# 手工还原

# -*- coding:utf-8 -*-

# 8
arr0 = [249, 91, 149, 113, 16, 91, 53, 41]
# 20
arr1 = [43, 1, 6, 69, 20, 62, 6, 44, 24, 113, 6, 35, 0, 3, 6, 44, 20, 22, 127, 60]
# 12
arr2 = [90, 100, 87, 109, 86, 108, 86, 105, 90, 104, 88, 102]

# 应该是判断输入字符在32~128
def check0():
pass

def check1(s):
if len(s) < 100 and (((len(s) * len(s)) % 777) ^ 233 == 513):
return True
else:
return False

def check2(s):
if (((((ord(s[0]) * 128 + ord(s[1])) * 128 + ord(s[2])) * 128 + ord(s[3])) * 128 + ord(s[4])) * 128 + ord(
s[5]) == 3533889469877) and (ord(s[-1]) == 125):
return True
else:
return False

def check3(s):
arr = map(ord, s)
a = arr[6:30:3]
for i in range(len(a)):
if (a[i] * 17684 + 372511) % 257 != arr0[i]:
return False
b = arr[-2:33:-1] * 5
print (map(chr,b))
c = map(lambda b: b[0] ^ b[1], zip(b, arr[7:27]))
print (c)
if c != arr1:
return False
p = 0
for i in range(28, 34):
if (((arr[i] + 107) // 16 + 77) != arr2[p]) or ((arr[i] + 117) % 16 + 99) != arr2[p + 1]:
return False
p = p + 2
return True

# 代码分析

## check1

def check1(s):
if len(s) < 100 and (((len(s) * len(s)) % 777) ^ 233 == 513):
return True
else:
return False

from math import *

for i in range(100):
len_s = sqrt(744+777*i)
if (len_s%1) == 0 and len_s < 100:
print(len_s)

# check2

def check2(s):
if (((((ord(s[0]) * 128 + ord(s[1])) * 128 + ord(s[2])) * 128 + ord(s[3])) * 128 + ord(s[4])) * 128 + ord(
s[5]) == 3533889469877) and (ord(s[-1]) == 125):
return True
else:
return False

chr(3533889469877 - ((((ord(s[0]) * 128 + ord(s[1])) * 128 + ord(s[2])) * 128 + ord(s[3])) * 128 + ord(s[4])) * 128)

## check3

### 第一部分

    arr = map(ord, s)
a = arr[6:30:3]
for i in range(len(a)):
if (a[i] * 17684 + 372511) % 257 != arr0[i]:
return False

arr0 = [249, 91, 149, 113, 16, 91, 53, 41]

for i in arr0:
for n in range(10000):
num = ((i+257*n)-372511) / 17684
if num%1 == 0 and num <= 256 and num > 0:
print (chr(int(num)),end="")

### 第二部分

    b = arr[-2:33:-1] * 5
print (map(chr,b))
c = map(lambda b: b[0] ^ b[1], zip(b, arr[7:27]))
print (c)
if c != arr1:
return False

arr1 = [43, 1, 6, 69, 20, 62, 6, 44, 24, 113, 6, 35, 0, 3, 6, 44, 20, 22, 127, 60]

s = chr(ord('i')^arr1[15-7]) + chr(ord('x')^arr1[12-7]) + chr(ord('5')^arr1[9-7]) + chr(ord('V')^arr1[18-7])
print (s)
model = [ord(x) for x in s]
flag = ''.join([chr(model[x%4]^arr1[x]) for x in range(len(arr1))])
print (flag)

### 第三部分

    p = 0
for i in range(28, 34):
if (((arr[i] + 107) // 16 + 77) != arr2[p]) or ((arr[i] + 117) % 16 + 99) != arr2[p + 1]:
return False
p = p + 2

arr2 = [90, 100, 87, 109, 86, 108, 86, 105, 90, 104, 88, 102]

for i in range(0, len(arr2), 2):
for ch in range(256):
if int((ch + 107) // 16) + 77 == arr2[i] and ((ch + 117) % 16) + 99 == arr2[i + 1]:
print (chr(ch),end="")

# 脚本

# -*- coding:utf-8 -*-

flag = [''] * 39

flag[0:5] = 'flag{'
flag[5] = chr(3533889469877 - (
(((ord(flag[0]) * 128 + ord(flag[1])) * 128 + ord(flag[2])) * 128 + ord(flag[3])) * 128 + ord(
flag[4])) * 128)
flag[-1] = '}'

arr0 = [249, 91, 149, 113, 16, 91, 53, 41]

tmp1 = 6
for i in arr0:
for n in range(10000):
num = ((i + 257 * n) - 372511) / 17684
if num % 1 == 0 and num <= 256 and num > 0:
flag[tmp1] = chr(int(num))
tmp1 = tmp1 + 3

arr1 = [43, 1, 6, 69, 20, 62, 6, 44, 24, 113, 6, 35, 0, 3, 6, 44, 20, 22, 127, 60]

flag[37:33:-1] = chr(ord('i') ^ arr1[15 - 7]) + chr(ord('x') ^ arr1[12 - 7]) + chr(ord('5') ^ arr1[9 - 7]) + chr(
ord('V') ^ arr1[18 - 7])

model = [ord(x) for x in flag[37:33:-1]]
flag[7:27] = ''.join([chr(model[x % 4] ^ arr1[x]) for x in range(len(arr1))])

arr2 = [90, 100, 87, 109, 86, 108, 86, 105, 90, 104, 88, 102]

tmp2 = 28
for i in range(0, len(arr2), 2):
for j in range(256):
if int((j + 107) // 16) + 77 == arr2[i] and ((j + 117) % 16) + 99 == arr2[i + 1]:
flag[tmp2] = chr(j)
tmp2 = tmp2 + 1
print (''.join(flag))

# get flag！

flag{5LZG50ex5Yi75VqE5YePLIKl541pNu3Fq}

posted @ 2020-04-23 23:08  Hk_Mayfly  阅读(354)  评论(0编辑  收藏  举报