pyc\u53cd\u7f16\u8bd1\uff0c\u52a0\u5bc6\u987a\u5e8f\u662f\uff0c\u5f02\u621617\uff0c\u9ad8\u4f4e\u4f4d\u4ea4\u6362\uff0c\u53cd\u8f6c\u5b57\u8282\uff0c\u5faa\u73af\u5de6\u79fb32\u4f4d<\/p>\n\n\n\n
SYC{jtfgdsfda554_a54d8as53}<\/p>\n\n\n\n
cipher = [\n\n 48, 55, 57, 50, 53, 55, 53, 50, 52, 50, 48, 55, 101, 52, 53, 50, 52, 50, 52, 50, 48, 55, 53, 55, 55, 55, 50, 54, 53, 55, 54, 55, 55, 55, 53, 54, 98, 55, 97, 54, 50, 53, 56, 52, 50, 52, 99, 54, 50, 50, 52, 50, 50, 54]\n\n\n\ndef en3(b):\n\n return (b << 4 & 240) | (b >> 4 & 15)\n\n\n\ndef en33_inv(data, n):\n\n bit_len = len(data) * 8\n\n n = n % bit_len\n\n val = int.from_bytes(data, 'big')\n\n val = (val >> n) | (val << (bit_len - n)) & ((1 << bit_len) - 1)\n\n return val.to_bytes(len(data), 'big')\n\n\ncipher_hex = ''.join(chr(c) for c in cipher)\n\ndata = bytes.fromhex(cipher_hex)\n\ndata = en33_inv(data, 32)\n\ndata = data[::-1]\n\ndata = bytes([en3(b) for b in data])\ndata = bytes([b ^ 17 for b in data])\n\nflag = data.decode('utf-8')\n\nprint(flag)<\/code><\/pre>\n\n\n\nonly flower<\/h1>\n\n\n\n
ida\u53cd\u7f16\u8bd1\u6253\u5f00\u627e\u5230jumpout\u5904\u6253\u5f00\u6c47\u7f16\uff0c\u53d1\u73b0\u662fjmp\u8df3\u8f6c\u5230\u9519\u8bef\u5730\u5740\u5bfc\u81f4\u9519\u8bef\uff0cjmp\u5bf9\u5e94ef\uff0c\u5c06ef\u90e8\u5206nop\u6389\uff0c\u76f4\u5230\u80fd\u770b\u5230\u6b63\u786e\u4f2a\u4ee3\u7801\uff0c\u67e5\u770b\u7b97\u6cd5\u5f97\u51fa\uff08\u8bd5\u51fa\u6765\u7684\u7b97\u6cd5\uff0c\u8bd5\u4e86\u51e0\u4e2a\u4e0d\u540crol8\u7684\u5b9e\u73b0\uff0c\u6807\u51c6\u5faa\u73af\u5de6\u79fb\uff0c\u53f3\u79fb\uff0c\u53f3\u79fb\u6210\u529f\u4e86\uff09<\/p>\n\n\n\n
cipher = [\n 0x0A, 0x84, 0xC2, 0x84, 0x51, 0x48, 0x5F, 0xF2,\n 0x9E, 0x8D, 0xD0, 0x84, 0x75, 0x67, 0x73, 0x8F,\n 0xCA, 0x57, 0xD7, 0xE6, 0x14, 0x6E, 0x77, 0xE2,\n 0x29, 0xFE, 0xDF, 0xCC\n]\nkey = \"GEEK2025\"\nresult = []\n\nfor i, y in enumerate(cipher):\n r = (y - i) & 0xFF\n k = ord(key[i % len(key)])\n shift = k & 7\n x = ((r >> shift) | (r << (8 - shift))) & 0xFF\n result.append(chr(x ^ k))\n\nprint(''.join(result))<\/code><\/pre>\n\n\n\nSYC{asdjjasdhjk12wk12ijkejk}<\/p>\n\n\n\n
QYQS\u306e\u5947\u5999\u5192\u9669<\/h1>\n\n\n\n
die\u67e5\u770b\u6587\u4ef6\u683c\u5f0f\uff0c\u62d6\u8fdbx86dbg\u67e5\u770b\uff0c\u9898\u76ee\u63d0\u793a\u6709\u6309\u7a7a\u683c\uff0c\u8bd5\u4e86\u4e0b\u53d1\u73b0\u53eb\u6211nop\u7684\uff0c\u628ajmp\u90e8\u5206nop\u7ed3\u675f\u8fd0\u884c\uff0c\u6709\u591a\u4f59\u7684int3\u90e8\u5206\uff0cnop\u6389\u8fdb\u5165\u6b63\u786e\u6c47\u7f16\u7801\uff0c\u7ee7\u7eed\u8fd0\u884c\uff0c\u968f\u673a\u8bd5\u4e00\u4e2a\u53d1\u73b0\u9000\u51fa\u4e86\uff0c\u653e\u5f03\u4e86\uff0c\u62d6\u8fdbida\u9759\u6001\u5206\u6790\u53d1\u73b0\u662fxor\uff0c\u76f4\u63a5\u7b97\u4e86\uff0c\u5c31\u662f\u5148\u8ba9input\u4e0ei\u5f02\u6216\uff0c\u518d\u4e0ekey[i%4]\u5f02\u6216\uff0ckey\u4e3aQYQS<\/p>\n\n\n\n
def decrypt():\n\n QYQS = [\n\n 2, 1, 16, 43, 28, 3, 23, 57, 6, 1,\n\n 34, 41, 14, 11, 45, 109, 6, 32, 23, 127, 56\n\n ]\n\n key = \"QYQS\"\n\n result = []\n\n for i in range(21):\n\n decrypted = QYQS[i] ^ ord(key[i % 4])\n\n decrypted ^= i\n\n result.append(chr(decrypted))\n\n return ''.join(result)\n\n\n\nflag = decrypt()\n\nprint(f\"Flag: {flag}\")<\/code><\/pre>\n\n\n\nSYC{I_@m_QyqS_r1GhT?}<\/p>\n\n\n\n
encode<\/h1>\n\n\n\n
\u62d6\u8fdbida\uff0c\u6709\u4e2abase64\u63d0\u793a\uff0c\u67e5\u770b\u987a\u5e8f\u8868\u53d1\u73b0\u662f\u6807\u51c6base64\uff0c\u5916\u52a0\u4e00\u4e2a\u5f02\u6216\uff0c\uff08\u6bcf\u4e2a\u4e0e0x5A\u5f02\u6216\uff09\u628a\u5bc6\u6587\u89e3\u7801\u53d1\u73b0\u662f\u4e71\u7801\uff0c\u4e0d\u5bf9\uff0c\u7ffb\u7ffb\u522b\u7684\u7b97\u6cd5\uff0c\u53d1\u73b0\u8fd8\u6709\u4e2axtea\uff0c\u52a0\u4e0axtea\u89e3\u7801\uff0c\u5bc6\u94a5\u662fgeek2025reverse\uff01\uff0c\u5f97\u51faflag
\u6d41\u7a0b\u5c31\u662f\u5148\u7528tea\u52a0\u5bc6\uff0c\u5f02\u6216\uff0cbase64\u52a0\u5bc6\u5f97\u5230\u52a0\u5bc6\u540eflagvBzX30Koxl3HpDaYaFJKhyB\/1ckuVCnc4wZhrwUWeNuZkAxr+Qn5UaYbpvymmCrk<\/p>\n\n\n\n
import base64\nimport struct\n\ndef xtea_dec(block, key):\n v0, v1 = struct.unpack('>II', block)\n sum_val, delta = 0xC6EF3720, 0x9E3779B9\n for _ in range(32):\n v1 = (v1 - (((v0 << 4) ^ (v0 >> 5)) + v0 ^ sum_val + key[(sum_val >> 11) & 3])) & 0xFFFFFFFF\n sum_val = (sum_val - delta) & 0xFFFFFFFF\n v0 = (v0 - (((v1 << 4) ^ (v1 >> 5)) + v1 ^ sum_val + key[sum_val & 3])) & 0xFFFFFFFF\n return struct.pack('>II', v0, v1)\n\ndata = base64.b64decode(\"vBzX30Koxl3HpDaYaFJKhyB\/1ckuVCnc4wZhrwUWeNuZkAxr+Qn5UaYbpvymmCrk\")\ndata = bytes(b ^ 0x5A for b in data)\nkey = struct.unpack('>4I', b\"geek2025reverse!\")\n\nres = b''.join(xtea_dec(data[i:i+8], key) for i in range(0, len(data), 8))\nprint(res[:-res[-1]].decode())<\/code><\/pre>\n\n\n\nSYC{St4nd4rd_Funct10n_N0t_4lw4ys_St4nd4rd}<\/p>\n\n\n\n
ezSMC<\/h1>\n\n\n\n
\u53bb\u6389virtualprotcet\u90e8\u5206\uff0c\u5728miao encrypt\u70b9\u8fdb\u53bb\u4e4b\u540e\u7684\u524d\u9762\u4e0b\u65ad\u70b9\u52a8\u8c03\uff0c\u5f97\u5230\u89e3\u5bc6\u540e\u7684\u52a0\u5bc6\u51fd\u6570\u5185\u5bb9\uff0cu\uff0cc\u5f97\u5230\u4f2a\u4ee3\u7801\uff0c\u7b97\u6cd5\u662frc4\uff0bbase58\uff0bbase64<\/p>\n\n\n\n
import base64\n\nBASE58_TABLE = \"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz123456789\"\n\nclass RC4:\n def __init__(self, key):\n self.S = list(range(256))\n j = 0\n for i in range(256):\n j = (j + self.S[i] + key[i % len(key)]) & 0xFF\n self.S[i], self.S[j] = self.S[j], self.S[i]\n self.i = 0\n self.j = 0\n\n def crypt(self, data):\n res = bytearray()\n for b in data:\n self.i = (self.i + 1) & 0xFF\n self.j = (self.j + self.S[self.i]) & 0xFF\n self.S[self.i], self.S[self.j] = self.S[self.j], self.S[self.i]\n k = self.S[(self.S[self.i] + self.S[self.j]) & 0xFF]\n res.append(b ^ k)\n return bytes(res)\n\ndef base58_decode(data):\n leading_zeros = 0\n for char in data:\n if char == BASE58_TABLE[0]:\n leading_zeros += 1\n else:\n break\n num = 0\n for char in data[leading_zeros:]:\n num = num * 58 + BASE58_TABLE.index(char)\n res = bytearray()\n while num > 0:\n res.append(num & 0xFF)\n num >>= 8\n return (b'\\x00' * leading_zeros) + res[::-1]\n\ncipher = \"tHMoSoMX71sm62ARQ8aHF6i88nhkH9Ac2J7CrkQsQgXpiy6efoC8YVkzZu1tMyFxCLbbqvgXZHxtwK5TACVhPi1EE5mK6JG56wPNR4d2GmkELGfJHgtcAEH7\"\n\nb58_res = base58_decode(cipher)\nb64_res = base64.b64decode(b58_res)\nhex_res = bytes.fromhex(b64_res.decode())\nrc4 = RC4([17])\nflag = rc4.crypt(hex_res)\n\nprint(flag.decode())<\/code><\/pre>\n\n\n\nSYC{OHhhhhhhh_y0u_Kn0m_SMCCCC@!}<\/p>\n\n\n\n
QYQS\u306e\u5947\u5999\u5192\u96692<\/h1>\n\n\n\n
\u7ffb\u6c47\u7f16\u4e2d\uff0c\u770b\u5230flag\u4e86\uff0c\u628aflag\u5bfc\u51fa\u6765\u53bb\u7a7a\u683c
SYC{M@y_bE_y0u_F1nd?}<\/p>\n\n\n\n
obfuscat3<\/h1>\n\n\n\n
\u5728init_encode\u91cc\u9762\u770b\u5230\u4e00\u4e2a\u50cf\u662f\u5bc6\u94a5\u6d41\u4e00\u6837\u7684\u4e1c\u897f\uff0c\u4ed4\u7ec6\u770b\u53d1\u73b0\u662frc4\uff0cv5 = 0x617261736D6153LL\uff0c\u5bf9\u5e94Samsara\uff0cmain\u91cc\u9762\u6709<\/p>\n\n\n\n
obf_encode(s, n_4, (unsigned __int8 *)&v5);<\/code><\/pre>\n\n\n\na1[i] += mysterious_box[(unsigned __int8)((int)(v19\n - ((~(unsigned __int8)mysterious_box[v22] | ~((v13 & 0x7911131C | mysterious_box[v21] & 0xE3) ^ (mysterious_box[v22] & 0x1C | ~(unsigned __int8)mysterious_box[v22] & 0x86EEECE3)))\n + 1))\n % 256)];<\/code><\/pre>\n\n\n\n(\u80fd\u770b\u5230\u7c7b\u4f3crc4\u7684\u64cd\u4f5c\u4e86)\u5728initencode\u91cc\u00b7\uff0c\u521d\u59cb\u5316\u4e86s\uff0c\u7528\u5bc6\u94a5\u7f6e\u6362\uff0cobfencode\u751f\u6210\u5bc6\u94a5\u6d41\uff0c\u64cd\u4f5c\uff0c\u62ffrc4\u89e3\u51fa\u9519\u4e86\uff0c\u91cd\u65b0\u770b\uff0c\u4f7f\u7528\u4e86mysteriousbox\u6570\u7ec4\uff0c\u53d1\u73b0\u662f\u53d8\u79cdrc4\uff0c\u5f02\u6216\u53d8\u6210\u52a0\u6cd5\uff0c<\/p>\n\n\n\n
a1[i] += mysterious_box<\/code><\/pre>\n\n\n\n\u89e3\u5bc6\u628a\u52a0\u6cd5\u53d8\u6210\u51cf\u6cd5<\/p>\n\n\n\n
def rc4_init(key):\n\n S = list(range(256))\n\n j = 0\n\n for i in range(256):\n\n j = (j + S[i] + key[i % len(key)]) % 256\n\n S[i], S[j] = S[j], S[i]\n\n return S\n\n\n\ndef rc4_stream(S, length):\n\n i = 0\n\n j = 0\n\n stream = []\n\n for _ in range(length):\n\n i = (i + 1) % 256\n\n j = (j + S[i]) % 256\n\n S[i], S[j] = S[j], S[i]\n\n stream.append(S[(S[i] + S[j]) % 256])\n\n return stream\n\n\n\ncipher = [\n\n 0xB4, 0xCD, 0x69, 0x54, 0xBD, 0x67, 0x20, 0x9D, 0xF2, 0xC3, 0x24, 0x14, 0xC2, 0x1B, 0xE9, 0x6A,\n\n 0x44, 0x14, 0x4E, 0x39, 0xC5, 0xC8, 0x5B, 0x11, 0x75, 0xAD, 0xDE, 0xBB, 0xFE, 0xE4, 0x6E, 0x65,\n\n 0x06, 0x9A, 0x91, 0xFE, 0xA0, 0x68, 0xA4, 0x86, 0x17, 0x6C, 0x0A, 0xCF, 0x1E, 0x67, 0xE3, 0x0D,\n\n 0x60, 0x47, 0x13, 0x6B, 0xD1, 0x36, 0xF2, 0x77, 0x58, 0x76, 0x1E, 0x98, 0xF5, 0x7F, 0x0A, 0x92,\n\n 0xB7, 0x0A, 0xEA, 0xAE, 0x46, 0x7E, 0x6A, 0x18, 0x4A, 0x59, 0x4E, 0x71, 0xB2, 0xE1, 0x41, 0x7A,\n\n 0x0B, 0x31, 0xBA, 0xC6, 0xAA, 0xCF, 0xCE, 0x09, 0xBF, 0x2E, 0xF8, 0x4D, 0x75, 0xEF, 0x14, 0xED,\n\n 0x5F, 0x66, 0x44, 0x6F, 0xDE, 0xE2, 0x7C, 0x10, 0x8C, 0xB7, 0x4E, 0x6B, 0xB2, 0xD4, 0xF6, 0x91,\n\n 0xD7, 0x84, 0x86, 0x1F, 0xF8, 0x65, 0x94, 0x0B, 0x14, 0x28, 0xFB, 0xDD, 0x47, 0xF4, 0xC1, 0x17,\n\n 0x42, 0x3F, 0x1E, 0x38, 0x07, 0xBB, 0x37, 0x33, 0x12, 0x0C, 0x16, 0x68, 0xE0, 0x23, 0x12, 0x75,\n\n 0x72, 0xD9, 0x71, 0x7A, 0x88, 0xD0, 0x46, 0x28, 0x88, 0xAD, 0x1E, 0x98, 0x8F, 0x92, 0x7E, 0x0E,\n\n 0x69, 0x29, 0x37, 0xB1, 0xFF, 0xC5, 0xAF, 0x6F, 0x41, 0x37, 0x65, 0x0E, 0xD2, 0x62, 0x11, 0x8F,\n\n 0xA6, 0x3E, 0x95, 0xF5, 0x80, 0x9A, 0xDC\n\n]\n\n\n\nkey = b'Samsara'\n\nS = rc4_init(key)\n\nstream = rc4_stream(S, len(cipher))\n\nplain = bytes((cipher[i] - stream[i]) % 256 for i in range(len(cipher)))\n\nprint(plain.decode())<\/code><\/pre>\n\n\n\nSYC{Alright_I_sti1l_h0pe_th3t_you_solved_the_chall3nge_by_deobfuscating_them_Geek_is_just_the_first_step_of_your_CTF_journey_Im_glad_I_could_be_part_of_your_growth_Good_luck_for_y0u!}<\/p>\n\n\n\n
Gensh1n<\/h1>\n\n\n\n
\u6709\u4e2a\u7b80\u5355\u8f93\u5165\uff0c\u5bf9\u5e94\u516b\u4e2a\u6709\u4e00\u4e2a\u76f8\u540c\uff0c\u901a\u8fc7is valid char\u5224\u65ad\uff0c\u5c06\u8f93\u5165\u7684\u6bcf\u4e2a\u5b57\u7b26\u4e0eglobal_nodes[16 * j]\u6bd4\u8f83\uff0c\u6709\u5339\u914d\u5c31\u8bbe\u7f6ev5=1\u8df3\u51fa\u5faa\u73afclean up\u91cc\u9762\uff0c\u53d6\u516b\u4e2a\u5b57\u7b26\u4f5c\u4e3av7\uff0c\u7136\u540e\u5224\u65ad<\/p>\n\n\n\n
if ( !validate_key((__int64)v7, 8) )\n exit(1);<\/code><\/pre>\n\n\n\n\uff0c\u5728data\u6bb5\u627e\u5230 arr geek2025\uff0c\u548cresult28\u5b57\u8282\u6570\u636e\uff0c\u5728sub44656\u91cc\u9762\u770b\u51farc4\uff0c\u56e0\u4e3a\u6709\u4e2asbox\u548cksa\u548cprga\u548c\u5f02\u6216\u52a0\u5bc6\uff0c\u666e\u901arc4\u89e3\u5bc6\uff0c\u89e3\u4e00\u4e0b
validate_key\u8bf4\u660eglobalnodes\u7684\u516b\u5b57\u8282key\u56fa\u5b9a<\/p>\n\n\n\n
result = [0x52, 0x59, 0xF3, 0x8A, 0x00, 0x0F, 0xE6, 0x56, 0x36, 0xE5, 0xF0, 0x33, 0x40, 0x6E, 0x56, 0x81, 0x5A, 0xE5, 0x6F, 0x87, 0x6F, 0x9F, 0x21, 0xC9, 0xA6, 0xBB, 0x16, 0x51]\n\nkey = b\"geek2025\"\n\n\n\nS = list(range(256))\n\nj = 0\n\nfor i in range(256):\n\n j = (j + S[i] + key[i % 8]) % 256\n\n S[i], S[j] = S[j], S[i]\n\n\n\ni = j = 0\n\nplaintext = []\n\nfor byte in result:\n\n i = (i + 1) % 256\n\n j = (j + S[i]) % 256\n\n S[i], S[j] = S[j], S[i]\n\n k = S[(S[i] + S[j]) % 256]\n\n plaintext.append(byte ^ k)\n\n\n\nprint(\"Snd input:\", bytes(plaintext))<\/code><\/pre>\n\n\n\nSYC{50_y0u_pl@y_Gensh1n_too}<\/p>\n\n\n\n
GeekBinder<\/h1>\n\n\n\n
\u83b7\u53d6\u786c\u7f16\u7801\u6570\u636e\uff0c\u67e5\u770b\u7b97\u6cd5\uff0c\u6709\u4e2a8\u5b57\u8282\u5faa\u73af\u5bc6\u94a5\uff0c\u5f02\u6216\u89e3\u5bc6\u5c31\u884c\uff0c\u4e24\u4e2a\u6587\u4ef6\u5206\u522b\u6253\u5f00\u4f7f\u7528\u7684\u6570\u636e\u4f1a\u6709\u4e0d\u540cflag\uff0c\u6709\u7ec6\u5fae\u5dee\u522b
\u5728sub1119\u91cc\uff0c\u6709\u4e00\u4e2axor\u7684\u8fc7\u7a0b\uff0c\u6bcf\u4e2a\u5b57\u8282\uff0c\u5bc6\u94a5\u662fgeek2025\uff0c\u5faa\u73af\u4f7f\u7528\uff0c\u5728qword2020\uff0c2928\u52302060\uff0cword2078\uff0cbyte207a\u90a3\u91cc\u63d0\u6570\u636e\uff0c\u5728\u5185\u5b58\u4e2d\uff0c\u5b57\u8282\u4ece\u4f4e\u5730\u5740\u5230\u9ad8\u5730\u5740\uff0c\u6240\u4ee5\u6700\u540e\u6839\u636e\u63d0\u53d6\u51fa\u7684\u6570\u636e\u5199\u89e3\u5bc6\u811a\u672c
\u4f46\u662f\u7b2c\u4e00\u4e2a\u89e3\u5bc6\u811a\u672c\u5f97\u51fa\u4e86\u4e00\u4e2a\u9519\u8befflag\uff0c\u683c\u5f0f\u662f\u6b63\u786e\u7684<\/p>\n\n\n\n
encrypted = [\n 0x34, 0x3C, 0x26, 0x10, 0x73, 0x5E, 0x72, 0x7C,\n 0x1E, 0x1F, 0x54, 0x05, 0x55, 0x6F, 0x66, 0x5D,\n 0x54, 0x3A, 0x15, 0x19, 0x5D, 0x53, 0x01, 0x46,\n 0x14, 0x56, 0x14, 0x34, 0x70, 0x03, 0x66, 0x42,\n 0x02, 0x00, 0x0B, 0x34, 0x74, 0x59, 0x5E, 0x50,\n 0x54, 0x3A, 0x54, 0x18, 0x6D, 0x53, 0x5D, 0x5B,\n 0x13, 0x17, 0x25, 0x19, 0x4B, 0x6F, 0x66, 0x5A,\n 0x38, 0x0B, 0x55, 0x19, 0x5F, 0x70, 0x5E, 0x6A,\n 0x17, 0x17, 0x25, 0x08, 0x46, 0x59, 0x51, 0x06,\n 0x38, 0x54, 0x0B, 0x34, 0x60, 0x55, 0x6D, 0x50,\n 0x09, 0x02, 0x54, 0x05, 0x57, 0x55, 0x40, 0x04,\n 0x09, 0x02,\n 0x18\n]\n\nkey = \"geek2025\"\nkey_bytes = [ord(c) for c in key]\n\ndecrypted = []\nfor i, byte in enumerate(encrypted):\n k = key_bytes[i % len(key_bytes)]\n decrypted.append(byte ^ k)\n\ndecrypted_str = ''.join(chr(b) for b in decrypted)\nprint(decrypted_str)<\/code><\/pre>\n\n\n\nSYC{An@Iyz1ng_Th3_proc3s3q_B3Tween_File3_1s_contr@ry_To_n0rm@l_pr@ctic3_1n_Re_engineer1ng}\uff0c\u67e5\u770b\u53e6\u4e00\u4e2aso\u6587\u4ef6\u770b\u5230\u7684\u662f<\/p>\n\n\n\n
*v3 = 0x7C725E7310263C34LL;\n v3[1] = 0x5D666F5505541F1ELL;\n v3[2] = 0x4601535D19153A54LL;\n v3[3] = 0x4266037034165614LL;\n v3[4] = 0x505E5974340B0002LL;\n v3[5] = 0x5B5D536D18543A54LL;\n v3[6] = 0x5A666F4B19251713LL;\n v3[7] = 0x6A5E705F19550B38LL;\n v3[8] = 0x651594608251717LL;\n v3[9] = 0x506D5560340B5438LL;\n v3[10] = 0x440555705540209LL;<\/code><\/pre>\n\n\n\n\u6362\u4e86\u4e2a\u6570\u636e\u63d0\uff0c\u51fa\u6b63\u786eflag\u4e86<\/p>\n\n\n\n
encrypted = [\n\n 0x34, 0x3C, 0x26, 0x10, 0x73, 0x5E, 0x72, 0x7C,\n\n 0x1E, 0x1F, 0x54, 0x05, 0x55, 0x6F, 0x66, 0x5D,\n\n 0x54, 0x3A, 0x15, 0x19, 0x5D, 0x53, 0x01, 0x46,\n\n 0x14, 0x56, 0x14, 0x34, 0x70, 0x03, 0x66, 0x42,\n\n 0x02, 0x00, 0x0B, 0x34, 0x74, 0x59, 0x5E, 0x50,\n\n 0x54, 0x3A, 0x54, 0x18, 0x6D, 0x53, 0x5D, 0x5B,\n\n 0x13, 0x17, 0x25, 0x19, 0x4B, 0x6F, 0x66, 0x5A,\n\n 0x38, 0x0B, 0x55, 0x19, 0x5F, 0x70, 0x5E, 0x6A,\n\n 0x17, 0x17, 0x25, 0x08, 0x46, 0x59, 0x51, 0x06,\n\n 0x38, 0x54, 0x0B, 0x34, 0x60, 0x55, 0x6D, 0x50,\n\n 0x09, 0x02, 0x54, 0x05, 0x57, 0x55, 0x40, 0x04,\n\n 0x09, 0x02,\n\n 0x18\n\n]\n\nkey = \"geek2025\"\n\nkey_bytes = [ord(c) for c in key]\n\n\n\ndecrypted = []\n\nfor i, byte in enumerate(encrypted):\n\n k = key_bytes[i % len(key_bytes)]\n\n decrypted.append(byte ^ k)\n\n\n\ndecrypted_str = ''.join(chr(b) for b in decrypted)\n\nprint(decrypted_str)<\/code><\/pre>\n\n\n\nSYC{An@Iyz1ng_Th3_proc3ss3q_B3Tween_File3_1s_contr@ry_To_n0rm@l_pr@ctic3_1n_Re_eng1neer1ng}<\/p>\n\n\n\n
ez_vm<\/h1>\n\n\n\n
sub_1a2b3c\u91cc\uff0ckey\u4e3a3\uff0c\u8fd0\u884cstring_process_program\uff0c\u5904\u7406\u52a0\u5bc6\u6570\u636e<\/p>\n\n\n\n
sub_1a2b3c(global_vm, &sub_5c6d7e, 3LL, 0x1DuLL);<\/code><\/pre>\n\n\n\n\u4f20\u51653\u4e86\uff0c\u540e\u9762\u6570\u636e\u53d8\u5316\u4e86\uff0c
\u5728sub_9e8f7a\u91cc\uff0c\u4f1a\u8bfb\u8f93\u5165\uff0c\u5c06\u8f93\u5165\u5b58\u5230vm\u5185\u5b58\u504f\u79fb512\u7684\u5730\u65b9\uff0c\u518d\u5c06\u4e00\u6bb5\u957f\u5ea6\u4e3a29\u7684\u6570\u636e\u4ece\u504f\u79fb256\u51fa\u590d\u5236\u5230768\u5904\uff0c\u5728\u6c47\u7f16\u7801\u91cc\u9762\u6709\u4e00\u4e2amov r3\uff0c 0x5A\uff0c\u628az\u653e\u5165\u5bc4\u5b58\u5668\u4e86\uff0c\u7136\u540e\u5728vmrun\u91cc\u9762\u6267\u884c\u4e86\uff0c\u5224\u65ad\u5f02\u6216\u5728\u4e8e10h\uff0cxor\u7684\u64cd\u4f5c\u7801
\u63d0\u53d6\u6570\u636e\uff0c\u6bcf\u4e2a\u5b57\u8282\uff0b3\uff0c\u4e0e0x5A\u8fdb\u884c\u5f02\u6216\uff0c\u5f97\u5230flag<\/p>\n\n\n\n
def solve_final():\n\n encrypted_data = [\n\n 0x06, 0x00, 0x16, 0x1E, 0x0A,\n\n 0x66, 0x68, 0x36, 0x67, 0x34, 0x66,\n\n 0x02, 0x2B, 0x67, 0x02, 0x25, 0x66,\n\n 0x17, 0x68, 0x02, 0x25, 0x66, 0x29,\n\n 0x3C, 0x25, 0x26, 0x3C, 0x78, 0x24\n\n ]\n\n\n\n flag = \"\"\n\n for b in encrypted_data:\n\n val = ((b + 3) & 0xFF) ^ 0x5A\n\n flag += chr(val)\n\n\n\n print(f\"Flag: {flag}\")\n\n\n\nif __name__ == \"__main__\":\n\n solve_final()<\/code><\/pre>\n\n\n\nSYC{W31c0m3_t0_r3@1_r3verse!}<\/p>\n\n\n\n
reReverse<\/h1>\n\n\n\n
\u6253\u5f00main\u53d1\u73b0\u5f88\u7b80\u77ed\uff0c\u67e5\u770b\u5176\u4ed6function\u53d1\u73b0\u4e86\u4e00\u4e2a\u6ca1\u89c1\u8fc7\u7684writtenflags\uff0c\u5728csdn\u91cc\u9762\u641c\u7d22\u53d1\u73b0\u5e94\u8be5\u662ftf\uff0c\u67e5\u770b\u5176\u5b83\u90e8\u5206\uff0c\u76f4\u63a5\u52a8\u8c03\u8bd5\u9a8c\u4e00\u4e2aflag\uff0c\u53d1\u73b0\u7b26\u5408tf\u76f4\u63a5\u88ab\u9000\u51fa\u4e86\uff0c\u8bbe\u7f6e\u65ad\u70b9\u4e5f\u4f1a\u9000\u51fa\uff0c\u641c\u7d22\u6559\u7a0bnop\u6389tf\u90e8\u5206\u53d1\u73b0\u7a0b\u5e8f\u4f1a\u5d29\u6e83\uff0c\u6539\u53bb\u6c47\u7f16\u91cc\u9762\u627e\uff0c\u5728\u6c47\u7f16\u91cc\u9762\u53d1\u73b0\u6709\u4e2atea\u7cfb\u5217\u7684\u0394\u5e38\u65700x9E3779B9\uff0cTEA\u7b97\u6cd5\u7684\u4e3b\u8981\u7279\u5f81\u8868\u73b0\u5728sum\u548cdelta\u53d8\u91cf\uff0c\u6709\u4f4d\u8fd0\u7b97\u548c\u5faa\u73af\uff0c\u5c1d\u8bd5\u4e86tea\u548cxtea\u90fd\u662f\u4e71\u7801\uff0c\u6ca1\u62db\u4e86\u95ee\u4e86\u5b66\u957f\uff0c\u5bf9\u6bd4tea\uff0cxtea\uff0cxxtea\u7279\u5f81\uff0c\u53d1\u73b0mx\uff0c\u786e\u5b9a\u662fxxtea\u3002\u627e\u5230key\uff0c\u5bc6\u94a5\uff0c\u5bc6\u6587\u7b49\u90e8\u5206\uff0c\u522b\u7684\u503c\u89e3\u5bc6\u662f\u4e71\u7801\u6ca1\u6709\u6570\u5b57\uff0c\u4f46\u662f\u6c47\u7f16\u89e3\u5bc6\u6709\u4e00\u6bb50000000000403080\u4ece\u8fd9\u91cc\u5f00\u59cb\uff0c\u53ef\u80fd\u662f\u6bd4\u8f83\u7684\u660e\u6587\uff0c\u4ece\u6c47\u7f16\u7801\u63d0\u51fa\u503c\uff0c\u7136\u540e\u6839\u636e\u5730\u5740\u7684\u987a\u5e8f\u6392\u5217\u8fd9\u4e9b\u503c0xDEAD, 0xBEEF, 0x5A7D, 0xC0FF\u8fd0\u7528\u5bc6\u94a5\uff0c\u6700\u540e\u89e3\u5bc6\u6210\u5b57\u7b26\u4e32<\/p>\n\n\n\n
import struct\n\ndef xxtea_decrypt(v, k):\n n = len(v)\n rounds = 6 + 52 \/\/ n\n sum_val = (rounds * 0x9E3779B9) & 0xFFFFFFFF\n y = v[0]\n for _ in range(rounds):\n e = (sum_val >> 2) & 3\n for p in range(n - 1, 0, -1):\n z = v[p - 1]\n y = v[p] = (v[p] - ((((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))) ^ ((sum_val ^ y) + (k[(p & 3) ^ e] ^ z)))) & 0xFFFFFFFF\n p = 0\n z = v[n - 1]\n y = v[0] = (v[0] - ((((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))) ^ ((sum_val ^ y) + (k[(p & 3) ^ e] ^ z)))) & 0xFFFFFFFF\n sum_val = (sum_val - 0x9E3779B9) & 0xFFFFFFFF\n return v\n\ndata = [\n 0x2973BD37, 0x1BA99AA3, 0xB3C20088, 0xBFC393AB, 0x352ADCCF,\n 0x3B98E6E6, 0xAE421991, 0xD7B702CF, 0x0EEF6889, 0x08662435\n]\nkey = [0xDEAD, 0xBEEF, 0x5A7D, 0xC0FF]\n\nres = xxtea_decrypt(data, key)\nflag_bytes = b''.join(struct.pack('<I', x) for x in res)\n\nprint(f\"Hex: {flag_bytes.hex()}\")\nprint(f\"\u7ed3\u679c: {flag_bytes.decode().rstrip(chr(0))}\")<\/code><\/pre>\n\n\n\n\u5728.text\u6bb5\u53ef\u4ee5\u770b\u5230\u6bd4\u8f83\u6307\u4ee4<\/p>\n\n\n\n
.text:00000000004008BA cmp r9d, 2973BD37h\n.text:00000000004008E1 cmp r10d, 8662435h\n.text:00000000004008ED cmp r11d, 0EEF6889h\n.text:00000000004008F9 cmp ebx, 0AE421991h\n.text:0000000000400902 cmp ebp, 0D7B702CFh\n.text:000000000040090A cmp r8d, 3B98E6E6h\n.text:0000000000400926 cmp edx, 352ADCCFh\n.text:000000000040092F cmp ecx, 0BFC393ABh\n.text:0000000000400938 cmp esi, 0B3C20088h\n.text:0000000000400942 cmp edi, 1BA99AA3h<\/code><\/pre>\n\n\n\n\u7136\u540e\u518d\u8fd9\u6bb5\u4e2d\uff0c\u6709<\/p>\n\n\n\n
.text:0000000000400CEA mov r9d, [rsp+40h]\n.text:0000000000400CDE mov edi, [rsp+44h]\n.text:0000000000400CD0 mov esi, [rsp+48h]\n.text:0000000000400CC4 mov ecx, [rsp+4Ch]\n.text:0000000000400CB4 mov edx, [rsp+50h]\n.text:0000000000400CA7 mov r8d, [rsp+54h]\n.text:0000000000400CA3 mov ebx, [rsp+58h]\n.text:0000000000400C9F mov ebp, [rsp+5Ch]\n.text:0000000000400C92 mov r11d, [rsp+60h]\n.text:0000000000400C8D mov r10d, [rsp+64h]<\/code><\/pre>\n\n\n\n\u52a0\u8f7d\u503c\u5230\u5bc4\u5b58\u5668\u7684\u8fc7\u7a0b\uff0c\u7136\u540e\u5728\u540e\u9762\u7684\u6bd4\u8f83\u91cc\u88ab\u4f7f\u7528
\u5c31\u662f\u5148\u4ece\u6808\u52a0\u8f7d\u89e3\u5bc6\u540e\u7684\u503c\u5230\u5bc4\u5b58\u5668\uff0c\u518d\u5c06\u5bc4\u5b58\u5668\u503c\u4e0e\u786c\u7f16\u7801\u6bd4\u8f83\uff0c\u6bd4\u8f83\u6210\u529f\u5c31win<\/p>\n\n\n\n
SYC{sakurakouji_runasama_wa_seikai_ichi}<\/p>\n\n\n\n
ezRu3t<\/h1>\n\n\n\n
\u4e0b\u4e86\u4e2arust\u7684\u63d2\u4ef6\uff0c\u7b97\u6cd5\u4e00\u4e2abase64\u4e00\u4e2abase85\uff0c\u6709<\/p>\n\n\n\n
!\\\"#$%&'()*+,-.\/0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]^_`abcdefghijklmnopqrstu\nbase85\nABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/\nbase64\n<AA;XAM?,_@;T[r@7E779h8;s>'`pt=>3c6ASuHFASOtP<Gkf_A4&gPAl1]S\n\u5bc6\u6587<\/code><\/pre>\n\n\n\n\u7f51\u7ad9\u5728\u7ebf\u89e3\u5bc6\u5f97SYC{Ohjhhh_y0u_g3t_Ezzzzz3_Ru3t!@}<\/p>\n\n\n\n
qyqs2<\/h1>\n\n\n\n
\u53cd\u8c03\u8bd5\u6df7\u6dc6\u6280\u5de7
\u6d6e\u70b9\u6570\u6807\u51c6\uff08IEEE 754\uff09NAN\u7684\u7279\u6b8a\u6027\u8d28<\/p>\n\n\n\n
.text:000000014001264B movss xmm0, [rbp+2D0h+a] ; \u5c06\u53d8\u91cf a \u52a0\u8f7d\u5230 xmm0 \u5bc4\u5b58\u5668\n.text:0000000140012653 ucomiss xmm0, [rbp+2D0h+a] ; \u5c06 xmm0 \u4e0e a \u8fdb\u884c\u6bd4\u8f83 (\u5373\u6bd4\u8f83 a \u548c a)\n.text:000000014001265A jp loc_1400127AA ; jp (Jump if Parity) \u5982\u679c P\/PF \u6807\u5fd7\u4f4d\u4e3a 1 \u5219\u8df3\u8f6c\n.text:0000000140012660 jnz loc_1400127AA ; jnz \u5982\u679c\u975e\u96f6\u5219\u8df3\u8f6c\uff08\u8fd9\u91cc\u662f\u8f85\u52a9\u5224\u65ad\uff09\n.text:0000000140012666 mov [rbp+2D0h+i], 0 ; \u5047\u8def\u5f84\uff1a\u5982\u679c\u6ca1\u8df3\u8f6c\uff0c\u7ee7\u7eed\u6267\u884c\u8fd9\u91cc<\/code><\/pre>\n\n\n\n\u6307\u4ee4ucomiss
\u5f53\u4e24\u4e2a\u64cd\u4f5c\u6570\u81f3\u5c11\u6709\u4e00\u4e2a\u662fNAN\u65f6\uff0c\u6bd4\u8f83\u7ed3\u679c\u4f1a\u88ab\u6807\u8bb0\u4e3a\u65e0\u9700\uff0c\u4e09\u4e2a\u6807\u5fd7\u4f4dzf\uff0cpf\uff0ccf\u540c\u65f6\u7f6e\u4e3a\u4e00\u3002jp\u8df3\u8f6c\u68c0\u6d4bpf\uff0c\u6574\u6570\u8fd0\u7b97\u4e2d\uff0cpf\u8868\u793a\u5c31\u884c\uff0cpf\u8bbe\u7f6e\u4e3a\u4e00\uff0cjp\u751f\u6548\uff0c\u8df3\u8f6c\u5230loc_1400127AA
\u539f\u7406\uff0cida\u751f\u6210\u4f2a\u4ee3\u7801\u65f6\u4f1a\u8fdb\u884c\u6b7b\u4ee3\u7801\u6d88\u9664\uff0cucomiss\u4e4b\u540e\u7684jp\u6216jnz\u5206\u652f\u88ab\u8ba4\u4e3a\u4e0d\u53ef\u80fd\u6267\u884c
\u89e3\u51b3\uff0c\u5c06jp\u6539\u4e3ajmp\u5f3a\u5236\u8df3\u8f6c<\/p>\n\n\n\n
her<\/h1>\n\n\n\n
enc1\u5230enc2\u7684\u8fde\u63a5\u70b9\u5c31\u662fseh\u7ed3\u6784\u5316\u5f02\u5e38\u5904\u7406\uff0c\u5c06\u5f02\u5e38\u5904\u7406\u51fd\u6570\u5730\u5740\u538b\u6808\uff0c\u4fdd\u7559\u65e7\u7684\u5f02\u5e38\u94fe\u8868\u5934\uff0c\u5c06\u5f53\u524d\u6808\u9876\u8bbe\u4e3a\u65b0\u7684\u8868\u5934\uff0c\u7136\u540e\u518dmov large fs:0, esp\u540e\u9762\uff0c\u63a5\u4e86\u4e00\u4e2adiv\uff0c\u9996\u5148\u5728xor ecx, ecx\u8fd9\u91cc\uff0c\u5c06ecx\u5bc4\u5b58\u5668\u6e05\u96f6\uff0ceax\u8bbe\u4e3a1\uff0cdiv \u4e00\u4e2a\u4e3a0\u7684\u5bc4\u5b58\u5668\uff0c\u5bfc\u81f4\u5f02\u5e38\uff0c\u7136\u540e\u5c06eip\u6307\u5411sub401186\uff0c\u8ba9\u8fd9\u51e0\u4e2a\u65e0\u6cd5\u6267\u884c<\/p>\n\n\n\n
.text:00401F7C mov eax, [esp+0E0h+var_E0]\n.text:00401F7F mov large fs:0, eax\n.text:00401F85 add esp, 8<\/code><\/pre>\n\n\n\n\u7136\u540e\u5c31\u5230enc2\u4e86\uff0c\u7ee7\u7eed\u627eenc\u5c31\u884c\uff0c\u5c31\u662f\u628a\u6b63\u5e38\u52a0\u5bc6\u653e\u8fdbseh\u91cc\u9762\u4e86\uff0c\u4f46seh\u7684\u5927\u4f53\u7ed3\u6784\u662f\u4e0d\u53d8\u7684\uff0c\u5728\u53cd\u8c03\u8bd5\u7684\u90e8\u5206\u91cc\u9762\uff0c\u56e0\u4e3a\u8bbe\u7f6e\u4e86\u52a8\u6001key\uff0c\uff08\u6bcf\u6b21\u89e6\u53d1\u5f02\u5e38\u7684\u65f6\u5019\uff0c\u8fdb\u5165enc2\u6216\u8005enc3\uff0ckey\u5c31\u53d8\u5316\uff09\u6240\u4ee5\u628a\u53cd\u8c03\u8bd5\u6539\u6389\u4f1a\u76f4\u63a5\u51fa\u6765\u7a7a\u7684<\/p>\n\n\n\n
def solve():\n enc = [\n 0x2D, 0x4F, 0x69, 0x3D, 0x5F, 0x01, 0xBD, 0x9F,\n 0xA4, 0x6D, 0x89, 0xAE, 0x2A, 0xEA, 0xD1, 0x9C,\n 0x71, 0x6D, 0xE1, 0x1E, 0x38, 0x7E, 0x8C, 0x0A, \n 0xCE, 0x6B, 0xE0, 0xF7, 0x36, 0x72, 0x99\n ]\n\n b = 0\n flag = \"\"\n\n for i in range(len(enc)):\n target_byte = enc[i]\n b_start = b\n found = False\n\n for char_code in range(128):\n curr_b = b_start\n x = char_code\n\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n x = (curr_b & 0xFF) ^ x ^ 0xAA\n\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n term = (curr_b & 0xFF) + (i * i)\n x = (x + term) & 0xFF\n\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n term = (curr_b & 0xFF) + (i * i)\n x = (x + term) & 0xFF\n\n out = ((x >> 5) | (x << 3)) & 0xFF\n\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n curr_b ^= 0x1A373\n curr_b = (curr_b + 1) & 0xFFFFFFFF\n\n if out == target_byte:\n flag += chr(char_code)\n b = curr_b\n found = True\n break\n\n if not found:\n flag += \"?\"\n\n print(flag)\n\nif __name__ == \"__main__\":\n solve()<\/code><\/pre>\n\n\n\nMission Ghost Signal<\/h1>\n\n\n\n
\u7ffb\u770bdata\u6bb5\uff0c\u627e\u5230\u4e00\u4e2aSyclover2025Geek\uff0c\u5f80\u56de\u67e5\u8c03\u7528\uff0c\u7136\u540e\u53d1\u73b0<\/p>\n\n\n\n
int sub_402DB1()\n{\n _BYTE v1[32]; \/\/ [esp+1Ch] [ebp-20Ch] BYREF\n char v2[192]; \/\/ [esp+3Ch] [ebp-1ECh] BYREF\n char Buffer[256]; \/\/ [esp+FCh] [ebp-12Ch] BYREF\n _BYTE v4[16]; \/\/ [esp+1FCh] [ebp-2Ch] BYREF\n int v5; \/\/ [esp+20Ch] [ebp-1Ch]\n int j; \/\/ [esp+210h] [ebp-18h]\n char v7; \/\/ [esp+217h] [ebp-11h]\n int i; \/\/ [esp+218h] [ebp-10h]\n size_t v9; \/\/ [esp+21Ch] [ebp-Ch]\n\n sub_403500();\n SetConsoleOutputCP(0xFDE9u);\n SetConsoleCP(0xFDE9u);\n qmemcpy(v4, \"1145141145144332\", sizeof(v4));\n puts(&::Buffer);\n printf(&byte_407090);\n if ( fgets(Buffer, 256, (FILE *)iob[0]._ptr) )\n {\n v9 = strlen(Buffer);\n if ( v9 && Buffer[v9 - 1] == 10 )\n Buffer[--v9] = 0;\n if ( v9 == 25 )\n {\n sub_401C08(v2, aSyclover2025ge, v4);\n memcpy(v1, Buffer, 0x19u);\n v5 = 7;\n for ( i = 25; i <= 31; ++i )\n v1[i] = v5;\n sub_402B57(v2, v1, 32);\n v7 = 1;\n for ( j = 0; j <= 31; ++j )\n {\n if ( byte_406020[j] != v1[j] )\n {\n v7 = 0;\n break;\n }\n }\n if ( v7 )\n puts(&byte_4070F0);\n else\n puts(&byte_40711C);\n return 0;\n }\n else\n {\n puts(&byte_4070BC);\n return 1;\n }\n }\n else\n {\n puts(&::Buffer);\n return 1;\n }\n}<\/code><\/pre>\n\n\n\n\u5176\u4ed6puts\u7684\u8f6c\u5b57\u7b26\u4e32\u662f<\/p>\n\n\n\n
.rdata:0040707D Buffer db '\u5bc6\u7801\u9a8c\u8bc1\u7cfb\u7edf',0 ; DATA XREF: sub_402DB1+77\u2191o\n.rdata:00407090 ; const char asc_407090\n.rdata:00407090 asc_407090 db '\u8bf7\u8f93\u5165\u538b\u7f29\u5305\u5bc6\u7801: ',0 ; DATA XREF: sub_402DB1+83\u2191o\n.rdata:004070AB ; const char Buffer\n.rdata:004070AB Buffer db '\u8f93\u5165\u9519\u8bef\uff01',0,0 ; DATA XREF: sub_402DB1+B7\u2191o\n.rdata:004070BC ; const char asc_4070BC\n.rdata:004070BC asc_4070BC db '\u7279\u5de5\uff0c\u4f60\u5931\u8d25\u4e86\uff01\u5bc6\u7801\u957f\u5ea6\u4e0d\u6b63\u786e\u3002',0,0,0,0\n.rdata:004070BC ; DATA XREF: sub_402DB1+10E\u2191o\n.rdata:004070F0 ; const char asc_4070F0\n.rdata:004070F0 asc_4070F0 db '\u606d\u559c\uff01\u8fd9\u662f\u6b63\u786e\u7684\u538b\u7f29\u5305\u5bc6\u7801\u3002',0,0,'\u7279\u5de5\uff0c\u4f60\u5931\u8d25\u4e86\uff01\u5bc6\u7801\u4e0d\u6b63\u786e\u3002',0,0<\/code><\/pre>\n\n\n\n\u5c31\u786e\u5b9a\u4e86\u8fd9\u91cc\u662f\u4e3b\u8981\u52a0\u5bc6\u6bb5\u4e86
\u7136\u540e\u52a8\u8c03patse data
\u628acall 0x402B57\uff08\u52a0\u5bc6\uff09\u6539\u6210call 0x402BE8\uff08\u89e3\u5bc6\uff09\uff0c\u7136\u540e\u66ff\u6362\u6210byte_406020\u7684\u6570\u636e,\u5f97\u51fa\u5bc6\u7801<\/p>\n\n\n\n
stack_bomb<\/h1>\n\n\n\n
nop\u6389\u4e86\u4e00\u4e9bpush\u7684\u90e8\u5206\u4f2ac\u51fa\u6765\u4e86
\u77e5\u9053\u662ftea\u4e86\uff0c\u7136\u540e\u627e\u51fa\u9b54\u6539\u70b9<\/p>\n\n\n\n
from ctypes import c_uint32\n\ndef decrypt(v, k):\n v0, v1 = c_uint32(v[0]), c_uint32(v[1])\n delta = 0x9000000\n sum_val = c_uint32(delta * 32)\n\n for _ in range(32):\n v1.value -= ((v0.value << 4) + k[2]) ^ (v0.value + sum_val.value) ^ ((v0.value >> 5) + k[3])\n v0.value -= ((v1.value << 4) + k[0]) ^ (v1.value + sum_val.value) ^ ((v1.value >> 5) + k[1])\n sum_val.value -= delta\n return v0.value, v1.value\n\nenc = [\n [0x9A8C0C4B, 0xC412FF1C], [0xBFC3A488, 0xB16C8FD0],\n [0x4136E319, 0x8835E4FF], [0x118263A7, 0x7C85D629]\n]\nkey = [1, 2, 3, 4]\nflag = b''\n\nfor g in enc:\n d = decrypt(g, key)\n flag += d[0].to_bytes(4, 'little') + d[1].to_bytes(4, 'little')\n\nprint(flag.decode())<\/code><\/pre>\n\n\n\nez_android<\/h1>\n\n\n\n
\u6253\u5f00\u8f6f\u4ef6\uff0c\u5bf9\u5e94\u641c\u7d22\uff0c\u8fdb\u5165function1
\u89e3\u5bc6<\/p>\n\n\n\n
from Crypto.Cipher import DES\nimport binascii\n\ncipher_text = \"43464244374534323530413841423536\"\nkey = \"12345678\"\n\ndef solve_part1():\n try:\n first_layer = binascii.unhexlify(cipher_text).decode('utf-8')\n cipher_bytes = binascii.unhexlify(first_layer)\n des = DES.new(key.encode('utf-8'), DES.MODE_ECB)\n decrypted = des.decrypt(cipher_bytes)\n print(f\"Part 1 Flag: {decrypted.decode('utf-8', errors='ignore').strip()}\")\n except Exception as e:\n print(f\"Error: {e}\")\n\nif __name__ == \"__main__\":\n solve_part1()<\/code><\/pre>\n\n\n\nfunction2,\u8fdb\u5165libwrapper.so\u5c42\u67e5\u770b\uff0c\u6709\u63d0\u793arealso\uff0c\u7528frida\u811a\u672c\u63d0\u51fa\u6765\uff0c\u6216\u8005\u627eencrypted_so\uff0c\u6240\u6709\u5b57\u8282\u5f02\u62160xAA\uff08\u56e0\u4e3a\u53ef\u4ee5\u51faelf\u6587\u4ef6\u5934\uff09\uff0c\u7136\u540e\u53d1\u73b0\u662frc4\uff0ckey\u662fmysecret\uff0c\u89e3\u51fa\u7b2c\u4e8c\u90e8\u5206\uff0c\u7b2c\u4e09\u90e8\u5206\uff0c\u6709\u4e00\u4e2alibfunction3.so\uff0c\u80fd\u770b\u5230\u7b97\u6cd5\uff0c\u4f46\u4e0d\u77e5\u9053s\u76d2\uff0c\u8981dump\u51fa\u6765\uff0c\u6700\u540e\u89e3\u5bc6<\/p>\n\n\n\n
import struct\n\nIP = [\n 58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,\n 62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,\n 57, 49, 41, 33, 25, 17, 9, 1, 59, 51, 43, 35, 27, 19, 11, 3,\n 61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7\n]\n\nFP = [\n 40, 8, 48, 16, 56, 24, 64, 32, 39, 7, 47, 15, 55, 23, 63, 31,\n 38, 6, 46, 14, 54, 22, 62, 30, 37, 5, 45, 13, 53, 21, 61, 29,\n 36, 4, 44, 12, 52, 20, 60, 28, 35, 3, 43, 11, 51, 19, 59, 27,\n 34, 2, 42, 10, 50, 18, 58, 26, 33, 1, 41, 9, 49, 17, 57, 25\n]\n\nE = [\n 32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9, 10, 11, 12, 13, 12, 13,\n 14, 15, 16, 17, 16, 17, 18, 19, 20, 21, 20, 21, 22, 23, 24, 25,\n 24, 25, 26, 27, 28, 29, 28, 29, 30, 31, 32, 1\n]\n\nP = [\n 16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10,\n 2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25\n]\n\nPC1 = [\n 57, 49, 41, 33, 25, 17, 9, 1, 58, 50, 42, 34, 26, 18, 10, 2,\n 59, 51, 43, 35, 27, 19, 11, 3, 60, 52, 44, 36, 63, 55, 47, 39,\n 31, 23, 15, 7, 62, 54, 46, 38, 30, 22, 14, 6, 61, 53, 45, 37,\n 29, 21, 13, 5, 28, 20, 12, 4\n]\n\nPC2 = [\n 14, 17, 11, 24, 1, 5, 3, 28, 15, 6, 21, 10, 23, 19, 12, 4,\n 26, 8, 16, 7, 27, 20, 13, 2, 41, 52, 31, 37, 47, 55, 30, 40,\n 51, 45, 33, 48, 44, 49, 39, 56, 34, 53, 46, 42, 50, 36, 29, 32\n]\n\nSHIFTS = [1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1]\n\nS_BOX = [\n [\n [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7], [0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8], [4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0], [15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13]\n ],\n [\n [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10], [3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5], [0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15], [13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9]\n ],\n [\n [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8], [13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1], [13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7], [1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12]\n ],\n [\n [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15], [13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9], [10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4], [3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14]\n ],\n [\n [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9], [14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6], [4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14], [11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3]\n ],\n [\n [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11], [10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8], [9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6], [4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13]\n ],\n [\n [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1], [13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6], [1, 4, 11, 13, 12, 3, 7, 10, 15, 6, 8, 0, 5, 9, 14, 2], [6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12]\n ],\n [[0] * 16, [0] * 16, [0] * 16, [0] * 16]\n]\n\ndef c_permute(in_bytes, table, out_bits):\n out_len = (out_bits + 7) \/\/ 8\n out = bytearray(out_len)\n for i in range(out_bits):\n pos = table[i] - 1\n byte_idx = pos \/\/ 8\n bit_idx = 7 - (pos % 8)\n if byte_idx < len(in_bytes):\n bit = (in_bytes[byte_idx] >> bit_idx) & 0x01\n out[i \/\/ 8] |= (bit << (7 - (i % 8)))\n return out\n\ndef rotl32(val, shift):\n shift = shift % 32\n return ((val << shift) & 0xFFFFFFFF) | (val >> (32 - shift))\n\ndef generate_subkeys(key_bytes):\n permuted_key = c_permute(key_bytes, PC1, 56)\n c_bytes = permuted_key[0:4]\n d_bytes = permuted_key[3:7]\n c_int = struct.unpack('>I', c_bytes)[0]\n d_int = struct.unpack('>I', d_bytes)[0]\n subkeys = []\n for s in SHIFTS:\n c_int = rotl32(c_int, s)\n d_int = rotl32(d_int, s)\n c_new = struct.pack('>I', c_int)\n d_new = struct.pack('>I', d_int)\n combined = bytearray(7)\n combined[0:4] = c_new\n combined[3:7] = d_new\n subkey = c_permute(combined, PC2, 48)\n subkeys.append(subkey)\n return subkeys\n\ndef feistel(R, subkey):\n expanded = c_permute(R, E, 48)\n for i in range(6):\n expanded[i] ^= subkey[i]\n output_val = 0\n for i in range(8):\n idx = i * 6\n byte_idx = idx \/\/ 8\n bit_idx = 7 - (idx % 8)\n b0 = (expanded[byte_idx] >> bit_idx) & 0x01\n idx5 = idx + 5\n byte_idx5 = idx5 \/\/ 8\n bit_idx5 = 7 - (idx5 % 8)\n b5 = (expanded[byte_idx5] >> bit_idx5) & 0x01\n row = (b0 << 1) | b5\n col = 0\n for j in range(1, 5):\n idxj = idx + j\n byte_idxj = idxj \/\/ 8\n bit_idxj = 7 - (idxj % 8)\n bit = (expanded[byte_idxj] >> bit_idxj) & 0x01\n col = (col << 1) | bit\n val = S_BOX[i][row][col]\n pos_in_int = 28 - (i * 4)\n output_val |= (val << pos_in_int)\n output_bytes = struct.pack('>I', output_val)\n temp = c_permute(output_bytes, P, 32)\n R[:] = temp\n\ndef des_crypt(key, data, mode='decrypt'):\n subkeys = generate_subkeys(key)\n if mode == 'decrypt':\n subkeys = subkeys[::-1]\n block = c_permute(data, IP, 64)\n L = block[0:4]\n R = block[4:8]\n for i in range(16):\n temp = bytearray(R)\n feistel(R, subkeys[i])\n for j in range(4):\n R[j] ^= L[j]\n L = temp\n preoutput = R + L\n output = c_permute(preoutput, FP, 64)\n return output\n\ndef main():\n DES_KEY = bytes([0x13, 0x34, 0x57, 0x79, 0x9B, 0xBC, 0xDF, 0xF1])\n hex_ciphertext = \"AEBCDE9B24029CA7\"\n ciphertext = bytes.fromhex(hex_ciphertext)\n decrypted = des_crypt(DES_KEY, ciphertext, mode='decrypt')\n print(f\"\u89e3\u5bc6: {decrypted.decode('utf-8').rstrip(chr(0))}\")\n\nif __name__ == \"__main__\":\n main()<\/code><\/pre>\n\n\n\nTh1s_1s_Th3_R3@lly_F1ag!\u5f97\u51fa<\/p>\n","protected":false},"excerpt":{"rendered":"
ez_pyyy pyc\u53cd\u7f16\u8bd1\uff0c\u52a0\u5bc6\u987a\u5e8f\u662f\uff0c\u5f02\u621617\uff0c\u9ad8\u4f4e\u4f4d\u4ea4\u6362\uff0c\u53cd\u8f6c\u5b57\u8282\uff0c\u5faa\u73af\u5de6\u79fb32\u4f4d SYC{jtfgds […]<\/p>\n","protected":false},"author":1,"featured_media":65,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn"],"_links":{"self":[{"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/posts\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/comments?post=6"}],"version-history":[{"count":4,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/posts\/6\/revisions"}],"predecessor-version":[{"id":21,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/posts\/6\/revisions\/21"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/media\/65"}],"wp:attachment":[{"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/media?parent=6"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/categories?post=6"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/8.210.123.186\/index.php\/wp-json\/wp\/v2\/tags?post=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}