lit_xor_chain
异或
main函数
int __fastcall main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
char *v4; // rcx
_BYTE *i; // r8
char Str[30]; // [rsp+20h] [rbp-208h] BYREF
char v8; // [rsp+3Eh] [rbp-1EAh] BYREF
_main(argc, argv, envp);
_mingw_printf("input your flag: ");
v3 = _mingw_scanf("%511s", Str);
if ( v3 == 1 )
{
if ( strlen(Str) == 30 )
{
v4 = Str;
for ( i = &g_expected; *i == ((unsigned __int8)*v4 ^ 0x52) + 5; ++i )
{
if ( ++v4 == &v8 )
{
puts_0("Good!");
return 0;
}
}
}
puts_0("Wrong!");
}
else
{
puts_0("Wrong!");
return 1;
}
return v3;
}
进去就能看到加密逻辑 异或+5 逆过来就是 -5异或 数据提取直接逆
exp
a = [ 0x23, 0x40, 0x2B, 0x16, 0x0B, 0x19, 0x2E, 0x25, 0x3C, 0x29,
0x67, 0x68, 0x12, 0x2F, 0x42, 0x25, 0x12, 0x2B, 0x3F, 0x3C,
0x41, 0x12, 0x38, 0x3B, 0x3B, 0x12, 0x42, 0x3E, 0x78, 0x34]
for i in range(0,len(a)):
print(chr(((a[i]-5) ^ 0x52)),end='')
flag
LitCTF{rev01_xor_then_add_ok!}
lit_b64_chain
base 换表
int __fastcall main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
size_t v5; // rax
unsigned __int64 v6; // rsi
char *v7; // r9
char *v8; // rcx
size_t v9; // r11
__int64 v10; // rbp
unsigned __int64 v11; // r8
char v12; // al
int v13; // r10d
int v14; // edx
unsigned int v15; // eax
unsigned int v16; // edx
char Str1[512]; // [rsp+20h] [rbp-438h] BYREF
char Str[568]; // [rsp+220h] [rbp-238h] BYREF
_main();
_mingw_printf("input your flag: ");
v3 = _mingw_scanf("%511s", Str);
if ( v3 == 1 )
{
v5 = strlen(Str);
v6 = v5;
if ( v5 )
{
v7 = Str;
v8 = Str1;
v9 = v5;
v10 = 4;
v11 = 0;
while ( 1 )
{
v13 = 0;
if ( v11 + 1 < v6 )
v13 = (unsigned __int8)v7[1];
v14 = 0;
if ( v11 + 2 < v6 )
v14 = (unsigned __int8)v7[2];
v15 = (v13 << 8) | ((unsigned __int8)*v7 << 16);
v16 = v15 | v14;
*v8 = g_alphabet[v15 >> 18];
v8[1] = g_alphabet[(v15 >> 12) & 0x3F];
if ( v9 == 3 )
{
v8[2] = g_alphabet[(v16 >> 6) & 0x3F];
v12 = g_alphabet[v16 & 0x3F];
}
else
{
v8[2] = v9 == 2 ? g_alphabet[(v16 >> 6) & 0x3F] : 61;
v12 = 61;
}
v8[3] = v12;
v11 += 3LL;
v7 += 3;
v8 += 4;
v9 -= 3LL;
if ( v11 >= v6 )
break;
v10 += 4;
}
}
else
{
v10 = 0;
}
Str1[v10] = 0;
if ( !strcmp(Str1, "zjA5lToj9PUAGn2O+v6TRPosgYWB6noyGjhBgjfwyl==") )
{
puts_0("Good!");
return 0;
}
else
{
puts_0("Wrong!");
}
}
else
{
puts_0("Wrong!");
return 1;
}
return v3;
}
密文和表
.rdata:0000000140012040 g_expected db 'zjA5lToj9PUAGn2O+v6TRPosgYWB6noyGjhBgjfwyl==',0
.rdata:0000000140012040 ; DATA XREF: main+179↑o
.rdata:000000014001206D align 20h
.rdata:0000000140012080 g_alphabet db '2KuEphj84USZF67iloxzfYd+MrDgRG9yLwBnHAXcJq3eCN/s1bOQ5TvPa0tVkWmI',0
flag
LitCTF{rev02_custom_b64_table!}
lit_tea_standard
tea
int __fastcall main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
size_t v5; // rdx
size_t v6; // rcx
size_t v7; // r9
char *v8; // r9
unsigned int v9; // ecx
unsigned int v10; // edx
int i; // r8d
char Buf1[32]; // [rsp+20h] [rbp-318h] BYREF
char v13; // [rsp+40h] [rbp-2F8h] BYREF
char Str[280]; // [rsp+220h] [rbp-118h] BYREF
_main();
_mingw_printf("input your flag: ");
v3 = _mingw_scanf("%255s", Str);
if ( v3 == 1 )
{
v5 = strlen(Str);
v6 = v5 & 7;
v7 = v5 + 8 - v6;
qmemcpy(Buf1, Str, v5);
do
Buf1[v5++] = 8 - v6;
while ( v5 < v7 );
if ( v7 != 32 )
goto LABEL_13;
v8 = Buf1;
do
{
v9 = *v8;
v10 = *(v8 + 1);
for ( i = 0; i != 0xC6EF3720; v10 += (i + v9) ^ ((v9 >> 5) - 0x21524111) ^ (16 * v9 - 0x35014542) )
{
i -= 0x61C88647;
v9 += (i + v10) ^ ((v10 >> 5) - 0x4FF4E200) ^ (16 * v10 - 0x5EE31054);
}
*v8 = v9;
*(v8 + 1) = v10;
v8 += 8;
}
while ( v8 != &v13 );
if ( !memcmp(Buf1, &g_cipher, 0x20ui64) )
{
puts("Good!");
return 0;
}
else
{
LABEL_13:
puts("Wrong!");
}
}
else
{
puts("Wrong!");
return 1;
}
return v3;
}
简洁而概
exp
#include <stdio.h>
#include <stdint.h>
#include <string.h>
int main() {
uint8_t ciper[32] = {
0xED,0xEF,0x21,0xFE,0xB7,0x9B,0x3C,0xB0,
0x1E,0x93,0x72,0xE2,0x02,0x3E,0x29,0xBC,
0x36,0xF7,0x0C,0x92,0x2E,0x5A,0xAE,0x46,
0x44,0xFA,0x45,0x25,0x1A,0xE5,0x8C,0x87
};
for (int k = 0; k < 32; k += 8) {
uint32_t a, b, s = 0xC6EF3720;
memcpy(&a, ciper + k, 4);
memcpy(&b, ciper + k + 4, 4);
for (int i = 0; i < 32; i++) {
b -= (s + a) ^ ((a >> 5) - 0x21524111) ^ ((16 * a) - 0x35014542);
a -= (s + b) ^ ((b >> 5) - 0x4FF4E200) ^ (16 * b - 0x5EE31054);
s += 0x61C88647;
};
memcpy(ciper + k, &a, 4);
memcpy(ciper + k + 4, &b, 4);
};
puts((char*)ciper);
}
flag
LitCTF{rev03_tea_standard!!}
lit_xtea_tweak
xtea
依旧main函数给加密 直接解 就可以
int __fastcall main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
size_t v5; // rdx
size_t v6; // rcx
size_t v7; // r9
char *v8; // r10
unsigned int v9; // r8d
unsigned int v10; // ecx
unsigned int i; // eax
_BYTE Buf1[32]; // [rsp+20h] [rbp-328h] BYREF
char v13; // [rsp+40h] [rbp-308h] BYREF
char Str[296]; // [rsp+220h] [rbp-128h] BYREF
_main();
_mingw_printf("input your flag: ");
v3 = _mingw_scanf("%255s", Str);
if ( v3 == 1 )
{
v5 = strlen(Str);
v6 = v5 & 7;
v7 = v5 + 8 - v6;
qmemcpy(Buf1, Str, (unsigned int)v5);
do
Buf1[v5++] = 8 - v6;
while ( v5 < v7 );
if ( v7 != 32 )
goto LABEL_13;
v8 = Buf1;
do
{
v9 = *(_DWORD *)v8;
v10 = *((_DWORD *)v8 + 1);
for ( i = 0; i != 0xD5B7DDE0; v10 += (g_key[(i >> 11) & 3] + i) ^ (v9 + ((v9 >> 5) ^ (16 * v9))) )
{
v9 += (g_key[i & 3] + i) ^ (v10 + ((v10 >> 5) ^ (16 * v10)));
i -= 559038737;
}
*(_DWORD *)v8 = v9;
*((_DWORD *)v8 + 1) = v10;
v8 += 8;
}
while ( &v13 != v8 );
if ( !memcmp_0(Buf1, &g_cipher, 0x20u) )
{
puts_0("Good!");
return 0;
}
else
{
LABEL_13:
puts_0("Wrong!");
}
}
else
{
puts_0("Wrong!");
return 1;
}
return v3;
}
exp
#include <stdio.h>
#include <stdint.h>
#include <string.h>
int main() {
uint8_t ciper[32] = {
0xE3,0xEE,0x1E,0xE7,0xD3,0xA7,0x96,0x6F,
0xC6,0xA7,0xB9,0xE1,0xB9,0x4E,0x67,0x86,
0x5F,0x03,0x04,0xA6,0xDB,0xBB,0xB9,0x40,
0x56,0x3A,0xF7,0x9E,0xEE,0x64,0xD4,0x06
};
uint32_t key[4] = { 0x11111111,0x22222222,0x33333333,0x44444444 };
for (int k = 0; k < 32; k += 8) {
uint32_t v9, v10, s = 0xD5B7DDE0;
memcpy(&v9, ciper + k, 4);
memcpy(&v10, ciper + k + 4, 4);
for (int i = 0; i < 32; i++) {
v10 -= (key[(s >> 11) & 3] + s) ^ (v9 + ((v9 >> 5) ^ (16 * v9)));
s += 0x21524111;
v9 -= (key[s & 3] + s) ^ (v10 + ((v10 >> 5) ^ (16 * v10)));
};
memcpy(ciper + k, &v9, 4);
memcpy(ciper + k + 4, &v10, 4);
};
puts((char*)ciper);
}
flag
LitCTF{rev04_xtea_delta_twk!}
lit_rc4_variant
魔改rc4
main函数
int __fastcall main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
char *v5; // rcx
_BYTE *v6; // r8
_BYTE *v7; // r11
_BYTE *v8; // r10
int i; // edx
int v10; // edx
char v11; // r9
unsigned int v12; // edx
char v13; // kr00_1
char *v14; // r8
int v15; // r11d
int v16; // r10d
unsigned __int8 v17; // cl
_BYTE v18[64]; // [rsp+20h] [rbp-498h] BYREF
_BYTE v19[64]; // [rsp+60h] [rbp-458h] BYREF
_BYTE Buf1[29]; // [rsp+A0h] [rbp-418h] BYREF
char v21; // [rsp+BDh] [rbp-3FBh] BYREF
char Str[16]; // [rsp+2A0h] [rbp-218h] BYREF
_main();
_mingw_printf("input your flag: ");
v3 = _mingw_scanf("%511s", Str);
if ( v3 == 1 )
{
if ( strlen(Str) == 29 )
{
*(__m128i *)Buf1 = _mm_loadu_si128((const __m128i *)Str);
*(__m128i *)&Buf1[13] = _mm_loadu_si128((const __m128i *)&Str[13]);
v5 = v18;
v6 = v19;
v7 = v19;
v8 = v18;
for ( i = 0; i != 64; ++i )
{
*v8 = i;
*v7 = g_key[i % 12];
++v8;
++v7;
}
v10 = 0;
do
{
v11 = *v5;
v13 = v10 + *v5 + *v6;
v12 = (v10 + (unsigned __int8)*v5 + (unsigned __int8)*v6) >> 31;
v10 = (((v12 >> 26) + v13) & 0x3F) - (v12 >> 26);
*v5 = v18[v10];
v18[v10] = v11;
++v6;
++v5;
}
while ( v5 != v19 );
v14 = Buf1;
v15 = 0;
v16 = 0;
do
{
v16 = (v16 + 1) % 64;
v17 = v18[v16];
v15 = (v15 + v17) % 64;
v18[v16] = v18[v15];
v18[v15] = v17;
*v14++ ^= v18[(v18[v16] + v17) & 0x3F] + v18[v16];
}
while ( v14 != &v21 );
if ( !memcmp_0(Buf1, &g_cipher, 0x1Du) )
{
puts_0("Good!");
return 0;
}
else
{
puts_0("Wrong!");
}
}
else
{
puts_0("Wrong!");
}
}
else
{
puts_0("Wrong!");
return 1;
}
return v3;
}
exp
c = [0x7B,0x3D,0x38,0x77,0x4E,0x72,0x42,0x7D,0x45,0x37,
0x76,0x0F,0x53,0x53,0x4F,0x66,0x37,0x17,0x75,0x37,
0x5F,0x49,0x58,0x72,0x74,0x7F,0x79,0x1F,0x3A]
key = b"lit_rc4_key!"
s = list(range(64))
j = 0
for i in range(64):
t = s[i]
j = (j + s[i] + key[i % 12]) % 64
s[i] = s[j]
s[j] = t
i = j = 0
p = []
for x in c:
i = (i + 1) % 64
t = s[i]
j = (j + t) % 64
s[i] = s[j]
s[j] = t
k = (s[(s[i] + t) & 0x3f] + s[i]) & 0xff
p.append(x ^ k)
print(bytes(p).decode())
flag
LitCTF{rev05_rc4_variant_64!}
评论