SICTF#Round2部分wp

Reverse

pyc

直接在线反编译

myobject

密文

标准RC4加密

chbase

第一个函数有变表

base64加密

base64

pyinstxtractor.py反编译得到pyc，借助在线网站得到py文件

#!/usr/bin/env python
# visit http://tool.lu/pyc/ for more information
BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

def base64_encode(data):
    binary_str = ''.join((lambda .0: for x in .0:
format(x, '08b'))(data))
    padding = len(binary_str) % 24
    if padding != 0:
        binary_str += '0' * (24 - padding)
    result = ''
    for i in range(0, len(binary_str), 6):
        group = binary_str[i:i + 6]
        decimal_val = int(group, 2)
        result += BASE64_CHARS[decimal_val]
    padding_count = (4 - len(result) % 4) % 4
    result += '=' * padding_count
    return result

data = input('').encode()
encoded_data = base64_encode(data)
print(encoded_data)
if encoded_data == 'U0lDVEZ7OGUwZDM1OGQtOGI5ZC00ODY2LTliMDItNjc0OWIwN2FkMDlhfQAA':
    print('True!')

直接解码

java

给的是字节码，关键部分可以问gpt

最好分步让gpt生成，直接生成python大概率会出问题

public static void main(String[] args){
    double[] numArray = {148.0d, 136.0d, 151.0d, 234.0d, 177.0d, 48.0d, 226.0d,
                         234.0d, 214.0d, 177.0d, 168.0d, 176.0d,
                         151.0d, 250.0d, 19.0d, 20.0d, 253.0d, 52.0d, 72.0d,
                         176.0d, 170.0d, 140.0d, 176.0d, 236.0d,
                         54.0d, 231.0d, 212.0d, 237.0d, 135.0d, 151.0d, 150.0d,
                         135.0d, 217.0d, 231.0d, 229.0d, 32.0d,
                         90.0d};
    double[] flagChars;
    Scanner scanner = new Scanner(System.in);
    System.out.println("请输入flag:");
    String flagInput = scanner.nextLine();
    char[] flagCharArray = flagInput.toCharArray();
    if(flagInput.length() != 38){
        System.out.println("flag length error");
        return;
    }
    flagChars = new double[flagCharArray.length-1];
    for(int i=0;i<flagCharArray.length-1;i++){
        int xorResult = flagCharArray[i] ^ flagCharArray[i+1];
        xorResult -= "SICTF2023".charAt(i % "SICTF2023".length());
        xorResult ^= "SICTF2023".charAt(i % "SICTF2023".length());
        xorResult &= 0xFF;
        flagChars[i] = (double)xorResult;
    }
    if(Arrays.equals(flagChars,numArray)){
        System.out.println("OH!You are right!");
    }else{
        System.out.println("NO!You should try again!");
    }
    System.exit(0);
}

逆向脚本

charArray=[148, 136, 151, 234, 177, 48, 226, 234, 214, 177, 168, 176, 151, 250,
19, 20, 253, 52, 72, 176, 170, 140, 176, 236, 54, 231, 212, 237, 135, 151, 150,
135, 217, 231, 229, 32, 90, 125]
str = 'SICTF2023'
flag=""
for i in range(len(charArray)-2,-1,-1):
    a=ord(str[i%len(str)])
    charArray[i]=(((charArray[i]^a)+a))^charArray[i+1]
    charArray[i]&=0xff
    flag+=chr(charArray[i])

print(flag[::-1]+"}")
#SICTF{OMG_j@vac0de_1s_sO_interesting!}

Pwn

shop

整数溢出，数字大于2^32即可得到flag

有非预期，输入0或者一个较小的负数也能得到flag