狗儿

热爱的话就坚持吧~

0%

国赛逆向

发表于 更新于 分类于 ，

这次的逆向蛮简单的，比之前的几场简单多了，感觉就是签到难度。逆向第三题是智能合约，没接触过，不会做。

re-z3

第一题标题是z3，所以是想让我们用z3解，不过我个人更喜欢matlab。

刚开始没解出来是因为正则表达式提取方程式系数出了点小意外，很快就修改了。提取脚本如下。代码看着有点长，其实大多是可以复制粘贴的。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
import struct
#with open(r'd:\dump', 'rb')as f:
#    b = f.read()
#print(b)
b = b'\x17O\x00\x00\xf6\x9c\x00\x00\xdb\x8d\x00\x00\xa6\x8e\x00\x00)i\x00\x00\x11\x99\x00\x00\xa2@\x00\x00>/\x00\x00\xb6b\x00\x00\x82K\x00\x00lH\x00\x00\x02@\x00\x00\xd7R\x00\x00\xef-\x00\x00\xdc(\x00\x00\rd\x00\x00\x8fR\x00\x00;a\x00\x00\x81G\x00\x00\x17k\x00\x0072\x00\x00\x93*\x00\x00_a\x00\x00\xbeP\x00\x00\x8eY\x00\x00VF\x00\x001[\x00\x00:1\x00\x00\x100\x00\x00\xfeg\x00\x00_M\x00\x00\xdbX\x00\x00\x997\x00\x00\xa0`\x00\x00P\'\x00\x00Y7\x00\x00S\x89\x00\x00"q\x00\x00\xf9\x81\x00\x00$U\x00\x00q\x89\x00\x00\x1d:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
c = []
for i in range(42):
    a = b[i*4:i*4+4]
    n = struct.unpack('I', a)
    c.append(n[0])
    print(n[0],end=';')
print()
print(len(c))

s = '''v4 = 34 * v49 + 12 * v46 + 53 * v47 + 6 * v48 + 58 * v50 + 36 * v51 + v52;
  v5 = 27 * v50 + 73 * v49 + 12 * v48 + 83 * v46 + 85 * v47 + 96 * v51 + 52 * v52;
  v6 = 24 * v48 + 78 * v46 + 53 * v47 + 36 * v49 + 86 * v50 + 25 * v51 + 46 * v52;
  v7 = 78 * v47 + 39 * v46 + 52 * v48 + 9 * v49 + 62 * v50 + 37 * v51 + 84 * v52;
  v8 = 48 * v50 + 14 * v48 + 23 * v46 + 6 * v47 + 74 * v49 + 12 * v51 + 83 * v52;
  v9 = 15 * v51 + 48 * v50 + 92 * v48 + 85 * v47 + 27 * v46 + 42 * v49 + 72 * v52;
  v10 = 26 * v51 + 67 * v49 + 6 * v47 + 4 * v46 + 3 * v48 + 68 * v52;
  v11 = 34 * v56 + 12 * v53 + 53 * v54 + 6 * v55 + 58 * v57 + 36 * v58 + v59;
  v12 = 27 * v57 + 73 * v56 + 12 * v55 + 83 * v53 + 85 * v54 + 96 * v58 + 52 * v59;
  v13 = 24 * v55 + 78 * v53 + 53 * v54 + 36 * v56 + 86 * v57 + 25 * v58 + 46 * v59;
  v14 = 78 * v54 + 39 * v53 + 52 * v55 + 9 * v56 + 62 * v57 + 37 * v58 + 84 * v59;
  v15 = 48 * v57 + 14 * v55 + 23 * v53 + 6 * v54 + 74 * v56 + 12 * v58 + 83 * v59;
  v16 = 15 * v58 + 48 * v57 + 92 * v55 + 85 * v54 + 27 * v53 + 42 * v56 + 72 * v59;
  v17 = 26 * v58 + 67 * v56 + 6 * v54 + 4 * v53 + 3 * v55 + 68 * v59;
  v18 = 34 * v63 + 12 * v60 + 53 * v61 + 6 * v62 + 58 * v64 + 36 * v65 + v66;
  v19 = 27 * v64 + 73 * v63 + 12 * v62 + 83 * v60 + 85 * v61 + 96 * v65 + 52 * v66;
  v20 = 24 * v62 + 78 * v60 + 53 * v61 + 36 * v63 + 86 * v64 + 25 * v65 + 46 * v66;
  v21 = 78 * v61 + 39 * v60 + 52 * v62 + 9 * v63 + 62 * v64 + 37 * v65 + 84 * v66;
  v22 = 48 * v64 + 14 * v62 + 23 * v60 + 6 * v61 + 74 * v63 + 12 * v65 + 83 * v66;
  v23 = 15 * v65 + 48 * v64 + 92 * v62 + 85 * v61 + 27 * v60 + 42 * v63 + 72 * v66;
  v24 = 26 * v65 + 67 * v63 + 6 * v61 + 4 * v60 + 3 * v62 + 68 * v66;
  v25 = 34 * v70 + 12 * v67 + 53 * v68 + 6 * v69 + 58 * v71 + 36 * v72 + v73;
  v26 = 27 * v71 + 73 * v70 + 12 * v69 + 83 * v67 + 85 * v68 + 96 * v72 + 52 * v73;
  v27 = 24 * v69 + 78 * v67 + 53 * v68 + 36 * v70 + 86 * v71 + 25 * v72 + 46 * v73;
  v28 = 78 * v68 + 39 * v67 + 52 * v69 + 9 * v70 + 62 * v71 + 37 * v72 + 84 * v73;
  v29 = 48 * v71 + 14 * v69 + 23 * v67 + 6 * v68 + 74 * v70 + 12 * v72 + 83 * v73;
  v30 = 15 * v72 + 48 * v71 + 92 * v69 + 85 * v68 + 27 * v67 + 42 * v70 + 72 * v73;
  v31 = 26 * v72 + 67 * v70 + 6 * v68 + 4 * v67 + 3 * v69 + 68 * v73;
  v32 = 34 * v77 + 12 * v74 + 53 * v75 + 6 * v76 + 58 * v78 + 36 * v79 + v80;
  v33 = 27 * v78 + 73 * v77 + 12 * v76 + 83 * v74 + 85 * v75 + 96 * v79 + 52 * v80;
  v34 = 24 * v76 + 78 * v74 + 53 * v75 + 36 * v77 + 86 * v78 + 25 * v79 + 46 * v80;
  v35 = 78 * v75 + 39 * v74 + 52 * v76 + 9 * v77 + 62 * v78 + 37 * v79 + 84 * v80;
  v36 = 48 * v78 + 14 * v76 + 23 * v74 + 6 * v75 + 74 * v77 + 12 * v79 + 83 * v80;
  v37 = 15 * v79 + 48 * v78 + 92 * v76 + 85 * v75 + 27 * v74 + 42 * v77 + 72 * v80;
  v38 = 26 * v79 + 67 * v77 + 6 * v75 + 4 * v74 + 3 * v76 + 68 * v80;
  v39 = 34 * v84 + 12 * v81 + 53 * v82 + 6 * v83 + 58 * v85 + 36 * v86 + v87;
  v40 = 27 * v85 + 73 * v84 + 12 * v83 + 83 * v81 + 85 * v82 + 96 * v86 + 52 * v87;
  v41 = 24 * v83 + 78 * v81 + 53 * v82 + 36 * v84 + 86 * v85 + 25 * v86 + 46 * v87;
  v42 = 78 * v82 + 39 * v81 + 52 * v83 + 9 * v84 + 62 * v85 + 37 * v86 + 84 * v87;
  v43 = 48 * v85 + 14 * v83 + 23 * v81 + 6 * v82 + 74 * v84 + 12 * v86 + 83 * v87;
  v44 = 15 * v86 + 48 * v85 + 92 * v83 + 85 * v82 + 27 * v81 + 42 * v84 + 72 * v87;
  v45 = 26 * v86 + 67 * v84 + 6 * v82 + 4 * v81 + 3 * v83 + 68 * v87;'''
import re
lines = s.split('\n')

for line in lines:
#    print(line)
    left = [0] * 42
    r = re.search(r'v(\d+?) = (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?);', line)
    if r:
        left[int(r.group(3)) - 46] = int(r.group(2))
        left[int(r.group(5)) - 46] = int(r.group(4))
        left[int(r.group(7)) - 46] = int(r.group(6))
        left[int(r.group(9)) - 46] = int(r.group(8))
        left[int(r.group(11)) - 46] = int(r.group(10))
        left[int(r.group(13)) - 46] = int(r.group(12))
    else:
        r = re.search(r'v(\d+?) = (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?);', line)
        if r:
            left[int(r.group(3)) - 46] = int(r.group(2))
            left[int(r.group(5)) - 46] = int(r.group(4))
            left[int(r.group(7)) - 46] = int(r.group(6))
            left[int(r.group(9)) - 46] = int(r.group(8))
            left[int(r.group(11)) - 46] = int(r.group(10))
            left[int(r.group(13)) - 46] = int(r.group(12))
            left[int(r.group(15)) - 46] = int(r.group(14))
        else:
            r = re.search(r'v(\d+?) = (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ (\d+?) \* v(\d+?) \+ v(\d+?);', line)
            left[int(r.group(3)) - 46] = int(r.group(2))
            left[int(r.group(5)) - 46] = int(r.group(4))
            left[int(r.group(7)) - 46] = int(r.group(6))
            left[int(r.group(9)) - 46] = int(r.group(8))
            left[int(r.group(11)) - 46] = int(r.group(10))
            left[int(r.group(13)) - 46] = int(r.group(12))
            left[int(r.group(14)) - 46] = 1
    for i in range(42):
        if i != 41:
            print(left[i], end=',')
        else:
            print(left[i], end=';\n')

然后是索然无味的matlab：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
>> A = [12,53,6,34,58,36,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
83,85,12,73,27,96,52,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
78,53,24,36,86,25,46,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
39,78,52,9,62,37,84,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
23,6,14,74,48,12,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
27,85,92,42,48,15,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
4,6,3,67,0,26,68,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,12,53,6,34,58,36,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,83,85,12,73,27,96,52,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,78,53,24,36,86,25,46,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,39,78,52,9,62,37,84,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,23,6,14,74,48,12,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,27,85,92,42,48,15,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,4,6,3,67,0,26,68,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,53,6,34,58,36,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,85,12,73,27,96,52,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,78,53,24,36,86,25,46,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,39,78,52,9,62,37,84,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,6,14,74,48,12,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,85,92,42,48,15,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,6,3,67,0,26,68,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,53,6,34,58,36,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,85,12,73,27,96,52,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,78,53,24,36,86,25,46,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,39,78,52,9,62,37,84,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,6,14,74,48,12,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,85,92,42,48,15,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,6,3,67,0,26,68,0,0,0,0,0,0,0,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,53,6,34,58,36,1,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,85,12,73,27,96,52,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,78,53,24,36,86,25,46,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,39,78,52,9,62,37,84,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,6,14,74,48,12,83,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,85,92,42,48,15,72,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,6,3,67,0,26,68,0,0,0,0,0,0,0;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,53,6,34,58,36,1;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,85,12,73,27,96,52;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,78,53,24,36,86,25,46;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,39,78,52,9,62,37,84;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,6,14,74,48,12,83;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,85,92,42,48,15,72;
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,6,3,67,0,26,68]

A =

  Columns 1 through 24

    12    53     6    34    58    36     1     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    83    85    12    73    27    96    52     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    78    53    24    36    86    25    46     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    39    78    52     9    62    37    84     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    23     6    14    74    48    12    83     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    27    85    92    42    48    15    72     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     4     6     3    67     0    26    68     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    12    53     6    34    58    36     1     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    83    85    12    73    27    96    52     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    78    53    24    36    86    25    46     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    39    78    52     9    62    37    84     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    23     6    14    74    48    12    83     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0    27    85    92    42    48    15    72     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     4     6     3    67     0    26    68     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    12    53     6    34    58    36     1     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    83    85    12    73    27    96    52     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    78    53    24    36    86    25    46     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    39    78    52     9    62    37    84     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    23     6    14    74    48    12    83     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0    27    85    92    42    48    15    72     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     4     6     3    67     0    26    68     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    12    53     6
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    83    85    12
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    78    53    24
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    39    78    52
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    23     6    14
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0    27    85    92
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     4     6     3
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0

  Columns 25 through 42

     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    34    58    36     1     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    73    27    96    52     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    36    86    25    46     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     9    62    37    84     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    74    48    12    83     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    42    48    15    72     0     0     0     0     0     0     0     0     0     0     0     0     0     0
    67     0    26    68     0     0     0     0     0     0     0     0     0     0     0     0     0     0
     0     0     0     0    12    53     6    34    58    36     1     0     0     0     0     0     0     0
     0     0     0     0    83    85    12    73    27    96    52     0     0     0     0     0     0     0
     0     0     0     0    78    53    24    36    86    25    46     0     0     0     0     0     0     0
     0     0     0     0    39    78    52     9    62    37    84     0     0     0     0     0     0     0
     0     0     0     0    23     6    14    74    48    12    83     0     0     0     0     0     0     0
     0     0     0     0    27    85    92    42    48    15    72     0     0     0     0     0     0     0
     0     0     0     0     4     6     3    67     0    26    68     0     0     0     0     0     0     0
     0     0     0     0     0     0     0     0     0     0     0    12    53     6    34    58    36     1
     0     0     0     0     0     0     0     0     0     0     0    83    85    12    73    27    96    52
     0     0     0     0     0     0     0     0     0     0     0    78    53    24    36    86    25    46
     0     0     0     0     0     0     0     0     0     0     0    39    78    52     9    62    37    84
     0     0     0     0     0     0     0     0     0     0     0    23     6    14    74    48    12    83
     0     0     0     0     0     0     0     0     0     0     0    27    85    92    42    48    15    72
     0     0     0     0     0     0     0     0     0     0     0     4     6     3    67     0    26    68

>> B = [20247;40182;36315;36518;26921;39185;16546;12094;25270;19330;18540;16386;21207;11759;10460;25613;21135;24891;18305;27415;12855;10899;24927;20670;22926;18006;23345;12602;12304;26622;19807;22747;14233;24736;10064;14169;35155;28962;33273;21796;35185;14877]

B =

       20247
       40182
       36315
       36518
       26921
       39185
       16546
       12094
       25270
       19330
       18540
       16386
       21207
       11759
       10460
       25613
       21135
       24891
       18305
       27415
       12855
       10899
       24927
       20670
       22926
       18006
       23345
       12602
       12304
       26622
       19807
       22747
       14233
       24736
       10064
       14169
       35155
       28962
       33273
       21796
       35185
       14877

>> A\B

ans =

  102.0000
  108.0000
   97.0000
  103.0000
  123.0000
   55.0000
  101.0000
   49.0000
   55.0000
   49.0000
  100.0000
   52.0000
   51.0000
   45.0000
   54.0000
   51.0000
   98.0000
   57.0000
   45.0000
   52.0000
  101.0000
   49.0000
   56.0000
   45.0000
   57.0000
   57.0000
   48.0000
  101.0000
   45.0000
   54.0000
  101.0000
   49.0000
   52.0000
   99.0000
   50.0000
   97.0000
  102.0000
  101.0000
   54.0000
   52.0000
   56.0000
  125.0000

re-hyperthreading

就是简单的hook程序的执行流程，跳转到另一处地方进行加密。比较简单的汇编，不过多解释。

image-20200820192017336

image-20200820192055828

单击input，按x查看交叉引用。

image-20200820192204643

image-20200820192224274

加密逻辑很简单，不多解释，dump出密文后运行下面的脚本：

1
2
3
4
5
6
with open(r'd:\dump','rb')as f:
    b = f.read()
for i in b:
    for a in range(127):
        if ((((a>>2)^(a<<6))^0x23)+0x23)&0xff == i:
            print(chr(a),end='')

misc-电脑被黑

前面怎么搞的不清楚，拿到队友给出的密文和demo文件，逆向就行了，很简单。

1
2
3
4
5
6
7
8
9
10
def dec(i, n):
    v4 = 34*(i+1)
    v5 = (i*2) & 0xf
    e = (n ^ v4) - v5
    print(chr(e&0xff),end='')

with open(r'D:\文档\QQ文件\flag.txt','rb')as f:
    b = f.read()
for i, n in enumerate(b):
    dec(i, n)