• [buuctf.reverse] 152-154

    目录

    152_[watevrCTF 2019]Hacking For Vodka

    153_[watevrCTF 2019]sabataD

    154_[HackIM2020]returminator

    152_[watevrCTF 2019]Hacking For Vodka

    main上来就俩函数

    1. void __fastcall __noreturn main(int a1, char **a2, char **a3)
    2. {
    3.   if ( ptrace(PTRACE_TRACEME, 0LL, 1LL, 0LL) < 0 )
    4.     sub_102E();
    5.   sub_12BF();
    6.   exit(0);
    7. }

    打开看两个函数基本一样，将值异或

    1. __int64 sub_C6D()
    2. {
    3.   char v1[56]; // [rsp+20h] [rbp-40h] BYREF
    4.   unsigned __int64 v2; // [rsp+58h] [rbp-8h]
    5.  
    6.   v2 = __readfsqword(0x28u);
    7.   v1[0] = aWabcdefglhijkm[0];
    8.   v1[2] = aWabcdefglhijkm[21] ^ 2;
    9.   v1[3] = aWabcdefglhijkm[5] ^ 3;
    10.   v1[6] = aWabcdefglhijkm[28] ^ 6;
    11.   v1[13] = aWabcdefglhijkm[26] ^ 0xD;
    12.   v1[8] = aWabcdefglhijkm[9] ^ 8;
    13.   v1[5] = aWabcdefglhijkm[18] ^ 5;
    14.   v1[11] = aWabcdefglhijkm[12] ^ 0xB;
    15.   v1[1] = aWabcdefglhijkm[1] ^ 1;
    16.   v1[10] = aWabcdefglhijkm[15] ^ 0xA;
    17.   v1[9] = aWabcdefglhijkm[34] ^ 9;
    18.   v1[12] = aWabcdefglhijkm[35] ^ 0xC;
    19.   v1[47] = aWabcdefglhijkm[5] ^ 0x2F;
    20.   v1[16] = aWabcdefglhijkm[3] ^ 0x10;
    21.   v1[15] = aWabcdefglhijkm[34] ^ 0xF;
    22.   v1[4] = aWabcdefglhijkm[19] ^ 4;
    23.   v1[20] = aWabcdefglhijkm[7] ^ 0x14;
    24.   v1[23] = aWabcdefglhijkm[16] ^ 0x17;
    25.   v1[32] = aWabcdefglhijkm[1] ^ 0x20;
    26.   v1[24] = aWabcdefglhijkm[18] ^ 0x18;
    27.   v1[14] = aWabcdefglhijkm[9] ^ 0xE;
    28.   v1[18] = aWabcdefglhijkm[31] ^ 0x12;
    29.   v1[21] = aWabcdefglhijkm[26] ^ 0x15;
    30.   v1[31] = aWabcdefglhijkm[9] ^ 0x1F;
    31.   v1[22] = aWabcdefglhijkm[6] ^ 0x16;
    32.   v1[7] = aWabcdefglhijkm[21] ^ 7;
    33.   v1[34] = aWabcdefglhijkm[12] ^ 0x22;
    34.   v1[17] = aWabcdefglhijkm[12] ^ 0x11;
    35.   v1[19] = aWabcdefglhijkm[15] ^ 0x13;
    36.   v1[40] = aWabcdefglhijkm[18] ^ 0x28;
    37.   v1[26] = aWabcdefglhijkm[20] ^ 0x1A;
    38.   v1[33] = aWabcdefglhijkm[3] ^ 0x21;
    39.   v1[25] = aWabcdefglhijkm[26] ^ 0x19;
    40.   v1[29] = aWabcdefglhijkm[22] ^ 0x1D;
    41.   v1[27] = aWabcdefglhijkm[40] ^ 0x1B;
    42.   v1[42] = aWabcdefglhijkm[16] ^ 0x2A;
    43.   v1[37] = aWabcdefglhijkm[7] ^ 0x25;
    44.   v1[28] = aWabcdefglhijkm[11] ^ 0x1C;
    45.   v1[39] = aWabcdefglhijkm[16] ^ 0x27;
    46.   v1[35] = aWabcdefglhijkm[10] ^ 0x23;
    47.   v1[36] = aWabcdefglhijkm[15] ^ 0x24;
    48.   v1[48] = aWabcdefglhijkm[1] ^ 0x30;
    49.   v1[30] = aWabcdefglhijkm[26] ^ 0x1E;
    50.   v1[51] = 0;
    51.   v1[43] = aWabcdefglhijkm[11] ^ 0x2B;
    52.   v1[44] = aWabcdefglhijkm[22] ^ 0x2C;
    53.   v1[45] = aWabcdefglhijkm[30] ^ 0x2D;
    54.   v1[38] = aWabcdefglhijkm[6] ^ 0x26;
    55.   v1[50] = aWabcdefglhijkm[29] ^ 0x32;
    56.   v1[49] = aWabcdefglhijkm[13] ^ 0x31;
    57.   v1[41] = aWabcdefglhijkm[20] ^ 0x29;
    58.   v1[46] = aWabcdefglhijkm[21] ^ 0x2E;
    59.   sub_92A((__int64)"wabcdefglhijkmqnoprvstuzxy_!{}.1234567890 ", (__int64)v1, 51);
    60.   return 1LL;
    61. }

    然后 处理一下即可

    1. aWabcdefglhijkm = b'wabcdefglhijkmqnoprvstuzxy_!{}.1234567890 '
    2. v1 = [0]*60
    3. v1[0] = aWabcdefglhijkm[0]
    4. v1[2] = aWabcdefglhijkm[21] ^ 2
    5. v1[3] = aWabcdefglhijkm[5] ^ 3
    6. v1[6] = aWabcdefglhijkm[28] ^ 6
    7. v1[13] = aWabcdefglhijkm[26] ^ 0xD
    8. v1[8] = aWabcdefglhijkm[9] ^ 8
    9. v1[5] = aWabcdefglhijkm[18] ^ 5
    10. v1[11] = aWabcdefglhijkm[12] ^ 0xB
    11. v1[1] = aWabcdefglhijkm[1] ^ 1
    12. v1[10] = aWabcdefglhijkm[15] ^ 0xA
    13. v1[9] = aWabcdefglhijkm[34] ^ 9
    14. v1[12] = aWabcdefglhijkm[35] ^ 0xC
    15. v1[47] = aWabcdefglhijkm[5] ^ 0x2F
    16. v1[16] = aWabcdefglhijkm[3] ^ 0x10
    17. v1[15] = aWabcdefglhijkm[34] ^ 0xF
    18. v1[4] = aWabcdefglhijkm[19] ^ 4
    19. v1[20] = aWabcdefglhijkm[7] ^ 0x14
    20. v1[23] = aWabcdefglhijkm[16] ^ 0x17
    21. v1[32] = aWabcdefglhijkm[1] ^ 0x20
    22. v1[24] = aWabcdefglhijkm[18] ^ 0x18
    23. v1[14] = aWabcdefglhijkm[9] ^ 0xE
    24. v1[18] = aWabcdefglhijkm[31] ^ 0x12
    25. v1[21] = aWabcdefglhijkm[26] ^ 0x15
    26. v1[31] = aWabcdefglhijkm[9] ^ 0x1F
    27. v1[22] = aWabcdefglhijkm[6] ^ 0x16
    28. v1[7] = aWabcdefglhijkm[21] ^ 7
    29. v1[34] = aWabcdefglhijkm[12] ^ 0x22
    30. v1[17] = aWabcdefglhijkm[12] ^ 0x11
    31. v1[19] = aWabcdefglhijkm[15] ^ 0x13
    32. v1[40] = aWabcdefglhijkm[18] ^ 0x28
    33. v1[26] = aWabcdefglhijkm[20] ^ 0x1A
    34. v1[33] = aWabcdefglhijkm[3] ^ 0x21
    35. v1[25] = aWabcdefglhijkm[26] ^ 0x19
    36. v1[29] = aWabcdefglhijkm[22] ^ 0x1D
    37. v1[27] = aWabcdefglhijkm[40] ^ 0x1B
    38. v1[42] = aWabcdefglhijkm[16] ^ 0x2A
    39. v1[37] = aWabcdefglhijkm[7] ^ 0x25
    40. v1[28] = aWabcdefglhijkm[11] ^ 0x1C
    41. v1[39] = aWabcdefglhijkm[16] ^ 0x27
    42. v1[35] = aWabcdefglhijkm[10] ^ 0x23
    43. v1[36] = aWabcdefglhijkm[15] ^ 0x24
    44. v1[48] = aWabcdefglhijkm[1] ^ 0x30
    45. v1[30] = aWabcdefglhijkm[26] ^ 0x1E
    46. v1[51] = 0
    47. v1[43] = aWabcdefglhijkm[11] ^ 0x2B
    48. v1[44] = aWabcdefglhijkm[22] ^ 0x2C
    49. v1[45] = aWabcdefglhijkm[30] ^ 0x2D
    50. v1[38] = aWabcdefglhijkm[6] ^ 0x26
    51. v1[50] = aWabcdefglhijkm[29] ^ 0x32
    52. v1[49] = aWabcdefglhijkm[13] ^ 0x31
    53. v1[41] = aWabcdefglhijkm[20] ^ 0x29
    54. v1[46] = aWabcdefglhijkm[21] ^ 0x2E
    55. flag = [0]*52
    56. for i in range(52):
    57.     flag[i] = v1[i]^i
    58. print(bytes(flag))    
    59. #watevr{th4nk5_h4ck1ng_for_s0ju_hackingforsoju.team}
    60. #flag{th4nk5_h4ck1ng_for_s0ju_hackingforsoju.team}  第2段正确

    153_[watevrCTF 2019]sabataD

    程序先做了个rot13然后分成3份比较

    1. unsigned __int64 sub_B7A()
    2. {
    3.   int i; // [rsp+0h] [rbp-310h]
    4.   int v2; // [rsp+4h] [rbp-30Ch]
    5.   int j; // [rsp+4h] [rbp-30Ch]
    6.   int v4; // [rsp+8h] [rbp-308h]
    7.   int v5; // [rsp+Ch] [rbp-304h]
    8.   int v6; // [rsp+10h] [rbp-300h]
    9.   int v7; // [rsp+14h] [rbp-2FCh]
    10.   FILE *stream; // [rsp+18h] [rbp-2F8h]
    11.   glob_t pglob; // [rsp+20h] [rbp-2F0h] BYREF
    12.   char nptr[6]; // [rsp+6Ah] [rbp-2A6h] BYREF
    13.   char s1[64]; // [rsp+70h] [rbp-2A0h] BYREF
    14.   char s2[64]; // [rsp+B0h] [rbp-260h] BYREF
    15.   char pattern[64]; // [rsp+F0h] [rbp-220h] BYREF
    16.   char s[208]; // [rsp+130h] [rbp-1E0h] BYREF
    17.   char v15[264]; // [rsp+200h] [rbp-110h] BYREF
    18.   unsigned __int64 v16; // [rsp+308h] [rbp-8h]
    19.  
    20.   v16 = __readfsqword(0x28u);
    21.   while ( strcmp(s1, "terminate") )
    22.   {
    23.     fflush(stdin);
    24.     fflush(stdout);
    25.     bzero(s, 0xC8uLL);
    26.     bzero(s1, 0x32uLL);
    27.     bzero(nptr, 6uLL);
    28.     fgets(s, 200, stdin);
    29.     v2 = 0;
    30.     v4 = 0;
    31.     v5 = 0;
    32.     v6 = 0;
    33.     for ( i = 0; i <= 154; ++i )
    34.     {
    35.       s[i] = sub_AEA(s[i]);                     // rot13,大小写字符，其它不变
    36.       if ( i <= 150 )
    37.       {
    38.         if ( i % 3 )
    39.         {
    40.           if ( i % 3 == 1 )
    41.           {
    42.             if ( s[i] != 95 )                   // 下划线_
    43.               s2[v4] = s[i];
    44.             ++v4;
    45.           }
    46.           else if ( i % 3 == 2 )
    47.           {
    48.             if ( s[i] != 95 )
    49.               pattern[v5] = s[i];
    50.             ++v5;
    51.           }
    52.         }
    53.         else
    54.         {
    55.           if ( s[i] != 95 )
    56.             s1[v2] = s[i];
    57.           ++v2;
    58.         }
    59.       }
    60.       else
    61.       {
    62.         nptr[v6++] = s[i];
    63.       }
    64.     }
    65.     v7 = atoi(nptr);
    66.     if ( strcmp("watevr-admin", s2) || !strcmp("/home/ctf/flag.txt", pattern) )
    67.     {
    68.       puts("Unauthorized access! This has been logged.");
    69.       exit(0);
    70.     }
    71.     fflush(stdout);
    72.     if ( !strcmp("Fetch from file with index", s1) )
    73.     {
    74.       glob(pattern, 0, 0LL, &pglob);
    75.       stream = fopen(*(const char **)pglob.gl_pathv, "r");
    76.       if ( stream )
    77.       {
    78.         for ( j = 0; fgets(v15, 256, stream) && j != v7; ++j )
    79.           ;
    80.         globfree(&pglob);
    81.         printf("Found %s\n", v15);
    82.         fclose(stream);
    83.       }
    84.       else
    85.       {
    86.         puts("Tried to open non-existing file!");
    87.       }
    88.     }
    89.   }
    90.   puts("Terminated connection");
    91.   return __readfsqword(0x28u) ^ v16;
    92. }

    只是flag用个通配符

    1. def rot13(s):
    2.     t = ''
    3.     for i in s:
    4.         if ord(i)>=ord('A') and ord(i)<=ord('Z'):
    5.             t += chr((ord(i) - 65 + 13)%26 + 65)
    6.         elif ord(i)>=ord('a') and ord(i)<=ord('z'):
    7.             t += chr((ord(i) - 97 + 13)%26 + 97)
    8.         else:
    9.             t += i 
    10.     return t
    11.  
    12. s1 = "Fetch from file with index\0"
    13. s2 = "watevr-admin".ljust(27,'\0')
    14. pattern = "/home/ctf/fl?g.txt".ljust(27,'\0')
    15. s = ''
    16. for i in range(27):
    17.     s+=s1[i]+s2[i]+pattern[i]
    18. s = rot13(s)
    19.     
    20. from pwn import *
    21.  
    22. p = remote('node4.buuoj.cn', 27845)
    23. #p = process('./service')
    24. context.log_level = 'debug'
    25.  
    26. p.sendline(s.encode())
    27. p.recv()
    28.  
    29. #flag{1eaae55e-3119-4a10-83f4-b1836d9f26b5}

    154_[HackIM2020]returminator

    程序非常短，只是个读入，但是有溢出

    1. __int64 __fastcall main(int a1, char **a2, char **a3)
    2. {
    3.   char s[40]; // [rsp+0h] [rbp-30h] BYREF
    4.   FILE *stream; // [rsp+28h] [rbp-8h]
    5.  
    6.   puts("Hello world!");
    7.   stream = fopen("flag", "r");
    8.   if ( !stream )
    9.     exit(1);
    10.   fgets(s, 35, stream);
    11.   fclose(stream);
    12.   memset(dest, 0, 0x23uLL);
    13.   strcpy(dest, s);
    14.   read(0, s, 0x400uLL);
    15.   return 0LL;
    16. }

    然后有个deploy.py读入payload获取返回值（看上去像是pwn题的rop）

    1. import subprocess
    2.  
    3. o = [296, 272, 272, 272, 296, 360, 272, 424, 272, 208, 120, 120, 120, 96, 120, 120, 120, 120, 120, 120, 120, 208, 120, 120, 208, 208, 208, 208, 208, 272, 120, 208, 208]
    4. r = [208, 225, 237, 20, 214, 183, 79, 105, 207, 217, 125, 66, 123, 104, 97, 99, 107 , 105, 109, 50, 48, 202, 111, 111, 29, 63, 223, 36, 0, 124, 100, 219, 32]
    5.  
    6. cmd = ['./main']
    7. rets = []
    8.  
    9. with open('blob', 'rb') as f:
    10.     for offset in o:
    11.         data = f.read(offset)
    12.         p = subprocess.Popen(cmd, stdin=subprocess.PIPE)
    13.         p.stdin.write(data)
    14.         p.communicate()
    15.         rets.append(p.returncode)
    16.  
    17. if all([rets[i] == r[i] for i in range(len(r))]):
    18.     print('Yes!')
    19. else:
    20.     print('No!')

    而blob里就是他的payload,先把payload还原

    1. from pwn import *
    2.  
    3. dic ={0x40119a: 'pop rdi', 0x40119c: 'pop rsi', 0x40119e: 'pop rdx', 0x4011a0: 'pop rcx', 0x4011a2: 'pop rax', 
    4.       0x4011a4: 'add rax,rdi', 0x4011a8: 'add rax,rsi', 0x4011ac: 'add rax,rdx', 0x4011b0: 'add rax,rcx', 0x4011b4: 'add rax,rax',
    5.       0x4011b8: 'add rax,1', 0x4011bd: 'xor rax,rax', 
    6.       0x4011c1: 'sub rax,rdi', 0x4011c5: 'sub rax,rsi', 0x4011c9: 'sub rax,rdx', 0x4011cd: 'sub rax,rcx',
    7.       0x4011d1: 'sub rax,1', 
    8.       0x4011d6: 'movzx   rdi,[rdi]', 0x4011db: 'movzx   rsi,[rsi]', 0x4011e0: 'movzx   rdx,[rdx]', 0x4011e5: 'movzx   rcx,[rcx]',
    9.       0x4011ea: 'mov rdi,rax', 0x4011ee: 'mov rsi,rax', 0x4011f2: 'mov rdx,rax', 0x4011f6: 'mov rcx,rax', 0x4011fa: 'mov rdi,0;call exit()',
    10.       0x4011ff: 'call exit()'}
    11.  
    12. f = open('blob', 'rb')
    13. txt = ''
    14. i = 0
    15. while True:
    16.     v = f.read(8)
    17.     i+=8
    18.     if v == b'aaaaaaaa':
    19.         txt += '----------\n'
    20.         i+=0x30
    21.         v = f.read(0x30)
    22.         continue
    23.     else:
    24.         if 'pop' in dic[u64(v)]:
    25.             txt += dic[u64(v)]+ ';' +str(u64(f.read(8))) + '\n'
    26.             i+=8
    27.         else:
    28.             txt += dic[u64(v)]+'\n'
    29.     #print(hex(i),v)
    30.     if i>=0x1988:
    31.         break    
    32.  
    33. print(txt)

    把结果再翻译一下，得到一些算式

    1. ----------f[0]+f[2]+f[4] -100 == r[0]
    2. pop rax;4210848
    3. pop rdi;0
    4. add rax,rdi
    5. mov rdi,rax
    6. movzx   rdi,[rdi]
    7. pop rax;4210848
    8. pop rsi;2
    9. add rax,rsi
    10. mov rsi,rax
    11. movzx   rsi,[rsi]
    12. pop rax;4210848
    13. pop rdx;4
    14. add rax,rdx
    15. mov rdx,rax
    16. movzx   rdx,[rdx]
    17. xor rax,rax
    18. add rax,rdi
    19. add rax,rsi
    20. add rax,rdx
    21. pop rdi;100
    22. sub rax,rdi
    23. mov rdi,rax
    24. call exit()
    25. ----------f[6]+f[8]+f[10] == r[1]
    26. pop rax;4210848
    27. pop rdi;6
    28. add rax,rdi
    29. mov rdi,rax
    30. movzx   rdi,[rdi]
    31. pop rax;4210848
    32. pop rsi;8
    33. add rax,rsi
    34. mov rsi,rax
    35. movzx   rsi,[rsi]
    36. pop rax;4210848
    37. pop rdx;10
    38. add rax,rdx
    39. mov rdx,rax
    40. movzx   rdx,[rdx]
    41. xor rax,rax
    42. add rax,rdi
    43. add rax,rsi
    44. add rax,rdx
    45. mov rdi,rax
    46. call exit()
    47. ----------f[12]+f[14]+f[16] == r[2]
    48. pop rax;4210848
    49. pop rdi;12
    50. add rax,rdi
    51. mov rdi,rax
    52. movzx   rdi,[rdi]
    53. pop rax;4210848
    54. pop rsi;14
    55. add rax,rsi
    56. mov rsi,rax
    57. movzx   rsi,[rsi]
    58. pop rax;4210848
    59. pop rdx;16
    60. add rax,rdx
    61. mov rdx,rax
    62. movzx   rdx,[rdx]
    63. xor rax,rax
    64. add rax,rdi
    65. add rax,rsi
    66. add rax,rdx
    67. mov rdi,rax
    68. call exit()
    69. ----------f[18]+f[1]-f[30] == r[3]
    70. pop rax;4210848
    71. pop rdi;18
    72. add rax,rdi
    73. mov rdi,rax
    74. movzx   rdi,[rdi]
    75. pop rax;4210848
    76. pop rsi;1
    77. add rax,rsi
    78. mov rsi,rax
    79. movzx   rsi,[rsi]
    80. pop rax;4210848
    81. pop rdx;30
    82. add rax,rdx
    83. mov rdx,rax
    84. movzx   rdx,[rdx]
    85. xor rax,rax
    86. add rax,rdi
    87. add rax,rsi
    88. sub rax,rdx
    89. mov rdi,rax
    90. call exit()
    91. ----------f[3]+f[22]+f[3]-100 == r[4]
    92. pop rax;4210848
    93. pop rdi;3
    94. add rax,rdi
    95. mov rdi,rax
    96. movzx   rdi,[rdi]
    97. pop rax;4210848
    98. pop rsi;22
    99. add rax,rsi
    100. mov rsi,rax
    101. movzx   rsi,[rsi]
    102. pop rax;4210848
    103. pop rdx;3
    104. add rax,rdx
    105. mov rdx,rax
    106. movzx   rdx,[rdx]
    107. xor rax,rax
    108. add rax,rdi
    109. add rax,rsi
    110. add rax,rdx
    111. pop rdi;100
    112. sub rax,rdi
    113. mov rdi,rax
    114. call exit()
    115. ----------f[5]+f[29]+f[28]-f[7]-100 == r[5]
    116. pop rax;4210848
    117. pop rdi;5
    118. add rax,rdi
    119. mov rdi,rax
    120. movzx   rdi,[rdi]
    121. pop rax;4210848
    122. pop rsi;29
    123. add rax,rsi
    124. mov rsi,rax
    125. movzx   rsi,[rsi]
    126. pop rax;4210848
    127. pop rdx;28
    128. add rax,rdx
    129. mov rdx,rax
    130. movzx   rdx,[rdx]
    131. pop rax;4210848
    132. pop rcx;7
    133. add rax,rcx
    134. mov rcx,rax
    135. movzx   rcx,[rcx]
    136. xor rax,rax
    137. add rax,rdi
    138. add rax,rsi
    139. add rax,rdx
    140. sub rax,rcx
    141. pop rdi;100
    142. sub rax,rdi
    143. mov rdi,rax
    144. call exit()
    145. ----------f[9]+f[17]-f[11] == r[6]
    146. pop rax;4210848
    147. pop rdi;9
    148. add rax,rdi
    149. mov rdi,rax
    150. movzx   rdi,[rdi]
    151. pop rax;4210848
    152. pop rsi;17
    153. add rax,rsi
    154. mov rsi,rax
    155. movzx   rsi,[rsi]
    156. pop rax;4210848
    157. pop rdx;11
    158. add rax,rdx
    159. mov rdx,rax
    160. movzx   rdx,[rdx]
    161. xor rax,rax
    162. add rax,rdi
    163. add rax,rsi
    164. sub rax,rdx
    165. mov rdi,rax
    166. call exit()
    167. ----------f[13]+f[15]+f[20]-f[19]+f[27] == r[7]
    168. pop rax;4210848
    169. pop rdi;19
    170. add rax,rdi
    171. mov rdi,rax
    172. movzx   rdi,[rdi]
    173. pop rax;4210848
    174. pop rsi;27
    175. add rax,rsi
    176. mov rsi,rax
    177. movzx   rsi,[rsi]
    178. xor rax,rax
    179. add rax,rdi
    180. add rax,rsi
    181. mov rcx,rax
    182. pop rax;4210848
    183. pop rdi;13
    184. add rax,rdi
    185. mov rdi,rax
    186. movzx   rdi,[rdi]
    187. pop rax;4210848
    188. pop rsi;15
    189. add rax,rsi
    190. mov rsi,rax
    191. movzx   rsi,[rsi]
    192. pop rax;4210848
    193. pop rdx;20
    194. add rax,rdx
    195. mov rdx,rax
    196. movzx   rdx,[rdx]
    197. xor rax,rax
    198. add rax,rdi
    199. add rax,rsi
    200. add rax,rdx
    201. sub rax,rcx
    202. mov rdi,rax
    203. call exit()
    204. ----------
    205. pop rax;4210848
    206. pop rdi;21
    207. add rax,rdi
    208. mov rdi,rax
    209. movzx   rdi,[rdi]
    210. pop rax;4210848
    211. pop rsi;23
    212. add rax,rsi
    213. mov rsi,rax
    214. movzx   rsi,[rsi]
    215. pop rax;4210848
    216. pop rdx;23
    217. add rax,rdx
    218. mov rdx,rax
    219. movzx   rdx,[rdx]
    220. xor rax,rax
    221. add rax,rdi
    222. add rax,rsi
    223. add rax,rdx
    224. mov rdi,rax
    225. call exit()
    226. ----------
    227. pop rax;4210848
    228. pop rdi;25
    229. add rax,rdi
    230. mov rdi,rax
    231. movzx   rdi,[rdi]
    232. pop rax;4210848
    233. pop rsi;26
    234. add rax,rsi
    235. mov rsi,rax
    236. movzx   rsi,[rsi]
    237. xor rax,rax
    238. add rax,rdi
    239. add rax,rsi
    240. mov rdi,rax
    241. call exit()
    242. ----------
    243. pop rax;4210848
    244. pop rdi;30
    245. add rax,rdi
    246. mov rdi,rax
    247. movzx   rdi,[rdi]
    248. call exit()
    249. ----------
    250. pop rax;4210848
    251. pop rdi;9
    252. add rax,rdi
    253. mov rdi,rax
    254. movzx   rdi,[rdi]
    255. call exit()
    256. ----------
    257. pop rax;4210848
    258. pop rdi;8
    259. add rax,rdi
    260. mov rdi,rax
    261. movzx   rdi,[rdi]
    262. call exit()
    263. ----------
    264. pop rax;4210848
    265. mov rdi,rax
    266. movzx   rdi,[rdi]
    267. call exit()
    268. ----------
    269. pop rax;4210848
    270. pop rdi;1
    271. add rax,rdi
    272. mov rdi,rax
    273. movzx   rdi,[rdi]
    274. call exit()
    275. ----------
    276. pop rax;4210848
    277. pop rdi;2
    278. add rax,rdi
    279. mov rdi,rax
    280. movzx   rdi,[rdi]
    281. call exit()
    282. ----------
    283. pop rax;4210848
    284. pop rdi;3
    285. add rax,rdi
    286. mov rdi,rax
    287. movzx   rdi,[rdi]
    288. call exit()
    289. ----------
    290. pop rax;4210848
    291. pop rdi;4
    292. add rax,rdi
    293. mov rdi,rax
    294. movzx   rdi,[rdi]
    295. call exit()
    296. ----------
    297. pop rax;4210848
    298. pop rdi;5
    299. add rax,rdi
    300. mov rdi,rax
    301. movzx   rdi,[rdi]
    302. call exit()
    303. ----------
    304. pop rax;4210848
    305. pop rdi;6
    306. add rax,rdi
    307. mov rdi,rax
    308. movzx   rdi,[rdi]
    309. call exit()
    310. ----------
    311. pop rax;4210848
    312. pop rdi;7
    313. add rax,rdi
    314. mov rdi,rax
    315. movzx   rdi,[rdi]
    316. call exit()
    317. ----------
    318. pop rax;4210848
    319. pop rdi;11
    320. add rax,rdi
    321. mov rdi,rax
    322. movzx   rdi,[rdi]
    323. pop rax;4210848
    324. pop rsi;0
    325. add rax,rsi
    326. mov rsi,rax
    327. movzx   rsi,[rsi]
    328. xor rax,rax
    329. add rax,rdi
    330. add rax,rsi
    331. mov rdi,rax
    332. call exit()
    333. ----------
    334. pop rax;4210848
    335. pop rdi;29
    336. add rax,rdi
    337. mov rdi,rax
    338. movzx   rdi,[rdi]
    339. call exit()
    340. ----------
    341. pop rax;4210848
    342. pop rdi;29
    343. add rax,rdi
    344. mov rdi,rax
    345. movzx   rdi,[rdi]
    346. call exit()
    347. ----------
    348. pop rax;4210848
    349. pop rdi;29
    350. add rax,rdi
    351. mov rdi,rax
    352. movzx   rdi,[rdi]
    353. pop rax;4210848
    354. pop rsi;13
    355. add rax,rsi
    356. mov rsi,rax
    357. movzx   rsi,[rsi]
    358. xor rax,rax
    359. add rax,rdi
    360. sub rax,rsi
    361. mov rdi,rax
    362. call exit()
    363. ----------
    364. pop rax;4210848
    365. pop rdi;28
    366. add rax,rdi
    367. mov rdi,rax
    368. movzx   rdi,[rdi]
    369. pop rax;4210848
    370. pop rsi;14
    371. add rax,rsi
    372. mov rsi,rax
    373. movzx   rsi,[rsi]
    374. xor rax,rax
    375. add rax,rdi
    376. sub rax,rsi
    377. mov rdi,rax
    378. call exit()
    379. ----------
    380. pop rax;4210848
    381. pop rdi;28
    382. add rax,rdi
    383. mov rdi,rax
    384. movzx   rdi,[rdi]
    385. pop rax;4210848
    386. pop rsi;15
    387. add rax,rsi
    388. mov rsi,rax
    389. movzx   rsi,[rsi]
    390. xor rax,rax
    391. add rax,rdi
    392. add rax,rsi
    393. mov rdi,rax
    394. call exit()
    395. ----------
    396. pop rax;4210848
    397. pop rdi;0
    398. add rax,rdi
    399. mov rdi,rax
    400. movzx   rdi,[rdi]
    401. pop rax;4210848
    402. pop rsi;27
    403. add rax,rsi
    404. mov rsi,rax
    405. movzx   rsi,[rsi]
    406. xor rax,rax
    407. add rax,rdi
    408. sub rax,rsi
    409. mov rdi,rax
    410. call exit()
    411. ----------
    412. pop rax;4210848
    413. pop rdi;23
    414. add rax,rdi
    415. mov rdi,rax
    416. movzx   rdi,[rdi]
    417. pop rax;4210848
    418. pop rsi;24
    419. add rax,rsi
    420. mov rsi,rax
    421. movzx   rsi,[rsi]
    422. xor rax,rax
    423. add rax,rdi
    424. sub rax,rsi
    425. mov rdi,rax
    426. call exit()
    427. ----------
    428. pop rax;4210848
    429. pop rdi;26
    430. add rax,rdi
    431. mov rdi,rax
    432. movzx   rdi,[rdi]
    433. pop rax;4210848
    434. pop rsi;0
    435. add rax,rsi
    436. mov rsi,rax
    437. movzx   rsi,[rsi]
    438. pop rax;4210848
    439. pop rdx;1
    440. add rax,rdx
    441. mov rdx,rax
    442. movzx   rdx,[rdx]
    443. xor rax,rax
    444. add rax,rdi
    445. add rax,rsi
    446. sub rax,rdx
    447. mov rdi,rax
    448. call exit()
    449. ----------
    450. pop rax;4210848
    451. pop rdi;19
    452. add rax,rdi
    453. mov rdi,rax
    454. movzx   rdi,[rdi]
    455. call exit()
    456. ----------
    457. pop rax;4210848
    458. pop rdi;11
    459. add rax,rdi
    460. mov rdi,rax
    461. movzx   rdi,[rdi]
    462. pop rax;4210848
    463. pop rsi;12
    464. add rax,rsi
    465. mov rsi,rax
    466. movzx   rsi,[rsi]
    467. xor rax,rax
    468. add rax,rdi
    469. add rax,rsi
    470. mov rdi,rax
    471. call exit()
    472. ----------
    473. pop rax;4210848
    474. pop rdi;21
    475. add rax,rdi
    476. mov rdi,rax
    477. movzx   rdi,[rdi]
    478. pop rax;4210848
    479. pop rsi;20
    480. add rax,rsi
    481. mov rsi,rax
    482. movzx   rsi,[rsi]
    483. xor rax,rax
    484. add rax,rdi
    485. sub rax,rsi
    486. mov rdi,rax
    487. call exit()
    488.

    然后把算式放z3

    1. from z3 import *
    2.  
    3. r = [208, 225, 237, 20, 214, 183, 79, 105, 207, 217, 
    4.      125, 66, 123, 104, 97, 99, 107 , 105, 109, 50, 
    5.      48, 202, 111, 111, 29, 63, 223, 36, 0, 124, 
    6.      100, 219, 32]
    7.  
    8. f = [Int(f'f_{i}') for i in range(31)]
    9. s = Solver()
    10. for i in range(31):
    11.     s.add([f[i]>0x20, f[i]<0x7f])
    12.     
    13.     
    14. s.add(f[0]+f[2]+f[4] -100 == r[0])
    15. s.add(f[6]+f[8]+f[10] == r[1])
    16. s.add(f[12]+f[14]+f[16] == r[2])
    17. s.add(f[18]+f[1]-f[30] == r[3])
    18. s.add(f[3]+f[22]+f[3]-100 == r[4])
    19. s.add(f[5]+f[29]+f[28]-f[7]-100 == r[5])
    20. s.add(f[9]+f[17]-f[11] == r[6])
    21. s.add(f[13]+f[15]+f[20]-f[19]-f[27] == r[7])
    22. s.add(f[21]+f[23]+f[23] == r[8])
    23. s.add(f[25]+f[26] == r[9])
    24. s.add(f[30] == r[10])
    25. s.add(f[9] == r[11])
    26. s.add(f[8] == r[12])
    27. s.add(f[0] == r[13])
    28. s.add(f[1] == r[14])
    29. s.add(f[2] == r[15])
    30. s.add(f[3] == r[16])
    31. s.add(f[4] == r[17])
    32. s.add(f[5] == r[18])
    33. s.add(f[6] == r[19])
    34. s.add(f[7] == r[20])
    35. s.add(f[11]+f[0] == r[21])
    36. s.add(f[29] == r[22])
    37. s.add(f[29] == r[23])
    38. s.add(f[29]-f[13] == r[24])
    39. s.add(f[28]-f[14] == r[25])
    40. s.add(f[28]+f[15] == r[26])
    41. s.add(f[0]-f[27] == r[27])
    42. s.add(f[23]-f[24] == r[28])
    43. s.add(f[26]+f[0]-f[1] == r[29])
    44. s.add(f[19] == r[30])
    45. s.add(f[11]+f[12] == r[31])
    46. s.add(f[21]-f[20] == r[32])
    47.  
    48. if s.check() == sat:
    49.     d = s.model()
    50.     print(d)
    51.     for i in range(31):
    52.         print(chr(d[f[i]].as_long()), end='')
    53.  
    54. #hackim20{B4byR0pDo0dOod00duDoo}
    55. #flag{B4byR0pDo0dOod00duDoo}

  • 相关阅读:
    目标检测YOLO实战应用案例100讲-基于改进的YOLOV5算法的垃圾分类模型
    辐射骚扰整改思路及方法：实地验证？|深圳比创达电子EMC
    《熬夜整理》保姆级系列教程-玩转Wireshark抓包神器教程(2)-Wireshark在Windows系统上安装部署
    搜维尔科技：【软件篇】TechViz是一款专为工程设计的专业级3D可视化软件
    Spring Boot——日志文件
    LeetCode 面试题 10.01. 合并排序的数组
    Avalonia中的自绘控件
    stacking算法基本思想
    Unexpected mutation of “dialogVisible“ prop.
    跨境电商的发展趋势及语言翻译的重要性
  • 原文地址：https://blog.csdn.net/weixin_52640415/article/details/125604970