您好,登錄后才能下訂單哦!
一上來(lái)就給了兩個(gè)文件,一個(gè)是加密的源代碼,一個(gè)是加密過(guò)程文件,
challenge.py
N1ES.py
N1ES.py里一共有四個(gè)函數(shù),一個(gè)類,類里含有兩個(gè)函數(shù),除了最后一個(gè)encrypt函數(shù)外其他函數(shù)都是在對(duì)key進(jìn)行運(yùn)算,然后通過(guò)key來(lái)對(duì)flag進(jìn)行加密,所以我直接跑了一下程序,獲得了key加密后的數(shù)據(jù),然后只對(duì)encrypt函數(shù)進(jìn)行逆向
解密腳本:
Kn=[['~', 'w', 'Y', 'k', 'k', '\x02', '\x05', '\x05'],['w', 'd', '}', '\x14', '?', '\x13', '\x04', 'W'],['l', '6', '\x08', '\x04', '\x13', '3', '\x19', '\x10'],['\x08', 'P', '2', '\x02', '/', 'W', '/', 'W'],['\x08', '\x14', '?', '@', 'W', '^', ' ', 'k'],['\x1b', '6', '^', '(', 'M', 'Y', '\x19', '\x02'],['3', 'f', 'w', '(', '\x13', '}', '\x08', 'u'],['=', '_', '\x13', 'M', '2', '=', '@', '\x04'],['z', '_', '~', '\x08', 'L', 'f', '\x19', 'z'],['I', 'Y', '\x01', '}', '/', '}', 'L', 'o'],['\x19', '\x05', '3', '\x01', 'z', 'w', '~', '?'],['L', 'B', '~', '\x13', '@', '6', '@', '\x05'],['\x08', 'd', '\x13', 'L', '^', '?', 'L', 'u'],['\x05', '{', 'M', 'P', 'M', '\n', 'z', 'P'],['k', '~', 'k', '/', 'o', 'u', '\x19', '\x04'],['o', 'k', '(', '\x13', 'I', 'f', ' ', '='],['~', '\x04', '\x08', '^', '\x02', '\n', '6', '3'],['/', '\x05', 'w', '2', ' ', 'd', '\x13', '6'],[' ', '/', '}', '?', '\x04', '}', 'z', '\x19'],['\x05', '\n', '\n', 'l', '\x02', 'l', '^', 'l'],['k', '3', '}', '\x19', 'u', 'I', ' ', '^'],['~', 'B', '\x02', '}', 'k', '\x05', '\x02', '/'],['\n', '\x05', '^', '^', 'P', '}', '!', '{'],['\x08', 'W', 'u', 'o', ' ', '2', 'd', '\x04'],['/', 'W', 'w', '\x08', 'z', '\x19', '@', 'I'],['\x14', ' ', 'P', '!', '6', '6', ' ', '}'],['(', '!', '\x01', '\x08', 'd', '\x08', 'w', '?'],['u', 'W', '@', '\x13', '}', '~', '6', 'o'],['3', 'B', 'd', '\x01', 'W', '2', '\n', '6'],['}', '\x08', '6', '\x19', '&', '\x04', 'k', 'u'],['\x13', '2', '2', '(', '\x19', '{', '/', 'w'],['\x02', 'Y', ' ', 'W', '\x08', 'u', '\x01', 'I']]
import base64
s=base64.b64decode('HRlgC2ReHW1/WRk2DikfNBo1dl1XZBJrRR9qECMNOjNHDktBJSxcI1hZIz07YjVx')
flag=[]
for i in range(3):
flag.append(s[i*16:(i+1)*16])
from z3 import *
def fun(a,b):
x=[BitVec('x%d'%i,32) for i in range(8)]
solver=Solver()
res=''
for i in range(len(a)):
exec("solver.add(x[i]-2*(x[i]&ord(b[i]))==ord(a[i])-ord(b[i]))")
solver.check()
try:
exec("res+=chr(solver.model()[x[i]].as_long())")
except:
print solver
return res
res=''
for i in flag:
L=i[:8]
R=i[8:]
L,R=R,L
for k in range(32):
L,R=R,fun(L,Kn[k])
res+=L+R
print res
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng),如果涉及侵權(quán)請(qǐng)聯(lián)系站長(zhǎng)郵箱:is@yisu.com進(jìn)行舉報(bào),并提供相關(guān)證據(jù),一經(jīng)查實(shí),將立刻刪除涉嫌侵權(quán)內(nèi)容。