[安洵杯 2019]game [SUCTF2018]babyre

本文主要是介绍[安洵杯 2019]game [SUCTF2018]babyre，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

无脑挂点wp，大概率只有简单描述和脚本

[安洵杯 2019]game

• llvm，deflat去混淆，然后就是个数独的填写，前面有一堆简单置换，直接逆写

s = [0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00,0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00,0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x08, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x04, 0x00, 0x00, 0x00]
temp = []
for i in range(81):temp.append(s[i*4])
print(temp.count(0))
w = [0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,0x03, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x06, 0x00,0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00,0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00,0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,0x07, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x03, 0x00,0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x08, 0x00,0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,0x06, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,0x04, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x06, 0x00,0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,0x03, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x05, 0x00,0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x09, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00,0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
temp1 = []
for i in range(81):temp1.append(w[i*4])
for i in range(81):if temp[i] == 0:print(temp1[i],end=',')key = [4,6,9,3,6,4,1,7,6,2,8,9,4,6,8,5,7,2,2,8,4,3,5,5,6,1,3,7,2,1,9,8,7,6,2,5,5,9,8,6]
key = [i+68 for i in key]
key = [(temp & 0xf3 | ~temp & 0xc) for temp in key]
print(len(key))
for i in range(20):temp = key[i*2]key[i*2] = key[i*2+1]key[i*2+1] = temp
for i in range(20,40):print(chr(key[i]),end='')
for i in range(0,20):print(chr(key[i]),end='')
# KDEEIFGKIJ@AFGEJAEF@FDKADFGIJFA@FDE@JG@J

[SUCTF2018]babyre

• 虽然是个bin，但是不影响ida64识别
• 输入一个数字还mod 65536，直接仿写爆破

#include <bits/stdc++.h>
using namespace std;
int main()
{int v4[10000] = {0};v4[0] = 2;v4[1] = 3;v4[2] = 2;v4[3] = 1;v4[4] = 4;v4[5] = 7;v4[6] = 4;v4[7] = 5;v4[8] = 10;v4[9] = 11;v4[10] = 10;v4[11] = 9;v4[12] = 14;v4[13] = 15;v4[14] = 12;v4[15] = 13;v4[16] = 16;v4[17] = 19;v4[18] = 16;v4[19] = 17;v4[20] = 20;v4[21] = 23;v4[22] = 22;v4[23] = 19;v4[24] = 28;v4[25] = 25;v4[26] = 30;v4[27] = 31;v4[28] = 28;v4[29] = 25;v4[30] = 26;v4[31] = 31;v4[32]=36;
v4[33]=33;
v4[34]=34;
v4[35]=39;
v4[36]=36;
v4[37]=33;
v4[38]=34;
v4[39]=35;
v4[40]=40;
v4[41]=41;
v4[42]=46;
v4[43]=43;
v4[44]=36;
v4[45]=45;
v4[46]=38;
v4[47]=47;
v4[48]=56;
v4[49]=49;
v4[50]=58;
v4[51]=59;
v4[52]=52;
v4[53]=61;
v4[54]=62;
v4[55]=55;
v4[56]=48;
v4[57]=57;
v4[58]=50;
v4[59]=59;
v4[60]=60;
v4[61]=53;
v4[62]=54;
v4[63]=55;
v4[64]=72;
v4[65]=73;
v4[66]=66;
v4[67]=66;
v4[68]=68;
v4[69]=68;
v4[70]=70;
v4[71]=71;
v4[72]=72;
v4[73]=73;
v4[74]=74;
v4[75]=74;
v4[76]=77;
v4[77]=77;
v4[78]=79;
v4[79]=78;
v4[80]=80;
v4[81]=80;
v4[82]=82;
v4[83]=83;
v4[84]=85;
v4[85]=84;
v4[86]=86;
v4[87]=87;
v4[88]=89;
v4[89]=89;
v4[90]=90;
v4[91]=91;
v4[92]=92;
v4[93]=93;
v4[94]=94;
v4[95]=94;
v4[96]=96;
v4[97]=96;
v4[98]=99;
v4[99]=99;
v4[100]=100;
v4[101]=101;
v4[102]=103;
v4[103]=103;
v4[104]=105;
v4[105]=105;
v4[106]=107;
v4[107]=107;
v4[108]=108;
v4[109]=109;
v4[110]=110;
v4[111]=110;
v4[112]=112;
v4[113]=112;
v4[114]=114;
v4[115]=115;
v4[116]=116;
v4[117]=117;
v4[118]=119;
v4[119]=119;
v4[120]=120;
v4[121]=121;
v4[122]=123;
v4[123]=123;
v4[124]=125;
v4[125]=125;v4[126] = 0x7F;v4[127] = 127;v4[128] = 0x81;v4[129] = 0x81;v4[130] = 131;v4[131] = 131;v4[132] = 0x8C;v4[133] = 0x8D;v4[134] = 0x8E;v4[135] = -113;v4[136] = -120;v4[137] = -119;v4[138] = -118;v4[139] = -117;v4[140] = -116;v4[141] = -115;v4[142] = -114;v4[143] = -121;v4[144] = -104;v4[145] = -111;v4[146] = -110;v4[147] = -109;v4[148] = -108;v4[149] = -107;v4[150] = -106;v4[151] = -105;v4[152] = -104;v4[153] = -103;v4[154] = -102;v4[155] = -102;v4[156] = -100;v4[157] = -100;v4[158] = -98;v4[159] = -98;v4[160] = -96;v4[161] = -96;v4[162] = -94;v4[163] = -94;v4[164] = -92;v4[165] = -92;v4[166] = -90;v4[167] = -90;v4[168] = -88;v4[169] = -88;v4[170] = -86;v4[171] = -86;v4[172] = -84;v4[173] = -84;v4[174] = -82;v4[175] = -82;v4[176] = -80;v4[177] = -79;v4[178] = -78;v4[179] = -77;int v9,v10;for(int i = 0; i < 65536; i++){int v6[31] = {0};v6[30] = 8;while ( v6[30] ){--v6[30];for (int j = 22; j; v6[j] |= v10 << v6[30] ){v9 = v4[22 * v6[30] + --j];v10 = (v9 >> ((i >> (2 * v6[30])) & 3)) & 1;}}if ((char)v6[0] == 'S'){for(int temp = 0; v6[temp];temp++){cout <<(char)v6[temp];}cout <<endl;}}return 0;} 

这篇关于[安洵杯 2019]game [SUCTF2018]babyre的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

---