avatar
Articles
58
Tags
5
Categories
8
Home
Archives
Tags
Categories
Link
About
List
L0x1c's Sky garden
Home
Archives
Tags
Categories
Link
About
List
HGAME-2020
|CTF-RE
Word count:2.1k|Reading time: 11 min
|Post View:

Rev

advance

upload successful

base64的变种，直接套用脚本了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/bin/python
import base64

base_now="abcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZ"

base_init="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="

clear="0g371wvVy9qPztz7xQ+PxNuKxQv74B/5n/zwuPfX"

c=""

for i in range(len(clear)):

    b=base_now.find(clear[i])

    c+=base_init[b]

c=base64.b64decode(c)

print c

maze

迷宫题：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
#include <string.h>
#include <stdio.h>
int main()
{
	int maze[1024] = {
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01,
	0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01,
	0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00,
	0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00,
	0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00,
	0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01,
	0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01,
	0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01,
	0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01,
	0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,
	0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00,
	0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01
	};
	int i = 0, j = 3;
	for (i = 0;i < 1024;i++)
	{
		j++;
		if (j == 4)
		{
			j = 0;
			if (i == 68) printf("@");
			else if (i == 956) printf("@");
			else if (maze[i] == 0)
				printf("1");
			else printf("2");
		}
		if ((i + 1) % 64 == 0) printf("\n");
	}

upload successful

bitwise_operation2

upload successful

进行异或的运算，然后有一个位运算，位运算采取了爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#include<stdio.h>
#include<windows.h>
int main() {
	BYTE v14[9] = "e4sy_Re_";
	BYTE v14a[9] = "e4sy_Re_";
	BYTE v16[9] = "Easylif3";
	BYTE v6[8] = { 0x4C,0x3C,0xD6u,0x36,0x50,0x88u,0x20,0xCCu };
	for (BYTE k = 0; k <= 7; ++k)
	{
		v14[k] ^= v6[k];
		printf("%x ", v14[k]);
	}
	printf("\n");
	for (BYTE k = 0; k <= 7; ++k)
	{
		v16[k] ^= v14a[k]^v6[k];
		printf("%x ", v16[k]);
	}
	for (int k = 0;k < 8;k++) {
		for (BYTE i = 0; i <= 0xfe; i++)
		{
			for (BYTE j = 0;j <= 0xfe;j++)
			{
				BYTE a1 = i;
				BYTE a2 = j;
				a1 = ((a1 & 0xE0) >> 5) | 8 * a1;
				a1 = a1 & 0x55 ^ ((a2 & 0xAA) >> 1) | a1 & 0xAA;
				a2 = 2 * (a1 & 0x55) ^ a2 & 0xAA | a2 & 0x55;
				a1 = a1 & 0x55 ^ ((a2 & 0xAA) >> 1) | a1 & 0xAA;
				if (a1 == v14[k] && a2 == v16[7-k])
				{
					printf("%x,%x\n", i, j);
				}
			}
		}
	}
	system("pause");
}

upload successful

v16反着输入就是flag了

题目名称 | cpp | solve : L0x1c

upload successful

上次上面的方程看错了= =，实际上是三个未知数看到有个判断的函数 我们三层循环的满足条件需要等于v12才可以

upload successful

给了我们公式我们算出来9个方程组

hgame{12345_78901_34567_90123_56789_123456_890123_5678_0123}分配格式，解方程带入格式就好了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# include <stdio.h>
int main(void)
{
	int i, j, m, n, r, k = 0, t; //i,j,m,k,t 作为循环计数变量；n表示有n个未知数，即n元；r表示有r个方程组成方程组。 
	printf("请输入未知数个数n和方程的个数:\n");
	scanf_s("%d %d", &n, &r);  //n表示有n个未知数，即n元；r表示有r个方程组成方程组。  
	float a[11][20];        //用二维数组存储方程组参数。11和100课改动。这里的程序限 10 元 20 个方程的方程组。  
	printf("请输入方程组参数\n");
	for (j = 0; j < n; j++)
		for (i = 0; i < r + 1; i++)
			scanf_s("%f", &a[j][i]);
	if (r < n)
		printf("方程有无穷解\n");
	if (r == n)
	{
		printf("方程有唯一解\n");
		for (t = 0; t < n - 1; t++)      //循环次数：当t=0时，仅将a[1][0],a[2][0],a[2][1]的值转换为0；t=1时，才将其转换成最简型阶梯矩阵。   
			for (m = 0; m < n; m++)   //m表示第m列     
				for (j = 0; j < n; j++)       //j表示第j行      
					if (j != m)
					{
						float b = a[j][m] / a[m][m];
						for (i = 0; i < n + 1; i++) //因为一行的每个元素均要进行运算等式两边才会相等。        
							a[j][i] -= a[m][i] * b;
					}
		for (j = 0; j < n; j++)      //为了将其转换成单位矩阵，见《线性代数》
		{
			a[j][n] /= a[j][j];
			a[j][j] /= a[j][j];
		}
	}
	for (j = 0; j < r; j++)
		printf("x[%d] = %f\n", j, a[j][n]);  //输出最终结果，即未知数x,y,z...的值。
	return 0;
}

Z3版本：

1
2
3
4
5
6
7
8
9
10
from z3 import *
a=Real('a')
b=Real('b')
c=Real('c')
s=Solver()
s.add(a+c= )
s.add(b+2*c= )
s.dd(a+b+2*c= )
if s.check()==sat
    print s.mode1()

解方程算出v14的值
x[0] = -24840.000000

x[1] = -78193.000000

x[2] = 51567.000000

x[3] = 2556.000000

x[4] = -26463.000000

x[5] = 26729.000000

x[6] = 3608.000000

x[7] = -25933.000000

x[8] = 25943.000000

// 其实就是个矩阵乘法，直接逆矩阵相乘就可以了

-24840_ -78193_51567_2556_ -26463_26729_3608_ -25933_25943

题目名称 | unpack | solve : L0x1c

upx -d 发现不好使，直接dump去镜像内存文件，进行ida分析即可https://blog.csdn.net/caiqiiqi/article/details/72807952
upload successful

1
2
3
4
5
6
7
8
9
10
11
#include<stdio.h>
int main() {
	int v7[42] = {};
	int v[42] = { 0x68,0x68,0x63,0x70,0x69,0x80,0x5b,0x75,0x78,0x49,0x6d,0x76,0x75,0x7b,0x75,0x6e,0x41,0x84,0x71,0x65,0x44,0x82,0x4a,0x85,0x8c,0x82,0x7d,0x7a,0x82,0x4d,0x90,0x7e,0x92,0x54,0x98,0x88,0x96,0x98,0x57,0x95,0x8f,0xa6 };
	for (int i = 0; i <= 41; ++i)
	{
		v7[i] = v[i] - i;
		printf("%c", v7[i]);
	}
	return 0;
}
Author: L0x1c
Link: https://l0x1c.github.io/2020/02/02/2020-02-03/
Copyright Notice: All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.
CTF
Donate
  • 微信
    微信
  • 支付寶
    支付寶
Recommend
2019-11-08
Buuctf wp
2019-11-18
函数调用约定以及栈
2019-11-22
nctf wp
2019-12-18
CNSS RE wp
2019-12-22
GXY wp
简