[原创]kctf2021 第四题英雄救美-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]kctf2021 第四题英雄救美

2021-5-17 22:21 5944

[原创]kctf2021 第四题英雄救美

Emtanling

2021-5-17 22:21

5944

载入IDA，这里对输入进行了三个判断，长度是否大于64，是否是特定数组中的字符，是否符合数组。

# 特定数组
inum = [0x24, 0x42, 0x50, 0x56, 0x3A, 0x75, 0x62, 0x66, 0x59, 0x70, 0x7D, 0x5D, 0x44, 0x74, 0x4E, 0x3E,
        0x61, 0x54, 0x5E, 0x4D, 0x47, 0x6D, 0x4A, 0x51, 0x23, 0x2A, 0x48, 0x72, 0x60, 0x4F, 0x27, 0x77,
        0x6A, 0x69, 0x63, 0x30, 0x21, 0x68, 0x64, 0x79, 0x7B, 0x6F, 0x5A, 0x7A, 0x2D, 0x40, 0x6E, 0x2B,
        0x3F, 0x26, 0x25, 0x73, 0x5F, 0x2F, 0x67, 0x3C, 0x65, 0x5B, 0x57, 0x29, 0x58, 0x55, 0x78, 0x52,
        0x46, 0x53, 0x4C, 0x52, 0x41, 0x3B, 0x2E, 0x6C, 0x3D, 0x43, 0x45, 0x6B, 0x76, 0x4B, 0x2D, 0x28
]

取出在数组中的位置，进行如下操作，存入二维数组，判断是否为符合数独

# 原数独数组
map = [0x00, 0x04, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
       0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x07,
       0x08, 0x03, 0x00, 0x00, 0x00, 0x05, 0x04, 0x00, 0x00,
       0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00,
       0x00, 0x00, 0x04, 0x09, 0x00, 0x00, 0x00, 0x07, 0x01,
       0x03, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x09, 0x04,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x06, 0x00
]

使用脚本求出数独

import datetime
class solution(object):
    def __init__(self,board):
        self.b = board
        self.t = 0
 
    def check(self,x,y,value):
        for row_item in self.b[x]:
            if row_item == value:
                return False
        for row_all in self.b:
            if row_all[y] == value:
                return False
        row,col=x/3*3,y/3*3
        row3col3=self.b[row][col:col+3]+self.b[row+1][col:col+3]+self.b[row+2][col:col+3]
        for row3col3_item in row3col3:
            if row3col3_item == value:
                return False
        return True
 
    def get_next(self,x,y):
        for next_soulu in range(y+1,9):
            if self.b[x][next_soulu] == 0:
                return x,next_soulu
        for row_n in range(x+1,9):
            for col_n in range(0,9):
                if self.b[row_n][col_n] == 0:
                    return row_n,col_n
        return -1,-1 
 
    def try_it(self,x,y):
        if self.b[x][y] == 0:
            for i in range(1,10):
                self.t+=1
                if self.check(x,y,i):
                    self.b[x][y]=i 
                    next_x,next_y=self.get_next(x,y)
                    if next_x == -1: #
                        return True  #
                    else:        
                        end=self.try_it(next_x,next_y)
                        if not end:   #
                            self.b[x][y] = 0    #
                        else:
                            return True
 
    def start(self):
        begin = datetime.datetime.now()
        if self.b[0][0] == 0:
            self.try_it(0,0)
        else:
            x,y=self.get_next(0,0)
            self.try_it(x,y)
        for i in self.b:
            print i
        end = datetime.datetime.now()
        print '\ncost time:', end - begin
        print 'times:',self.t
        return
 
 
s=solution(
       [[0x00, 0x04, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00], 
       [0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x07], 
       [0x08, 0x03, 0x00, 0x00, 0x00, 0x05, 0x04, 0x00, 0x00],
       [0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00],
       [0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00], 
       [0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00], 
       [0x00, 0x00, 0x04, 0x09, 0x00, 0x00, 0x00, 0x07, 0x01], 
       [0x03, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x09, 0x04],
       [0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x06, 0x00]]
       )
s.start()

得到的正确数独为

map = [ [5, 4, 6, 7, 1, 9, 2, 3, 8]
        [9, 2, 1, 8, 3, 4, 6, 5, 7]
        [8, 3, 7, 6, 2, 5, 4, 1, 9]
        [7, 1, 8, 4, 6, 3, 9, 2, 5]
        [4, 5, 3, 2, 9, 1, 7, 8, 6]
        [6, 9, 2, 5, 8, 7, 1, 4, 3]
        [2, 8, 4, 9, 5, 6, 3, 7, 1]
        [3, 6, 5, 1, 7, 2, 8, 9, 4]
        [1, 7, 9, 3, 4, 8, 5, 6, 2] ]

按照空的顺序打印出字符串即可，每行后加上没有输入的位数。

inum = [0x24, 0x42, 0x50, 0x56, 0x3A, 0x75, 0x62, 0x66, 0x59, 0x70, 0x7D, 0x5D, 0x44, 0x74, 0x4E, 0x3E,
        0x61, 0x54, 0x5E, 0x4D, 0x47, 0x6D, 0x4A, 0x51, 0x23, 0x2A, 0x48, 0x72, 0x60, 0x4F, 0x27, 0x77,
        0x6A, 0x69, 0x63, 0x30, 0x21, 0x68, 0x64, 0x79, 0x7B, 0x6F, 0x5A, 0x7A, 0x2D, 0x40, 0x6E, 0x2B,
        0x3F, 0x26, 0x25, 0x73, 0x5F, 0x2F, 0x67, 0x3C, 0x65, 0x5B, 0x57, 0x29, 0x58, 0x55, 0x78, 0x52,
        0x46, 0x53, 0x4C, 0x52, 0x41, 0x3B, 0x2E, 0x6C, 0x3D, 0x43, 0x45, 0x6B, 0x76, 0x4B, 0x2D, 0x28,
        0x71 ]
map = [0x00, 0x04, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
       0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x07,
       0x08, 0x03, 0x00, 0x00, 0x00, 0x05, 0x04, 0x00, 0x00,
       0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00,
       0x00, 0x00, 0x04, 0x09, 0x00, 0x00, 0x00, 0x07, 0x01,
       0x03, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x09, 0x04,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x06, 0x00
       ]
map1 = [
    5, 4, 6, 7, 1, 9, 2, 3, 8,
    9, 2, 1, 8, 3, 4, 6, 5, 7,
    8, 3, 7, 6, 2, 5, 4, 1, 9,
    7, 1, 8, 4, 6, 3, 9, 2, 5,
    4, 5, 3, 2, 9, 1, 7, 8, 6,
    6, 9, 2, 5, 8, 7, 1, 4, 3,
    2, 8, 4, 9, 5, 6, 3, 7, 1,
    3, 6, 5, 1, 7, 2, 8, 9, 4,
    1, 7, 9, 3, 4, 8, 5, 6, 2,
]
count = 0
contl = 0
for i in range(len(map)):
    if map[i] != map1[i]:
        for j in range(contl,len(inum)):
            if inum[j] != 0 and (j%9+1) == map1[i]:
                # print(j)
                print(chr(inum[j]),end="")
                count += 1
                inum[j] = 0
                break
    if i % 9 == 8:
        print(str(hex(9 - count))[2:],end="")
        contl += 9
        count = 0
# :u$YBPf2pa]Dt4#QM^H4ic'j0`w2y{d-Zzo2%/n_s@+2<UW)e4AR;F.4=-qEkvC2