-
-
[原创] 看雪 2025 KCTF 第九题 智斗邪首
-
发表于: 2025-9-2 00:35 2767
-
start函数调用了_CorExeMain,可以确定是.NET程序,但常规工具都识别不出来,文件头也没有CLR Header的信息。
(看到是方案二+存在.enigma1和.enigma2段+出题人之前发的文章,一度以为程序加了很重的壳)
但不管怎么样,调用_CorExeMain之前肯定会恢复CLR Header。程序有一个TLS callback,动态调试过掉这部分后发现头部0x178位置的CLRDirectory从0变为了有意义的值:00 20 00 00 48 00 00 00,将其patch回二进制文件,然后dnSpy就能正常打开和反编译文件了。
全部逻辑基本只有这些,看看AI的分析:
至第三段,分析结果已经非常清晰了:输入的name被简单转换为一个整数作为分子,输入的serial被解码后转换为一个大数,然后做高精度除法,小数位2025位为一组,相邻四组需要满足d == 5*a + 8*b + 9*c的递推,然后需要前2036个四组满足要求。
serial的编码方式是游程编码:先是一位十进制数字,然后直到字符'l'的剩下的十进制数字表示前面的十进制数字的重复次数,依次类推完成解码。例如公开的serial 51l41l92022l51l01l41l92022l52l92023l71l21l51,展开后即:1个5、1个4、2022个9、...依次拼接起来。
公开的用户名FCCE23A5A04E0EA5按照name的规则转换为整数是55,KCTF转换后是27。考虑到题目的校验只是name的整数除以serial的整数,当分子从55变为27后,只需要让公开serial的分子等比例的除以55乘以27,再编码回去,即可得到KCTF的序列号。
估计一血就是这么出的,而且这么做也不需要太多分析,花费的时间也差不多;但是,自己的serial编码函数写错了没注意到……算出来的结果验证不过的时候开始疯狂的怀疑(然而最简单的assert encode(decode(serial)) == serial验证却一直没做;以后一定不再偷懒)
从题目的小数结构联想到了去年GeekGame的一道题codegolf,其题解提到了一篇文章 827K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2M7r3q4#2L8r3S2S2L8X3E0A6L8W2)9J5k6h3&6W2N6q4)9J5c8X3k6A6j5X3!0F1j5h3y4U0K9g2)9J5c8R3`.`. ,题目里对小数的线性递推检验完全符合生成函数的特征。
让AI给出题目递推式的推导:
an+3=5an+8an+1+9an+2.
A(x)=∑n=0∞anxn.
从递推
an+3=5an+8an+1+9an+2(n≥0)
出发,有
A(x)=a0+a1x+a2x2+n=3∑∞anxn=a0+a1x+a2x2+n=3∑∞(5an−3+8an−2+9an−1)xn=a0+a1x+a2x2+5x3A(x)+8x2(A(x)−a0)+9x(A(x)−a0−a1x).
整理得
A(x)(1−9x−8x2−5x3)=a0(1−9x−8x2)+a1x(1−9x)+a2x2.
生成函数闭式:
A(x)=1−9x−8x2−5x3a0(1−9x−8x2)+a1x(1−9x)+a2x2
为方便记号,常写分子为
N(x)=a0(1−9x−8x2)+a1x(1−9x)+a2x2.
若希望“分子是常数(例如 27)”,则需选取 a0,a1,a2,x 使得 N(x)≡>27(见下文“分子常数化”)。
分母对应特征多项式
1−9r−8r2−5r3=0.
设其三根为 r1,r2,r3(可为实根或复根),则序列通解为
an=α1r1n+α2r2n+α3r3n,
其中系数 α1,α2,α3 由初值 a0,a1,a2 决定。
若要求
A(x)=1−9x−8x2−5x327,
则需令
N(x)=a0(1−9x−8x2)+a1x(1−9x)+a2x2≡27.
N(1)=−16a0−8a1+a2=27,
这给出一条线性约束;任选两个初值即可解出第三个。例如
(a0,a1,a2)=(1,1,51)、(0,0,27)、(2,1,67) 等都满足该等式。
一般 x=1 时,若要 N(x) 为常数而非随 x 变化的多项式,需要在给> 定的 x 下解线性条件
a0(1−9x−8x2)+a1x(1−9x)+a2x2=27,
它在固定 x 时同样是一条关于 (a0,a1,a2) 的线性方程。
x=10−block_len
(例如 block_len=2025 时 x=10−2025)。
若需要在某特定窗口(例如第 2036 组)出现自然失配,可在工程上考虑
x=10−block_len(1+ε),∣ε∣≪>1,
结合数值截断/取整机制与初值选择,使前 2035 组满足递推而目标窗口出现偏离(需> 严格依据实现的“取整/进位”规则做误差预算与证明)。
根据上面给出的分母 1−9x−8x2−5x3,由于程序检查的段长度为2025,这里应当取 x=10−2025 ;为了让结果变为整数,这里把整个式子再乘 (10−2025)3 ,与公开的serial做对比,发现公开的serial恰好是这个值的55倍。按照类比,对于KCTF,则正好是27倍,此时分子分母的比例不变,所以最终生成的小数序列也完全相同。
对于提到的资源节释放的exe,静态提取后发现是pyinstaller打包的python3.12程序,用pyinstxtractor-ng解包后再用pycdc反编译,得到源代码:
最终答案:
name:KCTF
serial: 21l61l92022l71l51l61l92022l71l81l31l92022l81l61l51
using System;using System.Text;namespace _2024003_Crackme{ // Token: 0x02000005 RID: 5 internal class KX_UHJvZ3JhbQ雪雪 { // Token: 0x0600000F RID: 15 RVA: 0x00002410 File Offset: 0x00000810 private static void KX_TWFpbg雪雪() { Console.WriteLine("Name:"); string text = Console.ReadLine(); Console.WriteLine("SN:"); string text2 = Console.ReadLine(); if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(text2)) { return; } byte[] bytes = Encoding.UTF8.GetBytes(text); byte b = 0; foreach (byte b2 in bytes) { b ^= b2; } int num = (int)(b % 64); if (num % 2 == 0) { num++; } StringBuilder stringBuilder = new StringBuilder(); try { stringBuilder = KX_UHJvZ3JhbQ雪雪.KX_RGVjb2Rl(text2); } catch { return; } StringBuilder stringBuilder2 = new StringBuilder(num.ToString()); if (stringBuilder2 == null || stringBuilder == null || string.IsNullOrWhiteSpace(stringBuilder2.ToString()) || string.IsNullOrWhiteSpace(stringBuilder.ToString())) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } if (stringBuilder2.ToString().EndsWith("0") || stringBuilder.ToString().EndsWith("0")) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } int num2 = 2040; int num3 = 2025; KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪(); kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Precision = (num2 + 1) * num3; kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXlEaXZpZGU雪(stringBuilder2, stringBuilder); int j = 0; try { while (j < num2) { if (kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) && kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3)) { j = int.MaxValue; } if (!KX_UHJvZ3JhbQ雪雪.KX_VmVyaWZ5U2lnbmFs(kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 3) * num3, num3))) { j++; break; } j++; } if (j != num2 - 3) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } } catch { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } Console.WriteLine("Congratulations!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); } // Token: 0x06000010 RID: 16 RVA: 0x000026D4 File Offset: 0x00000AD4 public static bool KX_VmVyaWZ5U2lnbmFs(string KX_YQ雪雪, string KX_Yg雪雪, string KX_Yw雪雪, string KX_ZA雪雪) { KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪(); string text = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_YQ雪雪, 5).ToString(); string text2 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yg雪雪, 8).ToString(); string text3 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yw雪雪, 9).ToString(); string text4 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text, text2).ToString(); string text5 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text4, text3).ToString(); return KX_ZA雪雪 == text5; } // Token: 0x06000011 RID: 17 RVA: 0x00002738 File Offset: 0x00000B38 public static StringBuilder KX_RGVjb2Rl(string KX_U04雪) { if (KX_U04雪.Length < 26 || KX_U04雪.Length > 50) { Environment.Exit(0); } StringBuilder stringBuilder = new StringBuilder(); StringBuilder stringBuilder2 = new StringBuilder(); char c = ' '; string text = ""; long num = 0L; bool flag = true; if (KX_U04雪.StartsWith("0")) { Environment.Exit(0); } if (KX_U04雪.EndsWith(".")) { Environment.Exit(0); } foreach (char c2 in KX_U04雪) { if (c2 >= '0' && c2 <= '9') { if (c == ' ') { c = c2; text = ""; } else { if (text == "" && c2 == '0') { return stringBuilder2; } text += c2.ToString(); } flag = false; } else if (c2 == 'l') { if (flag) { return stringBuilder2; } if (c == ' ') { return stringBuilder2; } if (text == "") { return stringBuilder2; } if (num != 0L) { return stringBuilder2; } num = Convert.ToInt64(text); if (num == 0L) { return stringBuilder2; } for (;;) { long num2 = num; num = num2 - 1L; if (num2 <= 0L) { break; } stringBuilder.Append(c); } num += 1L; c = ' '; text = ""; flag = true; } else { if (c2 != '.') { return stringBuilder2; } if (string.IsNullOrWhiteSpace(stringBuilder.ToString())) { return stringBuilder2; } if (!string.IsNullOrEmpty(text)) { return stringBuilder2; } if (c != ' ' && string.IsNullOrEmpty(text)) { return stringBuilder2; } c = ' '; text = ""; stringBuilder.Append(c2); flag = true; } } if (!flag) { if (string.IsNullOrWhiteSpace(stringBuilder.ToString())) { return stringBuilder2; } if (c == ' ') { return stringBuilder2; } if (text == "") { return stringBuilder2; } if (num != 0L) { return stringBuilder2; } num = Convert.ToInt64(text); if (num == 0L) { return stringBuilder2; } for (;;) { long num3 = num; num = num3 - 1L; if (num3 <= 0L) { break; } stringBuilder.Append(c); } } return stringBuilder; } }}using System;using System.Text;namespace _2024003_Crackme{ // Token: 0x02000005 RID: 5 internal class KX_UHJvZ3JhbQ雪雪 { // Token: 0x0600000F RID: 15 RVA: 0x00002410 File Offset: 0x00000810 private static void KX_TWFpbg雪雪() { Console.WriteLine("Name:"); string text = Console.ReadLine(); Console.WriteLine("SN:"); string text2 = Console.ReadLine(); if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(text2)) { return; } byte[] bytes = Encoding.UTF8.GetBytes(text); byte b = 0; foreach (byte b2 in bytes) { b ^= b2; } int num = (int)(b % 64); if (num % 2 == 0) { num++; } StringBuilder stringBuilder = new StringBuilder(); try { stringBuilder = KX_UHJvZ3JhbQ雪雪.KX_RGVjb2Rl(text2); } catch { return; } StringBuilder stringBuilder2 = new StringBuilder(num.ToString()); if (stringBuilder2 == null || stringBuilder == null || string.IsNullOrWhiteSpace(stringBuilder2.ToString()) || string.IsNullOrWhiteSpace(stringBuilder.ToString())) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } if (stringBuilder2.ToString().EndsWith("0") || stringBuilder.ToString().EndsWith("0")) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } int num2 = 2040; int num3 = 2025; KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪(); kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Precision = (num2 + 1) * num3; kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXlEaXZpZGU雪(stringBuilder2, stringBuilder); int j = 0; try { while (j < num2) { if (kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) && kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3)) { j = int.MaxValue; } if (!KX_UHJvZ3JhbQ雪雪.KX_VmVyaWZ5U2lnbmFs(kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 3) * num3, num3))) { j++; break; } j++; } if (j != num2 - 3) { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } } catch { Console.WriteLine("Failed!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); return; } Console.WriteLine("Congratulations!"); Console.WriteLine("按任意键结束!"); Console.ReadKey(); } // Token: 0x06000010 RID: 16 RVA: 0x000026D4 File Offset: 0x00000AD4 public static bool KX_VmVyaWZ5U2lnbmFs(string KX_YQ雪雪, string KX_Yg雪雪, string KX_Yw雪雪, string KX_ZA雪雪) { KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪(); string text = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_YQ雪雪, 5).ToString(); string text2 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yg雪雪, 8).ToString(); string text3 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yw雪雪, 9).ToString(); string text4 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text, text2).ToString(); string text5 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text4, text3).ToString(); return KX_ZA雪雪 == text5; } // Token: 0x06000011 RID: 17 RVA: 0x00002738 File Offset: 0x00000B38 public static StringBuilder KX_RGVjb2Rl(string KX_U04雪) { if (KX_U04雪.Length < 26 || KX_U04雪.Length > 50) { Environment.Exit(0); } StringBuilder stringBuilder = new StringBuilder(); StringBuilder stringBuilder2 = new StringBuilder(); char c = ' '; string text = ""; long num = 0L; bool flag = true; if (KX_U04雪.StartsWith("0")) { Environment.Exit(0); } if (KX_U04雪.EndsWith(".")) { Environment.Exit(0); } foreach (char c2 in KX_U04雪) { if (c2 >= '0' && c2 <= '9') { if (c == ' ') { c = c2; text = ""; } else { if (text == "" && c2 == '0') { return stringBuilder2; } text += c2.ToString(); } flag = false; } else if (c2 == 'l') { if (flag) { return stringBuilder2; } if (c == ' ') { return stringBuilder2; } if (text == "") { return stringBuilder2; } if (num != 0L) { return stringBuilder2; } num = Convert.ToInt64(text); if (num == 0L) { return stringBuilder2; } for (;;) { long num2 = num; num = num2 - 1L; if (num2 <= 0L) { break; } stringBuilder.Append(c); } num += 1L; c = ' '; text = ""; flag = true; } else { if (c2 != '.') { return stringBuilder2; } if (string.IsNullOrWhiteSpace(stringBuilder.ToString())) { return stringBuilder2; } if (!string.IsNullOrEmpty(text)) { return stringBuilder2; } if (c != ' ' && string.IsNullOrEmpty(text)) { return stringBuilder2; } c = ' '; text = ""; stringBuilder.Append(c2); flag = true; } } if (!flag) { if (string.IsNullOrWhiteSpace(stringBuilder.ToString())) { return stringBuilder2; } if (c == ' ') { return stringBuilder2; } if (text == "") { return stringBuilder2; } if (num != 0L) { return stringBuilder2; } num = Convert.ToInt64(text); if (num == 0L) { return stringBuilder2; } for (;;) { long num3 = num; num = num3 - 1L; if (num3 <= 0L) { break; } stringBuilder.Append(c); } } return stringBuilder; } }}using System;using System.Diagnostics;using System.IO;using System.Linq;using System.Reflection;using System.Runtime.CompilerServices;using System.Text;namespace _2024003_Crackme{ // Token: 0x02000004 RID: 4 internal class KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 { // Token: 0x17000001 RID: 1 // (get) Token: 0x06000003 RID: 3 RVA: 0x00002058 File Offset: 0x00000458 // (set) Token: 0x06000004 RID: 4 RVA: 0x00002060 File Offset: 0x00000460 public string Quotient { get; private set; } // Token: 0x17000002 RID: 2 // (get) Token: 0x06000005 RID: 5 RVA: 0x00002069 File Offset: 0x00000469 // (set) Token: 0x06000006 RID: 6 RVA: 0x00002071 File Offset: 0x00000471 public string Remainder { get; private set; } // Token: 0x17000003 RID: 3 // (get) Token: 0x06000007 RID: 7 RVA: 0x0000207A File Offset: 0x0000047A // (set) Token: 0x06000008 RID: 8 RVA: 0x00002082 File Offset: 0x00000482 public int Precision { get; set; } // Token: 0x06000009 RID: 9 RVA: 0x00002108 File Offset: 0x00000508 public void KX_TXlEaXZpZGU雪(StringBuilder KX_ZGl2aWRlbmQ雪, StringBuilder KX_ZGl2aXNvcg雪雪) { string text = ""; try { string text2 = KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_RXh0cmFjdFJlc291cmNlVG9UZW1w(); using (Process process = Process.Start(new ProcessStartInfo { FileName = text2, Arguments = string.Concat(new string[] { KX_ZGl2aWRlbmQ雪.ToString(), " ", KX_ZGl2aXNvcg雪雪.ToString(), " ", this.Precision.ToString() }), UseShellExecute = false, RedirectStandardOutput = true, CreateNoWindow = true })) { text = process.StandardOutput.ReadToEnd(); process.WaitForExit(); } File.Delete(text2); } catch (Exception ex) { Environment.Exit(0); Console.WriteLine("错误: " + ex.Message); } if (text == "") { return; } if (text.Contains("E")) { string[] array = text.Split(new char[] { '.', 'E', '-' }); this.Quotient = "1" + array[1]; if (text.Contains('-')) { this.Quotient = this.Quotient.PadLeft(this.Quotient.Length + Convert.ToInt32(array[array.Length - 1]) - 1, '0'); } } } // Token: 0x0600000A RID: 10 RVA: 0x00002278 File Offset: 0x00000678 private static string KX_RXh0cmFjdFJlc291cmNlVG9UZW1w() { Assembly.GetExecutingAssembly(); string text = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString() + ".exe"); using (FileStream fileStream = new FileStream(text, FileMode.Create, FileAccess.Write)) { fileStream.Write(KX_UmVzb3VyY2Ux._20250805Calc, 0, KX_UmVzb3VyY2Ux._20250805Calc.Length); fileStream.Flush(); } return text; } // Token: 0x0600000B RID: 11 RVA: 0x0000208B File Offset: 0x0000048B private static int KX_Q29tcGFyZVN0cmluZ3M雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪) { if (KX_bnVtMQ雪雪.Length != KX_bnVtMg雪雪.Length) { return KX_bnVtMQ雪雪.Length - KX_bnVtMg雪雪.Length; } return string.Compare(KX_bnVtMQ雪雪, KX_bnVtMg雪雪, StringComparison.Ordinal); } // Token: 0x0600000C RID: 12 RVA: 0x000022F4 File Offset: 0x000006F4 public StringBuilder KX_QWRkU3RyaW5ncw雪雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪) { StringBuilder stringBuilder = new StringBuilder(); int num = 0; if (KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_Q29tcGFyZVN0cmluZ3M雪(KX_bnVtMQ雪雪, KX_bnVtMg雪雪) < 0) { string text = KX_bnVtMQ雪雪; KX_bnVtMQ雪雪 = KX_bnVtMg雪雪; KX_bnVtMg雪雪 = text; } for (int i = 0; i < KX_bnVtMQ雪雪.Length; i++) { int num2 = (int)(KX_bnVtMQ雪雪[KX_bnVtMQ雪雪.Length - 1 - i] - '0'); int num3 = (int)((i < KX_bnVtMg雪雪.Length) ? (KX_bnVtMg雪雪[KX_bnVtMg雪雪.Length - 1 - i] - '0') : '\0'); int num4 = num2 + num3 + num; num = 0; if (num4 >= 10) { num = num4 / 10; num4 %= 10; } stringBuilder.Insert(0, num4.ToString()); } if (num > 0) { stringBuilder.Insert(0, num.ToString()); } return stringBuilder; } // Token: 0x0600000D RID: 13 RVA: 0x0000239C File Offset: 0x0000079C public StringBuilder KX_TXVsdGlTdHJpbmdz(string KX_bnVtMQ雪雪, int KX_bnVtMg雪雪) { StringBuilder stringBuilder = new StringBuilder(); int num = 0; for (int i = 0; i < KX_bnVtMQ雪雪.Length; i++) { int num2 = (int)(KX_bnVtMQ雪雪[KX_bnVtMQ雪雪.Length - 1 - i] - '0') * KX_bnVtMg雪雪 + num; num = 0; if (num2 >= 10) { num = num2 / 10; num2 %= 10; } stringBuilder.Insert(0, num2.ToString()); } if (num > 0) { stringBuilder.Insert(0, num.ToString()); } return stringBuilder; } // Token: 0x04000001 RID: 1 [CompilerGenerated] private string KX_PFF1b3RpZW50PmtfX0JhY2tpbmdGaWVsZA雪雪; // Token: 0x04000002 RID: 2 [CompilerGenerated] private string KX_PFJlbWFpbmRlcj5rX19CYWNraW5nRmllbGQ雪; // Token: 0x04000003 RID: 3 [CompilerGenerated] private int KX_PFByZWNpc2lvbj5rX19CYWNraW5nRmllbGQ雪; }}using System;using System.Diagnostics;using System.IO;using System.Linq;using System.Reflection;using System.Runtime.CompilerServices;using System.Text;namespace _2024003_Crackme{ // Token: 0x02000004 RID: 4 internal class KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 { // Token: 0x17000001 RID: 1 // (get) Token: 0x06000003 RID: 3 RVA: 0x00002058 File Offset: 0x00000458 // (set) Token: 0x06000004 RID: 4 RVA: 0x00002060 File Offset: 0x00000460 public string Quotient { get; private set; } // Token: 0x17000002 RID: 2 // (get) Token: 0x06000005 RID: 5 RVA: 0x00002069 File Offset: 0x00000469 // (set) Token: 0x06000006 RID: 6 RVA: 0x00002071 File Offset: 0x00000471 public string Remainder { get; private set; } // Token: 0x17000003 RID: 3 // (get) Token: 0x06000007 RID: 7 RVA: 0x0000207A File Offset: 0x0000047A // (set) Token: 0x06000008 RID: 8 RVA: 0x00002082 File Offset: 0x00000482 public int Precision { get; set; } // Token: 0x06000009 RID: 9 RVA: 0x00002108 File Offset: 0x00000508 public void KX_TXlEaXZpZGU雪(StringBuilder KX_ZGl2aWRlbmQ雪, StringBuilder KX_ZGl2aXNvcg雪雪) { string text = ""; try { string text2 = KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_RXh0cmFjdFJlc291cmNlVG9UZW1w(); using (Process process = Process.Start(new ProcessStartInfo { FileName = text2, Arguments = string.Concat(new string[] { KX_ZGl2aWRlbmQ雪.ToString(), " ", KX_ZGl2aXNvcg雪雪.ToString(), " ", this.Precision.ToString() }), UseShellExecute = false, RedirectStandardOutput = true, CreateNoWindow = true })) { text = process.StandardOutput.ReadToEnd(); process.WaitForExit(); } File.Delete(text2); } catch (Exception ex) { Environment.Exit(0); Console.WriteLine("错误: " + ex.Message); } if (text == "") { return; } if (text.Contains("E")) { string[] array = text.Split(new char[] { '.', 'E', '-' }); this.Quotient = "1" + array[1]; if (text.Contains('-')) { this.Quotient = this.Quotient.PadLeft(this.Quotient.Length + Convert.ToInt32(array[array.Length - 1]) - 1, '0'); } } } // Token: 0x0600000A RID: 10 RVA: 0x00002278 File Offset: 0x00000678 private static string KX_RXh0cmFjdFJlc291cmNlVG9UZW1w() { Assembly.GetExecutingAssembly(); string text = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString() + ".exe"); using (FileStream fileStream = new FileStream(text, FileMode.Create, FileAccess.Write)) { fileStream.Write(KX_UmVzb3VyY2Ux._20250805Calc, 0, KX_UmVzb3VyY2Ux._20250805Calc.Length); fileStream.Flush(); } return text; } // Token: 0x0600000B RID: 11 RVA: 0x0000208B File Offset: 0x0000048B private static int KX_Q29tcGFyZVN0cmluZ3M雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪) { if (KX_bnVtMQ雪雪.Length != KX_bnVtMg雪雪.Length) { return KX_bnVtMQ雪雪.Length - KX_bnVtMg雪雪.Length; } return string.Compare(KX_bnVtMQ雪雪, KX_bnVtMg雪雪, StringComparison.Ordinal); } // Token: 0x0600000C RID: 12 RVA: 0x000022F4 File Offset: 0x000006F4 public StringBuilder KX_QWRkU3RyaW5ncw雪雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪) {