首页
社区
课程
招聘
[原创] 看雪 2025 KCTF 第九题 智斗邪首
发表于: 2025-9-2 00:35 2767

[原创] 看雪 2025 KCTF 第九题 智斗邪首

2025-9-2 00:35
2767

start函数调用了_CorExeMain,可以确定是.NET程序,但常规工具都识别不出来,文件头也没有CLR Header的信息。

(看到是方案二+存在.enigma1和.enigma2段+出题人之前发的文章,一度以为程序加了很重的壳)

但不管怎么样,调用_CorExeMain之前肯定会恢复CLR Header。程序有一个TLS callback,动态调试过掉这部分后发现头部0x178位置的CLRDirectory从0变为了有意义的值:00 20 00 00 48 00 00 00,将其patch回二进制文件,然后dnSpy就能正常打开和反编译文件了。

全部逻辑基本只有这些,看看AI的分析:

至第三段,分析结果已经非常清晰了:输入的name被简单转换为一个整数作为分子,输入的serial被解码后转换为一个大数,然后做高精度除法,小数位2025位为一组,相邻四组需要满足d == 5*a + 8*b + 9*c的递推,然后需要前2036个四组满足要求。

serial的编码方式是游程编码:先是一位十进制数字,然后直到字符'l'的剩下的十进制数字表示前面的十进制数字的重复次数,依次类推完成解码。例如公开的serial 51l41l92022l51l01l41l92022l52l92023l71l21l51,展开后即:1个5、1个4、2022个9、...依次拼接起来。

公开的用户名FCCE23A5A04E0EA5按照name的规则转换为整数是55,KCTF转换后是27。考虑到题目的校验只是name的整数除以serial的整数,当分子从55变为27后,只需要让公开serial的分子等比例的除以55乘以27,再编码回去,即可得到KCTF的序列号。

估计一血就是这么出的,而且这么做也不需要太多分析,花费的时间也差不多;但是,自己的serial编码函数写错了没注意到……算出来的结果验证不过的时候开始疯狂的怀疑(然而最简单的assert encode(decode(serial)) == serial验证却一直没做;以后一定不再偷懒)

从题目的小数结构联想到了去年GeekGame的一道题codegolf,其题解提到了一篇文章 827K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2M7r3q4#2L8r3S2S2L8X3E0A6L8W2)9J5k6h3&6W2N6q4)9J5c8X3k6A6j5X3!0F1j5h3y4U0K9g2)9J5c8R3`.`. ,题目里对小数的线性递推检验完全符合生成函数的特征。

让AI给出题目递推式的推导:

f5fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">=++.a_{n+3} \;=\; 5\,a_n \;+\; 8\,a_{n+1} \;+\; 9\,a_{n+2}\,.an+3=5an+8an+1+9an+2.

0a4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">A(x)=n=xn.A(x) \;=\; \sum_{n=0}^{\infty} a_n x^n .A(x)=n=0anxn.

从递推

7daK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">=++(n)a_{n+3} = 5a_n + 8a_{n+1} + 9a_{n+2}\quad(n\ge0)an+3=5an+8an+1+9an+2(n0)

出发,有

448K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">\begin{aligned} A(x) &= a_0 + a_1 x + a_2 x^2 + \sum_{n=3}^{\infty} a_n x^n \\ &= a_0 + a_1 x + a_2 x^2 + \sum_{n=3}^{\infty} (5 a_{n-3} + 8 a_{n-2} + 9 a_{n-1}) x^n \\ &= a_0 + a_1 x + a_2 x^2 + 5x^3 A(x) + 8x^2\big(A(x)-a_0\big) + 9x\big (A(x)-a_0-a_1 x\big). \end{aligned}A(x)=a0+a1x+a2x2+n=3anxn=a0+a1x+a2x2+n=3(5an3+8an2+9an1)xn=a0+a1x+a2x2+5x3A(x)+8x2(A(x)a0)+9x(A(x)a0a1x).

整理得

14dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">A(x)(xxx)=(xx)+x(x)+x.A(x)\,(1 - 9x - 8x^2 - 5x^3) = a_0 (1 - 9x - 8x^2) + a_1 x (1 - 9x) + a_2 x^2 .A(x)(19x8x25x3)=a0(19x8x2)+a1x(19x)+a2x2.

生成函数闭式:

fa8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">\boxed{ \displaystyle A(x) \;=\; \frac{a_0 (1 - 9x - 8x^2) + a_1 x (1 - 9x) + a_2 x^2}{\,1 - 9x - 8x^2 - 5x^3\,} }A(x)=19x8x25x3a0(19x8x2)+a1x(19x)+a2x2

为方便记号,常写分子为

13dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">N(x)=(xx)+x(x)+x.N(x) \;=\; a_0 (1 - 9x - 8x^2) + a_1 x (1 - 9x) + a_2 x^2 .N(x)=a0(19x8x2)+a1x(19x)+a2x2.

若希望“分子是常数(例如 27)”,则需选取 c60K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">,,,xa_0,a_1,a_2,xa0,a1,a2,x 使得 bccK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">N(x)>N(x)\equiv > 27N(x)≡>27(见下文“分子常数化”)。

分母对应特征多项式

deaK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">rrr=1 - 9r - 8r^2 - 5r^3 = 0 .19r8r25r3=0.

设其三根为 d45K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">,,r_1,r_2,r_3r1,r2,r3(可为实根或复根),则序列通解为

b9aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">=rn+rn+rn,a_n = \alpha_1 r_1^n + \alpha_2 r_2^n + \alpha_3 r_3^n ,an=α1r1n+α2r2n+α3r3n,

其中系数 bd0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">,,\alpha_1,\alpha_2,\alpha_3α1,α2,α3 由初值 69cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">,,a_0,a_1,a_2a0,a1,a2 决定。

若要求

d76K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">A(x)=,A(x) \;=\; \frac{27}{1 - 9x - 8x^2 - 5x^3},A(x)=19x8x25x327,

则需令

b40K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">N(x)=(xx)+x(x)+xN(x) \;=\; a_0 (1 - 9x - 8x^2) + a_1 x (1 - 9x) + a_2 x^2 \;\equiv\; 27 .N(x)=a0(19x8x2)+a1x(19x)+a2x227.

ac2K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">N()=+=,N(1) = -16\,a_0 - 8\,a_1 + a_2 = 27,N(1)=16a08a1+a2=27,

这给出一条线性约束;任选两个初值即可解出第三个。例如
9dbK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(,,)=(,,)(a_0,a_1,a_2)=(1,1,51)(a0,a1,a2)=(1,1,51)abeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(,,)(0,0,27)(0,0,27)f1bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(,,)(2,1,67)(2,1,67) 等都满足该等式。

一般 562K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">xx\neq1x=1 时,若要 bb9K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">N(x)N(x)N(x)常数而非随 45cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">xxx 变化的多项式,需要在给> 定的 2b2K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">xxx 下解线性条件

129K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(xx)+x(x)+x=,a_0 (1 - 9x - 8x^2) + a_1 x (1 - 9x) + a_2 x^2 = 27,a0(19x8x2)+a1x(19x)+a2x2=27,

它在固定 86cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">xxx 时同样是一条关于 dc6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(,,)(a_0,a_1,a_2)(a0,a1,a2) 的线性方程。

fd3K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">\boxed{ \displaystyle x \;=\; 10^{-\mathrm{block\_len}} }x=10block_len

(例如 block_len=2025 时 7c2K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">x=x=10^{-2025}x=102025)。

若需要在某特定窗口(例如第 2036 组)出现自然失配,可在工程上考虑

3a4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">x=block_len(+ε),ε>,x = 10^{-\mathrm{block\_len}} (1+\varepsilon),\;\; |\varepsilon|\ll > 1,x=10block_len(1+ε),ε≪>1,

结合数值截断/取整机制与初值选择,使前 2035 组满足递推而目标窗口出现偏离(需> 严格依据实现的“取整/进位”规则做误差预算与证明)。

根据上面给出的分母 2dcK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">xxx1 - 9x - 8x^2 - 5x^319x8x25x3,由于程序检查的段长度为2025,这里应当取 b92K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">x=x=10^{-2025}x=102025 ;为了让结果变为整数,这里把整个式子再乘 afdK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4M7K6i4K6u0W2L8%4u0Y4i4K6u0r3x3e0V1&6z5q4)9J5c8V1#2S2N6r3S2Q4x3V1k6y4j5i4c8Z5e0f1H3`.">(){(10^{-2025})}^3(102025)3 ,与公开的serial做对比,发现公开的serial恰好是这个值的55倍。按照类比,对于KCTF,则正好是27倍,此时分子分母的比例不变,所以最终生成的小数序列也完全相同。

对于提到的资源节释放的exe,静态提取后发现是pyinstaller打包的python3.12程序,用pyinstxtractor-ng解包后再用pycdc反编译,得到源代码:

最终答案:
name:KCTF
serial: 21l61l92022l71l51l61l92022l71l81l31l92022l81l61l51

using System;
using System.Text;
 
namespace _2024003_Crackme
{
    // Token: 0x02000005 RID: 5
    internal class KX_UHJvZ3JhbQ雪雪
    {
        // Token: 0x0600000F RID: 15 RVA: 0x00002410 File Offset: 0x00000810
        private static void KX_TWFpbg雪雪()
        {
            Console.WriteLine("Name:");
            string text = Console.ReadLine();
            Console.WriteLine("SN:");
            string text2 = Console.ReadLine();
            if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(text2))
            {
                return;
            }
            byte[] bytes = Encoding.UTF8.GetBytes(text);
            byte b = 0;
            foreach (byte b2 in bytes)
            {
                b ^= b2;
            }
            int num = (int)(b % 64);
            if (num % 2 == 0)
            {
                num++;
            }
            StringBuilder stringBuilder = new StringBuilder();
            try
            {
                stringBuilder = KX_UHJvZ3JhbQ雪雪.KX_RGVjb2Rl(text2);
            }
            catch
            {
                return;
            }
            StringBuilder stringBuilder2 = new StringBuilder(num.ToString());
            if (stringBuilder2 == null || stringBuilder == null || string.IsNullOrWhiteSpace(stringBuilder2.ToString()) || string.IsNullOrWhiteSpace(stringBuilder.ToString()))
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            if (stringBuilder2.ToString().EndsWith("0") || stringBuilder.ToString().EndsWith("0"))
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            int num2 = 2040;
            int num3 = 2025;
            KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪();
            kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Precision = (num2 + 1) * num3;
            kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXlEaXZpZGU雪(stringBuilder2, stringBuilder);
            int j = 0;
            try
            {
                while (j < num2)
                {
                    if (kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) && kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3))
                    {
                        j = int.MaxValue;
                    }
                    if (!KX_UHJvZ3JhbQ雪雪.KX_VmVyaWZ5U2lnbmFs(kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 3) * num3, num3)))
                    {
                        j++;
                        break;
                    }
                    j++;
                }
                if (j != num2 - 3)
                {
                    Console.WriteLine("Failed!");
                    Console.WriteLine("按任意键结束!");
                    Console.ReadKey();
                    return;
                }
            }
            catch
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            Console.WriteLine("Congratulations!");
            Console.WriteLine("按任意键结束!");
            Console.ReadKey();
        }
 
        // Token: 0x06000010 RID: 16 RVA: 0x000026D4 File Offset: 0x00000AD4
        public static bool KX_VmVyaWZ5U2lnbmFs(string KX_YQ雪雪, string KX_Yg雪雪, string KX_Yw雪雪, string KX_ZA雪雪)
        {
            KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪();
            string text = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_YQ雪雪, 5).ToString();
            string text2 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yg雪雪, 8).ToString();
            string text3 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yw雪雪, 9).ToString();
            string text4 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text, text2).ToString();
            string text5 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text4, text3).ToString();
            return KX_ZA雪雪 == text5;
        }
 
        // Token: 0x06000011 RID: 17 RVA: 0x00002738 File Offset: 0x00000B38
        public static StringBuilder KX_RGVjb2Rl(string KX_U04雪)
        {
            if (KX_U04雪.Length < 26 || KX_U04雪.Length > 50)
            {
                Environment.Exit(0);
            }
            StringBuilder stringBuilder = new StringBuilder();
            StringBuilder stringBuilder2 = new StringBuilder();
            char c = ' ';
            string text = "";
            long num = 0L;
            bool flag = true;
            if (KX_U04雪.StartsWith("0"))
            {
                Environment.Exit(0);
            }
            if (KX_U04雪.EndsWith("."))
            {
                Environment.Exit(0);
            }
            foreach (char c2 in KX_U04雪)
            {
                if (c2 >= '0' && c2 <= '9')
                {
                    if (c == ' ')
                    {
                        c = c2;
                        text = "";
                    }
                    else
                    {
                        if (text == "" && c2 == '0')
                        {
                            return stringBuilder2;
                        }
                        text += c2.ToString();
                    }
                    flag = false;
                }
                else if (c2 == 'l')
                {
                    if (flag)
                    {
                        return stringBuilder2;
                    }
                    if (c == ' ')
                    {
                        return stringBuilder2;
                    }
                    if (text == "")
                    {
                        return stringBuilder2;
                    }
                    if (num != 0L)
                    {
                        return stringBuilder2;
                    }
                    num = Convert.ToInt64(text);
                    if (num == 0L)
                    {
                        return stringBuilder2;
                    }
                    for (;;)
                    {
                        long num2 = num;
                        num = num2 - 1L;
                        if (num2 <= 0L)
                        {
                            break;
                        }
                        stringBuilder.Append(c);
                    }
                    num += 1L;
                    c = ' ';
                    text = "";
                    flag = true;
                }
                else
                {
                    if (c2 != '.')
                    {
                        return stringBuilder2;
                    }
                    if (string.IsNullOrWhiteSpace(stringBuilder.ToString()))
                    {
                        return stringBuilder2;
                    }
                    if (!string.IsNullOrEmpty(text))
                    {
                        return stringBuilder2;
                    }
                    if (c != ' ' && string.IsNullOrEmpty(text))
                    {
                        return stringBuilder2;
                    }
                    c = ' ';
                    text = "";
                    stringBuilder.Append(c2);
                    flag = true;
                }
            }
            if (!flag)
            {
                if (string.IsNullOrWhiteSpace(stringBuilder.ToString()))
                {
                    return stringBuilder2;
                }
                if (c == ' ')
                {
                    return stringBuilder2;
                }
                if (text == "")
                {
                    return stringBuilder2;
                }
                if (num != 0L)
                {
                    return stringBuilder2;
                }
                num = Convert.ToInt64(text);
                if (num == 0L)
                {
                    return stringBuilder2;
                }
                for (;;)
                {
                    long num3 = num;
                    num = num3 - 1L;
                    if (num3 <= 0L)
                    {
                        break;
                    }
                    stringBuilder.Append(c);
                }
            }
            return stringBuilder;
        }
    }
}
using System;
using System.Text;
 
namespace _2024003_Crackme
{
    // Token: 0x02000005 RID: 5
    internal class KX_UHJvZ3JhbQ雪雪
    {
        // Token: 0x0600000F RID: 15 RVA: 0x00002410 File Offset: 0x00000810
        private static void KX_TWFpbg雪雪()
        {
            Console.WriteLine("Name:");
            string text = Console.ReadLine();
            Console.WriteLine("SN:");
            string text2 = Console.ReadLine();
            if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(text2))
            {
                return;
            }
            byte[] bytes = Encoding.UTF8.GetBytes(text);
            byte b = 0;
            foreach (byte b2 in bytes)
            {
                b ^= b2;
            }
            int num = (int)(b % 64);
            if (num % 2 == 0)
            {
                num++;
            }
            StringBuilder stringBuilder = new StringBuilder();
            try
            {
                stringBuilder = KX_UHJvZ3JhbQ雪雪.KX_RGVjb2Rl(text2);
            }
            catch
            {
                return;
            }
            StringBuilder stringBuilder2 = new StringBuilder(num.ToString());
            if (stringBuilder2 == null || stringBuilder == null || string.IsNullOrWhiteSpace(stringBuilder2.ToString()) || string.IsNullOrWhiteSpace(stringBuilder.ToString()))
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            if (stringBuilder2.ToString().EndsWith("0") || stringBuilder.ToString().EndsWith("0"))
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            int num2 = 2040;
            int num3 = 2025;
            KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪();
            kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Precision = (num2 + 1) * num3;
            kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXlEaXZpZGU雪(stringBuilder2, stringBuilder);
            int j = 0;
            try
            {
                while (j < num2)
                {
                    if (kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) && kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3) == kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3))
                    {
                        j = int.MaxValue;
                    }
                    if (!KX_UHJvZ3JhbQ雪雪.KX_VmVyaWZ5U2lnbmFs(kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring(j * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 1) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 2) * num3, num3), kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.Quotient.Substring((j + 3) * num3, num3)))
                    {
                        j++;
                        break;
                    }
                    j++;
                }
                if (j != num2 - 3)
                {
                    Console.WriteLine("Failed!");
                    Console.WriteLine("按任意键结束!");
                    Console.ReadKey();
                    return;
                }
            }
            catch
            {
                Console.WriteLine("Failed!");
                Console.WriteLine("按任意键结束!");
                Console.ReadKey();
                return;
            }
            Console.WriteLine("Congratulations!");
            Console.WriteLine("按任意键结束!");
            Console.ReadKey();
        }
 
        // Token: 0x06000010 RID: 16 RVA: 0x000026D4 File Offset: 0x00000AD4
        public static bool KX_VmVyaWZ5U2lnbmFs(string KX_YQ雪雪, string KX_Yg雪雪, string KX_Yw雪雪, string KX_ZA雪雪)
        {
            KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪 = new KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪();
            string text = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_YQ雪雪, 5).ToString();
            string text2 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yg雪雪, 8).ToString();
            string text3 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_TXVsdGlTdHJpbmdz(KX_Yw雪雪, 9).ToString();
            string text4 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text, text2).ToString();
            string text5 = kx_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_QWRkU3RyaW5ncw雪雪(text4, text3).ToString();
            return KX_ZA雪雪 == text5;
        }
 
        // Token: 0x06000011 RID: 17 RVA: 0x00002738 File Offset: 0x00000B38
        public static StringBuilder KX_RGVjb2Rl(string KX_U04雪)
        {
            if (KX_U04雪.Length < 26 || KX_U04雪.Length > 50)
            {
                Environment.Exit(0);
            }
            StringBuilder stringBuilder = new StringBuilder();
            StringBuilder stringBuilder2 = new StringBuilder();
            char c = ' ';
            string text = "";
            long num = 0L;
            bool flag = true;
            if (KX_U04雪.StartsWith("0"))
            {
                Environment.Exit(0);
            }
            if (KX_U04雪.EndsWith("."))
            {
                Environment.Exit(0);
            }
            foreach (char c2 in KX_U04雪)
            {
                if (c2 >= '0' && c2 <= '9')
                {
                    if (c == ' ')
                    {
                        c = c2;
                        text = "";
                    }
                    else
                    {
                        if (text == "" && c2 == '0')
                        {
                            return stringBuilder2;
                        }
                        text += c2.ToString();
                    }
                    flag = false;
                }
                else if (c2 == 'l')
                {
                    if (flag)
                    {
                        return stringBuilder2;
                    }
                    if (c == ' ')
                    {
                        return stringBuilder2;
                    }
                    if (text == "")
                    {
                        return stringBuilder2;
                    }
                    if (num != 0L)
                    {
                        return stringBuilder2;
                    }
                    num = Convert.ToInt64(text);
                    if (num == 0L)
                    {
                        return stringBuilder2;
                    }
                    for (;;)
                    {
                        long num2 = num;
                        num = num2 - 1L;
                        if (num2 <= 0L)
                        {
                            break;
                        }
                        stringBuilder.Append(c);
                    }
                    num += 1L;
                    c = ' ';
                    text = "";
                    flag = true;
                }
                else
                {
                    if (c2 != '.')
                    {
                        return stringBuilder2;
                    }
                    if (string.IsNullOrWhiteSpace(stringBuilder.ToString()))
                    {
                        return stringBuilder2;
                    }
                    if (!string.IsNullOrEmpty(text))
                    {
                        return stringBuilder2;
                    }
                    if (c != ' ' && string.IsNullOrEmpty(text))
                    {
                        return stringBuilder2;
                    }
                    c = ' ';
                    text = "";
                    stringBuilder.Append(c2);
                    flag = true;
                }
            }
            if (!flag)
            {
                if (string.IsNullOrWhiteSpace(stringBuilder.ToString()))
                {
                    return stringBuilder2;
                }
                if (c == ' ')
                {
                    return stringBuilder2;
                }
                if (text == "")
                {
                    return stringBuilder2;
                }
                if (num != 0L)
                {
                    return stringBuilder2;
                }
                num = Convert.ToInt64(text);
                if (num == 0L)
                {
                    return stringBuilder2;
                }
                for (;;)
                {
                    long num3 = num;
                    num = num3 - 1L;
                    if (num3 <= 0L)
                    {
                        break;
                    }
                    stringBuilder.Append(c);
                }
            }
            return stringBuilder;
        }
    }
}
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Text;
 
namespace _2024003_Crackme
{
    // Token: 0x02000004 RID: 4
    internal class KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪
    {
        // Token: 0x17000001 RID: 1
        // (get) Token: 0x06000003 RID: 3 RVA: 0x00002058 File Offset: 0x00000458
        // (set) Token: 0x06000004 RID: 4 RVA: 0x00002060 File Offset: 0x00000460
        public string Quotient { get; private set; }
 
        // Token: 0x17000002 RID: 2
        // (get) Token: 0x06000005 RID: 5 RVA: 0x00002069 File Offset: 0x00000469
        // (set) Token: 0x06000006 RID: 6 RVA: 0x00002071 File Offset: 0x00000471
        public string Remainder { get; private set; }
 
        // Token: 0x17000003 RID: 3
        // (get) Token: 0x06000007 RID: 7 RVA: 0x0000207A File Offset: 0x0000047A
        // (set) Token: 0x06000008 RID: 8 RVA: 0x00002082 File Offset: 0x00000482
        public int Precision { get; set; }
 
        // Token: 0x06000009 RID: 9 RVA: 0x00002108 File Offset: 0x00000508
        public void KX_TXlEaXZpZGU雪(StringBuilder KX_ZGl2aWRlbmQ雪, StringBuilder KX_ZGl2aXNvcg雪雪)
        {
            string text = "";
            try
            {
                string text2 = KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_RXh0cmFjdFJlc291cmNlVG9UZW1w();
                using (Process process = Process.Start(new ProcessStartInfo
                {
                    FileName = text2,
                    Arguments = string.Concat(new string[]
                    {
                        KX_ZGl2aWRlbmQ雪.ToString(),
                        " ",
                        KX_ZGl2aXNvcg雪雪.ToString(),
                        " ",
                        this.Precision.ToString()
                    }),
                    UseShellExecute = false,
                    RedirectStandardOutput = true,
                    CreateNoWindow = true
                }))
                {
                    text = process.StandardOutput.ReadToEnd();
                    process.WaitForExit();
                }
                File.Delete(text2);
            }
            catch (Exception ex)
            {
                Environment.Exit(0);
                Console.WriteLine("错误: " + ex.Message);
            }
            if (text == "")
            {
                return;
            }
            if (text.Contains("E"))
            {
                string[] array = text.Split(new char[] { '.', 'E', '-' });
                this.Quotient = "1" + array[1];
                if (text.Contains('-'))
                {
                    this.Quotient = this.Quotient.PadLeft(this.Quotient.Length + Convert.ToInt32(array[array.Length - 1]) - 1, '0');
                }
            }
        }
 
        // Token: 0x0600000A RID: 10 RVA: 0x00002278 File Offset: 0x00000678
        private static string KX_RXh0cmFjdFJlc291cmNlVG9UZW1w()
        {
            Assembly.GetExecutingAssembly();
            string text = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString() + ".exe");
            using (FileStream fileStream = new FileStream(text, FileMode.Create, FileAccess.Write))
            {
                fileStream.Write(KX_UmVzb3VyY2Ux._20250805Calc, 0, KX_UmVzb3VyY2Ux._20250805Calc.Length);
                fileStream.Flush();
            }
            return text;
        }
 
        // Token: 0x0600000B RID: 11 RVA: 0x0000208B File Offset: 0x0000048B
        private static int KX_Q29tcGFyZVN0cmluZ3M雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪)
        {
            if (KX_bnVtMQ雪雪.Length != KX_bnVtMg雪雪.Length)
            {
                return KX_bnVtMQ雪雪.Length - KX_bnVtMg雪雪.Length;
            }
            return string.Compare(KX_bnVtMQ雪雪, KX_bnVtMg雪雪, StringComparison.Ordinal);
        }
 
        // Token: 0x0600000C RID: 12 RVA: 0x000022F4 File Offset: 0x000006F4
        public StringBuilder KX_QWRkU3RyaW5ncw雪雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪)
        {
            StringBuilder stringBuilder = new StringBuilder();
            int num = 0;
            if (KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_Q29tcGFyZVN0cmluZ3M雪(KX_bnVtMQ雪雪, KX_bnVtMg雪雪) < 0)
            {
                string text = KX_bnVtMQ雪雪;
                KX_bnVtMQ雪雪 = KX_bnVtMg雪雪;
                KX_bnVtMg雪雪 = text;
            }
            for (int i = 0; i < KX_bnVtMQ雪雪.Length; i++)
            {
                int num2 = (int)(KX_bnVtMQ雪雪[KX_bnVtMQ雪雪.Length - 1 - i] - '0');
                int num3 = (int)((i < KX_bnVtMg雪雪.Length) ? (KX_bnVtMg雪雪[KX_bnVtMg雪雪.Length - 1 - i] - '0') : '\0');
                int num4 = num2 + num3 + num;
                num = 0;
                if (num4 >= 10)
                {
                    num = num4 / 10;
                    num4 %= 10;
                }
                stringBuilder.Insert(0, num4.ToString());
            }
            if (num > 0)
            {
                stringBuilder.Insert(0, num.ToString());
            }
            return stringBuilder;
        }
 
        // Token: 0x0600000D RID: 13 RVA: 0x0000239C File Offset: 0x0000079C
        public StringBuilder KX_TXVsdGlTdHJpbmdz(string KX_bnVtMQ雪雪, int KX_bnVtMg雪雪)
        {
            StringBuilder stringBuilder = new StringBuilder();
            int num = 0;
            for (int i = 0; i < KX_bnVtMQ雪雪.Length; i++)
            {
                int num2 = (int)(KX_bnVtMQ雪雪[KX_bnVtMQ雪雪.Length - 1 - i] - '0') * KX_bnVtMg雪雪 + num;
                num = 0;
                if (num2 >= 10)
                {
                    num = num2 / 10;
                    num2 %= 10;
                }
                stringBuilder.Insert(0, num2.ToString());
            }
            if (num > 0)
            {
                stringBuilder.Insert(0, num.ToString());
            }
            return stringBuilder;
        }
 
        // Token: 0x04000001 RID: 1
        [CompilerGenerated]
        private string KX_PFF1b3RpZW50PmtfX0JhY2tpbmdGaWVsZA雪雪;
 
        // Token: 0x04000002 RID: 2
        [CompilerGenerated]
        private string KX_PFJlbWFpbmRlcj5rX19CYWNraW5nRmllbGQ雪;
 
        // Token: 0x04000003 RID: 3
        [CompilerGenerated]
        private int KX_PFByZWNpc2lvbj5rX19CYWNraW5nRmllbGQ雪;
    }
}
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Text;
 
namespace _2024003_Crackme
{
    // Token: 0x02000004 RID: 4
    internal class KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪
    {
        // Token: 0x17000001 RID: 1
        // (get) Token: 0x06000003 RID: 3 RVA: 0x00002058 File Offset: 0x00000458
        // (set) Token: 0x06000004 RID: 4 RVA: 0x00002060 File Offset: 0x00000460
        public string Quotient { get; private set; }
 
        // Token: 0x17000002 RID: 2
        // (get) Token: 0x06000005 RID: 5 RVA: 0x00002069 File Offset: 0x00000469
        // (set) Token: 0x06000006 RID: 6 RVA: 0x00002071 File Offset: 0x00000471
        public string Remainder { get; private set; }
 
        // Token: 0x17000003 RID: 3
        // (get) Token: 0x06000007 RID: 7 RVA: 0x0000207A File Offset: 0x0000047A
        // (set) Token: 0x06000008 RID: 8 RVA: 0x00002082 File Offset: 0x00000482
        public int Precision { get; set; }
 
        // Token: 0x06000009 RID: 9 RVA: 0x00002108 File Offset: 0x00000508
        public void KX_TXlEaXZpZGU雪(StringBuilder KX_ZGl2aWRlbmQ雪, StringBuilder KX_ZGl2aXNvcg雪雪)
        {
            string text = "";
            try
            {
                string text2 = KX_SGlnaFByZWNpc2lvbkRpdmlzaW9uMg雪雪.KX_RXh0cmFjdFJlc291cmNlVG9UZW1w();
                using (Process process = Process.Start(new ProcessStartInfo
                {
                    FileName = text2,
                    Arguments = string.Concat(new string[]
                    {
                        KX_ZGl2aWRlbmQ雪.ToString(),
                        " ",
                        KX_ZGl2aXNvcg雪雪.ToString(),
                        " ",
                        this.Precision.ToString()
                    }),
                    UseShellExecute = false,
                    RedirectStandardOutput = true,
                    CreateNoWindow = true
                }))
                {
                    text = process.StandardOutput.ReadToEnd();
                    process.WaitForExit();
                }
                File.Delete(text2);
            }
            catch (Exception ex)
            {
                Environment.Exit(0);
                Console.WriteLine("错误: " + ex.Message);
            }
            if (text == "")
            {
                return;
            }
            if (text.Contains("E"))
            {
                string[] array = text.Split(new char[] { '.', 'E', '-' });
                this.Quotient = "1" + array[1];
                if (text.Contains('-'))
                {
                    this.Quotient = this.Quotient.PadLeft(this.Quotient.Length + Convert.ToInt32(array[array.Length - 1]) - 1, '0');
                }
            }
        }
 
        // Token: 0x0600000A RID: 10 RVA: 0x00002278 File Offset: 0x00000678
        private static string KX_RXh0cmFjdFJlc291cmNlVG9UZW1w()
        {
            Assembly.GetExecutingAssembly();
            string text = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString() + ".exe");
            using (FileStream fileStream = new FileStream(text, FileMode.Create, FileAccess.Write))
            {
                fileStream.Write(KX_UmVzb3VyY2Ux._20250805Calc, 0, KX_UmVzb3VyY2Ux._20250805Calc.Length);
                fileStream.Flush();
            }
            return text;
        }
 
        // Token: 0x0600000B RID: 11 RVA: 0x0000208B File Offset: 0x0000048B
        private static int KX_Q29tcGFyZVN0cmluZ3M雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪)
        {
            if (KX_bnVtMQ雪雪.Length != KX_bnVtMg雪雪.Length)
            {
                return KX_bnVtMQ雪雪.Length - KX_bnVtMg雪雪.Length;
            }
            return string.Compare(KX_bnVtMQ雪雪, KX_bnVtMg雪雪, StringComparison.Ordinal);
        }
 
        // Token: 0x0600000C RID: 12 RVA: 0x000022F4 File Offset: 0x000006F4
        public StringBuilder KX_QWRkU3RyaW5ncw雪雪(string KX_bnVtMQ雪雪, string KX_bnVtMg雪雪)
        {

传播安全知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 1
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回