CISCN 2020 线上初赛 z3 WP

IDA打开后核心代码如下:

int __cdecl main(int argc, const char **argv, const char **envp)
{
int v4; // [rsp+20h] [rbp-60h]
int v5; // [rsp+24h] [rbp-5Ch]
int v6; // [rsp+28h] [rbp-58h]
int v7; // [rsp+2Ch] [rbp-54h]
int v8; // [rsp+30h] [rbp-50h]
int v9; // [rsp+34h] [rbp-4Ch]
int v10; // [rsp+38h] [rbp-48h]
int v11; // [rsp+3Ch] [rbp-44h]
int v12; // [rsp+40h] [rbp-40h]
int v13; // [rsp+44h] [rbp-3Ch]
int v14; // [rsp+48h] [rbp-38h]
int v15; // [rsp+4Ch] [rbp-34h]
int v16; // [rsp+50h] [rbp-30h]
int v17; // [rsp+54h] [rbp-2Ch]
int v18; // [rsp+58h] [rbp-28h]
int v19; // [rsp+5Ch] [rbp-24h]
int v20; // [rsp+60h] [rbp-20h]
int v21; // [rsp+64h] [rbp-1Ch]
int v22; // [rsp+68h] [rbp-18h]
int v23; // [rsp+6Ch] [rbp-14h]
int v24; // [rsp+70h] [rbp-10h]
int v25; // [rsp+74h] [rbp-Ch]
int v26; // [rsp+78h] [rbp-8h]
int v27; // [rsp+7Ch] [rbp-4h]
int v28; // [rsp+80h] [rbp+0h]
int v29; // [rsp+84h] [rbp+4h]
int v30; // [rsp+88h] [rbp+8h]
int v31; // [rsp+8Ch] [rbp+Ch]
int v32; // [rsp+90h] [rbp+10h]
int v33; // [rsp+94h] [rbp+14h]
int v34; // [rsp+98h] [rbp+18h]
int v35; // [rsp+9Ch] [rbp+1Ch]
int v36; // [rsp+A0h] [rbp+20h]
int v37; // [rsp+A4h] [rbp+24h]
int v38; // [rsp+A8h] [rbp+28h]
int v39; // [rsp+ACh] [rbp+2Ch]
int v40; // [rsp+B0h] [rbp+30h]
int v41; // [rsp+B4h] [rbp+34h]
int v42; // [rsp+B8h] [rbp+38h]
int v43; // [rsp+BCh] [rbp+3Ch]
int v44; // [rsp+C0h] [rbp+40h]
int v45; // [rsp+C4h] [rbp+44h]
unsigned __int8 v46; // [rsp+D0h] [rbp+50h]
unsigned __int8 v47; // [rsp+D1h] [rbp+51h]
unsigned __int8 v48; // [rsp+D2h] [rbp+52h]
unsigned __int8 v49; // [rsp+D3h] [rbp+53h]
unsigned __int8 v50; // [rsp+D4h] [rbp+54h]
unsigned __int8 v51; // [rsp+D5h] [rbp+55h]
unsigned __int8 v52; // [rsp+D6h] [rbp+56h]
unsigned __int8 v53; // [rsp+D7h] [rbp+57h]
unsigned __int8 v54; // [rsp+D8h] [rbp+58h]
unsigned __int8 v55; // [rsp+D9h] [rbp+59h]
unsigned __int8 v56; // [rsp+DAh] [rbp+5Ah]
unsigned __int8 v57; // [rsp+DBh] [rbp+5Bh]
unsigned __int8 v58; // [rsp+DCh] [rbp+5Ch]
unsigned __int8 v59; // [rsp+DDh] [rbp+5Dh]
unsigned __int8 v60; // [rsp+DEh] [rbp+5Eh]
unsigned __int8 v61; // [rsp+DFh] [rbp+5Fh]
unsigned __int8 v62; // [rsp+E0h] [rbp+60h]
unsigned __int8 v63; // [rsp+E1h] [rbp+61h]
unsigned __int8 v64; // [rsp+E2h] [rbp+62h]
unsigned __int8 v65; // [rsp+E3h] [rbp+63h]
unsigned __int8 v66; // [rsp+E4h] [rbp+64h]
unsigned __int8 v67; // [rsp+E5h] [rbp+65h]
unsigned __int8 v68; // [rsp+E6h] [rbp+66h]
unsigned __int8 v69; // [rsp+E7h] [rbp+67h]
unsigned __int8 v70; // [rsp+E8h] [rbp+68h]
unsigned __int8 v71; // [rsp+E9h] [rbp+69h]
unsigned __int8 v72; // [rsp+EAh] [rbp+6Ah]
unsigned __int8 v73; // [rsp+EBh] [rbp+6Bh]
unsigned __int8 v74; // [rsp+ECh] [rbp+6Ch]
unsigned __int8 v75; // [rsp+EDh] [rbp+6Dh]
unsigned __int8 v76; // [rsp+EEh] [rbp+6Eh]
unsigned __int8 v77; // [rsp+EFh] [rbp+6Fh]
unsigned __int8 v78; // [rsp+F0h] [rbp+70h]
unsigned __int8 v79; // [rsp+F1h] [rbp+71h]
unsigned __int8 v80; // [rsp+F2h] [rbp+72h]
unsigned __int8 v81; // [rsp+F3h] [rbp+73h]
unsigned __int8 v82; // [rsp+F4h] [rbp+74h]
unsigned __int8 v83; // [rsp+F5h] [rbp+75h]
unsigned __int8 v84; // [rsp+F6h] [rbp+76h]
unsigned __int8 v85; // [rsp+F7h] [rbp+77h]
unsigned __int8 v86; // [rsp+F8h] [rbp+78h]
unsigned __int8 v87; // [rsp+F9h] [rbp+79h]
int Dst[43]; // [rsp+110h] [rbp+90h]
int i; // [rsp+1BCh] [rbp+13Ch]

_main(*(_QWORD *)&argc, argv, envp);
memcpy(Dst, &unk_404020, 0xA8ui64);
printf("plz input your flag:");
scanf("%42s", &v46);
v4 = 34 * v49 + 12 * v46 + 53 * v47 + 6 * v48 + 58 * v50 + 36 * v51 + v52;
v5 = 27 * v50 + 73 * v49 + 12 * v48 + 83 * v46 + 85 * v47 + 96 * v51 + 52 * v52;
v6 = 24 * v48 + 78 * v46 + 53 * v47 + 36 * v49 + 86 * v50 + 25 * v51 + 46 * v52;
v7 = 78 * v47 + 39 * v46 + 52 * v48 + 9 * v49 + 62 * v50 + 37 * v51 + 84 * v52;
v8 = 48 * v50 + 14 * v48 + 23 * v46 + 6 * v47 + 74 * v49 + 12 * v51 + 83 * v52;
v9 = 15 * v51 + 48 * v50 + 92 * v48 + 85 * v47 + 27 * v46 + 42 * v49 + 72 * v52;
v10 = 26 * v51 + 67 * v49 + 6 * v47 + 4 * v46 + 3 * v48 + 68 * v52;
v11 = 34 * v56 + 12 * v53 + 53 * v54 + 6 * v55 + 58 * v57 + 36 * v58 + v59;
v12 = 27 * v57 + 73 * v56 + 12 * v55 + 83 * v53 + 85 * v54 + 96 * v58 + 52 * v59;
v13 = 24 * v55 + 78 * v53 + 53 * v54 + 36 * v56 + 86 * v57 + 25 * v58 + 46 * v59;
v14 = 78 * v54 + 39 * v53 + 52 * v55 + 9 * v56 + 62 * v57 + 37 * v58 + 84 * v59;
v15 = 48 * v57 + 14 * v55 + 23 * v53 + 6 * v54 + 74 * v56 + 12 * v58 + 83 * v59;
v16 = 15 * v58 + 48 * v57 + 92 * v55 + 85 * v54 + 27 * v53 + 42 * v56 + 72 * v59;
v17 = 26 * v58 + 67 * v56 + 6 * v54 + 4 * v53 + 3 * v55 + 68 * v59;
v18 = 34 * v63 + 12 * v60 + 53 * v61 + 6 * v62 + 58 * v64 + 36 * v65 + v66;
v19 = 27 * v64 + 73 * v63 + 12 * v62 + 83 * v60 + 85 * v61 + 96 * v65 + 52 * v66;
v20 = 24 * v62 + 78 * v60 + 53 * v61 + 36 * v63 + 86 * v64 + 25 * v65 + 46 * v66;
v21 = 78 * v61 + 39 * v60 + 52 * v62 + 9 * v63 + 62 * v64 + 37 * v65 + 84 * v66;
v22 = 48 * v64 + 14 * v62 + 23 * v60 + 6 * v61 + 74 * v63 + 12 * v65 + 83 * v66;
v23 = 15 * v65 + 48 * v64 + 92 * v62 + 85 * v61 + 27 * v60 + 42 * v63 + 72 * v66;
v24 = 26 * v65 + 67 * v63 + 6 * v61 + 4 * v60 + 3 * v62 + 68 * v66;
v25 = 34 * v70 + 12 * v67 + 53 * v68 + 6 * v69 + 58 * v71 + 36 * v72 + v73;
v26 = 27 * v71 + 73 * v70 + 12 * v69 + 83 * v67 + 85 * v68 + 96 * v72 + 52 * v73;
v27 = 24 * v69 + 78 * v67 + 53 * v68 + 36 * v70 + 86 * v71 + 25 * v72 + 46 * v73;
v28 = 78 * v68 + 39 * v67 + 52 * v69 + 9 * v70 + 62 * v71 + 37 * v72 + 84 * v73;
v29 = 48 * v71 + 14 * v69 + 23 * v67 + 6 * v68 + 74 * v70 + 12 * v72 + 83 * v73;
v30 = 15 * v72 + 48 * v71 + 92 * v69 + 85 * v68 + 27 * v67 + 42 * v70 + 72 * v73;
v31 = 26 * v72 + 67 * v70 + 6 * v68 + 4 * v67 + 3 * v69 + 68 * v73;
v32 = 34 * v77 + 12 * v74 + 53 * v75 + 6 * v76 + 58 * v78 + 36 * v79 + v80;
v33 = 27 * v78 + 73 * v77 + 12 * v76 + 83 * v74 + 85 * v75 + 96 * v79 + 52 * v80;
v34 = 24 * v76 + 78 * v74 + 53 * v75 + 36 * v77 + 86 * v78 + 25 * v79 + 46 * v80;
v35 = 78 * v75 + 39 * v74 + 52 * v76 + 9 * v77 + 62 * v78 + 37 * v79 + 84 * v80;
v36 = 48 * v78 + 14 * v76 + 23 * v74 + 6 * v75 + 74 * v77 + 12 * v79 + 83 * v80;
v37 = 15 * v79 + 48 * v78 + 92 * v76 + 85 * v75 + 27 * v74 + 42 * v77 + 72 * v80;
v38 = 26 * v79 + 67 * v77 + 6 * v75 + 4 * v74 + 3 * v76 + 68 * v80;
v39 = 34 * v84 + 12 * v81 + 53 * v82 + 6 * v83 + 58 * v85 + 36 * v86 + v87;
v40 = 27 * v85 + 73 * v84 + 12 * v83 + 83 * v81 + 85 * v82 + 96 * v86 + 52 * v87;
v41 = 24 * v83 + 78 * v81 + 53 * v82 + 36 * v84 + 86 * v85 + 25 * v86 + 46 * v87;
v42 = 78 * v82 + 39 * v81 + 52 * v83 + 9 * v84 + 62 * v85 + 37 * v86 + 84 * v87;
v43 = 48 * v85 + 14 * v83 + 23 * v81 + 6 * v82 + 74 * v84 + 12 * v86 + 83 * v87;
v44 = 15 * v86 + 48 * v85 + 92 * v83 + 85 * v82 + 27 * v81 + 42 * v84 + 72 * v87;
v45 = 26 * v86 + 67 * v84 + 6 * v82 + 4 * v81 + 3 * v83 + 68 * v87;
for ( i = 0; i <= 41; ++i )
{
if ( *(&v4 + i) != Dst[i] )
{
printf("error");
exit(0);
}
}
printf("win");
return 0;
}

看着十分凌乱,我们整理一下代码

int __cdecl main(int argc, const char **argv, const char **envp)
{
int cyphered[42]; // [rsp+20h] [rbp-60h]
char input_str[42]; // [rsp+D0h] [rbp+50h]
int Dst[43]; // [rsp+110h] [rbp+90h]
int i; // [rsp+1BCh] [rbp+13Ch]

_main(*(_QWORD *)&argc, argv, envp);
memcpy(Dst, &unk_404020, 0xA8ui64);
printf("plz input your flag:");
scanf("%42s", input_str);
cyphered[0] = 34 * (unsigned __int8)input_str[3]
+ 12 * (unsigned __int8)input_str[0]
+ 53 * (unsigned __int8)input_str[1]
+ 6 * (unsigned __int8)input_str[2]
+ 58 * (unsigned __int8)input_str[4]
+ 36 * (unsigned __int8)input_str[5]
+ (unsigned __int8)input_str[6];
cyphered[1] = 27 * (unsigned __int8)input_str[4]
+ 73 * (unsigned __int8)input_str[3]
+ 12 * (unsigned __int8)input_str[2]
+ 83 * (unsigned __int8)input_str[0]
+ 85 * (unsigned __int8)input_str[1]
+ 96 * (unsigned __int8)input_str[5]
+ 52 * (unsigned __int8)input_str[6];
cyphered[2] = 24 * (unsigned __int8)input_str[2]
+ 78 * (unsigned __int8)input_str[0]
+ 53 * (unsigned __int8)input_str[1]
+ 36 * (unsigned __int8)input_str[3]
+ 86 * (unsigned __int8)input_str[4]
+ 25 * (unsigned __int8)input_str[5]
+ 46 * (unsigned __int8)input_str[6];
cyphered[3] = 78 * (unsigned __int8)input_str[1]
+ 39 * (unsigned __int8)input_str[0]
+ 52 * (unsigned __int8)input_str[2]
+ 9 * (unsigned __int8)input_str[3]
+ 62 * (unsigned __int8)input_str[4]
+ 37 * (unsigned __int8)input_str[5]
+ 84 * (unsigned __int8)input_str[6];
cyphered[4] = 48 * (unsigned __int8)input_str[4]
+ 14 * (unsigned __int8)input_str[2]
+ 23 * (unsigned __int8)input_str[0]
+ 6 * (unsigned __int8)input_str[1]
+ 74 * (unsigned __int8)input_str[3]
+ 12 * (unsigned __int8)input_str[5]
+ 83 * (unsigned __int8)input_str[6];
cyphered[5] = 15 * (unsigned __int8)input_str[5]
+ 48 * (unsigned __int8)input_str[4]
+ 92 * (unsigned __int8)input_str[2]
+ 85 * (unsigned __int8)input_str[1]
+ 27 * (unsigned __int8)input_str[0]
+ 42 * (unsigned __int8)input_str[3]
+ 72 * (unsigned __int8)input_str[6];
cyphered[6] = 26 * (unsigned __int8)input_str[5]
+ 67 * (unsigned __int8)input_str[3]
+ 6 * (unsigned __int8)input_str[1]
+ 4 * (unsigned __int8)input_str[0]
+ 3 * (unsigned __int8)input_str[2]
+ 68 * (unsigned __int8)input_str[6];
cyphered[7] = 34 * (unsigned __int8)input_str[10]
+ 12 * (unsigned __int8)input_str[7]
+ 53 * (unsigned __int8)input_str[8]
+ 6 * (unsigned __int8)input_str[9]
+ 58 * (unsigned __int8)input_str[11]
+ 36 * (unsigned __int8)input_str[12]
+ (unsigned __int8)input_str[13];
cyphered[8] = 27 * (unsigned __int8)input_str[11]
+ 73 * (unsigned __int8)input_str[10]
+ 12 * (unsigned __int8)input_str[9]
+ 83 * (unsigned __int8)input_str[7]
+ 85 * (unsigned __int8)input_str[8]
+ 96 * (unsigned __int8)input_str[12]
+ 52 * (unsigned __int8)input_str[13];
cyphered[9] = 24 * (unsigned __int8)input_str[9]
+ 78 * (unsigned __int8)input_str[7]
+ 53 * (unsigned __int8)input_str[8]
+ 36 * (unsigned __int8)input_str[10]
+ 86 * (unsigned __int8)input_str[11]
+ 25 * (unsigned __int8)input_str[12]
+ 46 * (unsigned __int8)input_str[13];
cyphered[10] = 78 * (unsigned __int8)input_str[8]
+ 39 * (unsigned __int8)input_str[7]
+ 52 * (unsigned __int8)input_str[9]
+ 9 * (unsigned __int8)input_str[10]
+ 62 * (unsigned __int8)input_str[11]
+ 37 * (unsigned __int8)input_str[12]
+ 84 * (unsigned __int8)input_str[13];
cyphered[11] = 48 * (unsigned __int8)input_str[11]
+ 14 * (unsigned __int8)input_str[9]
+ 23 * (unsigned __int8)input_str[7]
+ 6 * (unsigned __int8)input_str[8]
+ 74 * (unsigned __int8)input_str[10]
+ 12 * (unsigned __int8)input_str[12]
+ 83 * (unsigned __int8)input_str[13];
cyphered[12] = 15 * (unsigned __int8)input_str[12]
+ 48 * (unsigned __int8)input_str[11]
+ 92 * (unsigned __int8)input_str[9]
+ 85 * (unsigned __int8)input_str[8]
+ 27 * (unsigned __int8)input_str[7]
+ 42 * (unsigned __int8)input_str[10]
+ 72 * (unsigned __int8)input_str[13];
cyphered[13] = 26 * (unsigned __int8)input_str[12]
+ 67 * (unsigned __int8)input_str[10]
+ 6 * (unsigned __int8)input_str[8]
+ 4 * (unsigned __int8)input_str[7]
+ 3 * (unsigned __int8)input_str[9]
+ 68 * (unsigned __int8)input_str[13];
cyphered[14] = 34 * (unsigned __int8)input_str[17]
+ 12 * (unsigned __int8)input_str[14]
+ 53 * (unsigned __int8)input_str[15]
+ 6 * (unsigned __int8)input_str[16]
+ 58 * (unsigned __int8)input_str[18]
+ 36 * (unsigned __int8)input_str[19]
+ (unsigned __int8)input_str[20];
cyphered[15] = 27 * (unsigned __int8)input_str[18]
+ 73 * (unsigned __int8)input_str[17]
+ 12 * (unsigned __int8)input_str[16]
+ 83 * (unsigned __int8)input_str[14]
+ 85 * (unsigned __int8)input_str[15]
+ 96 * (unsigned __int8)input_str[19]
+ 52 * (unsigned __int8)input_str[20];
cyphered[16] = 24 * (unsigned __int8)input_str[16]
+ 78 * (unsigned __int8)input_str[14]
+ 53 * (unsigned __int8)input_str[15]
+ 36 * (unsigned __int8)input_str[17]
+ 86 * (unsigned __int8)input_str[18]
+ 25 * (unsigned __int8)input_str[19]
+ 46 * (unsigned __int8)input_str[20];
cyphered[17] = 78 * (unsigned __int8)input_str[15]
+ 39 * (unsigned __int8)input_str[14]
+ 52 * (unsigned __int8)input_str[16]
+ 9 * (unsigned __int8)input_str[17]
+ 62 * (unsigned __int8)input_str[18]
+ 37 * (unsigned __int8)input_str[19]
+ 84 * (unsigned __int8)input_str[20];
cyphered[18] = 48 * (unsigned __int8)input_str[18]
+ 14 * (unsigned __int8)input_str[16]
+ 23 * (unsigned __int8)input_str[14]
+ 6 * (unsigned __int8)input_str[15]
+ 74 * (unsigned __int8)input_str[17]
+ 12 * (unsigned __int8)input_str[19]
+ 83 * (unsigned __int8)input_str[20];
cyphered[19] = 15 * (unsigned __int8)input_str[19]
+ 48 * (unsigned __int8)input_str[18]
+ 92 * (unsigned __int8)input_str[16]
+ 85 * (unsigned __int8)input_str[15]
+ 27 * (unsigned __int8)input_str[14]
+ 42 * (unsigned __int8)input_str[17]
+ 72 * (unsigned __int8)input_str[20];
cyphered[20] = 26 * (unsigned __int8)input_str[19]
+ 67 * (unsigned __int8)input_str[17]
+ 6 * (unsigned __int8)input_str[15]
+ 4 * (unsigned __int8)input_str[14]
+ 3 * (unsigned __int8)input_str[16]
+ 68 * (unsigned __int8)input_str[20];
cyphered[21] = 34 * (unsigned __int8)input_str[24]
+ 12 * (unsigned __int8)input_str[21]
+ 53 * (unsigned __int8)input_str[22]
+ 6 * (unsigned __int8)input_str[23]
+ 58 * (unsigned __int8)input_str[25]
+ 36 * (unsigned __int8)input_str[26]
+ (unsigned __int8)input_str[27];
cyphered[22] = 27 * (unsigned __int8)input_str[25]
+ 73 * (unsigned __int8)input_str[24]
+ 12 * (unsigned __int8)input_str[23]
+ 83 * (unsigned __int8)input_str[21]
+ 85 * (unsigned __int8)input_str[22]
+ 96 * (unsigned __int8)input_str[26]
+ 52 * (unsigned __int8)input_str[27];
cyphered[23] = 24 * (unsigned __int8)input_str[23]
+ 78 * (unsigned __int8)input_str[21]
+ 53 * (unsigned __int8)input_str[22]
+ 36 * (unsigned __int8)input_str[24]
+ 86 * (unsigned __int8)input_str[25]
+ 25 * (unsigned __int8)input_str[26]
+ 46 * (unsigned __int8)input_str[27];
cyphered[24] = 78 * (unsigned __int8)input_str[22]
+ 39 * (unsigned __int8)input_str[21]
+ 52 * (unsigned __int8)input_str[23]
+ 9 * (unsigned __int8)input_str[24]
+ 62 * (unsigned __int8)input_str[25]
+ 37 * (unsigned __int8)input_str[26]
+ 84 * (unsigned __int8)input_str[27];
cyphered[25] = 48 * (unsigned __int8)input_str[25]
+ 14 * (unsigned __int8)input_str[23]
+ 23 * (unsigned __int8)input_str[21]
+ 6 * (unsigned __int8)input_str[22]
+ 74 * (unsigned __int8)input_str[24]
+ 12 * (unsigned __int8)input_str[26]
+ 83 * (unsigned __int8)input_str[27];
cyphered[26] = 15 * (unsigned __int8)input_str[26]
+ 48 * (unsigned __int8)input_str[25]
+ 92 * (unsigned __int8)input_str[23]
+ 85 * (unsigned __int8)input_str[22]
+ 27 * (unsigned __int8)input_str[21]
+ 42 * (unsigned __int8)input_str[24]
+ 72 * (unsigned __int8)input_str[27];
cyphered[27] = 26 * (unsigned __int8)input_str[26]
+ 67 * (unsigned __int8)input_str[24]
+ 6 * (unsigned __int8)input_str[22]
+ 4 * (unsigned __int8)input_str[21]
+ 3 * (unsigned __int8)input_str[23]
+ 68 * (unsigned __int8)input_str[27];
cyphered[28] = 34 * (unsigned __int8)input_str[31]
+ 12 * (unsigned __int8)input_str[28]
+ 53 * (unsigned __int8)input_str[29]
+ 6 * (unsigned __int8)input_str[30]
+ 58 * (unsigned __int8)input_str[32]
+ 36 * (unsigned __int8)input_str[33]
+ (unsigned __int8)input_str[34];
cyphered[29] = 27 * (unsigned __int8)input_str[32]
+ 73 * (unsigned __int8)input_str[31]
+ 12 * (unsigned __int8)input_str[30]
+ 83 * (unsigned __int8)input_str[28]
+ 85 * (unsigned __int8)input_str[29]
+ 96 * (unsigned __int8)input_str[33]
+ 52 * (unsigned __int8)input_str[34];
cyphered[30] = 24 * (unsigned __int8)input_str[30]
+ 78 * (unsigned __int8)input_str[28]
+ 53 * (unsigned __int8)input_str[29]
+ 36 * (unsigned __int8)input_str[31]
+ 86 * (unsigned __int8)input_str[32]
+ 25 * (unsigned __int8)input_str[33]
+ 46 * (unsigned __int8)input_str[34];
cyphered[31] = 78 * (unsigned __int8)input_str[29]
+ 39 * (unsigned __int8)input_str[28]
+ 52 * (unsigned __int8)input_str[30]
+ 9 * (unsigned __int8)input_str[31]
+ 62 * (unsigned __int8)input_str[32]
+ 37 * (unsigned __int8)input_str[33]
+ 84 * (unsigned __int8)input_str[34];
cyphered[32] = 48 * (unsigned __int8)input_str[32]
+ 14 * (unsigned __int8)input_str[30]
+ 23 * (unsigned __int8)input_str[28]
+ 6 * (unsigned __int8)input_str[29]
+ 74 * (unsigned __int8)input_str[31]
+ 12 * (unsigned __int8)input_str[33]
+ 83 * (unsigned __int8)input_str[34];
cyphered[33] = 15 * (unsigned __int8)input_str[33]
+ 48 * (unsigned __int8)input_str[32]
+ 92 * (unsigned __int8)input_str[30]
+ 85 * (unsigned __int8)input_str[29]
+ 27 * (unsigned __int8)input_str[28]
+ 42 * (unsigned __int8)input_str[31]
+ 72 * (unsigned __int8)input_str[34];
cyphered[34] = 26 * (unsigned __int8)input_str[33]
+ 67 * (unsigned __int8)input_str[31]
+ 6 * (unsigned __int8)input_str[29]
+ 4 * (unsigned __int8)input_str[28]
+ 3 * (unsigned __int8)input_str[30]
+ 68 * (unsigned __int8)input_str[34];
cyphered[35] = 34 * (unsigned __int8)input_str[38]
+ 12 * (unsigned __int8)input_str[35]
+ 53 * (unsigned __int8)input_str[36]
+ 6 * (unsigned __int8)input_str[37]
+ 58 * (unsigned __int8)input_str[39]
+ 36 * (unsigned __int8)input_str[40]
+ (unsigned __int8)input_str[41];
cyphered[36] = 27 * (unsigned __int8)input_str[39]
+ 73 * (unsigned __int8)input_str[38]
+ 12 * (unsigned __int8)input_str[37]
+ 83 * (unsigned __int8)input_str[35]
+ 85 * (unsigned __int8)input_str[36]
+ 96 * (unsigned __int8)input_str[40]
+ 52 * (unsigned __int8)input_str[41];
cyphered[37] = 24 * (unsigned __int8)input_str[37]
+ 78 * (unsigned __int8)input_str[35]
+ 53 * (unsigned __int8)input_str[36]
+ 36 * (unsigned __int8)input_str[38]
+ 86 * (unsigned __int8)input_str[39]
+ 25 * (unsigned __int8)input_str[40]
+ 46 * (unsigned __int8)input_str[41];
cyphered[38] = 78 * (unsigned __int8)input_str[36]
+ 39 * (unsigned __int8)input_str[35]
+ 52 * (unsigned __int8)input_str[37]
+ 9 * (unsigned __int8)input_str[38]
+ 62 * (unsigned __int8)input_str[39]
+ 37 * (unsigned __int8)input_str[40]
+ 84 * (unsigned __int8)input_str[41];
cyphered[39] = 48 * (unsigned __int8)input_str[39]
+ 14 * (unsigned __int8)input_str[37]
+ 23 * (unsigned __int8)input_str[35]
+ 6 * (unsigned __int8)input_str[36]
+ 74 * (unsigned __int8)input_str[38]
+ 12 * (unsigned __int8)input_str[40]
+ 83 * (unsigned __int8)input_str[41];
cyphered[40] = 15 * (unsigned __int8)input_str[40]
+ 48 * (unsigned __int8)input_str[39]
+ 92 * (unsigned __int8)input_str[37]
+ 85 * (unsigned __int8)input_str[36]
+ 27 * (unsigned __int8)input_str[35]
+ 42 * (unsigned __int8)input_str[38]
+ 72 * (unsigned __int8)input_str[41];
cyphered[41] = 26 * (unsigned __int8)input_str[40]
+ 67 * (unsigned __int8)input_str[38]
+ 6 * (unsigned __int8)input_str[36]
+ 4 * (unsigned __int8)input_str[35]
+ 3 * (unsigned __int8)input_str[37]
+ 68 * (unsigned __int8)input_str[41];
for ( i = 0; i <= 41; ++i )
{
if ( cyphered[i] != Dst[i] )
{
printf("error");
exit(0);
}
}
printf("win");
return 0;
}

我们可以看出是7位一组进行加密,而且是使用了线性方程组的形式,解该线性方程组即可进行解密。

CISCN 2020 线上初赛 z3 WP

重复6次即可得到flag

102 108 97 103 123 55 101 49 55 49 100 52 51 45 54 51 98 57 45 52 101 49 56 45 57 57 48 101 45 54 101 49 52 99 50 97 102 101 54 52 56 125
flag{7e171d43-63b9-4e18-990e-6e14c2afe648}

我感觉应该有更快的方法。。比赛时几乎直接就秒了。。

要是有师傅有更优解可以给个提示。。感激不尽

原创:https://www.panoramacn.com
源码网提供WordPress源码,帝国CMS源码discuz源码,微信小程序,小说源码,杰奇源码,thinkphp源码,ecshop模板源码,微擎模板源码,dede源码,织梦源码等。

专业搭建小说网站,小说程序,杰奇系列,微信小说系列,app系列小说

CISCN 2020 线上初赛 z3 WP

免责声明,若由于商用引起版权纠纷,一切责任均由使用者承担。

您必须遵守我们的协议,如果您下载了该资源行为将被视为对《免责声明》全部内容的认可-> 联系客服 投诉资源
www.panoramacn.com资源全部来自互联网收集,仅供用于学习和交流,请勿用于商业用途。如有侵权、不妥之处,请联系站长并出示版权证明以便删除。 敬请谅解! 侵权删帖/违法举报/投稿等事物联系邮箱:2640602276@qq.com
未经允许不得转载:书荒源码源码网每日更新网站源码模板! » CISCN 2020 线上初赛 z3 WP
关注我们小说电影免费看
关注我们,获取更多的全网素材资源,有趣有料!
120000+人已关注
分享到:
赞(0) 打赏

评论抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址

您的打赏就是我分享的动力!

支付宝扫一扫打赏

微信扫一扫打赏