[SWPU2019]ReverseMe
32exe，拖进ida
要求输入为32长度，
此处进行了一次异或，值为SWPU_2019_CTF
此处将异或处理后的数据存入另一地址，找到它下断
继续跑，
此处又进行了第二次异或，并且又换了地址，再次找到它下断，
此处判断了数据，写脚本
a="SWPU_2019_CTF" b="86 0C 3E CA 98 D7 AE 19 E2 77 6B A6 6A A1 77 B0 69 91 37 05 7A F9 7B 30 43 5A 4B 10 86 7D D4 28" b=b.split() c="B3 37 0F F8 BC BC AE 5D BA 5A 4D 86 44 97 62 D3 4F BA 24 16 0B 9F 72 1A 65 68 6D 26 BA 6B C8 67" c=c.split() for i in range(len(b)): c[i]=eval("0x"+c[i])^eval("0x"+b[i]) for i in range(len(c)): c[i]=c[i]^ord(a[i%len(a)]) for i in c: print(chr(i),end="")
[ACTF新生赛2020]Oruga
迷宫题，只有在碰到障碍时才能换方向
1111*1111111**** 111**111**111111 11111111**1**111 111*1**1**1**111 111*1**1**1*1111 11**1**1111*1111 11111**1111*1111 *111111111111111 111111111111*111 111111***111*111 1111111***1111** 111*1*1*1*1111*1 11111111111111** ****1*1*1*1111*1 1*1*1*1*1*1111*1 1*1*1*1*1*#111**
WEMEWEMJWEMJW
[FlareOn1]Bob Doge
这一上我还以为要逆安装程序，结果是安装完的程序。。。
c#，dnspy打开，找到decode，在下图处下个断
得到flag
[FlareOn2]very_success
32exe,应该是用汇编写的
这里很有意思，这个pop把返回地址压入eax
进sub_401084,
压入的地址被作为数据进行比对，其中加法用的是adc，v10是cf的值，在这里为一
a="AF AA AD EB AE AA EC A4 BA AF AE AA 8A C0 A7 B0 BC 9A BA A5 A5 BA AF B8 9D B8 F9 AE 9D AB B4 BC B6 B3 90 9A A8" a=a.split() for i in range(len(a)): a[i]=eval("0x"+a[i]) a=a[::-1] flag="" c=0
for i in a: b=(1<<(c&0x3)) flag+=chr((i-1-b)^0xc7) c+=i print(flag)
[FlareOn1]Javascrap
这题看了半天那个html文件，结果图片才是题目。。。
图片后面有东西，提出来大概是php，（为什么是大概，因为我不会php）
''' <?php $terms=array("M", "Z", "]", "p", "\\", "w", "f", "1", "v", "<", "a", "Q", "z", " ", "s", "m", "+", "E", "D", "g", "W", "\"", "q", "y", "T", "V", "n", "S", "X", ")", "9", "C", "P", "r", "&", "\'", "!", "x", "G", ":", "2", "~", "O", "h", "u", "U", "@", ";", "H", "3", "F", "6", "b", "L", ">", "^", ",", ".", "l", "$", "d", "`", "%", "N", "*", "[", "0", "}", "J", "-", "5", "_", "A", "=", "{", "k", "o", "7", "#", "i", "I", "Y", "(", "j", "/", "?", "K", "c", "B", "t", "R", "4", "8", "e", "|"); $order=array(59, 71, 73, 13, 35, 10, 20, 81, 76, 10, 28, 63, 12, 1, 28, 11, 76, 68, 50, 30, 11, 24, 7, 63, 45, 20, 23, 68, 87, 42, 24, 60, 87, 63, 18, 58, 87, 63, 18, 58, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 17, 37, 63, 58, 37, 91, 63, 83, 43, 87, 42, 24, 60, 87, 93, 18, 87, 66, 28, 48, 19, 66, 63, 50, 37, 91, 63, 17, 1, 87, 93, 18, 45, 66, 28, 48, 19, 40, 11, 25, 5, 70, 63, 7, 37, 91, 63, 12, 1, 87, 93, 18, 81, 37, 28, 48, 19, 12, 63, 25, 37, 91, 63, 83, 63, 87, 93, 18, 87, 23, 28, 18, 75, 49, 28, 48, 19, 49, 0, 50, 37, 91, 63, 18, 50, 87, 42, 18, 90, 87, 93, 18, 81, 40, 28, 48, 19, 40, 11, 7, 5, 70, 63, 7, 37, 91, 63, 12, 68, 87, 93, 18, 81, 7, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 18, 17, 37, 0, 50, 5, 40, 42, 50, 5, 49, 42, 25, 5, 91, 63, 50, 5, 70, 42, 25, 37, 91, 63, 75, 1, 87, 93, 18, 1, 17, 80, 58, 66, 3, 86, 27, 88, 77, 80, 38, 25, 40, 81, 20, 5, 76, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 7, 88, 32, 45, 7, 90, 52, 80, 58, 5, 70, 63, 7, 5, 66, 42, 25, 37, 91, 0, 12, 50, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 48, 19, 7, 63, 50, 5, 37, 0, 24, 1, 87, 0, 24, 72, 66, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 1, 87, 93, 18, 11, 66, 28, 18, 87, 70, 28, 48, 19, 7, 63, 50, 5, 37, 0, 18, 1, 87, 42, 24, 60, 87, 0, 24, 17, 91, 28, 18, 75, 49, 28, 18, 45, 12, 28, 48, 19, 40, 0, 7, 5, 37, 0, 24, 90, 87, 93, 18, 81, 37, 28, 48, 19, 49, 0, 50, 5, 40, 63, 25, 5, 91, 63, 50, 5, 37, 0, 18, 68, 87, 93, 18, 1, 18, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 90, 87, 0, 24, 72, 37, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 48, 19, 40, 90, 25, 37, 91, 63, 18, 90, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 75, 70, 28, 48, 19, 40, 90, 58, 37, 91, 63, 75, 11, 79, 28, 27, 75, 3, 42, 23, 88, 30, 35, 47, 59, 71, 71, 73, 35, 68, 38, 63, 8, 1, 38, 45, 30, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 23, 75, 77, 1, 28, 1, 43, 52, 31, 19, 75, 81, 40, 30, 75, 1, 27, 75, 77, 35, 47, 59, 71, 71, 71, 73, 21, 4, 37, 51, 40, 4, 7, 91, 7, 4, 37, 77, 49, 4, 7, 91, 70, 4, 37, 49, 51, 4, 51, 91, 4, 37, 70, 6, 4, 7, 91, 91, 4, 37, 51, 70, 4, 7, 91, 49, 4, 37, 51, 6, 4, 7, 91, 91, 4, 37, 51, 70, 21, 47, 93, 8, 10, 58, 82, 59, 71, 71, 71, 82, 59, 71, 71, 29, 29, 47); $do_me=""; for($i=0;$i<count($order);$i++){ $do_me=$do_me.$terms[$order[$i]]; } eval($do_me); ?>
''' terms=["M", "Z", "]", "p", "\\", "w", "f", "1", "v", "<", "a", "Q", "z", " ", "s", "m", "+", "E", "D", "g", "W", "\"", "q", "y", "T", "V", "n", "S", "X", ")", "9", "C", "P", "r", "&", "\'", "!", "x", "G", ":", "2", "~", "O", "h", "u", "U", "@", ";", "H", "3", "F", "6", "b", "L", ">", "^", ",", ".", "l", "$", "d", "`", "%", "N", "*", "[", "0", "}", "J", "-", "5", "_", "A", "=", "{", "k", "o", "7", "#", "i", "I", "Y", "(", "j", "/", "?", "K", "c", "B", "t", "R", "4", "8", "e", "|"] order=[59, 71, 73, 13, 35, 10, 20, 81, 76, 10, 28, 63, 12, 1, 28, 11, 76, 68, 50, 30, 11, 24, 7, 63, 45, 20, 23, 68, 87, 42, 24, 60, 87, 63, 18, 58, 87, 63, 18, 58, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 17, 37, 63, 58, 37, 91, 63, 83, 43, 87, 42, 24, 60, 87, 93, 18, 87, 66, 28, 48, 19, 66, 63, 50, 37, 91, 63, 17, 1, 87, 93, 18, 45, 66, 28, 48, 19, 40, 11, 25, 5, 70, 63, 7, 37, 91, 63, 12, 1, 87, 93, 18, 81, 37, 28, 48, 19, 12, 63, 25, 37, 91, 63, 83, 63, 87, 93, 18, 87, 23, 28, 18, 75, 49, 28, 48, 19, 49, 0, 50, 37, 91, 63, 18, 50, 87, 42, 18, 90, 87, 93, 18, 81, 40, 28, 48, 19, 40, 11, 7, 5, 70, 63, 7, 37, 91, 63, 12, 68, 87, 93, 18, 81, 7, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 18, 17, 37, 0, 50, 5, 40, 42, 50, 5, 49, 42, 25, 5, 91, 63, 50, 5, 70, 42, 25, 37, 91, 63, 75, 1, 87, 93, 18, 1, 17, 80, 58, 66, 3, 86, 27, 88, 77, 80, 38, 25, 40, 81, 20, 5, 76, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 7, 88, 32, 45, 7, 90, 52, 80, 58, 5, 70, 63, 7, 5, 66, 42, 25, 37, 91, 0, 12, 50, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 48, 19, 7, 63, 50, 5, 37, 0, 24, 1, 87, 0, 24, 72, 66, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 1, 87, 93, 18, 11, 66, 28, 18, 87, 70, 28, 48, 19, 7, 63, 50, 5, 37, 0, 18, 1, 87, 42, 24, 60, 87, 0, 24, 17, 91, 28, 18, 75, 49, 28, 18, 45, 12, 28, 48, 19, 40, 0, 7, 5, 37, 0, 24, 90, 87, 93, 18, 81, 37, 28, 48, 19, 49, 0, 50, 5, 40, 63, 25, 5, 91, 63, 50, 5, 37, 0, 18, 68, 87, 93, 18, 1, 18, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 90, 87, 0, 24, 72, 37, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 48, 19, 40, 90, 25, 37, 91, 63, 18, 90, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 75, 70, 28, 48, 19, 40, 90, 58, 37, 91, 63, 75, 11, 79, 28, 27, 75, 3, 42, 23, 88, 30, 35, 47, 59, 71, 71, 73, 35, 68, 38, 63, 8, 1, 38, 45, 30, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 23, 75, 77, 1, 28, 1, 43, 52, 31, 19, 75, 81, 40, 30, 75, 1, 27, 75, 77, 35, 47, 59, 71, 71, 71, 73, 21, 4, 37, 51, 40, 4, 7, 91, 7, 4, 37, 77, 49, 4, 7, 91, 70, 4, 37, 49, 51, 4, 51, 91, 4, 37, 70, 6, 4, 7, 91, 91, 4, 37, 51, 70, 4, 7, 91, 49, 4, 37, 51, 6, 4, 7, 91, 91, 4, 37, 51, 70, 21, 47, 93, 8, 10, 58, 82, 59, 71, 71, 71, 82, 59, 71, 71, 29, 29, 47] do_me=""
for i in range(len(order)): do_me+=terms[order[i]] print(do_me)
得到
$_= 'aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9';$__='JGNvZGU9YmFzZTY0X2RlY29kZSgkXyk7ZXZhbCgkY29kZSk7';$___="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65";eval($___($__));
看着像base64，解密
if(isset($_POST["\97\49\49\68\x4F\84\116\x68\97\x74\x44\x4F\x54\x6A\97\x76\x61\x35\x63\x72\97\x70\x41\84\x66\x6C\97\x72\x65\x44\65\x53\72\111\110\68\79\84\99\x6F\x6D"])) { eval(base64_decode($_POST["\97\49\x31\68\x4F\x54\116\104\x61\116\x44\79\x54\106\97\118\97\53\x63\114\x61\x70\65\84\102\x6C\x61\114\101\x44\65\x53\72\111\x6E\x44\x4F\84\99\x6F\x6D"])); }$code=base64_decode($_);eval($code);
post里的值就是flag
[FlareOn1]Shellolololol
32exe,拖进od，程序跳到了栈里运行
程序里有好几个这样的部分，直接在数据窗口看esi指向地址的变化就能找到flag
[HDCTF2019]MFC
这题参考了https://bbs.pediy.com/thread-250802.htm
MFC，vmp壳
用xspy
有个OnMsg：0464
#include<stdio.h> #include<windows.h>
int main(void) { HWND h = FindWindowA(NULL, "Flag就在控件里"); SendMessage(h, 0x464, NULL, NULL); return 0; }
解des得到flag
[XMAN2018排位赛]easyvm
mach-o 栈虚拟机 没去符号还是比较好看的
写脚本
op="05 01 0B 13 03 03 13 00 00 13 04 04 28 0C 00 33 14 00 20 05 09 01 11 09 00 0B 0A 09 01 04 0A 1B 05 04 0C 03 01 24 03 20 28 13 00 00 07 08 05 0E 08 E0 07 02 08 09 0A 02 01 00 0A 18 00 E0 1E 00 05 01 04 00 13 03 03 28 09 0A 02 01 00 0A 18 00 1F 20 00 03 1B 05 00 07 08 05 0E 08 E0 07 02 08 09 0A 02 01 00 0A 18 00 E0 1E 00 05 1D 05 0A 0D 0A 00 1B 05 0A 0C 03 01 24 03 1F 28 09 0A 02 01 00 0A 18 00 1F 20 00 03 0D 00 04 1B 05 00 13 03 03 03 04 0D 28 07 08 05 0E 08 E0 07 02 08 09 0A 02 01 00 0A 1B 05 00 01 00 04 0D 00 03 1D 05 0A 13 0A 00 1B 05 0A 22 04 08 0C 03 01 24 03 20 28 13 03 03 13 04 04 05 01 0C 28 05 09 01 11 09 03 0B 0A 09 01 00 0A 1B 05 00 07 08 05 0E 08 DF 09 0A 08 1D 05 00 1B 05 00 27 00 0A 17 04 07 0C 03 01 24 03 20 28 2A " op=op.split() for i in range(len(op)): op[i]=eval("0x"+op[i]) v21=0
for i in range(len(op)): v24 = op[v21] v21+=1 v23 = v24 & 0xFE v22 = v24 & 1
if v23==0: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"mov((int *)(&v25)["+str(v8)+"], (unsigned int)*(&v25)["+str(v7)+"])") else: print(str(i)+"mov((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==2: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"mov32((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"mov32((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==4: if v22 == 1: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1 print(str(i)+"lea_ch((&v25)["+str(v8)+"], *(&v25)["+str(v7)+"])") if v23==6: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"lea_int((int **)(&v25)["+str(v8)+"], (int *)*(&v25)["+str(v7)+"])") if v23==8: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"ldr_int((int *)(&v25)["+str(v8)+"], (int *)*(&v25)["+str(v7)+"])") if v23==10: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"ldr_ch((int *)(&v25)["+str(v8)+"], *(&v25)["+str(v7)+"])") if v23==12: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"add((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"add((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==14: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"add_pint((int **)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"add_pint((int **)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==16: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"add_pch((&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"add_pch((&v25)["+str(v8)+"], "+str(v7)+")") if v23==18: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"my_xor((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"my_xor((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==20: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22==0: print(str(i)+"mod((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==22: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"my_or((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"my_or((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==24: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"my_and((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"my_and((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==26: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"push((int **)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: push(str(i)+"(int **)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==28: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"pop((int **)(&v25)["+str(v8)+"], (int *)(&v25)["+str(v7)+"])") if v23==30: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"shr((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"shr((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==32: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"shl((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"shl((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==34: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"ror((int *)(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"ror((int *)(&v25)["+str(v8)+"], "+str(v7)+")") if v23==36: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"v11 = cmpl((int)*(&v25)["+str(v8)+"], (int)*(&v25)["+str(v7)+"])") else: print(str(i)+"v11 = cmpl((int)*(&v25)["+str(v8)+"], "+str(v7)+")") if v23==38: v8 = op[v21] v21+=1 v7 = op[v21] v21+=1
if v22 == 1: print(str(i)+"v10 = cmpeq((unsigned int)*(&v25)["+str(v8)+"], (unsigned int)*(&v25)["+str(v7)+"])") else: print(str(i)+"v10 = cmpeq((unsigned int)*(&v25)["+str(v8)+"], "+str(v7)+")") if v23==40: print("loop") """ if inloop==1: if v11==1: v21 = v20 else: inloop = 0
else: inloop = 1 v20 = v21 """
if v23==42: ''' if v17==1: print("fail...\n") else: print("success!!\n") ''' break
else: continue
得到
0lea_ch((&v25)[1], *(&v25)[11]) 1my_xor((int*)(&v25)[3], (int)*(&v25)[3]) 2my_xor((int*)(&v25)[0], (int)*(&v25)[0]) 3my_xor((int*)(&v25)[4], (int)*(&v25)[4]) loop //for 0 to 32:
5add((int*)(&v25)[0], 51) // a+=51%32
6mod((int*)(&v25)[0], 32) // c[i]=flag[a]
7lea_ch((&v25)[9], *(&v25)[1]) //
8add_pch((&v25)[9], (int)*(&v25)[0]) 9ldr_ch((int*)(&v25)[10], *(&v25)[9]) 10mov((int*)(&v25)[4], (unsigned int)*(&v25)[10]) 11push((int**)(&v25)[5], (int)*(&v25)[4]) 12add((int*)(&v25)[3], 1) 13v11 = cmpl((int)*(&v25)[3], 32) loop 15my_xor((int*)(&v25)[0], (int)*(&v25)[0]) 16lea_int((int**)(&v25)[8], (int*)*(&v25)[5]) 17add_pint((int**)(&v25)[8], 224) 18lea_int((int**)(&v25)[2], (int*)*(&v25)[8]) 19ldr_int((int*)(&v25)[10], (int*)*(&v25)[2]) 20mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) 21my_and((int*)(&v25)[0], 224) 22shr((int*)(&v25)[0], 5) 23mov((int*)(&v25)[4], (unsigned int)*(&v25)[0]) 24my_xor((int*)(&v25)[3], (int)*(&v25)[3]) loop //for 0 to 31
26ldr_int((int*)(&v25)[10], (int*)*(&v25)[2]) //x1&0x1f<<3+x2&0xe0>>5
27mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) //上下两段是第32个
28my_and((int*)(&v25)[0], 31) 29shl((int*)(&v25)[0], 3) 30push((int**)(&v25)[5], (int)*(&v25)[0]) 31lea_int((int**)(&v25)[8], (int*)*(&v25)[5]) 32add_pint((int**)(&v25)[8], 224) 33lea_int((int**)(&v25)[2], (int*)*(&v25)[8]) 34ldr_int((int*)(&v25)[10], (int*)*(&v25)[2]) 35mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) 36my_and((int*)(&v25)[0], 224) 37shr((int*)(&v25)[0], 5) 38pop((int**)(&v25)[5], (int*)(&v25)[10]) 39add((int*)(&v25)[10], (int)*(&v25)[0]) 40push((int**)(&v25)[5], (int)*(&v25)[10]) 41add((int*)(&v25)[3], 1) 42v11 = cmpl((int)*(&v25)[3], 31) loop 44ldr_int((int*)(&v25)[10], (int*)*(&v25)[2]) 45mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) 46my_and((int*)(&v25)[0], 31) 47shl((int*)(&v25)[0], 3) 48add((int*)(&v25)[0], (int)*(&v25)[4]) 49push((int**)(&v25)[5], (int)*(&v25)[0]) 50my_xor((int*)(&v25)[3], (int)*(&v25)[3]) 51mov32((int*)(&v25)[4], (int)*(&v25)[13]) loop //for 0 to 32
53lea_int((int**)(&v25)[8], (int*)*(&v25)[5]) // x^(?+i)
54add_pint((int**)(&v25)[8], 224) 55lea_int((int**)(&v25)[2], (int*)*(&v25)[8]) 56ldr_int((int*)(&v25)[10], (int*)*(&v25)[2]) 57mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) 58push((int**)(&v25)[5], (int)*(&v25)[0]) 59mov((int*)(&v25)[0], (unsigned int)*(&v25)[4]) 60add((int*)(&v25)[0], (int)*(&v25)[3]) 61pop((int**)(&v25)[5], (int*)(&v25)[10]) 62my_xor((int*)(&v25)[10], (int)*(&v25)[0]) 63push((int**)(&v25)[5], (int)*(&v25)[10]) 64ror((int*)(&v25)[4], 8) 65add((int*)(&v25)[3], 1) 66v11 = cmpl((int)*(&v25)[3], 32) loop 68my_xor((int*)(&v25)[3], (int)*(&v25)[3]) 69my_xor((int*)(&v25)[4], (int)*(&v25)[4]) 70lea_ch((&v25)[1], *(&v25)[12]) loop 72lea_ch((&v25)[9], *(&v25)[1]) 73add_pch((&v25)[9], (int)*(&v25)[3]) 74ldr_ch((int*)(&v25)[10], *(&v25)[9]) 75mov((int*)(&v25)[0], (unsigned int)*(&v25)[10]) 76push((int**)(&v25)[5], (int)*(&v25)[0]) 77lea_int((int**)(&v25)[8], (int*)*(&v25)[5]) 78add_pint((int**)(&v25)[8], 223) 79ldr_int((int*)(&v25)[10], (int*)*(&v25)[8]) 80pop((int**)(&v25)[5], (int*)(&v25)[0]) 81push((int**)(&v25)[5], (int)*(&v25)[0]) 82v10 = cmpeq((unsigned int)*(&v25)[0], (unsigned int)*(&v25)[10]) 83my_or((int*)(&v25)[4], (int)*(&v25)[7]) 84add((int*)(&v25)[3], 1) 85v11 = cmpl((int)*(&v25)[3], 32) loop
关键加密其实就是比特流循环左移三位
cmp="75 85 D1 39 0B 29 CD 77 6D 9F 73 23 61 8B 4D 45 9D 8F 5B 11 C1 C9 E5 CF 45 E5 B1 B3 41 D9 CF CF " v2=[0xde,0xad,0xbe,0xef] cmp=cmp.split() for i in range(len(cmp)): cmp[i]=eval("0x"+cmp[i]) f=[] for i in range(32): f.append(0) for i in range(32): cmp[i]=(cmp[i]^(v2[i%4]+i)) t=cmp[31] for i in range(31): f[i+1]=((cmp[i+1]&0xf8)>>3)+((cmp[i]&0x7)<<5) f[0]=((cmp[0]&0xf8)>>3)+((t&0x7)<<5) flag=[] a=0
for i in range(32): flag.append(0) for i in range(32): a+=51 a=a%32 flag[a]=f[i] for i in range(32): print(chr(flag[i]),end="")