-
-
ctf2018-第13题
-
2018-7-11 19:41 2269
-
sn长度为10
.text:00000000004039C7 cmp rdx, 0Ah .text:00000000004039CB jz short loc_403A0B
hex2bin, 必须是大写的16进制
.text:0000000000403A0B lea rdx, [rsp+1B8h+a2] ; a2 .text:0000000000403A10 mov r8d, 0Ah ; a3 .text:0000000000403A16 mov rcx, rsi ; a1 .text:0000000000403A19 call hex2bin .text:0000000000403A1E cmp eax, 5
x = ((snHex[1] << 8) | snHex[0]) << 48;
y = ((snHex[4] << 16) | (snHex[3] << 8) | snHex[2]) << 40;
in: (x,y)
out: r
.text:0000000000403A97 call x_4015E0
sprintf(buf, "%lf", r);
buf[1]=='.';
sqrt(int(buf[0])^2+int(buf[2])^2+int(buf[3])^2) > 15.5
sn[5] == '0'
=>
返回结果格式化后前4位必须是9.99
.text:0000000000403AE1 call sprintf .text:0000000000403AE6 cmp [rsp+1B8h+var_128+1], 2Eh .text:0000000000403AEE jz short loc_403B14 .. .text:0000000000403B61 call x_sqrt .text:0000000000403B66 ucomisd xmm0, cs:x_dbl_15_5 .text:0000000000403B6E jbe short loc_403BC3 .text:0000000000403B70 test [rsp+1B8h+a2+2], 0Fh .text:0000000000403B75 jnz short loc_403BC3
fabs(x+y-r) < 0.003
.text:0000000000403B77 movsd xmm1, cs:qword_409090 .text:0000000000403B7F xor eax, eax .text:0000000000403B81 movsd xmm0, [rsp+1B8h+a1+10h] .text:0000000000403B87 addsd xmm0, [rsp+1B8h+a1+18h] .text:0000000000403B8D subsd xmm0, [rsp+1B8h+v999] .text:0000000000403B93 andpd xmm0, cs:xmmword_409080 .text:0000000000403B9B ucomisd xmm1, xmm0 .text:0000000000403B9F jbe short loc_403BC5
#include <math.h> inline double double_from_qword(DWORD64 v) { double r; *(PDWORD64)&r = v; return r; } struct x_dtype { double x; double y; struct x_dtype() {} struct x_dtype(double x, double y) { this->x = x; this->y = y; } void set_qwords(DWORD64 x, DWORD64 y) { this->x = double_from_qword(x); this->y = double_from_qword(y); } }; double x_sigmoid(double v) { return 1.0 / (1.0 + exp(-v)); } bool x_bf(double& r, DWORD v_x, DWORD v_y, BOOL pre_check=TRUE) { DWORD64 vv1 = ((DWORD64)v_x) << 48; DWORD64 vv2 = ((DWORD64)v_y) << 40; x_dtype p_org; x_dtype p; p_org.set_qwords(vv1, vv2); p.set_qwords(vv1, vv2); if (_isnanf(p_org.x) || _isnanf(p_org.y)) { return false; } if (pre_check) { if (p_org.x < 1.0 || p_org.x > 10.0 || p_org.y < 1.0 || p_org.y > 10.0) { return false; } if (fabs(p_org.x + p_org.y - 9.99) > 0.01) { return false; } } x_dtype dbl_2_18[18] = { x_dtype(-1.024504249316792, 0.08480241402867354), x_dtype(-0.5309590977803851, 0.7038432325127907), x_dtype(-0.1205861957709724, -0.3131851271747841), x_dtype(-0.7652890161780372, 0.3394691173401321), x_dtype(0.4086898600107498, 0.3464293119927601), x_dtype(-0.6720841419207514, 0.7031382309683727), x_dtype(0.4793812427473341, 0.1450424242244652), x_dtype(-0.7581628205506215, -1.191167191666233), x_dtype(-0.7163237822899622, -0.1856960010068038), x_dtype(-0.3881042433775828, -0.441493873937651), x_dtype(0.7491528727021218, -0.2937231799332374), x_dtype(-0.2807669735695579, -0.6601771874660477), x_dtype(-1.139471804690722, -0.3733014048552536), x_dtype(-0.3716464154460851, -0.3209643451486224), x_dtype(0.2279505735413573, 0.2862581902519522), x_dtype(-0.6483301313648024, 0.3425095972835677), x_dtype(0.1018655229891429, -0.06694820784429865), x_dtype(-0.799296907551486, 0.2770735927171807), }; double dbl_18[18] = { -0.1194112006523917, 0.3642266945402522, -0.3350415063325052, -0.6162511508923307, 1.038326594084909, 0.1932021480282533, 1.001826904076745, 0.4434245541912034, -0.5712156493805307, -1.368248566749872, 0.1587663304193661, -1.153231630918381, 0.2535851365039063, -0.9888794593893403, 0.6114148602075213, 0.1491657913886502, 0.5188520292352635, 0.2985569369090871 }; x_dtype dbl_2_820_min(0.01, 0.03); x_dtype dbl_2_820_max(9.99, 9.99); int i; p.x = (p.x - dbl_2_820_min.x + 1.0) / (dbl_2_820_max.x - dbl_2_820_min.x + 1.0); p.y = (p.y - dbl_2_820_min.y + 1.0) / (dbl_2_820_max.y - dbl_2_820_min.y + 1.0); double v[18]; for (i = 0; i < 18; i++) { v[i] = x_sigmoid(p.x * dbl_2_18[i].x + p.y * dbl_2_18[i].y); } r = 0.0; for (i = 0; i < 18; i++) { r += v[i] * dbl_18[i]; } double dbl_820_max = 19.32; double dbl_820_min = 0.26; r = r * (dbl_820_max - dbl_820_min + 1.0) + dbl_820_min - 1.0; if (_isnanf(r)) { return false; } if (r < 9.99 || r >= 10.0) { return false; } if (fabs(p_org.x + p_org.y - r) > 0.003) { return false; } return true; } void print_sn(double v, DWORD v1, DWORD v2) { BYTE sn[5] = {0}; sn[0] = v1 & 0xFF; sn[1] = (v1 >> 8) & 0xFF; sn[2] = (v2 & 0x0F) << 4; sn[3] = (v2 >> 4) & 0xFF; sn[4] = (v2 >> 12) & 0xFF; printf("v=%lf, v1=%x, v2=%x\n", v, v1, v2); printf("sn: %02X%02X%02X%02X%02X\n", sn[0], sn[1], sn[2], sn[3], sn[4]); } void test() { BYTE sn[5] = {0}; for (DWORD v1 = 0; v1 < 0x10000; v1++) { for (DWORD v2 = 0; v2 < 0x100000; v2++) { //v1 = 0x3412; //v2 = 0x90785; double v = 0.0; if (x_bf(v, v1, v2 << 4)) { print_sn(v, v1, v2); } } } }
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
最后于 2018-7-11 21:24
被风间仁编辑
,原因:
赞赏
他的文章
KCTF2022春季赛 第三题 石像病毒
8224
KCTF2022春季赛 第二题 末日邀请
15351
KCTF2021秋季赛 第二题 迷失丛林
17877
KCTF2020秋季赛 第十题 终焉之战
8049
KCTF2020秋季赛 第九题 命悬一线
5787
看原图