[原创]2021KCTF秋季赛偶遇棋痴-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]2021KCTF秋季赛偶遇棋痴

2021-11-26 01:23 14380

[原创]2021KCTF秋季赛偶遇棋痴

ThTsOd

2021-11-26 01:23

14380

flag长度14，拆分出半个字节
图片描述
将flag输入，z为标记

找到字符串，随手在github上搜了一下

发现是lambda演算

查看https://zh.wikipedia.org/wiki/%CE%9B%E6%BC%94%E7%AE%97，大致了解
解析serialization::archive，这里最后一项数输入1以结束程序

#include<stdio.h>
int main(){
    int id;
    int type;
    while(1){
        scanf("%d",&id);
        scanf("%d",&type);
        switch(type){
            case 0:{
                int ch;
                int unk;
                scanf("%d%d",&ch,&unk);
                printf("\\%c",ch);
                break;
            }
            case 1:{
                printf("(");
                break;
            }
            case 2:{
                int ch;
                scanf("%d",&ch);
                printf("%c)",ch);
            }
        }
        int zero;
        scanf("%d",&zero);
        if(zero != 0){
            break;
        }
    }
}

观察到前16组数据有规律，(\n\f\x((n)f)(f)x) 重复加上\f\xx)结尾，猜测是输入数字
最后一组是程序输入
将 (\n\f\x((n)f)(f)x) 替换为 i
将 i\f\xx) 替换为 i(space)
同时发现中间有其他重复的结构，也可以替换，其中z是标记，保留
统计连续i的数量

f=open("s.txt")
text=f.read()
f.close()
 
count = 0
for i in range(len(text)):
    if(text[i] == 'i'):
        count +=1
    else:
        if(count>0):
            print(count,end=' ')
        if(text[i]=='z'):
            print()
        count = 0
print(count)

观察结果，发现有点规律
图片描述
处理数据

f=open("s.txt")
text=f.read()
f.close()
 
def calc(d):
    if(len(d)!=4):
        return
    print("%X"%((d[2]-d[1])//d[0]),end='')
    return
 
count = 0
num=[]
for i in range(len(text)):
    if(text[i] == 'i'):
        count +=1
    else:
        if(count>0):
            num.append(count)
            #print(count,end=' ')
        if(text[i]=='z'):
            #print(num)
            calc(num)
            num=[]
            #print()
        count = 0