[GWCTF 2019]pyre&[GXYCTF2019]luck_guy

---

前言

本文主要记录[GWCTF 2019]pyre和[GXYCTF2019]luck_guy的解题过程和相关思路

[GWCTF 2019]pyre

下载得到pyc文件，而pyc文件是由py文件编译得到，那么就需要将pyc文件反编译回py文件，这里用到一个在线工具

#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
# Version: Python 2.7

print 'Welcome to Re World!'
print 'Your input1 is your flag~'
l = len(input1)
for i in range(l):
    num = ((input1[i] + i) % 128 + 128) % 128
    code += num

for i in range(l - 1):
    code[i] = code[i] ^ code[i + 1]

print code
code = [
    '%1f',
    '%12',
    '%1d',
    '(',
    '0',
    '4',
    '%01',
    '%06',
    '%14',
    '4',
    ',',
    '%1b',
    'U',
    '?',
    'o',
    '6',
    '*',
    ':',
    '%01',
    'D',
    ';',
    '%',
    '%13']

直接写脚本

code = ['\x1f', '\x12', '\x1d', '(', '0', '4', '\x01', '\x06', '\x14', '4', ',', '\x1b', 'U', '?', 'o', '6', '*', ':',
        '\x01', 'D', ';', '%', '\x13']
flag = ''
for i in range(len(code) - 2, -1, -1):
    code[i] = chr(ord(code[i]) ^ ord(code[i + 1]))
for i in range(len(code)):
    num = chr((ord(code[i]) - i) % 128)
    flag += num
print(flag)  # GWHT{Just_Re_1s_Ha66y!}

[GXYCTF2019]luck_guy

首先查壳，发现无壳

使用IDA打开，shift+F12查找字符串，发现有提示以及部分的flag

双击进去，ctrl+x查找交叉引用，再F5，进入到关键函数

直接写脚本

flag = "GXY{do_not_"
f2 = [0x69, 0x63, 0x75, 0x67, 0x60, 0x6f, 0x66, 0x7f]  # 7F666F6067756369需要翻转
for j in range(8):
    if j % 2 == 1:
        s = chr(f2[j] - 2)
    else:
        s = chr(f2[j] - 1)

    flag += s

print(flag)  # GXY{do_not_hate_me}