반응형
#!/usr/bin/python
a = " FXWce2101J MLfest?'rsH TSbeweO himfw jiqtk gils! h;e(l8p,fCucl3 noyrs pn o!tt!#:*)UUUU"
'''
*(_BYTE *)(i + normal) = num->str[(unsigned __int8)(v5 ^ i) % (int)(unsigned __int16)num->length] ^ v5 ^ i ^ *(_BYTE *)(i + flag_byte)
normal[0] = num->str[checksum % num->length] ^ checksum ^ flag_byte
table = [222L, 217L, 161L, 249L, 237L, 192L, 168L, 255L, 225L, 214L, 172L, 145L, 160L, 198L, 231L, 242L, 188L, 166L, 230L, 249L, 178L, 171L, 175L, 171L, 189L, 238L, 188L, 247L, 177L, 252L, 187L, 174L, 221L, 154L, 203L, 128L, 200L, 216L, 150L, 212L, 188]
pwndbg> x/6gx 0x000055555576d1f0
0x55555576d1f0: 0xffa8c0edf9a1d9de 0xf2e7c6a091acd6e1
0x55555576d200: 0xabafabb2f9e6a6bc 0xaebbfcb1f7bceebd
0x55555576d210: 0xd496d8c880cb9add 0x00000000000000bc
'''
def a(d):
k = []
for i in range(8):
j = d & 0xff
d >>= 8
k.append(j)
return k
def calc_table_idx(table_check):
for i, d in enumerate(table):
if d == table_check:
print(i, d)
return i
return 0
table = [222, 217, 161, 249, 237, 192, 168, 255, 225, 214, 172, 145, 160, 198, 231, 242, 188, 166, 230, 249, 178, 171, 175, 171, 189, 238, 188, 247, 177, 252, 187, 174, 221, 154, 203, 128, 200, 216, 150, 212, 188]
fp = open('flag.enc', 'rb')
data = fp.read()
print(data)
flag_l = []
for ran in range(0, 1): # 1 3 9
random = 9 # 1 3 9
flag_len = 0x53
table_check = (data[-1] ^ random ^ flag_len) & 0xff
# table[checksum ^ flag_len % 0x29]
table_idx = calc_table_idx(table_check)
#print(table_check)
for X in range(0, 8):
#X = 1 # 0 1 2 3 4 5 6
checksum = ((table_idx + 0x29*X) ^ flag_len) & 0xff
bufa = []
for i, d in enumerate(data):
#print(i, d)
bufa.append( (i ^ d ^ random ^ table[ (i^checksum) % 0x29]) & 0xff)
#print(bufa)
#flag_l.append(bufa)
flag = ''
for i in range(flag_len):
flag += chr( (table[checksum % 0x29] ^ checksum ^ bufa[i]) & 0xff)
print(flag)
flag_l.append(flag)
print(flag_l)
# for i, bufa in enumerate(flag_l):
# #print(i, bufa)
# if bufa[0] == 0x3d and bufa[1] == 0x2f:
# print(i, bufa)
반응형
'Write-up' 카테고리의 다른 글
Uncrackable 2 (0) | 2020.07.15 |
---|---|
Uncrackable 1 (2) | 2020.07.15 |
[ASIS CTF Quals 2020] Full protection (0) | 2020.07.12 |
[ASIS CTF Quals 2020] Baby note (0) | 2020.07.12 |
Uncrackable 3 write up (0) | 2020.07.10 |