-
-
[原创][第九题] 歧路亡羊 wp
-
发表于: 2020-5-6 14:40 6305
-
歧路亡羊 98k战队wp
物华天宝,龙光射荆州之地。人杰地灵,洞庭下道人之榻。偶有闻道,半盲善防御之术。吾闻道甚浅,望能访半盲而得神术。奈何吾无名无术,不止如何面见。闻看雪竞软件攻防之道,高朋满座,喜迎士子,又闻半盲道人携多年心血,潜心练术,可使众士无可攻破防御之术公之于众。吾甚喜,奈何手无屠龙之剑,无精晓之术。不知何以面见诸位道友。吾甚是沮丧,广罗在野英雄,手握名册,寻志同道合之友。呕心搜寻获得神器pizza一。欲善其事必先利器,吾得pizza之助,必可在半盲道人府大显身手。吾甚喜,吾之所历,此册详录。
测半盲道人仙术之志
pizza甚善攻破之术,余侍立左右,看pizza用x64dbg记录其函数所算,先使数据尽为0x00后使数据尽为0xff,pizza尽得半盲运算,后pizza查半盲术之型,半盲术虽困人心智,其中却仍有特征,pizza将其详录其侧,在其断后仔细观察,观察log后晓术中真假类别。而后pizza追溯栈区,寻求马迹。一全局变量现于其中,而后尽得半盲小术。pizza其一人即可攻破,吾未尝助之,吾甚愧。pizza得一奇特之术,问余,此术可解?吾反复查之,见pizza录之如此。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 | zero = [ 0x4D09AF3ABCA28A8D , 0x9FE10506A2C9A9A , 0xD2CAE855C068E1E1 , 0x8E86479F6E6A694 , 0x6A4BD5F20EFD8499 , 0xA0449A4DF2C0F524 , 0x61B1EE4C89A1C74A , 0x3E2A0CF5AFC54669 , 0xBCC700EAD1995E75 , 0x281876D27FDD03C6 , 0x601A1255813ADF30 , 0xF507E8AC585A4E42 , 0xF81BB1D3980A2FA4 , 0x18E55A56CA0AD2C7 , 0xAAD9CFC2182BEBA0 , 0xEEE198AABDBE8A18 , 0x63FF598FDA7E7D6F , 0xE15CE23DF925822A , 0xBC36E215B5689224 , 0xB7800C9EBAE07702 , 0x80931FC6D227F8DC , 0x3F8DF570B658B85D , 0x7BA207CB52F24E88 , 0x6A633F82966E82AB , 0x75E0B5660623690F , 0xCC9148B45107B5C9 , 0x586B216EF43AD48E , 0xA96B5A8AFF1878F3 , 0x87762DB8DCE9B73C , 0x6FA7015E6BB367B6 , 0xBFD039B8B4F29C94 , 0x7EE7E8FD8040BD86 , 0x5A0CE9D5D3AF4435 , 0xBB3113E0107ADEDC , 0x3E7FFB6F3748AE83 , 0xA1F7BF0929977159 , 0xC269314AC1FEA8E7 , 0x5C064C38F21BC241 , 0x120D6129A85D8E4B , 0xFCA8B3EE674F2565 , 0x97C2F6A547610C57 , 0x1619A76F4EBE3D6 , 0x508180C897BA2FC6 , 0x9E6749482573B96D , 0x3FF6CC85C6A56601 , 0x7F9A7AE568EBFFB8 , 0xBFEFF562CE0D5D58 , 0x294B87E2897091D2 , 0x1C117BA895F600EE , 0xBFBE146E10193B6E , 0x8AB612550AA8E1AB , 0xDCC914BED9036F0D , 0xBA1343A95D820BA9 , 0x2F55690A4CACCA44 , 0x5B57CE14DACA37FC , 0x29D2BFF018B00740 , 0xA8A8FF75703DD709 , 0xF587AAEF1F9516F , 0xF50617B128A0071E , 0xFBD4FD51CEA9D12B , 0x7E1F54E20AFC1CD9 , 0x90148276BF1E5D49 , 0x527EA699DE716460 , 0x34F21BFC6D7943B3 , ] one = [ 0x3796F61D3F496D9A , 0xFA62CE8FF9D33901 , 0xC4F9550241FDFFA3 , 0x8ACDD6E445EFBD97 , 0x30A83415D047FB98 , 0x73957581242C53D , 0xAF82609DE0AEC05C , 0xAD063DBEB266AF43 , 0x435068F420FA4FF0 , 0xCE6C8C612BD1E439 , 0x1D3D3C45D52394CF , 0x1FA5D059C60AA3E3 , 0x3C4D092D773B3A2E , 0x97BF010CCFF099F9 , 0x5C35272C4834AD4D , 0x8A18F8556F480632 , 0x1A9B941774F6CDF4 , 0x3C73B45AE0CDBA4 , 0xB93D7864763E24E6 , 0x6A0ECDEBB77CD18F , 0x69295501BE7EC046 , 0x7A530DC89A3FCD12 , 0x253E5D6E09849A46 , 0xE6DE159244D58711 , 0xD1245D0E166D6484 , 0x88520272CC6E4A8D , 0x5F78D84D7401F1B9 , 0x821447502D8F83A5 , 0x5C9D9EE1F131C160 , 0xECE764A468850EF , 0xC4769184600CF71 , 0xCC566B2C807D1B84 , 0x4DC8AFA3B4485576 , 0x9D73EA268C866AC8 , 0x8133D136D4F81831 , 0x1F3C37467929918B , 0x9C2BCA2EA39C691F , 0xD69F4D2FC2D45B9E , 0xD5B60F964288FD32 , 0xE9E70AFED5EE6CBF , 0xA45472C49BED802F , 0x4549C58141A7CCC9 , 0x4659FD56784637A8 , 0xAB69D618D946FFA , 0x49F2759549998302 , 0xBFC400DFEF2928C8 , 0xFA1507576A21B1AE , 0x381BA1BD97727CDD , 0x2AF20C4B4D98CF16 , 0xA5141F6DDE5BE4F0 , 0x2BD13515C74A6B36 , 0x584603B14F9C07BE , 0x404CEC02BC8B778A , 0xB56620E4E50ED47C , 0x79467C2907B00174 , 0xF6BA88D86FE38A7F , 0x7C592711E4673A1E , 0x32252E609065990A , 0xAD8E364386CBA8D4 , 0xCE5280D041F19AAA , 0xFB738CEFCB4EBE76 , 0xA44396F44F4B69B8 , 0x717B237316B0728 , 0xA2D352BA607243F5 , ] pair = [ ( 0x4 , 0x20 ), ( 0x5 , 0x40 ), ( 0x2 , 0x1 ), ( 0x5 , 0x20 ), ( 0x3 , 0x8 ), ( 0x1 , 0x4 ), ( 0x4 , 0x1 ), ( 0x7 , 0x8 ), ( 0x0 , 0x20 ), ( 0x0 , 0x4 ), ( 0x5 , 0x4 ), ( 0x1 , 0x80 ), ( 0x1 , 0x2 ), ( 0x7 , 0x10 ), ( 0x6 , 0x1 ), ( 0x0 , 0x10 ), ( 0x5 , 0x1 ), ( 0x4 , 0x8 ), ( 0x7 , 0x2 ), ( 0x2 , 0x40 ), ( 0x3 , 0x10 ), ( 0x3 , 0x40 ), ( 0x6 , 0x20 ), ( 0x6 , 0x4 ), ( 0x6 , 0x80 ), ( 0x7 , 0x4 ), ( 0x1 , 0x1 ), ( 0x7 , 0x80 ), ( 0x1 , 0x20 ), ( 0x1 , 0x10 ), ( 0x0 , 0x8 ), ( 0x5 , 0x80 ), ( 0x2 , 0x2 ), ( 0x1 , 0x8 ), ( 0x6 , 0x10 ), ( 0x3 , 0x80 ), ( 0x1 , 0x40 ), ( 0x2 , 0x10 ), ( 0x7 , 0x20 ), ( 0x3 , 0x20 ), ( 0x4 , 0x80 ), ( 0x2 , 0x8 ), ( 0x3 , 0x4 ), ( 0x6 , 0x2 ), ( 0x0 , 0x1 ), ( 0x0 , 0x80 ), ( 0x6 , 0x40 ), ( 0x2 , 0x4 ), ( 0x0 , 0x2 ), ( 0x7 , 0x40 ), ( 0x0 , 0x40 ), ( 0x4 , 0x10 ), ( 0x4 , 0x40 ), ( 0x5 , 0x10 ), ( 0x2 , 0x80 ), ( 0x5 , 0x8 ), ( 0x2 , 0x20 ), ( 0x3 , 0x2 ), ( 0x5 , 0x2 ), ( 0x4 , 0x2 ), ( 0x3 , 0x1 ), ( 0x4 , 0x4 ), ( 0x7 , 0x1 ), ( 0x6 , 0x8 ), ] out = 0 val = [ 0xD0 , 0x8E , 0x85 , 0x01 , 0xBF , 0x45 , 0x04 , 0x6A ] # input val = [ 0x30 for i in range ( 8 )] for i in range ( 64 ): x, y = pair[i] x = 7 - x if val[x] & y = = y: out ^ = one[i] else : out ^ = zero[i] print ( hex (out)) print ( len (one)) #zero*(1-x)+one*x |
吾观其之术,虽无可穷之,其用术之深,不闻者不知,半盲深晓防御之术,其亦深通数学计数之道。吾使用sage,吾知此为整数环之运算,虽不可明解,却可在整数环2上用矩阵之术,得高斯助之。必可求逆解之。
1 | a = (M_zero * one_vector) + ((M_zero + M_one) * x_input) |
输入单表换之,可为式之入,而后求解。吾略知数学计数之道,可将其推换至得其输出而至其如。
1 | temp_input = (~(M_zero + M_one)) * (the_hex - (M_zero * one_vector)) |
得其逆,pizza则一气呵成,求得其逆,吾与pizza解之已到三天寅时。此吉时助我,寅虎捕亡羊,可为天时地利人和也。
后记
大家看ccfer dalao的wp调试就差多不了,我们战队能做此题,功劳全是pizza的,我是负责递茶的。
最后于 2020-5-6 14:42
被全盲法师编辑
,原因:
赞赏记录
参与人
雪币
留言
时间
juanqinqin
为你点赞~
2020-5-7 15:59
全盲法师
为你点赞~
2020-5-6 18:46
零加一
为你点赞~
2020-5-6 16:00
赞赏
他的文章
赞赏
雪币:
留言: