-
-
[原创][HWS]animals
-
发表于: 2025-10-22 17:51
-
以前老博客的wp，存看雪
首先IDA打开
熟悉的味道熟悉的花
整整两段，没有办法，挫一个idapython脚本梭一下
main函数分析错了，并且下面这一段不能按p声明。
往下翻找发现
这里有一个字节未识别，按C识别一下
识别完了之后一大段地址全部爆红
此时我们回到main函数下面继续按p
可以按p了，但是出main函数仍旧是有问题的，并且我们tab查看一下函数内容
寄存器丢失的同时还非常的乱，所以不能直接p
我们需要修改main函数的起始地点。
这个时候主函数就正常了
大致就是个猜动物游戏，选择的动物序号md5加密就是flag。
可以发现需要选择9次
每次选6个也就是6^9的选择次数，那么我们查看之后发现只有一千多万次，可以直接使用pwntools进行一个爆破来解决问题，但是这里介绍的方法就是直接分析题目
程序有反调试
分析程序之后可以发现程序是将你选择的动物全称进行一个变异的md5加密去比较的
看到一个比较处，我们查看比较内容
可以发现是一串md5数字
我们分析函数可以查找到该函数
该函数对变异md5后的值进行了一个处理
然后看到md5函数
发现md5函数的编码表被替换了，1，2交换3，4交换因此我们可以自己实现脚本来进行一个md5爆破了
得到选择的动物，然后找到他们的编码为051410233
md5加密后即为flag
start_add = 0x400800end_add = 0x406e22for i in range(start_add,end_add): if get_wide_dword(i) == 0x08750a74: patch_dword(i,0x90909090) patch_dword(i+4,0x90909090) patch_dword(i+8,0x90909090) elif get_wide_dword(i) == 0x13751574: patch_dword(i,0x90909090) patch_dword(i+4,0x90909090) patch_dword(i+8,0x90909090) patch_dword(i+12,0x90909090) patch_dword(i+16,0x90909090) patch_word(i+20,0x9090) patch_byte(i+22,0x90)start_add = 0x400800end_add = 0x406e22for i in range(start_add,end_add): if get_wide_dword(i) == 0x08750a74: patch_dword(i,0x90909090) patch_dword(i+4,0x90909090) patch_dword(i+8,0x90909090) elif get_wide_dword(i) == 0x13751574: patch_dword(i,0x90909090) patch_dword(i+4,0x90909090) patch_dword(i+8,0x90909090) patch_dword(i+12,0x90909090) patch_dword(i+16,0x90909090) patch_word(i+20,0x9090) patch_byte(i+22,0x90)void __fastcall main(__int64 a1, char **a2, char **a3){ size_t v3; // rax size_t v4; // rax size_t v5; // rax size_t v6; // rax size_t v7; // rax size_t v8; // rax int v9; // ecx int v10; // eax unsigned int v11; // eax size_t v12; // rax const char *v13; // [rsp+1Ch] [rbp-318h] const char *v14; // [rsp+6Ch] [rbp-2C8h] const char *v15; // [rsp+84h] [rbp-2B0h] const char *v16; // [rsp+9Ch] [rbp-298h] const char *v17; // [rsp+B4h] [rbp-280h] const char *v18; // [rsp+CCh] [rbp-268h] char *src; // [rsp+E4h] [rbp-250h] int i; // [rsp+148h] [rbp-1ECh] char v21[88]; // [rsp+14Ch] [rbp-1E8h] BYREF char v22[24]; // [rsp+1A4h] [rbp-190h] BYREF int v23; // [rsp+1BCh] [rbp-178h] BYREF int v24; // [rsp+1C0h] [rbp-174h] char v25[256]; // [rsp+1C4h] [rbp-170h] BYREF char *s; // [rsp+2C4h] [rbp-70h] BYREF char *v27; // [rsp+2CCh] [rbp-68h] char *v28; // [rsp+2D4h] [rbp-60h] char *v29; // [rsp+2DCh] [rbp-58h] char *v30; // [rsp+2E4h] [rbp-50h] char *v31; // [rsp+2ECh] [rbp-48h] pthread_t newthread[2]; // [rsp+2F4h] [rbp-40h] BYREF int v33; // [rsp+304h] [rbp-30h] int v34; // [rsp+308h] [rbp-2Ch] v34 = 0; v33 = a1; newthread[1] = (pthread_t)a2; sub_405FF0(a1, a2, a3); memset(&s, 0, 0x30uLL); s = (_BYTE *)("0. cat" + 3); v27 = (_BYTE *)("1. dog" + 3); v28 = (_BYTE *)("2. fox" + 3); v29 = (_BYTE *)("3. panda" + 3); v30 = (_BYTE *)("4. dragon" + 3); v31 = (_BYTE *)("5. monkey" + 3); memset(v25, 0, sizeof(v25)); v24 = 0; while ( v24 < 9 ) { if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) goto LABEL_26; while ( 1 ) { v23 = 0; puts("Welcome Animal shop"); sub_400900(); printf("Please input my favorite animal: "); __isoc99_scanf("%d", &v23); if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) ) break;LABEL_26: v23 = 0; puts("Welcome Animal shop"); sub_400900(); printf("Please input my favorite animal: "); __isoc99_scanf("%d", &v23); } switch ( v23 ) { case 0: src = s; v3 = strlen(s); strncat(v25, src, v3); goto LABEL_16; case 1: v18 = v27; v4 = strlen(v27); strncat(v25, v18, v4); goto LABEL_16; case 2: v17 = v28; v5 = strlen(v28); strncat(v25, v17, v5); goto LABEL_16; case 3: v16 = v29; v6 = strlen(v29); strncat(v25, v16, v6); goto LABEL_16; case 4: v15 = v30; v7 = strlen(v30); strncat(v25, v15, v7); goto LABEL_16; case 5: if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | ((unsigned __int8)~(dword_6080F4 < 10) ^ (unsigned __int8)~(((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) & 1 ) goto LABEL_12; do { v13 = v31; v12 = strlen(v31); strncat(v25, v13, v12);LABEL_12: v14 = v31; v8 = strlen(v31); strncat(v25, v14, v8); v9 = (((_BYTE)dword_608138 - 44 + 43) * (_BYTE)dword_608138) & 1; } while ( !((dword_6080F4 < 10) ^ (v9 == 0) | (dword_6080F4 < 10 && v9 == 0)) );LABEL_16: ++v24; break; default: v10 = (((_BYTE)dword_608138 - 14 + 13) * (_BYTE)dword_608138) & 1; if ( (dword_6080F4 < 10) ^ (v10 == 0) | (dword_6080F4 < 10 && v10 == 0) ) { puts("Input Err."); exit(0); } puts("Input Err."); exit(0); } } pthread_create(newthread, 0LL, start_routine, 0LL); pthread_join(newthread[0], 0LL); puts("done."); sub_4009A0(v21); v11 = strlen(v25); sub_400B30(v21, v25, v11); sub_4059A0(v21, v22); for ( i = 0; ; ++i ) { while ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) ; if ( i >= 16 ) break; if ( byte_608090[i] != v22[i] ) { puts("Wrong."); exit(0); } } if ( !((dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) )LABEL_30: puts("Win! , flag is flag{md5(input)}"); puts("Win! , flag is flag{md5(input)}"); if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) goto LABEL_30;}void __fastcall main(__int64 a1, char **a2, char **a3){ size_t v3; // rax size_t v4; // rax size_t v5; // rax size_t v6; // rax size_t v7; // rax size_t v8; // rax int v9; // ecx int v10; // eax unsigned int v11; // eax size_t v12; // rax const char *v13; // [rsp+1Ch] [rbp-318h] const char *v14; // [rsp+6Ch] [rbp-2C8h] const char *v15; // [rsp+84h] [rbp-2B0h] const char *v16; // [rsp+9Ch] [rbp-298h] const char *v17; // [rsp+B4h] [rbp-280h] const char *v18; // [rsp+CCh] [rbp-268h] char *src; // [rsp+E4h] [rbp-250h] int i; // [rsp+148h] [rbp-1ECh] char v21[88]; // [rsp+14Ch] [rbp-1E8h] BYREF char v22[24]; // [rsp+1A4h] [rbp-190h] BYREF int v23; // [rsp+1BCh] [rbp-178h] BYREF int v24; // [rsp+1C0h] [rbp-174h] char v25[256]; // [rsp+1C4h] [rbp-170h] BYREF char *s; // [rsp+2C4h] [rbp-70h] BYREF char *v27; // [rsp+2CCh] [rbp-68h] char *v28; // [rsp+2D4h] [rbp-60h] char *v29; // [rsp+2DCh] [rbp-58h] char *v30; // [rsp+2E4h] [rbp-50h] char *v31; // [rsp+2ECh] [rbp-48h] pthread_t newthread[2]; // [rsp+2F4h] [rbp-40h] BYREF int v33; // [rsp+304h] [rbp-30h] int v34; // [rsp+308h] [rbp-2Ch] v34 = 0; v33 = a1; newthread[1] = (pthread_t)a2; sub_405FF0(a1, a2, a3); memset(&s, 0, 0x30uLL); s = (_BYTE *)("0. cat" + 3); v27 = (_BYTE *)("1. dog" + 3); v28 = (_BYTE *)("2. fox" + 3); v29 = (_BYTE *)("3. panda" + 3); v30 = (_BYTE *)("4. dragon" + 3); v31 = (_BYTE *)("5. monkey" + 3); memset(v25, 0, sizeof(v25)); v24 = 0; while ( v24 < 9 ) { if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) goto LABEL_26; while ( 1 ) { v23 = 0; puts("Welcome Animal shop"); sub_400900(); printf("Please input my favorite animal: "); __isoc99_scanf("%d", &v23); if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) ) break;LABEL_26: v23 = 0; puts("Welcome Animal shop"); sub_400900(); printf("Please input my favorite animal: "); __isoc99_scanf("%d", &v23); } switch ( v23 ) { case 0: src = s; v3 = strlen(s); strncat(v25, src, v3); goto LABEL_16; case 1: v18 = v27; v4 = strlen(v27); strncat(v25, v18, v4); goto LABEL_16; case 2: v17 = v28; v5 = strlen(v28); strncat(v25, v17, v5); goto LABEL_16; case 3: v16 = v29; v6 = strlen(v29); strncat(v25, v16, v6); goto LABEL_16; case 4: v15 = v30; v7 = strlen(v30); strncat(v25, v15, v7); goto LABEL_16; case 5: if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | ((unsigned __int8)~(dword_6080F4 < 10) ^ (unsigned __int8)~(((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) & 1 ) goto LABEL_12; do { v13 = v31; v12 = strlen(v31); strncat(v25, v13, v12);LABEL_12: v14 = v31; v8 = strlen(v31); strncat(v25, v14, v8); v9 = (((_BYTE)dword_608138 - 44 + 43) * (_BYTE)dword_608138) & 1; } while ( !((dword_6080F4 < 10) ^ (v9 == 0) | (dword_6080F4 < 10 && v9 == 0)) );LABEL_16: ++v24; break; default: v10 = (((_BYTE)dword_608138 - 14 + 13) * (_BYTE)dword_608138) & 1; if ( (dword_6080F4 < 10) ^ (v10 == 0) | (dword_6080F4 < 10 && v10 == 0) ) { puts("Input Err."); exit(0); } puts("Input Err."); exit(0); } } pthread_create(newthread, 0LL, start_routine, 0LL); pthread_join(newthread[0], 0LL); puts("done."); sub_4009A0(v21); v11 = strlen(v25); sub_400B30(v21, v25, v11); sub_4059A0(v21, v22); for ( i = 0; ; ++i ) { while ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) ; if ( i >= 16 ) break; if ( byte_608090[i] != v22[i] ) { puts("Wrong."); exit(0); } } if ( !((dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) )LABEL_30: puts("Win! , flag is flag{md5(input)}"); puts("Win! , flag is flag{md5(input)}"); if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) ) goto LABEL_30;}#include <stdio.h>#include <stdlib.h>#include <stdbool.h>#include <time.h>#include <windows.h>#include<stdio.h>#include <stdio.h>#include <stdbool.h>#include <stdint.h>#include <stdio.h>#include <windows.h>#include <string.h>#include <stdio.h>#include <stdbool.h>#include <windows.h>#define MD5_H typedef struct{ unsigned int count[2]; unsigned int state[4]; unsigned char buffer[64]; }MD5_CTX; #define F(x,y,z) ((x & y) | (~x & z))#define G(x,y,z) ((x & z) | (y & ~z))#define H(x,y,z) (x^y^z)#define I(x,y,z) (y ^ (x | ~z))#define ROTATE_LEFT(x,n) ((x << n) | (x >> (32-n)))#define FF(a,b,c,d,x,s,ac) \ { \ a += F(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define GG(a,b,c,d,x,s,ac) \ { \ a += G(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define HH(a,b,c,d,x,s,ac) \ { \ a += H(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define II(a,b,c,d,x,s,ac) \ { \ a += I(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ } void MD5Init(MD5_CTX *context);void MD5Update(MD5_CTX *context,unsigned char *input,unsigned int inputlen);void MD5Final(MD5_CTX *context,unsigned char digest[16]);void MD5Transform(unsigned int state[4],unsigned char block[64]);void MD5Encode(unsigned char *output,unsigned int *input,unsigned int len);void MD5Decode(unsigned int *output,unsigned char *input,unsigned int len);using namespace std;typedef int status;typedef int selemtype; unsigned char PADDING[]={0x80,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}; void MD5Init(MD5_CTX *context){ context->count[0] = 0; context->count[1] = 0; context->state[0] = 0xEFCDAB89; context->state[1] = 0x67452301; context->state[2] = 0x10325476; context->state[3] = 0x98BADCFE;}void MD5Update(MD5_CTX *context,unsigned char *input,unsigned int inputlen){ unsigned int i = 0,index = 0,partlen = 0; index = (context->count[0] >> 3) & 0x3F; partlen = 64 - index; context->count[0] += inputlen << 3; if(context->count[0] < (inputlen << 3)) context->count[1]++; context->count[1] += inputlen >> 29; if(inputlen >= partlen) { memcpy(&context->buffer[index],input,partlen); MD5Transform(context->state,context->buffer); for(i = partlen;i+64 <= inputlen;i+=64) MD5Transform(context->state,&input[i]); index = 0; } else { i = 0; } memcpy(&context->buffer[index],&input[i],inputlen-i);}void MD5Final(MD5_CTX *context,unsigned char digest[16]){ unsigned int index = 0,padlen = 0; unsigned char bits[8]; index = (context->count[0] >> 3) & 0x3F; padlen = (index < 56)?(56-index):(120-index); MD5Encode(bits,context->count,8); MD5Update(context,PADDING,padlen); MD5Update(context,bits,8); MD5Encode(digest,context->state,16);}void MD5Encode(unsigned char *output,unsigned int *input,unsigned int len){ unsigned int i = 0,j = 0; while(j < len) { output[j] = input[i] & 0xFF; output[j+1] = (input[i] >> 8) & 0xFF; output[j+2] = (input[i] >> 16) & 0xFF; output[j+3] = (input[i] >> 24) & 0xFF; i++; j+=4; }}void MD5Decode(unsigned int *output,unsigned char *input,unsigned int len){ unsigned int i = 0,j = 0; while(j < len) { output[i] = (input[j]) | (input[j+1] << 8) | (input[j+2] << 16) | (input[j+3] << 24); i++; j+=4; }}void MD5Transform(unsigned int state[4],unsigned char block[64]){ unsigned int a = state[0]; unsigned int b = state[1]; unsigned int c = state[2]; unsigned int d = state[3]; unsigned int x[64]; MD5Decode(x,block,64); FF(a, b, c, d, x[ 0], 7, 0xd76aa478); /* 1 */ FF(d, a, b, c, x[ 1], 12, 0xe8c7b756); /* 2 */ FF(c, d, a, b, x[ 2], 17, 0x242070db); /* 3 */ FF(b, c, d, a, x[ 3], 22, 0xc1bdceee); /* 4 */ FF(a, b, c, d, x[ 4], 7, 0xf57c0faf); /* 5 */ FF(d, a, b, c, x[ 5], 12, 0x4787c62a); /* 6 */ FF(c, d, a, b, x[ 6], 17, 0xa8304613); /* 7 */ FF(b, c, d, a, x[ 7], 22, 0xfd469501); /* 8 */ FF(a, b, c, d, x[ 8], 7, 0x698098d8); /* 9 */ FF(d, a, b, c, x[ 9], 12, 0x8b44f7af); /* 10 */ FF(c, d, a, b, x[10], 17, 0xffff5bb1); /* 11 */ FF(b, c, d, a, x[11], 22, 0x895cd7be); /* 12 */ FF(a, b, c, d, x[12], 7, 0x6b901122); /* 13 */ FF(d, a, b, c, x[13], 12, 0xfd987193); /* 14 */ FF(c, d, a, b, x[14], 17, 0xa679438e); /* 15 */ FF(b, c, d, a, x[15], 22, 0x49b40821); /* 16 */ /* Round 2 */ GG(a, b, c, d, x[ 1], 5, 0xf61e2562); /* 17 */ GG(d, a, b, c, x[ 6], 9, 0xc040b340); /* 18 */ GG(c, d, a, b, x[11], 14, 0x265e5a51); /* 19 */ GG(b, c, d, a, x[ 0], 20, 0xe9b6c7aa); /* 20 */ GG(a, b, c, d, x[ 5], 5, 0xd62f105d); /* 21 */ GG(d, a, b, c, x[10], 9, 0x2441453); /* 22 */ GG(c, d, a, b, x[15], 14, 0xd8a1e681); /* 23 */ GG(b, c, d, a, x[ 4], 20, 0xe7d3fbc8); /* 24 */ GG(a, b, c, d, x[ 9], 5, 0x21e1cde6); /* 25 */ GG(d, a, b, c, x[14], 9, 0xc33707d6); /* 26 */ GG(c, d, a, b, x[ 3], 14, 0xf4d50d87); /* 27 */ GG(b, c, d, a, x[ 8], 20, 0x455a14ed); /* 28 */ GG(a, b, c, d, x[13], 5, 0xa9e3e905); /* 29 */ GG(d, a, b, c, x[ 2], 9, 0xfcefa3f8); /* 30 */ GG(c, d, a, b, x[ 7], 14, 0x676f02d9); /* 31 */ GG(b, c, d, a, x[12], 20, 0x8d2a4c8a); /* 32 */ /* Round 3 */ HH(a, b, c, d, x[ 5], 4, 0xfffa3942); /* 33 */ HH(d, a, b, c, x[ 8], 11, 0x8771f681); /* 34 */ HH(c, d, a, b, x[11], 16, 0x6d9d6122); /* 35 */ HH(b, c, d, a, x[14], 23, 0xfde5380c); /* 36 */ HH(a, b, c, d, x[ 1], 4, 0xa4beea44); /* 37 */ HH(d, a, b, c, x[ 4], 11, 0x4bdecfa9); /* 38 */ HH(c, d, a, b, x[ 7], 16, 0xf6bb4b60); /* 39 */ HH(b, c, d, a, x[10], 23, 0xbebfbc70); /* 40 */ HH(a, b, c, d, x[13], 4, 0x289b7ec6); /* 41 */ HH(d, a, b, c, x[ 0], 11, 0xeaa127fa); /* 42 */ HH(c, d, a, b, x[ 3], 16, 0xd4ef3085); /* 43 */ HH(b, c, d, a, x[ 6], 23, 0x4881d05); /* 44 */ HH(a, b, c, d, x[ 9], 4, 0xd9d4d039); /* 45 */ HH(d, a, b, c, x[12], 11, 0xe6db99e5); /* 46 */ HH(c, d, a, b, x[15], 16, 0x1fa27cf8); /* 47 */ HH(b, c, d, a, x[ 2], 23, 0xc4ac5665); /* 48 */ /* Round 4 */ II(a, b, c, d, x[ 0], 6, 0xf4292244); /* 49 */ II(d, a, b, c, x[ 7], 10, 0x432aff97); /* 50 */ II(c, d, a, b, x[14], 15, 0xab9423a7); /* 51 */ II(b, c, d, a, x[ 5], 21, 0xfc93a039); /* 52 */ II(a, b, c, d, x[12], 6, 0x655b59c3); /* 53 */ II(d, a, b, c, x[ 3], 10, 0x8f0ccc92); /* 54 */ II(c, d, a, b, x[10], 15, 0xffeff47d); /* 55 */ II(b, c, d, a, x[ 1], 21, 0x85845dd1); /* 56 */ II(a, b, c, d, x[ 8], 6, 0x6fa87e4f); /* 57 */ II(d, a, b, c, x[15], 10, 0xfe2ce6e0); /* 58 */ II(c, d, a, b, x[ 6], 15, 0xa3014314); /* 59 */ II(b, c, d, a, x[13], 21, 0x4e0811a1); /* 60 */ II(a, b, c, d, x[ 4], 6, 0xf7537e82); /* 61 */ II(d, a, b, c, x[11], 10, 0xbd3af235); /* 62 */ II(c, d, a, b, x[ 2], 15, 0x2ad7d2bb); /* 63 */ II(b, c, d, a, x[ 9], 21, 0xeb86d391); /* 64 */ state[0] += a; state[1] += b; state[2] += c; state[3] += d;}char choices[][10] = { "cat", "dog", "fox", "panda", "dragon", "monkey"};unsigned char answer[] = { 0xCB, 0xA4, 0x7B, 0xE5, 0xF0, 0x1C, 0xD1, 0x95, 0x5C, 0x85, 0x46, 0xA2, 0xB2, 0x4F, 0xBD, 0x18};int main () { //051410233 MD5_CTX md5; unsigned char md5_str[32]={0}; int length = 9; // 总共选择的次数 int choice[length]; // 用于保存每个选择的索引 // 初始化选择索引 for (int i = 0; i < length; i++) { choice[i] = 0; } while (1) { // 拼接动物名称 char animalName[length * 10 + 1]; // 假设每个动物名称不超过10个字符 int index = 0; for (int i = 0; i < length; i++) { int choiceIndex = choice[i]; char *animal = choices[choiceIndex]; while (*animal != '\0') { animalName[index] = *animal; animal++; index++; } } animalName[index] = '\0'; for(int i = 0 ; i < 16 ; i ++ ) { md5_str[i]=0; } MD5Init(&md5); MD5Update(&md5, (unsigned char *)animalName, strlen((char *)animalName)); MD5Final(&md5, (unsigned char *)md5_str); for (int i = 0 ; i < 16 ; i ++ ) { md5_str[i] = (md5_str[i] & 0xE9 | ~md5_str[i] & 0x16); } for(int i = 0 ; i < 16 ; i ++ ) { if(md5_str[i]!=answer[i]) { break; } if(i>5) { printf("%s",animalName); return 0; } } // 更新选择索引 int i = length - 1; while (i >= 0 && choice[i] == 5) { choice[i] = 0; i--; } if (i < 0) { break; } choice[i]++; } return 0;}#include <stdio.h>#include <stdlib.h>#include <stdbool.h>#include <time.h>#include <windows.h>#include<stdio.h>#include <stdio.h>#include <stdbool.h>#include <stdint.h>#include <stdio.h>#include <windows.h>#include <string.h>#include <stdio.h>#include <stdbool.h>#include <windows.h>#define MD5_H typedef struct{ unsigned int count[2]; unsigned int state[4]; unsigned char buffer[64]; }MD5_CTX; #define F(x,y,z) ((x & y) | (~x & z))#define G(x,y,z) ((x & z) | (y & ~z))#define H(x,y,z) (x^y^z)#define I(x,y,z) (y ^ (x | ~z))#define ROTATE_LEFT(x,n) ((x << n) | (x >> (32-n)))#define FF(a,b,c,d,x,s,ac) \ { \ a += F(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define GG(a,b,c,d,x,s,ac) \ { \ a += G(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define HH(a,b,c,d,x,s,ac) \ { \ a += H(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ }#define II(a,b,c,d,x,s,ac) \ { \ a += I(b,c,d) + x + ac; \ a = ROTATE_LEFT(a,s); \ a += b; \ } void MD5Init(MD5_CTX *context);void MD5Update(MD5_CTX *context,unsigned char *input,unsigned int inputlen);void MD5Final(MD5_CTX *context,unsigned char digest[16]);void MD5Transform(unsigned int state[4],unsigned char block[64]);void MD5Encode(unsigned char *output,unsigned int *input,unsigned int len);void MD5Decode(unsigned int *output,unsigned char *input,unsigned int len);using namespace std;
最后于 2025-10-22 17:52
被Shangwendada编辑
，原因：
|
|
|---|---|
