[61dctf]bbencode

題目

flag = open("flag", "r").read().strip()
assert len(flag) == 32
def str2num(s):
    return int(s.encode('hex'), 16)
def bbencode(n):
    a = 0
    for i in bin(n)[2:]:
        a = a << 1
        if (int(i)):
            a = a ^ n
        if a >> 256:
            a = a ^ 0x10000000000000000000000000000000000000000000000000000000000000223L
    return a

print bbencode(str2num(flag))

#result:61406787709715709430385495960238216763226399960658358000016620560764164045692

　　

可以看到算法是異或然后位移，當a長度為257bits時，結束並異或一個key

可以理解為在 2^(256) 下的一個環，遍歷2^256一定可以找到原文

但是實際上並不需要遍歷2^256這么多次

類似於流密碼生成器一樣，並不是256位就會生成2**256的密鑰流

簡單爆破就出來了

#flag = open("flag", "r").read().strip()
#assert len(flag) == 32
def str2num(s):
	return int(s.encode('hex'), 16)
def num2str(n):
	return str(hex(n)[2:-1])
def bbencode(n):
	a = 0
	for i in bin(n)[2:]:
		a = a << 1
		if (int(i)):
			a = a ^ n
		if a >> 256:
			a = a ^ 0x10000000000000000000000000000000000000000000000000000000000000223L
	return a


#print bbencode(str2num(flag))

#result:61406787709715709430385495960238216763226399960658358000016620560764164045692
flag = 61406787709715709430385495960238216763226399960658358000016620560764164045692
for i in range(2**16):
	flag = bbencode(flag)
	if 'flag'.encode('hex') in num2str(flag):
		print num2str(flag).decode('hex')