[原创]KCTF 2023 第六题至暗时刻-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]KCTF 2023 第六题至暗时刻

2023-9-17 23:28 1281

[原创]KCTF 2023 第六题至暗时刻

ThTsOd

2023-9-17 23:28

1281

找到程序算法入口

调试运行到这里崩溃了

观察调用栈，发现运行在内存中的一段代码，提取代码

解析输入的代码sub_447

联想调用处的代码，猜测可能有个数独

solve脚本：

import numpy as np
 
 
def decode_sudoku(encoded_sudoku_data):
    """
    解码数独布局，将其从16进制字符串转换为9x9矩阵。
    """
    sudoku_board = np.zeros((9, 9), dtype=int)
 
    for i in range(0, len(encoded_sudoku_data), 3):
        hex_triplet = encoded_sudoku_data[i:i+3]
        decimal_value = int(hex_triplet, 16)
        ones_digit, tens_digit, hundreds_digit = decimal_value % 10, (
            decimal_value // 10) % 10, (decimal_value // 100) % 10
 
        sudoku_board[tens_digit, ones_digit] = hundreds_digit
 
    return sudoku_board
 
 
def is_valid_move(board, row, col, num):
    """
    检查在数独板的特定位置放置一个数字是否有效。
    """
    return not (num in board[row] or num in board[:, col] or num in board[row//3*3:row//3*3 + 3, col//3*3:col//3*3 + 3])
 
 
def solve_sudoku(board):
    """
    使用回溯算法解决数独问题。
    """
    for row in range(9):
        for col in range(9):
            if board[row, col] == 0:
                for num in range(1, 10):
                    if is_valid_move(board, row, col, num):
                        board[row, col] = num
                        if solve_sudoku(board):
                            return True
                        board[row, col] = 0
                return False
    return True
 
 
def convert_solution_to_hex_string(original_board, solved_board):
    """
    将解决方案转换为指定的十六进制字符串格式。
    """
    hex_string = ''
    for row in range(9):
        for col in range(9):
            if original_board[row, col] == 0:
                decimal_number = solved_board[row, col] * 100 + row * 10 + col
                hex_number = hex(decimal_number)[2:].upper().zfill(3)
                hex_string += hex_number
    return hex_string
 
 
def rearrange_hex_string(hex_string_solution, correct_order_str):
    """
    使用指定的正确顺序重新排列十六进制字符串解决方案。
    """
    correct_order_list = [int(correct_order_str[i:i+2])
                          for i in range(0, len(correct_order_str), 2)]
    new_array = [None] * 256
 
    for i in range(0, len(hex_string_solution), 3):
        hex_chunk = hex_string_solution[i:i+3]
        decimal_value = int(hex_chunk, 16)
        index_value = (decimal_value % 10) + (decimal_value // 10 %
                                              10) + 8 * (decimal_value // 10 % 10)
        new_array[index_value] = hex_chunk
 
    final_hex_string_solution = ''.join(
        new_array[i] for i in correct_order_list if new_array[i] is not None)
    return final_hex_string_solution
 
 
# 主程序
encoded_sudoku_data = "3201382652D139C0E22132DF1BC2212EA0991650A229B36436823D0B13D51E6"
                        
sudoku_board = decode_sudoku(encoded_sudoku_data)
sudoku_board_copy = sudoku_board.copy()
 
is_solvable = solve_sudoku(sudoku_board_copy)
hex_string_solution = convert_solution_to_hex_string(
    sudoku_board, sudoku_board_copy)
 
correct_order_str = "677116575313142309154604431859253431473963507533496829080645035455771774602058076430276921790210013736267644383505517280"
final_hex_string_solution = rearrange_hex_string(
    hex_string_solution, correct_order_str)
 
print(sudoku_board, is_solvable, hex_string_solution, final_hex_string_solution)

11230A2CD3C31CA32E0D707D38E0743531F80F726C1D133B3A914E2F034B1D63BB17F34428E2A31B038C25E0FA2BF2301053752062AA16E20A2FC1971730E90823D01A724B0CA19B0652811541480B80943AE27E13122C30C120

[培训]科锐逆向工程师培训 48期预科班将于 2023年10月13日正式开班

收藏・0

点赞・0

打赏