NSSCTF逆向刷题记录

fivesheeptree

已于 2023-07-28 15:37:34 修改

阅读量2.4k

点赞数 15

CC 4.0 BY-SA版权

分类专栏： CTF逆向刷题记录文章标签： python java 前端

于 2023-07-18 17:03:24 首次发布

本文链接：https://blog.csdn.net/fivesheeptree/article/details/131784255

[WUSTCTF 2020]level3

[SWPUCTF 2022 新生赛]upx

[HNCTF 2022 Week1]你知道什么是Py嘛？

[CISCN 2022 东北]easycpp

[羊城杯 2020]login

[GDOUCTF 2023]doublegame

[GDOUCTF 2023]Tea

[WUSTCTF 2020]Cr0ssfun

[HNCTF 2022 Week1]CrackMe

[HDCTF 2023]fake_game

[MoeCTF 2022]Base

[watevrCTF 2019]Timeout

[WUSTCTF 2020]level3

base64_encode函数

翻转0-9和10-19位置的值

base64_table[i]数据

先翻转表，再base换表

basebiao = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
basebiao = list(basebiao)
for i in range(10):
    v1 = basebiao[i]
    basebiao[i] = basebiao[19-i]
    basebiao[19-i] = v1
basebiao = "".join(basebiao)
print(len(basebiao))
print(basebiao)
import base64
str1 = "d2G0ZjLwHjS7DmOzZAY0X2lzX3CoZV9zdNOydO9vZl9yZXZlcnGlfD=="
#string1 = "TSRQPONMLKJIHGFEDCBAUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
string2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
print(base64.b64decode(str1.translate(str.maketrans(basebiao,string2))))

[SWPUCTF 2022 新生赛]upx

Upx脱壳

简单的异或运算

code = "LQQAVDyWRZ]3q]zmpf]uc{]vm]glap{rv]dnce"
code = list(code)
for i in range(len(code)):
    print(chr(ord(code[i])^2),end="")

[HNCTF 2022 Week1]你知道什么是Py嘛？

得到第一位字符"N"以及flag的长度为35

arr数组的长度只有34,故将i的范围改为34

arr=[29, 0, 16, 23, 18, 61, 43, 41, 13, 28, 88, 94, 49, 110, 66, 44, 43, 28, 91, 108, 61, 7, 22, 7, 43, 51, 44, 46, 9, 18, 20, 6, 2, 24]
s = ['N']
#print(len(arr))
for i in range(34):
    a=ord(s[i])^arr[i]
    s.append(chr(a))
    print(s[i],end="")

[CISCN 2022 东北]easycpp

memcmp() 函数比较 v3 和 v12 指向的内存块前 Size 个字节的内容。将比较结果赋值给 v12=buf2

故我们需要得到buf2加密数据

在if(Size!=38)处下断点，启动动态调试

打开buf2得到加密数据

逆序解密

code = [0x0A, 0x0B, 0x7D, 0x2F, 0x7F, 0x67, 0x65, 0x30, 0x63, 0x60,
  0x37, 0x3F, 0x3C, 0x3F, 0x33, 0x3A, 0x3C, 0x3B, 0x35, 0x3C,
  0x3E, 0x6C, 0x64, 0x31, 0x64, 0x6C, 0x3B, 0x68, 0x61, 0x62,
  0x65, 0x36, 0x33, 0x60, 0x62, 0x36, 0x1C, 0x7D]
print(len(code))
for i in range(len(code)-4,-1,-1):
    code[i + 2] = code[i + 2] ^ code[i + 3]
    code[i+1] = code[i+1] ^ code[i + 2]
    code[i]=code[i]^code[i+1]
for i in range(len(code)):
    print(chr(code[i]), end="")

[羊城杯 2020]login

pyinstxtractor解包

#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
# Version: Python 3.6

import sys
input1 = input('input something:')
if len(input1) != 14:
    print('Wrong length!')
    sys.exit()
code = []
for i in range(13):
    code.append(ord(input1[i]) ^ ord(input1[i + 1]))

code.append(ord(input1[13]))
a1 = code[2]
a2 = code[1]
a3 = code[0]
a4 = code[3]
a5 = code[4]
a6 = code[5]
a7 = code[6]
a8 = code[7]
a9 = code[9]
a10 = code[8]
a11 = code[10]
a12 = code[11]
a13 = code[12]
a14 = code[13]
if ((((a1 * 88 + a2 * 67 + a3 * 65 - a4 * 5) + a5 * 43 + a6 * 89 + a7 * 25 + a8 * 13 - a9 * 36) + a10 * 15 + a11 * 11 + a12 * 47 - a13 * 60) + a14 * 29 == 22748) & ((((a1 * 89 + a2 * 7 + a3 * 12 - a4 * 25) + a5 * 41 + a6 * 23 + a7 * 20 - a8 * 66) + a9 * 31 + a10 * 8 + a11 * 2 - a12 * 41 - a13 * 39) + a14 * 17 == 7258) & ((((a1 * 28 + a2 * 35 + a3 * 16 - a4 * 65) + a5 * 53 + a6 * 39 + a7 * 27 + a8 * 15 - a9 * 33) + a10 * 13 + a11 * 101 + a12 * 90 - a13 * 34) + a14 * 23 == 26190) & ((((a1 * 23