宁波市第八届网络安全大赛初赛（REVERSE-Writeup)

小张的博客之旅

于 2025-08-18 23:42:51 发布

阅读量366

点赞数 7

CC 4.0 BY-SA版权

文章标签： Reverse 学习网络安全

本文链接：https://blog.csdn.net/2401_87471430/article/details/150502840

#新星杯·14天创作挑战营·第14期#

SEA_1

查壳

可以看到无壳、32位

打开看main函数

看到key：58453eec4d16ae234a10b597dfe1f6a6

分析代码得到密文存储在 unk_458014 里

所以密文的十六进制字符串是这三个块拼接起来的：

第一块：29708F1980CCE40F46ABAC148D488CA8
第二块：3716FE1D397202797B1999166265623E
第三块：8F761285CB28E256B381167761E41094

拼接后完整的密文：29708F1980CCE40F46ABAC148D488CA83716FE1D397202797B1999166265623E8F761285CB28E256B381167761E4109

可以看到这是典型的AES_ECB加密

用赛博厨子解密得到flag

flower_world

查壳

无壳、32位

打开main函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Str[256]; // [esp+10h] [ebp-100h] BYREF

  __main();
  memset(Str, 0, sizeof(Str));
  printf("Please input the flag and I will verify it:");
  scanf("%256s", Str);
  if ( strlen(Str) != 40 )
  {
    puts("Wrong length");
    exit_0(0);
  }
  memcpy(&flag, Str, 0x28u);
  byte_40704D -= 120;
  byte_407070 ^= 0x4Fu;
  byte_407055 -= 30;
  byte_407064 -= 93;
  byte_407048 += 95;
  byte_40704A += 103;
  byte_40705C ^= 0x82u;
  byte_407069 += 52;
  byte_40705E ^= 3u;
  byte_407041 += 71;
  byte_407076 ^= 0xE0u;
  byte_40706D -= 44;
  byte_407044 -= 127;
  byte_407075 -= 71;
  byte_407060 ^= 0xAAu;
  byte_40704E -= 119;
  byte_407062 ^= 0xAu;
  byte_40707D -= 48;
  byte_407075 += 55;
  byte_40705B += 111;
  byte_40706E ^= 0x32u;
  byte_40706C -= 92;
  byte_40705F ^= 0x29u;
  byte_407041 += 79;
  byte_40704A += 58;
  byte_407062 -= 17;
  byte_40705A += 123;
  byte_407075 -= 100;
  byte_40705C -= 64;
  byte_407056 -= 89;
  byte_407070 ^= 0x73u;
  byte_407062 ^= 0x61u;
  byte_40706E += 118;
  byte_407062 += 41;
  byte_407070 += 78;
  byte_407055 -= 11;
  byte_40704F ^= 0x5Eu;
  byte_407070 ^= 0xB2u;
  byte_407066 -= 66;
  byte_407046 ^= 0xECu;
  byte_407062 ^= 0xD1u;
  byte_407046 -= 99;
  byte_407069 -= 49;
  byte_407046 += 32;
  byte_407066 += 61;
  byte_407042 ^= 0x42u;
  byte_407055 += 109;
  byte_407070 += 14;
  byte_40707B -= 52;
  byte_40706E -= 94;
  byte_407074 += 57;
  byte_40705D -= 30;
  byte_40705E -= 107;
  byte_407048 += 55;
  byte_40704C -= 27;
  byte_40706F -= 88;
  byte_40707A -= 105;
  flag += 25;
  byte_40704C += 73;
  byte_40706F -= 80;
  byte_407070 += 125;
  byte_40706E -= 44;
  byte_40707A += 11;
  byte_407068 ^= 0x57u;
  byte_407062 += 117;
  byte_407056 += 92;
  byte_40705B ^= 0x7Au;
  byte_407043 += 33;
  byte_407045 ^= 0xC3u;
  byte_40705E += 19;
  byte_407064 -= 46;
  byte_407065 -= 45;
  byte_407067 ^= 0xB0u;
  byte_40704F -= 69;
  byte_407061 ^= 0xDCu;
  byte_407046 += 69;
  byte_40707E += 116;
  byte_40704B ^= 0x22u;
  byte_407063 ^= 0x7Eu;
  byte_407054 += 18;
  byte_407072 -= 11;
  byte_40704E ^= 5u;
  byte_40706E += 58;
  byte_407048 += 44;
  byte_40706D ^= 0xE4u;
  byte_407068 -= 30;
  byte_407063 += 96;
  byte_407047 -= 49;
  byte_407062 += 83;
  byte_40707A += 53;
  byte_40706A ^= 0x21u;
  byte_40707C += 49;
  byte_40705B += 11;
  byte_407070 -= 105;
  byte_407063 -= 47;
  byte_407073 -= 67;
  byte_407047 += 94;
  byte_40707E += 78;
  byte_40704F -= 96;
  byte_40707A ^= 0xD3u;
  byte_407043 += 115;
  byte_40705E -= 127;
  byte_40707A -= 86;
  byte_407074 += 32;
  byte_407067 ^= 0x5Cu;
  byte_407049 -= 64;
  byte_40706B ^= 0x8Eu;
  byte_40707E += 121;
  byte_407054 -= 98;
  byte_407074 ^= 0x22u;
  byte_40704F -= 12;
  byte_407045 ^= 0x2Du;
  byte_40707C -= 44;
  byte_40704D -= 74;
  byte_407061 ^= 0x82u;
  byte_407068 ^= 0xEDu;
  byte_407071 ^= 0xBEu;
  byte_407077 += 4;
  byte_40705E -= 120;
  byte_40704B += 67;
  byte_407072 -= 52;
  byte_407042 ^= 0x87u;
  byte_407067 -= 38;
  byte_40707B ^= 0xFAu;
  byte_407072 += 90;
  byte_40706E -= 9;
  byte_407077 ^= 0x2Fu;
  byte_407049 += 83;
  byte_40706B ^= 0xD6u;
  byte_407062 -= 6;
  byte_407048 -= 119;
  byte_407061 -= 118;
  byte_407062 -= 75;
  byte_407068 -= 52;
  flag -= 108;
  byte_40706A += 28;
  byte_40707C ^= 0x4Cu;
  byte_40706C ^= 0x4Au;
  byte_407061 ^= 0xFDu;
  byte_407063 += 125;
  byte_407041 ^= 0x6Cu;
  byte_407075 += 25;
  byte_407071 -= 7;
  byte_40707D -= 119;
  byte_40706F -= 16;
  byte_407064 += 53;
  byte_407066 ^= 0x56u;
  byte_407042 ^= 0xF2u;
  byte_40706B += 115;
  byte_407055 -= 37;
  byte_407072 -= 51;
  byte_407041 -= 107;
  byte_40704F -= 116;
  byte_40705C += 46;
  byte_407065 -= 67;
  byte_40704C += 113;
  byte_407061 += 114;
  byte_40704E += 69;
  byte_407060 += 99;
  byte_407064 ^= 0x88u;
  byte_407079 -= 37;
  byte_40705E ^= 0x76u;
  byte_407070 += 95;
  byte_40707A += 51;
  byte_407074 ^= 0xD3u;
  byte_40704F -= 86;
  flag -= 6;
  byte_40707C -= 8;
  byte_407071 ^= 0x30u;
  byte_40705B += 29;
  byte_407070 += 65;
  byte_40705D ^= 0xEEu;
  byte_407047 -= 31;
  byte_407061 -= 16;
  byte_407071 += 9;
  byte_407064 -= 46;
  byte_407049 ^= 0xDEu;
  byte_407054 ^= 0x6Du;
  byte_407065 -= 91;
  byte_407077 += 119;
  byte_40707D -= 8;
  --byte_407061;
  byte_407075 += 124;
  byte_407068 += 3;
  byte_407059 -= 22;
  byte_407060 ^= 0xD3u;
  byte_407072 ^= 0xA4u;
  flag ^= 0xA8u;
  byte_40707F += 50;
  byte_40707E ^= 0x4Du;
  byte_407070 += 60;
  byte_40704B += 49;
  byte_40707B += 3;
  byte_40706A -= 20;
  byte_407060 -= 38;
  byte_407063 -= 2;
  byte_40707B -= 108;
  byte_40707E -= 71;
  byte_40706E += 111;
  flag ^= 0xD9u;
  byte_40704E += 76;
  byte_40706F ^= 0xF6u;
  byte_40705B += 26;
  flag -= 27;
  byte_407060 -= 80;
  byte_407078 -= 27;
  byte_40705B += 7;
  ++byte_407073;
  byte_407075 ^= 0xDDu;
  byte_407043 -= 127;
  byte_407072 += 116;
  byte_407069 -= 70;
  byte_407065 ^= 0x9Bu;
  byte_407059 -= 34;
  byte_40704B -= 127;
  byte_40707F ^= 0xBu;
  byte_407058 -= 65;
  byte_40704B ^= 0x83u;
  byte_407059 ^= 0xB6u;
  byte_407067 -= 25;
  byte_407042 -= 94;
  byte_407061 ^= 0x7Eu;
  byte_407072 -= 69;
  byte_407077 -= 72;
  byte_407060 ^= 0xF7u;
  byte_407043 -= 11;
  byte_407069 ^= 0x64u;
  byte_407075 ^= 0xEu;
  byte_407073 -= 111;
  byte_407065 ^= 0x7Au;
  byte_40706B -= 7;
  byte_407060 += 103;
  byte_40707D ^= 0xF4u;
  byte_407077 += 16;
  byte_40705C ^= 0x89u;
  byte_407041 -= 20;
  byte_40707A ^= 0x3Fu;
  byte_40704D -= 31;
  byte_407073 += 98;
  byte_407073 -= 5;
  byte_407061 -= 30;
  byte_40704C += 73;
  byte_407054 -= 6;
  byte_407071 ^= 0x56u;
  byte_40705B ^= 3u;
  byte_407055 -= 119;
  byte_40706D += 37;
  byte_40705E += 4;
  byte_407044 -= 48;
  byte_407076 ^= 0xF4u;
  byte_407053 ^= 0x10u;
  byte_407059 ^= 0x47u;
  byte_407060 ^= 0xE2u;
  byte_40704E -= 16;
  byte_40705E ^= 0xD2u;
  byte_407042 += 70;
  byte_407060 -= 91;
  byte_407041 ^= 0x12u;
  byte_407042 -= 81;
  byte_407047 += 92;
  byte_407055 -= 77;
  byte_40705D ^= 0x7Du;
  byte_407070 ^= 0x4Au;
  byte_407074 -= 25;
  byte_407074 -= 127;
  byte_40704B += 121;
  byte_40706C += 64;
  byte_40707A ^= 0x58u;
  byte_40704B -= 123;
  byte_407078 += 42;
  byte_407071 -= 89;
  byte_40707E ^= 0x99u;
  byte_407043 -= 6;
  byte_407045 ^= 0x7Du;
  byte_407042 -= 14;
  byte_407064 += 96;
  byte_407058 += 26;
  byte_40706E += 54;
  byte_407052 -= 86;
  byte_40705D ^= 0x4Eu;
  byte_407055 -= 15;
  byte_407078 -= 32;
  byte_407057 += 75;
  byte_40706E += 66;
  byte_407053 += 101;
  byte_40705E -= 59;
  byte_40706B ^= 0xFAu;
  byte_407042 += 93;
  byte_407073 -= 123;
  byte_40707C += 31;
  byte_407064 ^= 0xA2u;
  byte_407073 -= 32;
  byte_40705A ^= 0x11u;
  byte_40707D += 121;
  byte_407074 -= 99;
  byte_407054 ^= 0x68u;
  byte_40706D -= 75;
  byte_407041 -= 117;
  byte_407043 += 92;
  byte_407041 += 88;
  byte_40704D -= 4;
  byte_407052 ^= 0x43u;
  byte_40704B += 8;
  byte_40706A -= 82;
  byte_407055 += 56;
  byte_407049 += 43;
  byte_407075 ^= 0xD1u;
  byte_40705D ^= 0x1Bu;
  byte_407052 -= 74;
  byte_40707B -= 104;
  byte_407073 -= 6;
  byte_407053 -= 120;
  byte_407043 -= 6;
  byte_407069 -= 2;
  byte_40705E ^= 0xFEu;
  byte_40707E ^= 0x45u;
  byte_407052 += 5;
  byte_407068 ^= 0x36u;
  byte_407051 -= 42;
  byte_407050 ^= 0xD6u;
  if ( !memcmp(&cipher, &flag, 0x28u) )
    puts("Right flag");
  else
    puts("Wrong flag");
  return 0;
}

和数据

太牛逼了，不废话了，请看图片

刚开我还以为是GPT5.0编的flag，没想到提交正确，给我震惊毁了

openai升级之后改善了编flag的特性还是太权威了！！！

随后我就直接让它给我输出了解密脚本

# compact_recover.py
import re

ops_text = '''
  97704D -= 120;
  977070 ^= 0x4Fu;
  977055 -= 30;
  977064 -= 93;
  977048 += 95;
  97704A += 103;
  97705C ^= 0x82u;
  977069 += 52;
  97705E ^= 3u;
  977041 += 71;
  977076 ^= 0xE0u;
  97706D -= 44;
  977044 -= 127;
  977075 -= 71;
  977060 ^= 0xAAu;
  97704E -= 119;
  977062 ^= 0xAu;
  97707D -= 48;
  977075 += 55;
  97705B += 111;
  97706E ^= 0x32u;
  97706C -= 92;
  97705F ^= 0x29u;
  977041 += 79;
  97704A += 58;
  977062 -= 17;
  97705A += 123;
  977075 -= 100;
  97705C -= 64;
  977056 -= 89;
  977070 ^= 0x73u;
  977062 ^= 0x61u;
  97706E += 118;
  977062 += 41;
  977070 += 78;
  977055 -= 11;
  97704F ^= 0x5Eu;
  977070 ^= 0xB2u;
  977066 -= 66;
  977046 ^= 0xECu;
  977062 ^= 0xD1u;
  977046 -= 99;
  977069 -= 49;
  977046 += 32;
  977066 += 61;
  977042 ^= 0x42u;
  977055 += 109;
  977070 += 14;
  97707B -= 52;
  97706E -= 94;
  977074 += 57;
  97705D -= 30;
  97705E -= 107;
  977048 += 55;
  97704C -= 27;
  97706F -= 88;
  97707A -= 105;
  977040 += 25;
  97704C += 73;
  97706F -= 80;
  977070 += 125;
  97706E -= 44;
  97707A += 11;
  977068 ^= 0x57u;
  977062 += 117;
  977056 += 92;
  97705B ^= 0x7Au;
  977043 += 33;
  977045 ^= 0xC3u;
  97705E += 19;
  977064 -= 46;
  977065 -= 45;
  977067 ^= 0xB0u;
  97704F -= 69;
  977061 ^= 0xDCu;
  977046 += 69;
  97707E += 116;
  97704B ^= 0x22u;
  977063 ^= 0x7Eu;
  977054 += 18;
  977072 -= 11;
  97704E ^= 5u;
  97706E += 58;
  977048 += 44;
  97706D ^= 0xE4u;
  977068 -= 30;
  977063 += 96;
  977047 -= 49;
  977062 += 83;
  97707A += 53;
  97706A ^= 0x21u;
  97707C += 49;
  97705B += 11;
  977070 -= 105;
  977063 -= 47;
  977073 -= 67;
  977047 += 94;
  97707E += 78;
  97704F -= 96;
  97707A ^= 0xD3u;
  977043 += 115;
  97705E -= 127;
  97707A -= 86;
  977074 += 32;
  977067 ^= 0x5Cu;
  977049 -= 64;
  97706B ^= 0x8Eu;
  97707E += 121;
  977054 -= 98;
  977074 ^= 0x22u;
  97704F -= 12;
  977045 ^= 0x2Du;
  97707C -= 44;
  97704D -= 74;
  977061 ^= 0x82u;
  977068 ^= 0xEDu;
  977071 ^= 0xBEu;
  977077 += 4;
  97705E -= 120;
  97704B += 67;
  977072 -= 52;
  977042 ^= 0x87u;
  977067 -= 38;
  97707B ^= 0xFAu;
  977072 += 90;
  97706E -= 9;
  977077 ^= 0x2Fu;
  977049 += 83;
  97706B ^= 0xD6u;
  977062 -= 6;
  977048 -= 119;
  977061 -= 118;
  977062 -= 75;
  977068 -= 52;
  977040 -= 108;
  97706A += 28;
  97707C ^= 0x4Cu;
  97706C ^= 0x4Au;
  977061 ^= 0xFDu;
  977063 += 125;
  977041 ^= 0x6Cu;
  977075 += 25;
  977071 -= 7;
  97707D -= 119;
  97706F -= 16;
  977064 += 53;
  977066 ^= 0x56u;
  977042 ^= 0xF2u;
  97706B += 115;
  977055 -= 37;
  977072 -= 51;
  977041 -= 107;
  97704F -= 116;
  97705C += 46;
  977065 -= 67;
  97704C += 113;
  977061 += 114;
  97704E += 69;
  977060 += 99;
  977064 ^= 0x88u;
  977079 -= 37;
  97705E ^= 0x76u;
  977070 += 95;
  97707A += 51;
  977074 ^= 0xD3u;
  97704F -= 86;
  977040 -= 6;
  97707C -= 8;
  977071 ^= 0x30u;
  97705B += 29;
  977070 += 65;
  97705D ^= 0xEEu;
  977047 -= 31;
  977061 -= 16;
  977071 += 9;
  977064 -= 46;
  977049 ^= 0xDEu;
  977054 ^= 0x6Du;
  977065 -= 91;
  977077 += 119;
  97707D -= 8;
  --977061;
  977075 += 124;
  977068 += 3;
  977059 -= 22;
  977060 ^= 0xD3u;
  977072 ^= 0xA4u;
  977040 ^= 0xA8u;
  97707F += 50;
  97707E ^= 0x4Du;
  977070 += 60;
  97704B += 49;
  97707B += 3;
  97706A -= 20;
  977060 -= 38;
  977063 -= 2;
  97707B -= 108;
  97707E -= 71;
  97706E += 111;
  977040 ^= 0xD9u;
  97704E += 76;
  97706F ^= 0xF6u;
  97705B += 26;
  977040 -= 27;
  977060 -= 80;
  977078 -= 27;
  97705B += 7;
  ++977073;
  977075 ^= 0xDDu;
  977043 -= 127;
  977072 += 116;
  977069 -= 70;
  977065 ^= 0x9Bu;
  977059 -= 34;
  97704B -= 127;
  97707F ^= 0xBu;
  977058 -= 65;
  97704B ^= 0x83u;
  977059 ^= 0xB6u;
  977067 -= 25;
  977042 -= 94;
  977061 ^= 0x7Eu;
  977072 -= 69;
  977077 -= 72;
  977060 ^= 0xF7u;
  977043 -= 11;
  977069 ^= 0x64u;
  977075 ^= 0xEu;
  977073 -= 111;
  977065 ^= 0x7Au;
  97706B -= 7;
  977060 += 103;
  97707D ^= 0xF4u;
  977077 += 16;
  97705C ^= 0x89u;
  977041 -= 20;
  97707A ^= 0x3Fu;
  97704D -= 31;
  977073 += 98;
  977073 -= 5;
  977061 -= 30;
  97704C += 73;
  977054 -= 6;
  977071 ^= 0x56u;
  97705B ^= 3u;
  977055 -= 119;
  97706D += 37;
  97705E += 4;
  977044 -= 48;
  977076 ^= 0xF4u;
  977053 ^= 0x10u;
  977059 ^= 0x47u;
  977060 ^= 0xE2u;
  97704E -= 16;
  97705E ^= 0xD2u;
  977042 += 70;
  977060 -= 91;
  977041 ^= 0x12u;
  977042 -= 81;
  977047 += 92;
  977055 -= 77;
  97705D ^= 0x7Du;
  977070 ^= 0x4Au;
  977074 -= 25;
  977074 -= 127;
  97704B += 121;
  97706C += 64;
  97707A ^= 0x58u;
  97704B -= 123;
  977078 += 42;
  977071 -= 89;
  97707E ^= 0x99u;
  977043 -= 6;
  977045 ^= 0x7Du;
  977042 -= 14;
  977064 += 96;
  977058 += 26;
  97706E += 54;
  977052 -= 86;
  97705D ^= 0x4Eu;
  977055 -= 15;
  977078 -= 32;
  977057 += 75;
  97706E += 66;
  977053 += 101;
  97705E -= 59;
  97706B ^= 0xFAu;
  977042 += 93;
  977073 -= 123;
  97707C += 31;
  977064 ^= 0xA2u;
  977073 -= 32;
  97705A ^= 0x11u;
  97707D += 121;
  977074 -= 99;
  977054 ^= 0x68u;
  97706D -= 75;
  977041 -= 117;
  977043 += 92;
  977041 += 88;
  97704D -= 4;
  977052 ^= 0x43u;
  97704B += 8;
  97706A -= 82;
  977055 += 56;
  977049 += 43;
  977075 ^= 0xD1u;
  97705D ^= 0x1Bu;
  977052 -= 74;
  97707B -= 104;
  977073 -= 6;
  977053 -= 120;
  977043 -= 6;
  977069 -= 2;
  97705E ^= 0xFEu;
  97707E ^= 0x45u;
  977052 += 5;
  977068 ^= 0x36u;
  977051 -= 42;
  977050 ^= 0xD6u;
'''

cipher_hex = "7F114A9DA5D5999FACD3D4BC1A5346F4E737036017BA67AC09DAA0FB2D8ECB1102C417F71B8F6752"
cipher = bytes.fromhex(cipher_hex)

# parse operations
op_re = re.compile(r'([0-9A-Fa-f]+)\s*([\+\-]\=|\^\=)\s*([^;]+);|(\+\+|--)([0-9A-Fa-f]+);')
ops = []
for line in ops_text.strip().splitlines():
    line = line.strip()
    if not line: continue
    m = op_re.search(line)
    if not m:
        m2 = re.match(r'(--|\+\+)\s*([0-9A-Fa-f]+);', line)
        if m2:
            sign, addr = m2.groups()
            op = 'add' if sign == '++' else 'sub'
            ops.append((int(addr,16), op, 1))
            continue
        m3 = re.match(r'(--|\+\+)([0-9A-Fa-f]+);', line)
        if m3:
            sign, addr = m3.groups()
            op = 'add' if sign == '++' else 'sub'
            ops.append((int(addr,16), op, 1))
            continue
        raise ValueError("Can't parse: "+line)
    addr_hex = m.group(1) if m.group(1) else m.group(5)
    op_sym = m.group(2)
    val_str = m.group(3)
    addr = int(addr_hex,16)
    if op_sym == '+=':
        val = int(val_str.strip().rstrip('u').rstrip('U'), 0)
        ops.append((addr, 'add', val))
    elif op_sym == '-=':
        val = int(val_str.strip().rstrip('u').rstrip('U'), 0)
        ops.append((addr, 'sub', val))
    elif op_sym == '^=':
        val = int(val_str.strip().rstrip('u').rstrip('U'), 0)
        ops.append((addr, 'xor', val))

# map addresses 0x9770xx -> 0x4070xx (subtract 0x570000)
mapped_ops = [(addr - 0x570000, op, val) for (addr,op,val) in ops]

base = 0x407040
fl = 0x28
ops_flag = [(addr,op,val) for (addr,op,val) in mapped_ops if base <= addr < base+fl]

# recover original input (apply inverse of ops_flag in reverse order)
def recover(cipher):
    buf = bytearray(cipher)
    for addr, op, val in reversed(ops_flag):
        idx = addr - base
        if op == 'add':
            buf[idx] = (buf[idx] - val) & 0xFF
        elif op == 'sub':
            buf[idx] = (buf[idx] + val) & 0xFF
        elif op == 'xor':
            buf[idx] = buf[idx] ^ (val & 0xFF)
    return bytes(buf)

print("Recovered:", recover(cipher).decode('ascii'))
# DASCTF{5ac3b28711aac86da0c6f4f489c05e96}