首页
社区
课程
招聘
[原创] 07wp
发表于: 2024-8-28 22:08 427

[原创] 07wp

2024-8-28 22:08
427
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# swap_code 就是401020开头的697个字节,如果加了软件断点就会不同
# 要求挖空部分 预处理 + swap bit 之后和KCTF...相等
# 剩下部分预处理之后和原来的main_code相等
# 最后一位是异或和,一定等于ret(c3)
const_xor_key = [121, 84, 0, 56, 68, 247, 12, 73, 235, 148, 10, 165, 203, 16, 33, 110, 47, 25, 18, 24, 65, 179, 174, 19,
                 130, 0, 239, 9, 121, 251, 5, 107, 45, 153, 74, 43, 50, 52, 205, 77, 86, 237, 140, 233, 234, 50, 28, 82,
                 62, 15, 216, 206, 62, 151, 183, 163, 99, 115, 216, 0, 211, 207, 197, 135, 65, 182, 119]
swap_code = bytes.fromhex('83ec4ca10030400033c48944244853555657bb18344000')
main_code = bytes.fromhex('6810214000FF15DC3F40006800384000FF15D83F40006820214000FF15DC3F400068'
                          '18344000FF15D83F400068D03F4000FF15D43F400083C414FF15A020400033C0C3')
 
 
def xor_sum(_s):
    res = 0
    for c in _s:
        res ^= c
    return res
 
 
def swap_bits(_b, _x, rev=False):
    _x &= 7
    if rev:
        hi = _b >> _x
        lo = _b << (8 - _x)
    else:
        lo = _b >> (8 - _x)
        hi = _b << _x
    hi &= 0xff
    lo &= 0xff
    return hi | lo
 
 
user = b'KCTF'  # KCTF
u_index = (xor_sum(user) & 0xf) * 2
 
 
goal = list(main_code[:u_index] + b'KCTF-2024-CRACK-SUCCESS' + main_code[u_index + 23:])
for i in range(u_index, u_index + 23):
    goal[i] = swap_bits(goal[i], swap_code[i - u_index], True)
 
for i in range(67):
    goal[i] ^= 0xc3 ^ const_xor_key[i]
 
goal[66] = xor_sum(goal[:66]) ^ 203 ^ 0xc3
print("Serial:", bytes(goal).hex())
 
 
# key = list(bytes.fromhex(bytes(goal).hex()))
#
# k_xor_sum = xor_sum(key) ^ 203
#
# for i in range(67):
#     key[i] ^= k_xor_sum ^ const_xor_key[i]
#
#
# for i in range(u_index, u_index + 23):
#     key[i] = swap_bits(key[i], swap_code[i - u_index])
#
# print(bytes(key))

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回
//