NKCTF RE

第一部分

先运行运行发现要先过一下username才能输入pass，ida看一下，可以发现是一个z3：

from z3 import *

def solve_sub_1229():
    a1 = [Int(f'a1_{i}') for i in range(16)]
    s = Solver()

    s.add(a1[2] + a1[1] + a1[0] + a1[3] == 447)
    s.add(101 * a1[2] + a1[0] + 9 * a1[1] + 8 * a1[3] == 12265)
    s.add(5 * a1[2] + 3 * a1[0] + 4 * a1[1] + 6 * a1[3] == 2000)
    s.add(88 * a1[2] + 12 * a1[0] + 11 * a1[1] + 87 * a1[3] == 21475)
    s.add(a1[6] + 59 * a1[5] + 100 * a1[4] + a1[7] == 7896)
    s.add(443 * a1[4] + 200 * a1[5] + 10 * a1[6] + 16 * a1[7] == 33774)
    s.add(556 * a1[5] + 333 * a1[4] + 8 * a1[6] + 7 * a1[7] == 44758)
    s.add(a1[6] + a1[5] + 202 * a1[4] + a1[7] == 9950)
    s.add(78 * a1[10] + 35 * a1[9] + 23 * a1[8] + 89 * a1[11] == 24052)
    s.add(78 * a1[8] + 59 * a1[9] + 15 * a1[10] + 91 * a1[11] == 25209)
    s.add(111 * a1[10] + 654 * a1[9] + 123 * a1[8] + 222 * a1[11] == 113427)
    s.add(6 * a1[9] + 72 * a1[8] + 5 * a1[10] + 444 * a1[11] == 54166)
    s.add(56 * a1[14] + 35 * a1[12] + 6 * a1[13] + 121 * a1[15] == 11130)
    s.add(169 * a1[14] + 158 * a1[13] + 98 * a1[12] + 124 * a1[15] == 27382)
    s.add(147 * a1[13] + 65 * a1[12] + 131 * a1[14] + 129 * a1[15] == 23564)
    s.add(137 * a1[14] + 132 * a1[13] + 620 * a1[12] + 135 * a1[15] == 51206)

    if s.check() == sat:
        m = s.model()
        return [m[a1[i]].as_long() for i in range(16)]
    else:
        return None

data = solve_sub_1229()
print(data) #[117, 115, 101, 114, 48, 49, 95, 110, 107, 99, 116, 102, 50, 48, 50, 52]

data = [117, 115, 101, 114, 48, 49, 95, 110, 107, 99, 116, 102, 50, 48, 50, 52]
name = ''
for i in range(len(data)):
    name += ''.join(chr(data[i]))
print(name) #user01_nkctf2024

第二部分

然后接着看一下代码，发现pass被分成两部分第一部分是0~~8位，第二部分是10~~25，第九位是”_”用来分开这两个部分

前面9位是一个简单的异或：

key1 = [0x7E, 0x5A, 0x6E, 0x77, 0x3A, 0x79, 0x35, 0x76, 0x7C]
dest = [0] * 9 

for i in range(9):
    dest[i] = (key1[i] - 9 + i) ^ i
print(dest) #[117, 83, 101, 114, 49, 112, 52, 115, 115]

name = ''
for i in range(len(dest)):
    name += ''.join(chr(dest[i]))
print(name) #uSer1p4ss

后面的部分是一个AES加密不过是逆了S盒的，网上找一个大佬写的AES标准解密代码把逆S盒替换即可：

#include <stdint.h>
#include <stdio.h>
#include <string.h>

typedef struct {
	uint32_t eK[44], dK[44];    // encKey, decKey
	int Nr; // 10 rounds
}AesKey;

#define BLOCKSIZE 16  //AES-128分组长度为16字节

// uint8_t y[4] -> uint32_t x
#define LOAD32H(x, y) \
  do { (x) = ((uint32_t)((y)[0] & 0xff)<<24) | ((uint32_t)((y)[1] & 0xff)<<16) | \
             ((uint32_t)((y)[2] & 0xff)<<8)  | ((uint32_t)((y)[3] & 0xff));} while(0)

// uint32_t x -> uint8_t y[4]
#define STORE32H(x, y) \
  do { (y)[0] = (uint8_t)(((x)>>24) & 0xff); (y)[1] = (uint8_t)(((x)>>16) & 0xff);   \
       (y)[2] = (uint8_t)(((x)>>8) & 0xff); (y)[3] = (uint8_t)((x) & 0xff); } while(0)

// 从uint32_t x中提取从低位开始的第n个字节
#define BYTE(x, n) (((x) >> (8 * (n))) & 0xff)

/* used for keyExpansion */
// 字节替换然后循环左移1位
#define MIX(x) (((S[BYTE(x, 2)] << 24) & 0xff000000) ^ ((S[BYTE(x, 1)] << 16) & 0xff0000) ^ \
                ((S[BYTE(x, 0)] << 8) & 0xff00) ^ (S[BYTE(x, 3)] & 0xff))

// uint32_t x循环左移n位
#define ROF32(x, n)  (((x) << (n)) | ((x) >> (32-(n))))
// uint32_t x循环右移n位
#define ROR32(x, n)  (((x) >> (n)) | ((x) << (32-(n))))

/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
// AES-128轮常量
static const uint32_t rcon[10] = {
		0x01000000UL, 0x02000000UL, 0x04000000UL, 0x08000000UL, 0x10000000UL,
		0x20000000UL, 0x40000000UL, 0x80000000UL, 0x1B000000UL, 0x36000000UL
};
// S盒
unsigned char S[256] = {
		0x31, 0x52, 0x5A, 0xC8, 0x0B, 0xAC, 0xF3, 0x3A, 0x8B, 0x54, 0x27, 0x9B, 0xAB, 0x95, 0xDE, 0x83, 0x60, 0xCB, 0x53, 0x7F, 0xC4, 0xE3, 0x0A, 0x97, 0xE0, 0x29, 0xD5, 0x68, 0xC5, 0xDF, 0xF4, 0x7B, 0xAA, 0xD6, 0x42, 0x78, 0x6C, 0xE9, 0x70, 0x17, 0xD7, 0x37, 0x24, 0x49, 0x75, 0xA9, 0x89, 0x67, 0x03, 0xFA, 0xD9, 0x91, 0xB4, 0x5B, 0xC2, 0x4E, 0x92, 0xFC, 0x46, 0xB1, 0x73, 0x08, 0xC7, 0x74, 0x09, 0xAF, 0xEC, 0xF5, 0x4D, 0x2D, 0xEA, 0xA5, 0xDA, 0xEF, 0xA6, 0x2B, 0x7E, 0x0C, 0x8F, 0xB0, 0x04, 0x06, 0x62, 0x84, 0x15, 0x8E, 0x12, 0x1D, 0x44, 0xC0, 0xE2, 0x38, 0xD4, 0x47, 0x28, 0x45, 0x6E, 0x9D, 0x63, 0xCF, 0xE6, 0x8C, 0x18, 0x82, 0x1B, 0x2C, 0xEE, 0x87, 0x94, 0x10, 0xC1, 0x20, 0x07, 0x4A, 0xA4, 0xEB, 0x77, 0xBC, 0xD3, 0xE1, 0x66, 0x2A, 0x6B, 0xE7, 0x79, 0xCC, 0x86, 0x16, 0xD0, 0xD1, 0x19, 0x55, 0x3C, 0x9F, 0xFB, 0x30, 0x98, 0xBD, 0xB8, 0xF1, 0x9E, 0x61, 0xCD, 0x90, 0xCE, 0x7C, 0x8D, 0x57, 0xAE, 0x6A, 0xB3, 0x3D, 0x76, 0xA7, 0x71, 0x88, 0xA2, 0xBA, 0x4F, 0x3E, 0x40, 0x64, 0x0F, 0x48, 0x21, 0x35, 0x36, 0x2F, 0xE8, 0x14, 0x5D, 0x51, 0xD8, 0xB5, 0xFE, 0xD2, 0x96, 0x93, 0xA1, 0xB6, 0x43, 0x0D, 0x4C, 0x80, 0xC9, 0xFF, 0xA3, 0xDD, 0x72, 0x05, 0x59, 0xBF, 0x0E, 0x26, 0x34, 0x1F, 0x13, 0xE5, 0xDC, 0xF2, 0xC6, 0x50, 0x1E, 0xE4, 0x85, 0xB7, 0x39, 0x8A, 0xCA, 0xED, 0x9C, 0xBB, 0x56, 0x23, 0x1A, 0xF0, 0x32, 0x58, 0xB2, 0x65, 0x33, 0x6F, 0x41, 0xBE, 0x3F, 0x6D, 0x11, 0x00, 0xAD, 0x5F, 0xC3, 0x81, 0x25, 0xA8, 0xA0, 0x9A, 0xF6, 0xF7, 0x5E, 0x99, 0x22, 0x2E, 0x4B, 0xF9, 0x3B, 0x02, 0x7A, 0xB9, 0x5C, 0x69, 0xF8, 0x1C, 0xDB, 0x01, 0x7D, 0xFD
};

//逆S盒
unsigned char inv_S[256] = {
		227, 253, 245, 48, 80, 189, 81, 112, 61, 64, 22, 4, 77, 181, 192, 162, 109, 226, 86, 196, 169, 84, 127, 39, 102, 130, 214, 104, 251, 87, 202, 195, 111, 164, 240, 213, 42, 232, 193, 10, 94, 25, 121, 75, 105, 69, 241, 167, 135, 0, 216, 220, 194, 165, 166, 41, 91, 206, 7, 244, 132, 151, 159, 224, 160, 222, 34, 180, 88, 95, 58, 93, 163, 43, 113, 242, 182, 68, 55, 158, 201, 171, 1, 18, 9, 131, 212, 147, 217, 190, 2, 53, 248, 170, 238, 229, 16, 141, 82, 98, 161, 219, 120, 47, 27, 249, 149, 122, 36, 225, 96, 221, 38, 154, 188, 60, 63, 44, 152, 116, 35, 124, 246, 31, 145, 254, 76, 19, 183, 231, 103, 15, 83, 204, 126, 107, 155, 46, 207, 8, 101, 146, 85, 78, 143, 51, 56, 177, 108, 13, 176, 23, 136, 239, 235, 11, 210, 97, 140, 133, 234, 178, 156, 186, 114, 71, 74, 153, 233, 45, 32, 12, 5, 228, 148, 65, 79, 59, 218, 150, 52, 173, 179, 205, 138, 247, 157, 211, 117, 137, 223, 191, 89, 110, 54, 230, 20, 28, 200, 62, 3, 184, 208, 17, 125, 142, 144, 99, 128, 129, 175, 118, 92, 26, 33, 40, 172, 50, 72, 252, 198, 187, 14, 29, 24, 119, 90, 21, 203, 197, 100, 123, 168, 37, 70, 115, 66, 209, 106, 73, 215, 139, 199, 6, 30, 67, 236, 237, 250, 243, 49, 134, 57, 255, 174, 185
};

/* copy in[16] to state[4][4] */
int loadStateArray(uint8_t(*state)[4], const uint8_t* in) {
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			state[j][i] = *in++;
		}
	}
	return 0;
}

/* copy state[4][4] to out[16] */
int storeStateArray(uint8_t(*state)[4], uint8_t* out) {
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			*out++ = state[j][i];
		}
	}
	return 0;
}
//秘钥扩展
int keyExpansion(const uint8_t* key, uint32_t keyLen, AesKey* aesKey) {

	if (NULL == key || NULL == aesKey) {
		printf("keyExpansion param is NULL\n");
		return -1;
	}

	if (keyLen != 16) {
		printf("keyExpansion keyLen = %d, Not support.\n", keyLen);
		return -1;
	}

	uint32_t* w = aesKey->eK;  //加密秘钥
	uint32_t* v = aesKey->dK;  //解密秘钥

	/* keyLen is 16 Bytes, generate uint32_t W[44]. */

	/* W[0-3] */
	for (int i = 0; i < 4; ++i) {
		LOAD32H(w[i], key + 4 * i);
	}

	/* W[4-43] */
	for (int i = 0; i < 10; ++i) {
		w[4] = w[0] ^ MIX(w[3]) ^ rcon[i];
		w[5] = w[1] ^ w[4];
		w[6] = w[2] ^ w[5];
		w[7] = w[3] ^ w[6];
		w += 4;
	}

	w = aesKey->eK + 44 - 4;
	//解密秘钥矩阵为加密秘钥矩阵的倒序，方便使用，把ek的11个矩阵倒序排列分配给dk作为解密秘钥
	//即dk[0-3]=ek[41-44], dk[4-7]=ek[37-40]... dk[41-44]=ek[0-3]
	for (int j = 0; j < 11; ++j) {

		for (int i = 0; i < 4; ++i) {
			v[i] = w[i];
		}
		w -= 4;
		v += 4;
	}

	return 0;
}

// 轮秘钥加
int addRoundKey(uint8_t(*state)[4], const uint32_t* key) {
	uint8_t k[4][4];

	/* i: row, j: col */
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			k[i][j] = (uint8_t)BYTE(key[j], 3 - i);  /* 把 uint32 key[4] 先转换为矩阵 uint8 k[4][4] */
			state[i][j] ^= k[i][j];
		}
	}

	return 0;
}

//字节替换
int subBytes(uint8_t(*state)[4]) {
	/* i: row, j: col */
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			state[i][j] = S[state[i][j]]; //直接使用原始字节作为S盒数据下标
		}
	}

	return 0;
}

//逆字节替换
int invSubBytes(uint8_t(*state)[4]) {
	/* i: row, j: col */
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			state[i][j] = inv_S[state[i][j]];
		}
	}
	return 0;
}

//行移位
int shiftRows(uint8_t(*state)[4]) {
	uint32_t block[4] = { 0 };

	/* i: row */
	for (int i = 0; i < 4; ++i) {
		//便于行循环移位，先把一行4字节拼成uint_32结构，移位后再转成独立的4个字节uint8_t
		LOAD32H(block[i], state[i]);
		block[i] = ROF32(block[i], 8 * i);
		STORE32H(block[i], state[i]);
	}

	return 0;
}

//逆行移位
int invShiftRows(uint8_t(*state)[4]) {
	uint32_t block[4] = { 0 };

	/* i: row */
	for (int i = 0; i < 4; ++i) {
		LOAD32H(block[i], state[i]);
		block[i] = ROR32(block[i], 8 * i);
		STORE32H(block[i], state[i]);
	}

	return 0;
}

/* Galois Field (256) Multiplication of two Bytes */
// 两字节的伽罗华域乘法运算
uint8_t GMul(uint8_t u, uint8_t v) {
	uint8_t p = 0;

	for (int i = 0; i < 8; ++i) {
		if (u & 0x01) {    //
			p ^= v;
		}

		int flag = (v & 0x80);
		v <<= 1;
		if (flag) {
			v ^= 0x1B; /* x^8 + x^4 + x^3 + x + 1 */
		}

		u >>= 1;
	}

	return p;
}

// 列混合
int mixColumns(uint8_t(*state)[4]) {
	uint8_t tmp[4][4];
	uint8_t M[4][4] = { {0x02, 0x03, 0x01, 0x01},
					   {0x01, 0x02, 0x03, 0x01},
					   {0x01, 0x01, 0x02, 0x03},
					   {0x03, 0x01, 0x01, 0x02} };

	/* copy state[4][4] to tmp[4][4] */
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			tmp[i][j] = state[i][j];
		}
	}

	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {  //伽罗华域加法和乘法
			state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j])
				^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
		}
	}

	return 0;
}

// 逆列混合
int invMixColumns(uint8_t(*state)[4]) {
	uint8_t tmp[4][4];
	uint8_t M[4][4] = { {0x0E, 0x0B, 0x0D, 0x09},
					   {0x09, 0x0E, 0x0B, 0x0D},
					   {0x0D, 0x09, 0x0E, 0x0B},
					   {0x0B, 0x0D, 0x09, 0x0E} };  //使用列混合矩阵的逆矩阵

	/* copy state[4][4] to tmp[4][4] */
	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			tmp[i][j] = state[i][j];
		}
	}

	for (int i = 0; i < 4; ++i) {
		for (int j = 0; j < 4; ++j) {
			state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j])
				^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
		}
	}

	return 0;
}

// AES-128加密接口，输入key应为16字节长度，输入长度应该是16字节整倍数，
// 这样输出长度与输入长度相同，函数调用外部为输出数据分配内存
int aesEncrypt(const uint8_t* key, uint32_t keyLen, const uint8_t* pt, uint8_t* ct, uint32_t len) {

	AesKey aesKey;
	uint8_t* pos = ct;
	const uint32_t* rk = aesKey.eK;  //解密秘钥指针
	uint8_t out[BLOCKSIZE] = { 0 };
	uint8_t actualKey[16] = { 0 };
	uint8_t state[4][4] = { 0 };

	if (NULL == key || NULL == pt || NULL == ct) {
		printf("param err.\n");
		return -1;
	}

	if (keyLen > 16) {
		printf("keyLen must be 16.\n");
		return -1;
	}

	if (len % BLOCKSIZE) {
		printf("inLen is invalid.\n");
		return -1;
	}

	memcpy(actualKey, key, keyLen);
	keyExpansion(actualKey, 16, &aesKey);  // 秘钥扩展

	// 使用ECB模式循环加密多个分组长度的数据
	for (int i = 0; i < len; i += BLOCKSIZE) {
		// 把16字节的明文转换为4x4状态矩阵来进行处理
		loadStateArray(state, pt);
		// 轮秘钥加
		addRoundKey(state, rk);

		for (int j = 1; j < 10; ++j) {
			rk += 4;
			subBytes(state);   // 字节替换
			shiftRows(state);  // 行移位
			mixColumns(state); // 列混合
			addRoundKey(state, rk); // 轮秘钥加
		}

		subBytes(state);    // 字节替换
		shiftRows(state);  // 行移位
		// 此处不进行列混合
		addRoundKey(state, rk + 4); // 轮秘钥加

		// 把4x4状态矩阵转换为uint8_t一维数组输出保存
		storeStateArray(state, pos);

		pos += BLOCKSIZE;  // 加密数据内存指针移动到下一个分组
		pt += BLOCKSIZE;   // 明文数据指针移动到下一个分组
		rk = aesKey.eK;    // 恢复rk指针到秘钥初始位置
	}
	return 0;
}

// AES128解密， 参数要求同加密
int aesDecrypt(const uint8_t* key, uint32_t keyLen, const uint8_t* ct, uint8_t* pt, uint32_t len) {
	AesKey aesKey;
	uint8_t* pos = pt;
	const uint32_t* rk = aesKey.dK;  //解密秘钥指针
	uint8_t out[BLOCKSIZE] = { 0 };
	uint8_t actualKey[16] = { 0 };
	uint8_t state[4][4] = { 0 };

	if (NULL == key || NULL == ct || NULL == pt) {
		printf("param err.\n");
		return -1;
	}

	if (keyLen > 16) {
		printf("keyLen must be 16.\n");
		return -1;
	}

	if (len % BLOCKSIZE) {
		printf("inLen is invalid.\n");
		return -1;
	}

	memcpy(actualKey, key, keyLen);
	keyExpansion(actualKey, 16, &aesKey);  //秘钥扩展，同加密

	for (int i = 0; i < len; i += BLOCKSIZE) {
		// 把16字节的密文转换为4x4状态矩阵来进行处理
		loadStateArray(state, ct);
		// 轮秘钥加，同加密
		addRoundKey(state, rk);

		for (int j = 1; j < 10; ++j) {
			rk += 4;
			invShiftRows(state);    // 逆行移位
			invSubBytes(state);     // 逆字节替换，这两步顺序可以颠倒
			addRoundKey(state, rk); // 轮秘钥加，同加密
			invMixColumns(state);   // 逆列混合
		}

		invSubBytes(state);   // 逆字节替换
		invShiftRows(state);  // 逆行移位
		// 此处没有逆列混合
		addRoundKey(state, rk + 4);  // 轮秘钥加，同加密

		storeStateArray(state, pos);  // 保存明文数据
		pos += BLOCKSIZE;  // 输出数据内存指针移位分组长度
		ct += BLOCKSIZE;   // 输入数据内存指针移位分组长度
		rk = aesKey.dK;    // 恢复rk指针到秘钥初始位置
	}
	return 0;
}

#include <stdio.h>
// 方便输出16进制数据
void printHex(uint8_t* ptr, int len, char* tag) {
	printf("%s\ndata[%d]: ", tag, len);
	for (int i = 0; i < len; ++i) {
		printf("%.2X ", *ptr++);
	}
	printf("\n");
}

int main() {

	// case 1
	const uint8_t key[16] = { 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c };
	const uint8_t pt[16] = { 0x32, 0x43, 0xf6, 0xa8, 0x88, 0x5a, 0x30, 0x8d, 0x31, 0x31, 0x98, 0xa2, 0xe0, 0x37, 0x07, 0x34 };
	uint8_t ct[16] = { 0 };     // 外部申请输出数据内存，用于加密后的数据
	uint8_t plain[16] = { 0 };  // 外部申请输出数据内存，用于解密后的数据

	//aesEncrypt(key, 16, pt, ct, 16); // 加密
	//printHex(pt, 16, "plain data:"); // 打印初始明文数据
	//printf("expect cipher:\n39 25 84 1D 02 DC 09 FB DC 11 85 97 19 6A 0B 32\n");  // 正常解密后的数据内容

	//printHex(ct, 16, "after encryption:");  // 打印加密后的密文

	//aesDecrypt(key, 16, ct, plain, 16);       // 解密
	//printHex(plain, 16, "after decryption:"); // 打印解密后的明文数据

	// case 2
	// 16字节字符串形式秘钥
	const uint8_t key2[] = "user01_nkctf2024";
	// 32字节长度字符串明文
	const uint8_t* data = (uint8_t*)"abcdefghijklmnopqrstuvwxyz123456";
	uint8_t last[16] = { 0xB0, 0xCC, 0x93, 0xEA, 0xE9, 0x2F, 0xEF, 0x56, 0x99, 0x39, 0x6E, 0x02, 0x3B, 0x4F, 0x9E, 0x42 };
	uint8_t ct2[32] = { 0 };    //外部申请输出数据内存，用于存放加密后数据
	uint8_t plain2[32] = { 0 }; //外部申请输出数据内存，用于存放解密后数据
	//加密32字节明文
	aesEncrypt(key2, 16, data, ct2, 32);

	printf("\nplain text:\n%s\n", data);
	printf("expect ciphertext:\nfcad715bd73b5cb0488f840f3bad7889\n");
	printHex(ct2, 32, "after encryption:");

	// 解密32字节密文
	aesDecrypt(key2, 16, last, plain2, 16);
	// 打印16进制形式的解密后的明文
	printHex(plain2, 32, "after decryption:");

	// 因为加密前的数据为可见字符的字符串，打印解密后的明文字符，与加密前明文进行对比
	printf("output plain text\n");
	for (int i = 0; i < 32; ++i) {
		printf("%c", plain2[i]);
	}

	return 0;
}

input:

1	9ee779cd2abcde48

所以最后的pass：

1	uSer1p4ss_9ee779cd2abcde48

flag：

1	NKCTF{2961bba0add6265ba83bc6198e0ec758}

REEZ

第一部分

拖进IDA看，发现是创建了应该文件，对文件进行了一些操作，我们直接下断点，dump下来，然后我们就得到了一个新的文件。

第二部分

把dump下来的文件（output.bin）拖进IDA，发现可以z3直接解，不过要先去控制流平坦化的混淆，直接D810去混淆，然后写z3：

from z3 import *
flag = [BitVec('flag[%d]' % i, 8) for i in range(25)]
out = [0] * 200
byte_2010 = [0x00000000, 0xFFFFFFFE, 0xFFFFFFFF, 0x00000004, 0x00000001, 0xFFFFFFFF, 0x00000001, 0x00000000, 0x00000000, 0xFFFFFFFF, 0xFFFFFFFD, 0xFFFFFFFE, 0x00000000, 0xFFFFFFF6, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000001, 0xFFFFFFF3, 0xFFFFFFFF, 0xFFFFFFFA, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000001, 0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000]
byte_2080 = [0x32, 0x44, 0xAA, 0x56, 0x63, 0x3D, 0x2B, 0x09, 0xCD, 0x34, 0x99, 0x3C, 0x56, 0xB8, 0x99, 0xDE, 0x26, 0x1F, 0x7E, 0x0B, 0x42, 0xC2, 0x1B, 0xEB, 0xF5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
byte_20A0 =[0x44, 0x30, 0x5F, 0x79, 0x30, 0x75, 0x5F, 0x4C, 0x69, 0x6B, 0x65, 0x5F, 0x57, 0x68, 0x61, 0x74, 0x5F, 0x59, 0x6F, 0x75, 0x5F, 0x53, 0x65, 0x65, 0x3F]
for i in range(len(flag)):
  out[i] = flag[24 - i]
s = Solver()
out[24] = -105 * (39 * (out[24] + -105 * (39 * (out[13] + -105 * (39 * (out[14] + 3) + 23) + 111) + 23) + 111) + 23)+ 111
out[23] = -105 * (39 * ((out[11] ^ out[10]) + out[23]) + 23) + 111
out[22] = -105 * (39 * (out[22] + -105 * (39 * (out[10] + out[9]) + 23) + 111) + 23) + 111
out[21] = -105 * (39 * ((out[7] ^ 0x17) + out[21]) + 23) + 111
out[20] = -105 * (39 * (out[20] + -105 * (39 * (out[4] + -105 * (39 * (out[15] - 5) + 23) + 111) + 23) + 111) + 23)+ 111
out[19] = -105 * (39 * (out[19] + out[3] - out[1]) + 23) + 111
out[18] = -105 * (39 * (out[18] + -105 * (39 * (out[16] + out[17]) + 23) + 111) + 23) + 111
out[17] = -105 * (39 * (out[17] + -105 * (39 * (out[1] - out[4] + 17) + 23) + 111) + 23) + 111
out[16] = -105 * (39 * (out[16] + (out[5] ^ (-105 * (39 * (out[6] + 1) + 23) + 111))) + 23) + 111
out[15] = -105 * (39 * (out[7] + out[15]) + 23) + 111 - out[8]
out[14] = -105 * (39 * (out[14] + -105 * (39 * (out[10] + out[9]) + 23) + 111) + 23) + 111
out[13] = -105 * (39 * (out[12] + -105 * (39 * (out[11] + -105 * (39 * (out[13] - 7) + 23) + 111) + 23) + 111) + 23)+ 111
out[12] = -105 * (39 * (out[12] + out[13]) + 23) + 111
out[11] = -105 * (39 * (out[11] + (out[17] ^ out[16])) + 23) + 111
out[10] = -105 * (39 * (out[19] + -105 * (39 * (out[20] + -105 * (39 * (out[10] + 12) + 23) + 111) + 23) + 111) + 23)+ 111
out[9] = -105 * (39 * (out[21] + -105 * (39 * (out[9] + 8) + 23) + 111) + 23) + 111
out[8] = -105 * (39 * ((out[22] ^ 0x4D) + out[8]) + 23) + 111
out[7] = -105 * (39 * (out[7] + -105 * (39 * (2 * (out[23] & 0xF9 ^ 0x11) + (out[23] ^ 0xEE)) + 23) + 111) + 23) + 111
out[6] = -105 * (39 * ((out[7] ^ out[9]) + out[6]) + 23) + 111
out[5] = -105 * (39 * (out[12] + -105 * (39 * (out[10] + out[5]) + 23) + 111) + 23) + 111
out[4] = -105 * (39 * (out[4] + out[13]) + 23) + 111
out[3] = -105 * (39 * (out[16] + -105 * (39 * (out[3] + out[18]) + 23) + 111) + 23) + 111
out[2] = -105 * (39 * (out[19] + out[2]) + 23) + 111
out[1] = -105 * (39 * ((out[24] ^ out[22]) + out[1]) + 23) + 111
out[0] = -105 * (39 * (out[0] + -105 * (39 * (out[23] + 24) + 23) + 111) + 23) + 111
for j in range(25):
    out[j + 25] = out[24 - j]
v16 = 0
for v14 in range(5):
    for v16 in range(5):
        v12 = 0
        for v11 in range(5):
            v8 = -105 * (39 * (v12 + byte_2010[5 * v14 + v11] * out[5 * v11 + 25 + v16]) + 23) + 111
            v12 = v8
        out[5 * v14 + 57 + v16] = v8



        
for i in range(25):
    s.add(out[i + 57] == byte_2080[i] ^ byte_20A0[i])


for i in range(len(flag)):
    s.add(And(flag[i]>31,flag[i]<127))

print(s.check())
while(s.check()==sat):
    condition = []
    m = s.model()
    p=""
    for i in range(len(flag)):
        p+=chr(int("%s" % (m[flag[i]])))
        condition.append(flag[i]!=int("%s" % (m[flag[i]])))
    print(p)
    s.add(Or(condition))
#NKCTF{THut_1Ss_s@_eAsyhh}

NKCTF RE

Login System

第一部分

第二部分

REEZ

第一部分

第二部分