NSSRound22-Reverse专项赛

22这个数字我很喜欢，就是出的题目难了点😥

ezapk-1

java层有XTEA

魔改异或918,得到username，负数用jeb转成16进制

#include <stdio.h>
#include <stdint.h>

int main() {
    uint32_t v[2] = { 1, 2 };
    int num = 32;
    uint32_t v0 = v[0], v1 = v[1], i; /* set up */
    uint32_t delta = 0x9E3779B9, sum = 0x9E3779B9 * num;
    uint32_t v2[2] = { 0x3D121D26, 0x5E6189F9 }, v3[2] = { 0xC1FB278E, 0x3B494648 }, v5[10] = { 0x3c36eb49, 0x81acb0c0, 0xfac269ae, 0xca5bf9ec };
    uint32_t k[4] = { 0x12345678, 0x5678abcd, 0x89ABCDEF, 0xCDEF1234 }, l = 0, r = 0;
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];
    // v为要加密的数据是两个32位无符号整数
    // k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
    for (int m = 0; m < 8; m += 2) {//flag不全的话有可能是10
        sum = 0x9E3779B9 * num;
        for (i = 0; i < 32; i++) {                     /* basic cycle start */
            v5[m + 1] -= (v5[m] << 4 ^ v5[m] >> 5)  + v5[m] ^ 918 ^ k[(sum >> 11) & 3] + sum;
            sum += 0x61C88647;
            v5[m] -= (v5[m + 1] << 4 ^ v5[m + 1] >> 5) + v5[m + 1] ^ 918 ^ k[sum & 3] + sum;
        }                                              /* end cycle */
    }

    for (int i = 0; i < 8; i++) {
        for (int m = 0; m <= 3; m++) {
            printf("%c", (v5[i] >> (8 * m)) & 0xff);
        }
    }

    return 0;
}
//NS5_R0Un6_z2_apK

魔改rc4,256变成128

一开始以为validatePassword函数还有加密，后来想如果是这样的话java层应该有密文，再去看发现上面函数只是确认密文，这样看的话java层validatePassword(str, encryptWithRC4(str2, str))两个str含义不一样

def rc4(data, key):
    S = list(range(128))
    j = 0
    out = []

    for i in range(128):
        j = (j + S[i] + key[i % len(key)]) % 128
        S[i], S[j] = S[j], S[i]

    i = j = 0
    for char in data:
        i = (i + 1) % 128
        j = (j + S[i]) % 128
        S[i], S[j] = S[j], S[i]
        out.append(char ^ S[(S[i] + S[j]) % 128])

    return bytes(out)


data = bytes.fromhex("572e180b1a680b3e5276344b241d5b52525a043173346b1355442028")
key = b'NS5_R0Un6_z2_apK'
decrypted = rc4(data, key)
print(decrypted)
#NSSCTF{V3ry_4z_1ib_W1th_4pk}