180620 逆向-SCTF（2）

Script In Script

下载下来文件，观察js发现有动态解密
将eval改为console.log后即可在console中抓到解码后的函数
也可在click函数中的r处下断，单步跟进后逐个查看函数

function a(r) {
    return D(~r, 1)
}

function D(r, n) {
    return n ? D(r ^ n, (r & n) << 1) : r
}

function E(r, n) {
    return D(r, a(n))
}

function F(r, n) {
    var a = 0;
    while (n) {
        if (n & 1) {
            a = D(a, r)
        }
        r = r << 1;
        n = n >> 1
    }
    return a
}

function G(r, n) {
    var a = 0;
    while (r >= n) {
        r = E(r, n);
        a = D(a, 1)
    }
    return a
}

function H(r) {
    return r.length
}

function J(r, n) {
    return !(r ^ n)
}

function K(r, n) {
    return r[n]
}

function L(r) {
    if (r.length == 1) {
        return r.charCodeAt(0)
    }
}

function M(r) {
    return +r
}

function N(r) {
    return String(r)
}

function O(r, n) {
    return r + n
}

function Q(r, n, a, v) {
    for (var t = r; t <= n; t++) {
        if (a[t] != v[t - r]) {
            return false
        }
    }
    return true
}

function r(r) {
    var n = r;
    var a = H(n);
    var v = J(a, 24);
    var t = K(n, 0);
    var u = K(n, 1);
    var i = K(n, 2);
    var e = K(n, 3);
    var f = D(L(t), L(i));
    var o = E(L(t), L(u));
    var c = K(n, 6);
    var l = K(n, 7);
    var h = K(n, 16);
    var w = K(n, 17);
    var I = J(E(L(u), L(h)), 0);
    var S = J(D(L(c), L(l)), D(L(h), L(w)));
    var _ = J(E(L(u), L(c)), 0);
    var g = K(n, 21);
    var p = K(n, 22);
    var s = J(E(F(L(g), 2), G(66, L(p))), 64);
    var P = Q(9, 15, n, "Pt_In_S");
    var T = J(L(l), L("r"));
    var b = J(f, 231);
    var d = J(o, 16);
    var j = M(K(n, 5));
    var k = J(G(M(O(N(L(e)), "0")), j), 204);
    var m = M(K(n, 8));
    var q = Q(18, 20, n, "IpT");
    var x = J(E(j, m), 4);
    var y = J(F(m, m), m);
    var z = J(D(L(K(n, 4)), D(m, m)), L(K(n, 23)));
    var A = J(L(u), 99);
    var B = J(L(K(n, 23)), 125);
    var C = J(L(K(n, 22)), 33);
    return v && I && S && _ && s && P && T && b && d && k && q && x && y && z && A && B && C
}

其中核心函数为D，动态调试输入几个值测试发现该函数为求和
后面其他几个函数就很简单了，E是减法、F是乘法、G是除法

机械梳理下来求解即可

from z3 import *
a = [Int("a%d"%i) for i in range(24)]
flag = [0 for i in range(24)]
s = Solver()
s.add(a[0] + a[2] == 231,
a[0] - a[1] == 16,
a[1] - a[16] == 0,
a[6] + a[7] == a[16] + a[17],
a[1] - a[6] == 0,
a[21]*2 - 66/a[22] == 64,
a[7] == ord('r'),
(a[3]*10)/(a[5]-ord('0')) == 204,
#int(a[5])
(a[5]-ord('0')) - (a[8]-ord('0')) == 4,
#int(a[8])
(a[8]-ord('0'))*(a[8]-ord('0'))==(a[8]-ord('0')),
a[4] + (a[8]-ord('0')+a[8]-ord('0')) == a[23],
a[1] == 99,
a[23] == 125,
a[22] == 33
)
c = s.check()
print(c)
if(c==sat):
    m = s.model()
    for i in range(24):
        try:
            v = m[a[i]].as_long()
            flag[i] = v
        except:
            continue
    for i in range(9, 16):
        flag[i] = ord("Pt_In_S"[i-9])
    for i in range(18, 21):
        flag[i] = ord("IpT"[i-18])
    print(flag)
    for i in flag:
        print(chr(i), end='')