,0x5,0x3,0x9,0x6,0x1,0x2,0xff,0x1,0xf,0xff,0xc,0x9,0x4,0x6,0x2,0xe,0xd,0xff,0xff,0x3,0xa,0xff,0x9,0x4,0x6,0xe,0x2,0x7,0x1,0x3,0xb,0x8,0xa,0xf,0x5,0xff,0x0,0xc,0xff,0x3,0xa,0x7,0xe,0x8,0xc,0x4,0x9,0xff,0x0,0xd,0x2,0xff,0x6,0xff,0xc,0x9,0x1,0xff,0xb,0x3,0xf,0xd,0xe,0xa,0xff,0xff,0x8,0x0,0x4,0x7,0x6,0xd,0x0,0x8,0xa,0x1,0x2,0xff,0xff,0x7,0x4,0x5,0xc,0xb,0xff,0xf,0xb,0x2,0xe,0xff,0x0,0xff,0x5,0xff,0xf,0x1,0xff,0xc,0xa,0x9,0xd,0x3,0xff,0xf,0xb,0xff,0x3,0xc,0xff,0xe,0x5,0xff,0xff,0x9,0xff,0x4,0x8,0xa,0xe,0x8,0xff,0xff,0x7,0x5,0xd,0xf,0x4,0x3,0xff,0xff,0x1,0xc,0x9,0x0,0xff,0x5,0xd,0x9,0x6,0x4,0x8,0xa,0x1,0xc,0xf,0xe,0xff,0x7,0x2,0xb,0x3,0xff,0x4,0xa,0xff,0xb,0x9,0x2,0xd,0x0,0xff,0x8,0xe,0xff,0xf,0x6]
flag=[0 for i in range(256)]
for i in range(256):
	if temp[i]>0xf:
		flag[i]=0x2d
	else:
		if temp[i]>=0x0 and temp[i]<=0x9:
			flag[i]=temp[i]+0x30
		else:
			flag[i]=temp[i]+0x57
print(''.join(map(chr,flag)))

temp= '8e-c9d-1af3b02-416325a7089-4febda0-d4f3b75e268c14b5f-2-c6d10-a392a-3d0b5c-91-f7ed7cbfea80-539612-1f-c9462ed--3a-946e2713b8af5-0c-3a7e8c49-0d2-6-c91-b3fdea--80476d08a12--745cb-fb2e-0-5-f1-ca9d3-fb-3c-e5--9-48ae8--75df43--1c90-5d9648a1cfe-72b3-4a-b92d0-8e-f6'
temp0='8e7c9d61af3b025416325a7089c4febda09d4f3b75e268c14b5f82ec6d107a392a83d0b5c6914f7ed7cbfea80453961251f0c9462ed7b3a8946e2713b8af5d0cf3a7e8c49b0d2165c915b3fdea2680476d08a1293745cbefb2e40657f18ca9d37fb13c0e5269d48ae82675df43ba1c9005d9648a1cfe372b3c4a1b92d078e5f6'
flag=[]
for i in range(256):
	if temp[i]!=temp0[i]:
		flag.append(temp0[i])
print(''.join(flag))
#765c98e78644507b8dfb1552693e467871026d26ba03c175