[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube

签层饼

真有一千层函数呀，沿着输入存入的两个变量找，找到3个函数:

主函数给出了flag的组织方式，

check1说number2<882408，

check2说number1 = number2^333509

check_n说返回的条件，但是由于这个数是个随机数不能确定，而且number2很小可以爆破。

int __cdecl main_0(int argc, const char **argv, const char **envp)
{int v3; // eaxprintf("Hello!Welcome to ctfshow,You need to input two numbers\n");printf("number1:");scanf("%d", &number1);printf("\n");printf("number2:");scanf("%d", &number2);v3 = time(0);sub_4B9370(v3);dword_528DC0 = (rand() - 999) % 500;if ( dword_528DC0 > 9999999 )printf("提示:这里的R是想写成任意范围的，但是因为运算溢出");        // 提示:这里的R是想写成任意范围的if ( number1 > 0 && number2 > 0 ){sub_40431D();if ( dword_525A30 ){printf("%d", dword_528DC0);printf("Key Error");}else{printf("yeah!Your flag:ctfshow{c52e1e1a33%d0e%dc}", number1, number2);}}else{printf("Error");}......
}int check1()
{int result; // eaxresult = sub_4015B4(881778, 666);             // a1^a2if ( number2 <= result )                      // <882408result = sub_4098EA();return result;
}
int check2()
{int result; // eaxresult = sub_4015B4(number2, 333509);         // number1 = number2 ^333509if ( number1 == result )result = sub_40C63A();return result;
}
int check_n()
{dword_525A30 = 1;if ( dword_528DC0 * dword_528DC0 * number2 - 1877 * dword_528DC0 + 1 < 0|| dword_528DC0 * dword_528DC0 * number2 - 1877 * dword_528DC0 != -1 ){dword_525A30 ^= 1u;}return sub_408724();
}

一般情况下实际的数应该在给定数比较近，所以一般不从0开始爆，而是从大向小爆。大概率少用时。

import subprocessfor n2 in range(882408,-1,-1):n1 = n2^333509p = subprocess.Popen('./千层饼.exe', stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)p.stdin.write(f"{n1}\n{n2}".encode())p.stdin.close()data = p.stdout.read()p.stdout.close()if b'flag' in data:print(data)break#b'Hello!Welcome to ctfshow,You need to input two numbers\r\nnumber1:\r\nnumber2:
#yeah!Your flag:ctfshow{c52e1e1a335489030e882402c}'

Tea_tube_pot

看名字就是tea加密，而且用了3次，不过都不难，直接逆回即可。第2段在中间变的v5所以处理v4时与v3时v5差1个。第3段虽然用了判断两种情况，但参数是固定的，所以只需看一半。

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{if ( check_c11() && (unsigned int)check_CA5(a1, a2) && (unsigned int)check_D45() )puts("Congrts!Your Flag is 'ctfshow{'+PART1+PART2+PART3+'}'!");return 0LL;
}
__int64 __fastcall sub_71A(unsigned int *input, _DWORD *a2)
{__int64 result; // raxunsigned int v3; // [rsp+1Ch] [rbp-24h]unsigned int v4; // [rsp+20h] [rbp-20h]int v5; // [rsp+24h] [rbp-1Ch]unsigned int i; // [rsp+28h] [rbp-18h]v3 = *input;                                  // input,'This_is_teatube!'v4 = input[1];v5 = 0;for ( i = 0; i <= 0x1F; ++i ){v5 -= 0x61C88647;v3 += (v4 + v5) ^ (16 * v4 + *a2) ^ ((v4 >> 5) + a2[1]);v4 += (v3 + v5) ^ (16 * v3 + a2[2]) ^ ((v3 >> 5) + a2[3]);}*input = v3;result = v4;input[1] = v4;return result;
}
__int64 __fastcall sub_7F8(unsigned int a1, unsigned int *a2, __int64 a3)
{__int64 result; // raxunsigned int i; // [rsp+24h] [rbp-14h]unsigned int v3; // [rsp+28h] [rbp-10h]unsigned int v4; // [rsp+2Ch] [rbp-Ch]unsigned int v5; // [rsp+30h] [rbp-8h]v3 = *a2;v4 = a2[1];v5 = 0;for ( i = 0; i < a1; ++i ){v3 += (((v4 >> 5) ^ (16 * v4)) + v4) ^ (*(_DWORD *)(4LL * (v5 & 3) + a3) + v5);v5 -= 0x61C88647;v4 += (((v3 >> 5) ^ (16 * v3)) + v3) ^ (*(_DWORD *)(4LL * ((v5 >> 11) & 3) + a3) + v5);}*a2 = v3;result = v4;a2[1] = v4;return result;
}
__int64 __fastcall sub_8D3(unsigned int *a1, int a2, __int64 a3)
{unsigned int *v3; // raxunsigned int *v4; // rax__int64 result; // raxunsigned int *v6; // raxint v7; // [rsp+Ch] [rbp-2Ch]unsigned int v8; // [rsp+20h] [rbp-18h]unsigned int v9; // [rsp+20h] [rbp-18h]unsigned int v10; // [rsp+24h] [rbp-14h]unsigned int v11; // [rsp+24h] [rbp-14h]unsigned int v12; // [rsp+24h] [rbp-14h]unsigned int v13; // [rsp+28h] [rbp-10h]unsigned int v14; // [rsp+28h] [rbp-10h]unsigned int j; // [rsp+2Ch] [rbp-Ch]int i; // [rsp+2Ch] [rbp-Ch]int v17; // [rsp+30h] [rbp-8h]int v18; // [rsp+30h] [rbp-8h]int v19; // [rsp+34h] [rbp-4h]unsigned int v20; // [rsp+34h] [rbp-4h]if ( a2 <= 1 ){if ( a2 < -1 ){v7 = -a2;v18 = 52 / -a2 + 6;v14 = -1640531527 * v18;v9 = *a1;do{v20 = (v14 >> 2) & 3;for ( i = v7 - 1; i; --i ){v11 = a1[i - 1];v6 = &a1[i];*v6 -= ((v9 ^ v14) + (v11 ^ *(_DWORD *)(4LL * (v20 ^ i & 3) + a3))) ^ (((4 * v9) ^ (v11 >> 5))+ ((v9 >> 3) ^ (16 * v11)));v9 = *v6;}v12 = a1[v7 - 1];*a1 -= (((4 * v9) ^ (v12 >> 5)) + ((v9 >> 3) ^ (16 * v12))) ^ ((v9 ^ v14) + (v12 ^ *(_DWORD *)(4LL * v20 + a3)));result = *a1;v9 = *a1;v14 += 1640531527;--v18;}while ( v18 );}}else{v17 = 52 / a2 + 6;                          // 32v13 = 0;v10 = a1[a2 - 1];                           // v10 = a1[1]do{v13 -= 0x61C88647;v19 = (v13 >> 2) & 3;for ( j = 0; j < a2 - 1; ++j ){v8 = a1[j + 1];v3 = &a1[j];*v3 += ((v8 ^ v13) + (v10 ^ *(_DWORD *)(4LL * (v19 ^ j & 3) + a3))) ^ (((4 * v8) ^ (v10 >> 5))+ ((v8 >> 3) ^ (16 * v10)));v10 = *v3;}v4 = &a1[a2 - 1];*v4 += ((*a1 ^ v13) + (v10 ^ *(_DWORD *)(4LL * (v19 ^ j & 3) + a3))) ^ (((4 * *a1) ^ (v10 >> 5))+ ((*a1 >> 3) ^ (16 * v10)));result = *v4;v10 = result;--v17;}while ( v17 );}return result;
}

逆程序

from pwn import u32,p32'''for ( i = 0; i <= 0x1F; ++i ){v5 -= 0x61C88647;v3 += (v4 + v5) ^ (16 * v4 + *a2) ^ ((v4 >> 5) + a2[1]);v4 += (v3 + v5) ^ (16 * v3 + a2[2]) ^ ((v3 >> 5) + a2[3]);}
'''
a2 = [u32(b'This'), u32(b'_is_'), u32(b'teat'), u32(b'ube!')]
v5 = [0]*0x20
t = 0
for i in range(0x20):t = (t - 0x61C88647) & 0xffffffffv5[i] = t #print(hex(t))v3 = 0x5FD744F6
v4 = 0x95832046
for i in range(0x1f,-1,-1):v4 -= (v3 + v5[i])^(16 * v3 + a2[2]) ^ ((v3>>5) + a2[3])v4 = v4&0xffffffffv3 -= (v4 + v5[i])^(16 * v4 + a2[0]) ^ ((v4>>5) + a2[1])v3 = v3&0xffffffff
flag = b'ctfshow{'+p32(v3)+p32(v4)#v3 += (((v4 >> 5) ^ (16 * v4)) + v4) ^ (*(_DWORD *)(4LL * (v5 & 3) + a3) + v5);
#v4 += (((v3 >> 5) ^ (16 * v3)) + v3) ^ (*(_DWORD *)(4LL * ((v5 >> 11) & 3) + a3) + v5);v3 = 0xFD731313
v4 = 0x6662CB90
v5 = [0] + v5
for i in range(0x1f,-1,-1):v4 -= (((v3 >> 5) ^ (16 * v3)) + v3) ^ (a2[(v5[i+1] >> 11) & 3] + v5[i+1])v4 &= 0xffffffffv3 -= (((v4 >> 5) ^ (16 * v4)) + v4) ^ (a2[v5[i]         & 3] + v5[i])v3 &= 0xffffffff
flag += p32(v3)+p32(v4)v3 = 0x4B136C82
v4 = 0x1A6E9613
v5 = v5[1:]
for i in range(0x1f,-1,-1):v4 -= ((v3 ^ v5[i]) + (v3 ^ a2[(((v5[i]>>2)&3)^1)&3])) ^ (((4 * v3) ^ (v3 >> 5))+ ((v3 >> 3) ^ (16 * v3)))v4 &= 0xffffffffv3 -= ((v4 ^ v5[i]) + (v4 ^ a2[(((v5[i]>>2)&3)^0)&3])) ^ (((4 * v4) ^ (v4 >> 5))+ ((v4 >> 3) ^ (16 * v4)))v3 &= 0xffffffff
flag += p32(v3)+p32(v4)+b'}'
print(flag)#ctfshow{T1nyENCryPti0nA19ori7hM!}

[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube_pot相关推荐

[ctf.show.reverse] 吃鸡杯 ezmore,有手就行,EzAutoRe
ezmore 动调的题,跟进去在4019d6下断点看比较情况得到neft输入后得到flag组成提示有手就行一上来就猜入口是_main然后解到一个fake s2 = [99,23,113,2,106 ...
ctfshow 吃瓜杯八月赛 Misc WriteUp
目录 1.Misc游戏签到 2.吃瓜 3.EZbingo 4.魔王 5.Dinner of Cyanogen 6.Music Game 7.一群强盗 1.Misc游戏签到别问问就是玩游戏套神说的 ...
CTFshow吃瓜杯的两道web
Shellme_Revenge 在BsidesCTF2021中出过类似的题,利用的是一些数学上的trick 首先是注意到cookie中的hint,所以在请求中加上?looklook=1即可看到源码: ...
ctfshow吃瓜杯之web(除魔女)详解
shellme 搜索ctfshow即可热身 <?phpinclude("flag.php"); highlight_file(__FILE__); if(isset($_G ...
ctfshow吃瓜杯 web
文章目录热身 ATTup 代码审计 phar反序列化 shellme shellme_Revenge 热身 <?php/* # -*- coding: utf-8 -*- # @Author: ...
ctfshow吃瓜杯八月群赛 WriteUp/WP
Web: shellme 题目问题,没什么说的,进去直接搜ctfshow就是flag 热身签到题,做过web入门的都应该知道怎么绕,分开来看比如第一个部分可以用小数绕过,第二部分没有字母,可以用8 ...
ctfshow 吃瓜杯 web 部分题
目录热身 shellme shellme_Revenge 热身 <?php /* # -*- coding: utf-8 -*- # @Author: h1xa # @Date: 2020 ...
猿辅导MSMARCO冠军团队：用MARS模型解决机器阅读任务 | 吃瓜笔记
主讲人:柳景明 | 猿辅导NLP团队负责人整理:陈铭林量子位出品 | 公众号 QbitAI 4月12日晚,量子位·吃瓜社邀请到猿辅导MSMARCO冠军团队,为大家详细讲解了RACE,SQUAD, ...
吃瓜笔记 | Momenta王晋玮：让深度学习更高效运行的两个视角
主讲人:王晋玮 | Momenta合伙人屈鑫编辑整理量子位出品 | 公众号 QbitAI 2月1日晚,量子位·吃瓜社联合Momenta带来吃瓜社第五期:让深度学习更高效运行的两个视角. 作为顶 ...

[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube_pot

[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube_pot相关推荐

最新文章

热门文章

[ctf.show.reverse] 吃瓜杯 签层饼，Tea_tube_pot

[ctf.show.reverse] 吃瓜杯 签层饼，Tea_tube_pot相关推荐

最新文章

热门文章

[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube_pot

[ctf.show.reverse] 吃瓜杯签层饼，Tea_tube_pot相关推荐