2021-03-16

windows内核安全与驱动开发学习笔记-3

由于Windows内核内存空间的特殊性，在对字符串和内存操作时和用户层开发有很大不同。通常在用户空间可以用的库函数在内核空间就不可以用了。

字符串

链表

2021-03-16

基于seleium的网络爬虫

配置环境

1	sudo apt install chromium chromium-chromedriver python3-seleium

安装chromium时可能需要代理，因为可能使用snap源

使用

关于xpath(实践中发现非常好用！)

https://www.w3school.com.cn/xpath/xpath_syntax.asp

使用下面的爬虫爬取

from selenium import webdriver
import time
import queue
import random

#使用chromedriver，上一篇讲过
driver = webdriver.Chrome()
driver.maximize_window()
driver.get('https://weibo.com')
time.sleep(10)

'''
@method 返回用户的被关注用户和最新博文
'''
def getBlogAndFocuesd(userid): 
    blogClass = '//div[@class="WB_detail"]'
    focusedClass='//ul[@class="picitems_ul clearfix"]/li/div/p/a[@class="S_txt1"]'
    startUrl='https://weibo.com/'
    driver.get(startUrl+userid)
    time.sleep(5)
    focusedElems = driver.find_elements_by_xpath(focusedClass)
    uids = []
    for i in focusedElems:
        url = i.get_property('href')
        if url:
            url = url[len(startUrl):].split('?')[0]
            if '/' in url:url = url[2:]
            uids.append(url)
    names = [_.text for _ in focusedElems]
    blogElems = driver.find_elements_by_xpath(blogClass)
    blogs = [_.text.replace('\n','',-1) for _ in blogElems]
    # driver.quit()
    # print(uids)
    # print(names)
    # print(blogs)
    # print("crawled",uids,names)
    return  uids,blogs
def controller(maxBlogs,startUsers):
    userQueue = []
    for u in startUsers:
        userQueue.append(u)
    cnt=0
    f = open('blogs.txt','w')
    crawledUser = set()
    while cnt<maxBlogs:
        selInd = random.randint(0,len(userQueue))
        if selInd>=len(userQueue):
            selInd=len(userQueue)-1
        
        selUserId = userQueue[selInd] # 随机选取一个用户
        del userQueue[selInd]
        users,blogs = getBlogAndFocuesd(selUserId)
        crawledUser.add(selUserId)
        for u in users:
            if not u in crawledUser:
                userQueue.append(u)
        for b in blogs:
            f.write(selUserId+","+b+'\n')
        f.flush()
        cnt+=len(blogs)
        print("current: ",selUserId,"len:",len(blogs),"sum:",cnt,"process:",cnt/maxBlogs)
        time.sleep(3)
        if random.random()>0.5:
            time.sleep(2)
    f.close()
    driver.close()
    
if __name__ == '__main__':
    userid = '2259906485'
    startUsers=['2259906485','shangganju','1046733017','6204415793','6591509611','rmrb','CHINAD8','5857559022','5721826695','1739663283']
    controller(50000,startUsers)

2021-03-15

项目回顾

DpLib

优化了差分隐私算法的计算方式

问卷如何保护个人隐私
优化了计算方式，使得之前的两次计算变成一次计算
使用预生成随机数算法：预生成几组随机数存储，在计算时随机选择一组随机数，加快速度
大计算量使用c语言编写
开发了用户收集数据测试APP，配合同学的服务端测试数据传输
制作了确保隐私传输协议，即厂商开发收集数据的APP时，其中的收集数据模块（用于机器学习等统计的）需要使用差分隐私方法，然后经过第三方机构认证并签名，第三方机构需要保存签名，用户拿到APP时可以验证签名，以确定该APP是否合法收集数据
使用了国密SM系列算法

信息隐藏

随机数生成器与验证

生成一些列随机数，使用蒙特卡罗检测法，统计他们的分布。

通常随机数生成器产生均匀分布的随机数，经过某个分布的反函数处理后，就会变成对应的分布。

SSDM

如果要只是要进行水印检测，则$s_i=x_i+aw_i$

$s_i=x_i+baw_i$

其中a是嵌入强度

检测水印：线性检测器

水印嵌入步骤

分块
进行DCT变换，ZIGZAG排列
选取要进行嵌入的DCT系数（几个）
嵌入水印
DCT反变换
检测水印
量化水印

$s=q_b(x)=q_{\Delta}\lfloor x-d[b]\rfloor +d[b]$

其中$\Delta$为量化步长，$d[b]$是抖动，通常取$d[0]=-0.25\Delta,d[1]=0.25\Delta$

水印检测就是判断当前数值与哪一个量化点近

STDM

基于扩展变换的量化技术

$\mathbf{x}在\mathbf{w}$上的投影为$\bar x=\frac{\sum\limits_{i=1}^{N}x_iw_i}{N}$

嵌入 $s_i=x_i+\lfloor q_b(\bar x) - \bar x\rfloor$

和扩频技术是一样的

其中$q_b(x)$就是量化函数

解码 $if |q_0(\bar Y)-\bar Y|<|q_1(\bar Y)-\bar Y|,b’=0,otherwise b’=1$，其中$\bar Y$是受攻击之后的嵌入水印的图片

hud

基于高德API开发了一个Android APP

修改默认布局，使显示支持hud
配合交通同学的设备，根据设备传来的数据来进行车路协同预警。比如红灯预警
自己开发了速度计View组件，便于hud显示

2021-03-15

软件逆向工程知识总结

计算机基础知识

重要概念

定义、静态分析、动态分析

常用算法识别

流密码，对称加密算法，非对称加密法，hash算法，树算法，图算法，大整数相加算法，常见数据结构

断点类型

软件断点：修改断点处为0xcc
硬件断点：利用x86架构的CPU的CR0~CR7调试寄存器
内存断点：修改内存页属性引发异常

dll注入技术

https://tomqunchao.github.io/2020/11/02/note/rev/dll-inject/

附加到目标进程
在目标进程中分配内存：用于存储参数、dll等
将dll文件路径，dll文件，复制到远程进程的内存空间
控制进程运行dll文件

hook相关

Windows

https://tomqunchao.github.io/2020/10/28/note/rev/win-hook/

内核层hook

SSDThook

应用层hook

消息hook
- SetWindowsHook
注入hook
- IAT hook 修改导入表
- inline hook 修改函数前5个字节；不支持多线程
- HotFix hook 利用hotfix机制，修改函数前2个字节为short jmp，到函数上面，然后再修改那5个字节；需要函数开头有mov edi,edi且上方有5个nop；支持多线程
调试Hook
- OpenProcess，DebugActiveProcess，附加到已经运行的进程
- CreateProcessA 创建进程，然后用上面的API进行调试
修改注册表

Linux

https://tomqunchao.github.io/2021/01/19/note/rev/game-1/

注入hook和win差不多，但是dll注入和调试使用ptrace。

还有个LD_PRELOAD

Android

native层hook即Linux hook，frida的hook也是ptrace

dalvik层hook可以使用xposed，利用了zygote特性

https://tomqunchao.github.io/2020/10/14/note/rev/rev-3/

Windows异常处理机制

https://tomqunchao.github.io/2020/10/28/note/rev/win-ehs/

异常处理步骤

交给调试器
执行VEH
执行SEH
执行TopLevelEH
交给调试器
调试异常端口通知csrss.exe

Linux异常处理机制

软件保护技术

静态（部分静态动态通用）

花指令（代码混淆）
ollvm（逻辑混淆）
SMC（自修改代码）
压缩壳（通常为了减少体积），加密壳
虚拟机保护技术

动态（主要是反调试技术）

基于时间的反调试
基于异常的反调试
基于API的反调试（Windows的IsDebuggerPresent, Linux的ptrace）
ZwQueryProcessInformation
父子进程反调试
代码校验（主要用于对抗软件断点）

Android逆向

反射机制
JNI_OnLoad函数
反调试

IoT逆向

CPU差异
datasheet

高级语言逆向

python
c#
java
rust
go (IDA Golang helper)

工具使用

静态分析

ida
ghirda 弥补IDA部分缺点
radare2
binutils
BinaryNinja

动态分析

ida
gdb
x64dbg

高级语言

dnspy
jadx,jeb
jd-gui,luyten

解题库

z3 线性求解
angr符号执行，利用执行图去混淆等
其他库

2021-03-14

vnctf2021逆向wp

VNCTF 2021

[rev]FilpGame

v8表示奇偶字节不同处理
成功结果为word_40301c全部为-1，长度为0x20，flag为输入的md5
处理了214次
v4+16*v5为递增数列，由此可见,v5需要递增，v5不变时v4才需要递增
根据数组，每次翻转的位只会是(v5-1,v4)(v5,v4)(v5,v4-1)(v5,v4+1)(v5+1,v4)
cnt为奇数时才会翻转，毕竟需要v4和v5
由于v4、v5都是uint32，所以范围为0~15

算法：当v5=2时，0号字必须是-1，这样v5=1时只会出现有限数量的方案，以此类推，可以进行DFS

#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <memory.h>
#include <string.h>
#include <math.h>
#include "defs.h"
// #include <setimp.h>
uint16_t wa[] = {48885, 35772, 41193, 29456, 55568, 41901, 52406, 19934, 13388, 15318, 26385, 34447, 7290, 33829, 27405, 6988};
int32_t d_40212c[]={-1,0,0,0,1};
int32_t d_402140[]={0,0,-1,1,0};
void printArray(const char *name,uint8_t *v,size_t len) 
{
    printf("========%s=========\n",name);
    for(size_t i=0;i<len;i++){
        printf("0x%02X,",v[i]);
    }
    printf("\n=================\n");
}
char toHex(uint32_t a){
    if(a<=9)return a+'0';
    else return a+55;
}
void dfs(uint16_t *state,size_t start,size_t i,char *flag){
    if(i==16){
        if(start>=1&&state[start-1]!=0xffff){
            return;
        }
        start+=1;
        i=0;
    }
    if(start==16){
        if(state[start-1]==0xffff){
            printf("%ld: %s\n",strlen(flag),flag);
            fflush(stdout);
            exit(0);
        }
        return;
    }
    if(strlen(flag)>214)return;
    uint16_t *nstate = (uint16_t*)alloca(sizeof(wa));
    memcpy(nstate,state,sizeof(wa));
    uint32_t v12,v13;
    for(size_t j=0;j<5;j++){
        v12=d_40212c[j]+i;
        v13=d_402140[j]+start;
        if(v12<=0xf&&v13<=0xf){
            nstate[v13]^=1<<(15-v12);
        }
    }
    size_t len = strlen(flag);
    // 优先寻找步数少的。。
    uint16_t *nnstate=(uint16_t*)alloca(sizeof(wa));
    char *nnflag = (char*)alloca(len+1);
    memcpy(nnflag,flag,len+1);
    memcpy(nnstate,state,sizeof(wa));
    dfs(nnstate,start,i+1,nnflag);

    char *nflag=(char*)alloca(len+3);
    memcpy(nflag,flag,len+1);
    nflag[len]=toHex(i);
    nflag[len+1]=toHex(start);
    nflag[len+2]=0;
    dfs(nstate,start,i+1,nflag);
}
int main(){
    char flag[]="";
    dfs(wa,0,0,flag);
    return 0;
}

先使用的python，发现效率不够，直接上c。。虽然剪枝了，也是花了不少时间

import hashlib
import base64
import sys
print(hashlib.md5(b'2050608090A0B0C0D02131417191A1B1527282B2D2E2F213234363B3D36494C4D4E415456575C5D5E50626566686C6F6071787B7C72838587898C8D81949596999B9C9F95A8AAAEA0B1B3B4B7B1C2C3C4C6C9CBCEC0D4D7D9DBDCDED0E1E3E4E5E6E8E9ECEEEFE3F7F8FBF').hexdigest())

[rev]Crackme2

调用了Native层函数stringFromJNI()，打开JNI_OnLoad，初始化了一个128位的数字，没有更换native函数

分析结果

jstring __fastcall Java_com_ctf_crackme_MainActivity_stringFromJNI(JNIEnv *a1, __int64 a2, jstring a3)
{
  const char *input; // x23
  jsize lenOfInput; // w21
  char *input2; // x20
  _BYTE *v8; // x1
  int v9; // w8
  unsigned int v10; // w21
  unsigned __int8 *v11; // x0
  jstring v12; // x0
  jstring v13; // x19
  __int64 v15; // [xsp+0h] [xbp-E0h] BYREF
  char key[20]; // [xsp+8h] [xbp-D8h] BYREF
  int v17; // [xsp+1Ch] [xbp-C4h] BYREF
  char v18; // [xsp+20h] [xbp-C0h] BYREF
  _BYTE v19[7]; // [xsp+21h] [xbp-BFh] BYREF
  _BYTE *v20; // [xsp+30h] [xbp-B0h]
  char v21[4]; // [xsp+38h] [xbp-A8h] BYREF
  _BYTE v22[116]; // [xsp+3Ch] [xbp-A4h] BYREF

  *(_QWORD *)&v22[108] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  input = (*a1)->GetStringUTFChars(a1, a3, 0LL);
// ...
// 不是key，实际上保存着AES的结构信息
  sub_428C4(key, 128LL);
  // AES加密函数，后面发现v22是key，可以在此处下断点，调试v22
  v11 = (unsigned __int8 *)sub_42944(key, input2, v10, v22, &v17);
  // 下面是比对，xmmword_C80F0就是JNI_OnLoad初始化的数字，就是按字节比对
  if ( (unsigned __int8)xmmword_C80F0 == *v11
    && __PAIR64__(BYTE2(xmmword_C80F0), BYTE1(xmmword_C80F0)) == __PAIR64__(v11[2], v11[1])
    && __PAIR64__(BYTE4(xmmword_C80F0), BYTE3(xmmword_C80F0)) == __PAIR64__(v11[4], v11[3])
    && __PAIR64__(BYTE6(xmmword_C80F0), BYTE5(xmmword_C80F0)) == __PAIR64__(v11[6], v11[5])
    && __PAIR64__(BYTE8(xmmword_C80F0), BYTE7(xmmword_C80F0)) == __PAIR64__(v11[8], v11[7])
    && __PAIR64__(BYTE10(xmmword_C80F0), BYTE9(xmmword_C80F0)) == __PAIR64__(v11[10], v11[9])
    && __PAIR64__(BYTE12(xmmword_C80F0), BYTE11(xmmword_C80F0)) == __PAIR64__(v11[12], v11[11])
    && __PAIR64__(BYTE14(xmmword_C80F0), BYTE13(xmmword_C80F0)) == __PAIR64__(v11[14], v11[13])
    && HIBYTE(xmmword_C80F0) == v11[15] )
  {
    v12 = (*a1)->NewStringUTF(a1, "Success");
  }
  else
  {
    v12 = (*a1)->NewStringUTF(a1, "Fail");
  }
  v13 = v12;
  if ( (v18 & 1) != 0 )
    operator delete(v20);
  return v13;
}

下面是AES加密函数

__int64 __fastcall sub_42944(_DWORD *key, const char *input, size_t len, __int64 a4, unsigned int *a5)
{
  //...
  // 下面这个是秘钥扩展函数,里面有个AES特征向量
  sub_42AE0(key, a4, v17);
  if ( *a5 )
  {
    v18 = 0;
    do
    {
		// ECB模式
      sub_42CBC(key, &v13[v18], v14 + v18, v17);
      v18 += key[3];
    }
    while ( v18 < *a5 );
  }
  operator delete[](v13);
  operator delete[](v17);
  return v14;
}

from Crypto.Cipher import AES
key = [114, 59, 255, 100, 203, 160, 225, 150, 176, 95, 92, 246, 23, 176, 18, 249,]
print(len(key))
aes = AES.new(key=bytes(key),mode=AES.MODE_ECB)

c = bytes([0xB2, 0x82, 0x16, 0xEE, 0x5E, 0xCD, 0x5F, 0xFA, 0xFF,0x82, 0x54, 0xE6, 0xB, 0x4B, 0xAE, 0xAA])
print(aes.decrypt(c))

[rev]notsudoku

在前面要补齐16个字节。。

data = []
with open('2.pyc','rb') as f:
    data = f.read()
struct = []
with open('notsudoku/struct','rb') as f:
    struct = f.read()
with open('2_2.pyc','wb') as f:
    f.write(struct[:16]+data)

穷举脚本，有限时间内我解不出来hhhh

import hashlib
import base64
import sys
import marshal
import dis
import uncompyle6

res = 'e3a912'
flag = [0 for i in range(50)]
state = [[-1 for _ in range(5)] for _ in range(5)]
state[0][1]=24
state[4][3]=2      
state[0][2]=1
state[2][3]=20    
state[1][0]=23
state[3][4]=3
aval = [0 for i in range(25)]
aval[24]=1
aval[2]=1
aval[1]=1
aval[20]=1
aval[23]=1
aval[3]=1
def check(start,state):
    # print(start)
    x = start//5
    y = start%5
    for i in range(x):
        if sum(state[i])!=60:
            return False
    return True

def dfs(state,start,aval):
    x = start//5
    y = start%5
    if start==25:
        isOk=True
        for i in range(5):
            if state[0][i]+state[1][i]+state[2][i]+state[3][i]+state[4][i]!=60:
                isOk=False
                break
        if isOk:
            print(state)
            flag = ''
            dic = [0 for i in range(25)]
            for i in range(5):
                for j in range(5):
                    dic[state[i][j]]=i*5+j
            for i in range(25):
                flag+=hex(dic[i]//5)[2:]
                flag+=hex(dic[i]%5)[2:]
            if hashlib.md5(bytes(flag,encoding='utf-8')).hexdigest()[:6]==res:
                print(flag)
        return
    if state[x][y]!=-1:
        dfs(state,start+1,aval)
    else:
        for i in range(25):
            nstate = [[j for j in state[k]] for k in range(5)]
            nstate[x][y]=i
            naval=[j for j in aval]
            if check(start+1,nstate) and aval[i]==0:
                naval[i]=1
                dfs(nstate,start+1,naval)
dfs(state,0,aval)
s = 0
for i in range(25):
    s+=i+1
print(s,s/5)

#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <memory.h>
#include <string.h>
#include <math.h>
#include "defs.h"
// #include <setimp.h>
/* POINTER defines a generic pointer type */
typedef unsigned char * POINTER;
 
/* UINT2 defines a two byte word */
//typedef unsigned short int UINT2;
 
/* UINT4 defines a four byte word */
typedef unsigned long int UINT4;
 
 
/* MD5 context. */
typedef struct {
	UINT4 state[4];                                   /* state (ABCD) */
	UINT4 count[2];        /* number of bits, modulo 2^64 (lsb first) */
	unsigned char buffer[64];                         /* input buffer */
} MD5_CTX;
 
void MD5Init (MD5_CTX *context);
void MD5Update (MD5_CTX *context, unsigned char *input, unsigned int inputLen);
void MD5UpdaterString(MD5_CTX *context,const char *string);
int MD5FileUpdateFile (MD5_CTX *context,char *filename);
void MD5Final (unsigned char digest[16], MD5_CTX *context);
void MDString (char *string,unsigned char digest[16]);
int MD5File (char *filename,unsigned char digest[16]);
#define S11 7
#define S12 12
#define S13 17
#define S14 22
#define S21 5
#define S22 9
#define S23 14
#define S24 20
#define S31 4
#define S32 11
#define S33 16
#define S34 23
#define S41 6
#define S42 10
#define S43 15
#define S44 21
 
static void MD5_memcpy (POINTER output, POINTER input, unsigned int len);
static void MD5Transform (UINT4 state[4], unsigned char block[64]);
static void Encode (unsigned char *output, UINT4 *input, unsigned int len);
static void MD5_memset (POINTER output, int value, unsigned int len);
static void Decode (UINT4 *output, unsigned char *input, unsigned int len);
 
static unsigned char PADDING[64] = {
	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};
 
/* F, G, H and I are basic MD5 functions.
*/
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))
#define I(x, y, z) ((y) ^ ((x) | (~z)))
 
/* ROTATE_LEFT rotates x left n bits.
*/
#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))
 
/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4.
Rotation is separate from addition to prevent recomputation.
*/
#define FF(a, b, c, d, x, s, ac) { \
	(a) += F ((b), (c), (d)) + (x) + (UINT4)(ac); \
	(a) = ROTATE_LEFT ((a), (s)); \
	(a) += (b); \
	}
#define GG(a, b, c, d, x, s, ac) { \
	(a) += G ((b), (c), (d)) + (x) + (UINT4)(ac); \
	(a) = ROTATE_LEFT ((a), (s)); \
	(a) += (b); \
	}
#define HH(a, b, c, d, x, s, ac) { \
	(a) += H ((b), (c), (d)) + (x) + (UINT4)(ac); \
	(a) = ROTATE_LEFT ((a), (s)); \
	(a) += (b); \
	}
#define II(a, b, c, d, x, s, ac) { \
	(a) += I ((b), (c), (d)) + (x) + (UINT4)(ac); \
	(a) = ROTATE_LEFT ((a), (s)); \
	(a) += (b); \
	}
 
/* MD5 initialization. Begins an MD5 operation, writing a new context.
 */
void MD5Init (MD5_CTX *context)                                     /* context */
{
	context->count[0] = context->count[1] = 0;
	/* Load magic initialization constants.
	*/
	context->state[0] = 0x67452301;
	context->state[1] = 0xefcdab89;
	context->state[2] = 0x98badcfe;
	context->state[3] = 0x10325476;
}
 
/* MD5 block update operation. Continues an MD5 message-digest
  operation, processing another message block, and updating the
  context.
 */
void MD5Update (MD5_CTX *context, unsigned char *input, unsigned int inputLen)
 
{
	unsigned int i, index, partLen;
 
	/* Compute number of bytes mod 64 */
	index = (unsigned int)((context->count[0] >> 3) & 0x3F);
 
	/* Update number of bits */
	if ((context->count[0] += ((UINT4)inputLen << 3))
		< ((UINT4)inputLen << 3))
		context->count[1]++;
	context->count[1] += ((UINT4)inputLen >> 29);
 
	partLen = 64 - index;
 
	/* Transform as many times as possible.
	*/
	if (inputLen >= partLen) {
		MD5_memcpy((POINTER)&context->buffer[index], (POINTER)input, partLen);
		MD5Transform (context->state, context->buffer);
 
		for (i = partLen; i + 63 < inputLen; i += 64)
			MD5Transform (context->state, &input[i]);
 
		index = 0;
	}
	else
		i = 0;
 
	/* Buffer remaining input */
	MD5_memcpy((POINTER)&context->buffer[index], (POINTER)&input[i],inputLen-i);
}
 
/* MD5 finalization. Ends an MD5 message-digest operation, writing the
  the message digest and zeroizing the context.
 */
void MD5Final (unsigned char digest[16], MD5_CTX *context)                                 
{
	unsigned char bits[8];
	unsigned int index, padLen;
 
	/* Save number of bits */
	Encode (bits, context->count, 8);
 
	/* Pad out to 56 mod 64.
	*/
	index = (unsigned int)((context->count[0] >> 3) & 0x3f);
	padLen = (index < 56) ? (56 - index) : (120 - index);
	MD5Update (context, PADDING, padLen);
 
	/* Append length (before padding) */
	MD5Update (context, bits, 8);
 
	/* Store state in digest */
	Encode (digest, context->state, 16);
 
	/* Zeroize sensitive information.
	*/
	MD5_memset ((POINTER)context, 0, sizeof (*context));
}
 
/* MD5 basic transformation. Transforms state based on block.
 */
static void MD5Transform (UINT4 state[4], unsigned char block[64])
{
	UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16];
 
	Decode (x, block, 64);
 
	/* Round 1 */
	FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
	FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
	FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
	FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
	FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
	FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
	FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
	FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
	FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
	FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
	FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
	FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
	FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
	FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
	FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
	FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */
 
	/* Round 2 */
	GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
	GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
	GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
	GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
	GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
	GG (d, a, b, c, x[10], S22,  0x2441453); /* 22 */
	GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
	GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
	GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
	GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
	GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */
	GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */
	GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */
	GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */
	GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */
	GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */
 
	/* Round 3 */
	HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
	HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
	HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
	HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
	HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
	HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
	HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
	HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
	HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
	HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
	HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
	HH (b, c, d, a, x[ 6], S34,  0x4881d05); /* 44 */
	HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
	HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
	HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
	HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */
 
	/* Round 4 */
	II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
	II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
	II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
	II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
	II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
	II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
	II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
	II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
	II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
	II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
	II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
	II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
	II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
	II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
	II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
	II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */
 
	state[0] += a;
	state[1] += b;
	state[2] += c;
	state[3] += d;
 
	/* Zeroize sensitive information.
	*/
	MD5_memset ((POINTER)x, 0, sizeof (x));
}
 
/* Encodes input (UINT4) into output (unsigned char). Assumes len is
  a multiple of 4.
 */
static void Encode (unsigned char *output, UINT4 *input, unsigned int len)
{
	unsigned int i, j;
 
	for (i = 0, j = 0; j < len; i++, j += 4) {
		output[j] = (unsigned char)(input[i] & 0xff);
		output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
		output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
		output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
	}
}
 
/* Decodes input (unsigned char) into output (UINT4). Assumes len is
  a multiple of 4.
 */
static void Decode (UINT4 *output, unsigned char *input, unsigned int len)
{
	unsigned int i, j;
 
	for (i = 0, j = 0; j < len; i++, j += 4)
		output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) |
		(((UINT4)input[j+2]) << 16) | (((UINT4)input[j+3]) << 24);
}
 
/* Note: Replace "for loop" with standard memcpy if possible.
 */
 
static void MD5_memcpy (POINTER output, POINTER input, unsigned int len)
{
	unsigned int i;
 
	for (i = 0; i < len; i++)
		output[i] = input[i];
}
 
/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD5_memset (POINTER output, int value, unsigned int len)
{
	unsigned int i;
 
	for (i = 0; i < len; i++)
		((char *)output)[i] = (char)value;
}
/* Digests a string and prints the result.
 */
void MDString (char *string,unsigned char digest[16])
{
	MD5_CTX context;
	unsigned int len = strlen (string);
 
	MD5Init (&context);
	MD5Update (&context, (unsigned char *)string, len);
	MD5Final (digest, &context);
}
/* Digests a file and prints the result.
 */
int MD5File (char *filename,unsigned char digest[16])
{
	FILE *file;
	MD5_CTX context;
	int len;
	unsigned char buffer[1024];
 
	if ((file = fopen (filename, "rb")) == NULL)
		return -1;
	else {
		MD5Init (&context);
		while (len = fread (buffer, 1, 1024, file))
			MD5Update (&context, buffer, len);
		MD5Final (digest, &context);
 
		fclose (file);
	}
	return 0;
}
void MD5UpdaterString(MD5_CTX *context,const char *string)
{
	unsigned int len = strlen (string);
	MD5Update (context, (unsigned char *)string, len);
}
int MD5FileUpdateFile (MD5_CTX *context,char *filename)
{
	FILE *file;
	int len;
	unsigned char buffer[1024];
 
	if ((file = fopen (filename, "rb")) == NULL)
		return -1;
	else {
		while (len = fread (buffer, 1, 1024, file))
			MD5Update (context, buffer, len);
		fclose (file);
	}
	return 0;
}
uint16_t wa[] = {48885, 35772, 41193, 29456, 55568, 41901, 52406, 19934, 13388, 15318, 26385, 34447, 7290, 33829, 27405, 6988};
int32_t d_40212c[]={-1,0,0,0,1};
int32_t d_402140[]={0,0,-1,1,0};
void printArray(const char *name,uint8_t *v,size_t len) 
{
    printf("========%s=========\n",name);
    for(size_t i=0;i<len;i++){
        printf("0x%02X,",v[i]);
    }
    printf("\n=================\n");
}
uint8_t check(uint8_t *state,uint8_t start){
    uint32_t sum=0;
    uint32_t x=start/5;
    uint32_t y=start%5;

    for(int i=0;i<x;i++){
        sum=0;
        for(int j=0;j<5;j++){
            sum+=state[i*5+j];
        }
        if(sum-60!=0)return 0;
    }
    return 1;
}
uint8_t flag[51];
uint8_t tab[25];
void dfs(uint8_t *state,uint8_t start,uint8_t *aval){
    // printf("%d\n",start);
    if(start==25){
        uint8_t isOk=1;
        for(int i=0;i<5;i++){
            uint32_t sum=0;
            for(int j=0;j<5;j++){
                sum+=state[j*5+i];
            }
            if(sum-60!=0){
                isOk=0;
            }
        }
        if(isOk){
            // printArray("ok state",state,25);
            for(int i=0;i<25;i++){
                tab[state[i]]=i;
            }
            for(size_t i=0;i<50;i+=2){
                flag[i]=tab[i]/5+'0';
                flag[i+1]=tab[i]%5+'0';
            }
            MD5_CTX md5c;
            MD5Init(&md5c);
            MD5UpdaterString(&md5c,flag);
            uint8_t digest[16];
            MD5Final(digest,&md5c);
            uint8_t cmpData[]={0xe3,0xa9,0x12};
            if(!memcmp(cmpData,digest,3)){
                printf("%s\n",flag);
                exit(0);
            }
        }
        return;
    }
    if(state[start]-0xff!=0){
        dfs(state,start+1,aval);
    }else{
        // uint8_t *naval=alloca(25);
        // uint8_t *nstate=alloca(25);
        for(uint8_t i=0;i<25;i++){
            if(aval[i]==0){
            //     memcpy(naval,aval,25);
            //     memcpy(nstate,state,25);
                state[start]=i;
                aval[i]=1;
                // printf("%d\n",start);
                if(check(state,start+1))
                    dfs(state,start+1,aval);
                state[start]=-1;
                aval[i]=0;
            }
        }
    }
}
int main(){
    memset(flag,0,51);
    uint8_t aval[25];
    uint8_t state[25];
    memset(state,-1,25);
    memset(aval,0,25);
    state[1]=24;
    state[4*5+3]=2;      
    state[2]=1;
    state[2*5+3]=20;    
    state[1*5+0]=23;
    state[3*5+4]=3;
    aval[24]=1;
    aval[2]=1;
    aval[1]=1;
    aval[20]=1;
    aval[23]=1;
    aval[3]=1;
    dfs(state,0,aval);
    return 0;
}

2021-03-12

心理咨询笔记-1

由于长时间发现自己对于自己不够努力而过分否定自己，导致心情非常难受，自己尝试了很多次都没有解决这个问题，遂尝试学校的心理咨询来寻找解决方案。

有个hr小姐姐说，我缺一个能听我倾诉的人。这个心理咨询是不仅听倾诉，还通过提出引导性问题让我找到某些事情的原因，并且把这些事情连接起来，最终解决问题。

总体来说原因是去年喜欢的那个人给了我一个暗示“希望我成为行业顶尖人才”。由于我当时非常喜欢她(也可能是色迷心窍)，是真的以这个为目标的。于是就给自己定下了超额计划，但是超额计划让我望而却步，从而没有一点动力学习，导致任务完不成，否定自己。不断地否定就成了过于否定。后来虽然在hr姐姐的引导下我知道了她的想法并忘了她，但是这个暗示还在，虽然开学之后效率挺好的，但是毕竟要成为“行业顶尖人才”学这些是不够的，导致两三周之后有否定自己，然后连锁反应，没有自信，各种烦躁etc。目标应该适合自己才对，而不是无限地高。

也许我去年真的是过分渴望爱情，太喜欢她了，会把她说的每一句话当做真的。她应该只是随口说说，但是我当成了我的目标，即使它远远超出了我现有的能力所能及。

emmm这里应该有一张分析图，但是考虑到个人隐私，后面想办法建立一个私有库吧。

另外心理咨询也让我理清了近年来的计划，实际上我早就制定好了，只是在否定自己中把它忘了。

虽然高标准、严要求是好事，但是在制定计划、提要求的时候也要充分考虑到自身的客观实际情况，忽然想起马克思主义也有说明，客观条件不以自己的主观意志转移，要充分考虑客观条件。原来好东西只有用的时候才会理解。果然是“书到用时方恨少么”。

最近我总是忘东西，这次心理咨询也记记笔记吧，免得下次否定了又重新想哈哈哈哈。

2021-03-10

d3ctf2021wp读后感

[rev]white give

这道题是自己做的。。

字符串存在解密操作，也用来转移数据用

输入长度为64，函数2090和1df0互为逆运算

解题思路

dump出最后一个memcmp比对的数据

逆向计算这个过程，其中编辑到输入的就是两个移位操作，其它数据中间有个数组是根据固定数组和n动态生成的

for ( m = 0;m < 2;m++ )
{
  for ( n = 0;n < 0x10;n++ )
  {
    for ( ii = 0;
          ii < 0x100;
          ii++ )
    {
      input4[(m<<8)+ii] = byte_13F777F60[(unsigned __int8)input4[(m<<8)+ii];
    }
    for(jj=1;jj<0x11;jj++){
        for(kk=0;kk<0x10;kk++){
             v15 = jj;
            v16 = kk + (kk | (16 * n)) - (kk & ~(16 * n));
            decryptString((__int64)&qword_13F106A40, a6e, a3, 0x100ui64);
            v17 = *((_BYTE *)a3 + v16);
            encryptString((__int64)&qword_13F106A40, a3, a6e, 0x100ui64);
            v28[16 * jj - 16 + kk] = v17 * v15;
        }
    }
    for ( ll = 0;ll < 0x100;ll++ )
    {
      input4[(m<<8)+ll] = 2 * (v28[ll] & ~input4[(m<<8)+ll]) + input4[(m<<8)+ll] - v28[ll];
      // 列表法得知异或input4[(m<<8)+ll]^v28[ll]
      input4[(m<<8)+ll] += (ll | ~input4[(m<<8)+ll]) + (ll | input4[(m<<8)+ll]) + 1;
      // 列表法得知 input4[ll]+=ll

    }
  }
}

逆向脚本


subArr = [240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
reSubArr = [0]*256
for i in range(256):
    reSubArr[subArr[i]] = i
# print(hex(subArr[0]))
addArr = [38, 39, 246, 133, 151, 21, 173, 29, 210, 148, 221, 196, 118, 25, 57, 49, 76, 78, 236, 10, 46, 42, 90, 58, 164, 40, 186, 136, 236, 50, 114, 98, 114, 117, 226, 143, 197, 63, 7, 87, 118, 188, 151, 76, 98, 75, 171, 147, 152, 156, 216, 20, 92, 84, 180, 116, 72, 80, 116, 16, 216, 100, 228, 196, 190, 195, 206, 153, 243, 105, 97, 145, 26, 228, 81, 212, 78, 125, 29, 245, 228, 234, 196, 30, 138, 126, 14, 174, 236, 120, 46, 152, 196, 150, 86, 38, 10, 17, 186, 163, 33, 147, 187, 203, 190, 12, 11, 92, 58, 175, 143, 87, 48, 56, 176, 40, 184, 168, 104, 232, 144, 160, 232, 32, 176, 200, 200, 136, 86, 95, 166, 173, 79, 189, 21, 5, 98, 52, 197, 228, 38, 225, 1, 185, 124, 134, 156, 50, 230, 210, 194, 34, 52, 200, 162, 168, 156, 250, 58, 234, 162, 173, 146, 183, 125, 231, 111, 63, 6, 92, 127, 108, 18, 19, 115, 27, 200, 212, 136, 60, 20, 252, 28, 92, 216, 240, 92, 48, 136, 44, 172, 76, 238, 251, 126, 193, 171, 17, 201, 121, 170, 132, 57, 244, 254, 69, 229, 125, 20, 34, 116, 70, 66, 38, 118, 150, 124, 24, 22, 184, 116, 94, 30, 174, 58, 73, 106, 203, 217, 59, 35, 179, 78, 172, 243, 124, 234, 119, 87, 223, 96, 112, 96, 80, 112, 80, 208, 208, 32, 64, 208, 64, 96, 144, 144, 16]
addBaseArr=[38, 39, 246, 133, 151, 21, 173, 29, 210, 148, 221, 196, 118, 25, 57, 49, 241, 173, 181, 88, 240, 147, 151, 50, 25, 43, 209, 192, 253, 22, 142, 78, 72, 155, 11, 245, 59, 73, 168, 99, 93, 222, 63, 223, 109, 104, 180, 135, 154, 170, 205, 220, 247, 193, 68, 129, 41, 8, 27, 64, 98, 56, 48, 78, 148, 212, 17, 208, 222, 196, 17, 157, 75, 63, 156, 70, 187, 239, 199, 84, 33, 80, 43, 208, 239, 90, 244, 9, 207, 95, 53, 145, 148, 54, 127, 137, 112, 153, 177, 30, 103, 204, 17, 84, 3, 127, 156, 3, 74, 246, 155, 30, 237, 103, 119, 59, 194, 164, 206, 80, 116, 249, 198, 187, 122, 88, 162, 134, 69, 179, 147, 232, 190, 170, 208, 15, 239, 102, 232, 28, 0, 197, 87, 112, 102, 183, 88, 38, 87, 232, 251, 224, 129, 159, 119, 199, 251, 230, 193, 205, 124, 235, 94, 54, 203, 166, 117, 86, 118, 188, 40, 156, 199, 163, 36, 207, 244, 7, 119, 152, 150, 109, 163, 65, 92, 23, 240, 188, 1, 39, 6, 231, 123, 7, 186, 14, 118, 7, 41, 177, 0, 72, 3, 136, 134, 218, 42, 197, 255, 33, 124, 153, 103, 125, 236, 249, 111, 41, 216, 162, 115, 100, 151, 91, 172, 207, 81, 122, 167, 23, 19, 169, 245, 211, 34, 234, 37, 176, 144, 217, 239, 203, 14, 49, 178, 94, 1, 146, 33, 159, 216, 130, 56, 229, 156, 177]

cmpArr = [43, 117, 221, 137, 85, 76, 98, 226, 240, 252, 42, 86, 81, 77, 65, 68, 30, 124, 136, 23, 146, 189, 165, 230, 241, 173, 39, 224, 224, 25, 253, 63, 199, 90, 135, 210, 249, 119, 215, 38, 124, 166, 202, 191, 114, 105, 3, 107, 222, 84, 208, 221, 230, 138, 46, 222, 97, 71, 118, 92, 178, 102, 176, 155, 119, 188, 228, 144, 220, 87, 156, 129, 97, 99, 45, 109, 219, 115, 26, 227, 126, 183, 194, 150, 104, 76, 172, 46, 31, 4, 121, 11, 55, 227, 126, 246, 46, 29, 145, 248, 112, 245, 124, 220, 22, 41, 154, 20, 217, 232, 232, 240, 184, 155, 167, 212, 227, 135, 168, 13, 54, 140, 71, 164, 55, 103, 124, 159, 24, 176, 57, 195, 249, 49, 182, 43, 198, 33, 23, 116, 71, 106, 135, 219, 58, 171, 29, 255, 20, 118, 242, 94, 51, 196, 204, 170, 251, 169, 57, 63, 253, 214, 100, 198, 65, 95, 184, 112, 243, 0, 15, 109, 198, 99, 250, 195, 54, 211, 68, 18, 230, 154, 204, 54, 176, 150, 96, 5, 3, 145, 41, 34, 183, 26, 209, 116, 185, 156, 111, 169, 30, 57, 144, 29, 216, 209, 41, 131, 250, 101, 217, 115, 27, 105, 30, 221, 225, 113, 17, 166, 177, 212, 68, 126, 125, 196, 217, 151, 241, 69, 163, 52, 150, 216, 100, 96, 81, 134, 19, 230, 121, 144, 124, 34, 73, 154, 51, 200, 109, 156, 31, 196, 105, 16, 176, 21, 252, 154, 200, 172, 42, 221, 132, 228, 229, 137, 15, 139, 105, 14, 58, 254, 224, 230, 152, 54, 101, 66, 242, 102, 64, 67, 190, 38, 143, 21, 88, 122, 33, 238, 235, 240, 157, 247, 51, 77, 170, 59, 99, 166, 13, 184, 58, 78, 17, 128, 54, 63, 208, 180, 94, 186, 187, 146, 87, 245, 123, 51, 249, 102, 187, 210, 206, 200, 25, 139, 29, 103, 57, 171, 255, 61, 234, 63, 230, 21, 251, 169, 70, 79, 255, 247, 0, 245, 31, 182, 95, 206, 50, 46, 40, 210, 241, 33, 126, 122, 163, 12, 222, 46, 189, 28, 136, 158, 127, 18, 205, 89, 157, 69, 19, 69, 25, 117, 15, 107, 186, 116, 32, 116, 24, 160, 137, 211, 1, 99, 230, 17, 52, 4, 104, 90, 106, 183, 178, 54, 110, 22, 110, 160, 6, 82, 236, 124, 15, 192, 61, 55, 207, 223, 128, 116, 105, 32, 93, 190, 140, 171, 94, 17, 26, 68, 74, 224, 106, 175, 59, 4, 125, 121, 9, 229, 70, 14, 238, 157, 54, 168, 177, 57, 176, 240, 95, 2, 96, 99, 187, 251, 196, 187, 1, 244, 138, 222, 60, 6, 144, 31, 140, 71, 196, 4, 142, 157, 191, 173, 149, 132, 104, 137, 154, 79, 244, 107, 82, 115, 13, 236, 153, 131, 97, 47, 179, 27, 143, 216, 132, 31, 145, 166, 191, 190, 99, 160, 238, 22, 213, 112, 115, 252, 217, 78, 142, 224, 146, 239, 74, 235, 235, 203, 126, 167]

# cmpArr = [201, 219, 92, 92, 83, 128, 5, 3, 144, 38, 236, 111, 108, 117, 100, 163, 98, 110, 129, 154, 101, 229, 149, 73, 101, 225, 27, 213, 243, 127, 247, 141, 202, 85, 190, 201, 203, 187, 81, 202, 211, 40, 29, 72, 143, 214, 73, 160, 184, 178, 11, 42, 114, 141, 177, 237, 222, 129, 110, 196, 162, 127, 112, 157, 85, 95, 83, 134, 74, 195, 190, 197, 18, 55, 249, 167, 230, 98, 225, 74, 211, 149, 68, 116, 255, 28, 4, 150, 209, 14, 231, 177, 145, 255, 198, 254, 154, 170, 149, 177, 48, 180, 55, 166, 26, 28, 239, 97, 51, 173, 89, 98, 18, 100, 67, 186, 167, 28, 55, 71, 11, 183, 64, 55, 18, 145, 154, 224, 10, 106, 191, 61, 179, 237, 2, 9, 145, 176, 157, 71, 27, 199, 183, 214, 123, 238, 141, 15, 10, 242, 182, 39, 9, 148, 102, 55, 107, 233, 38, 241, 88, 67, 47, 180, 28, 95, 26, 148, 215, 60, 193, 171, 221, 86, 182, 43, 9, 41, 3, 215, 222, 141, 103, 23, 221, 135, 185, 120, 183, 142, 89, 189, 56, 140, 156, 123, 160, 74, 221, 245, 141, 176, 102, 214, 143, 22, 205, 9, 154, 235, 141, 217, 16, 5, 113, 209, 114, 158, 121, 40, 11, 107, 248, 120, 148, 122, 234, 243, 240, 135, 186, 75, 249, 222, 151, 210, 27, 86, 84, 22, 65, 37, 226, 101, 30, 222, 189, 80, 181, 170, 158, 120, 52, 187, 17, 191, 214, 83, 221, 128, 28, 173, 136, 101, 104, 106, 144, 204, 25, 53, 2, 53, 190, 150, 40, 108, 158, 189, 30, 105, 67, 46, 145, 102, 20, 141, 167, 27, 86, 221, 10, 123, 207, 248, 134, 154, 75, 118, 151, 99, 184, 120, 62, 163, 248, 24, 21, 238, 126, 213, 56, 16, 74, 54, 53, 186, 207, 126, 162, 228, 65, 150, 82, 99, 201, 63, 72, 150, 210, 81, 17, 210, 152, 109, 228, 193, 24, 56, 107, 0, 199, 198, 61, 55, 4, 19, 233, 225, 244, 197, 198, 22, 17, 222, 145, 210, 40, 3, 45, 174, 142, 82, 97, 138, 78, 8, 92, 86, 126, 107, 136, 136, 121, 241, 60, 215, 59, 52, 156, 45, 70, 156, 182, 88, 158, 67, 50, 124, 87, 9, 57, 136, 177, 110, 227, 255, 7, 140, 135, 103, 234, 73, 167, 142, 236, 32, 157, 54, 110, 55, 226, 115, 209, 171, 203, 239, 223, 249, 152, 202, 161, 192, 161, 183, 234, 94, 22, 17, 160, 21, 50, 3, 252, 8, 161, 148, 55, 25, 65, 253, 103, 241, 125, 47, 23, 155, 193, 9, 136, 83, 242, 103, 157, 91, 173, 110, 61, 232, 3, 110, 43, 158, 155, 20, 42, 112, 123, 184, 20, 233, 5, 153, 88, 49, 196, 254, 254, 235, 138, 41, 3, 5, 103, 96, 168, 219, 114, 105, 72, 99, 51, 89, 250, 26, 159, 254, 253, 27, 140, 186, 45, 48, 0, 186, 67, 98, 89, 59, 37, 139, 112, 182]
# verArr = [136, 212, 38, 111, 212, 230, 51, 141, 19, 184, 69, 252, 242, 137, 87, 157, 32, 156, 137, 120, 35, 185, 33, 125, 163, 225, 97, 147, 111, 3, 21, 137, 229, 224, 136, 160, 182, 97, 99, 160, 162, 106, 94, 5, 61, 42, 68, 150, 220, 22, 171, 110, 14, 61, 209, 173, 242, 209, 106, 168, 74, 7, 140, 157, 0, 92, 25, 101, 137, 25, 24, 107, 133, 97, 140, 88, 112, 70, 62, 236, 141, 155, 140, 26, 157, 0, 32, 138, 83, 82, 137, 27, 165, 187, 224, 134, 241, 175, 195, 20, 121, 82, 45, 108, 255, 30, 208, 104, 249, 57, 152, 240, 90, 140, 211, 178, 47, 92, 55, 215, 243, 7, 8, 79, 98, 209, 210, 112, 131, 153, 37, 154, 44, 79, 236, 63, 26, 82, 172, 156, 149, 35, 140, 88, 113, 148, 61, 185, 116, 14, 82, 171, 39, 32, 36, 233, 247, 13, 108, 29, 15, 118, 233, 37, 121, 213, 88, 110, 206, 14, 226, 178, 111, 74, 211, 229, 213, 197, 227, 75, 138, 205, 215, 103, 89, 39, 229, 44, 15, 102, 141, 13, 85, 67, 158, 148, 75, 60, 19, 11, 114, 18, 115, 45, 105, 226, 194, 195, 236, 21, 181, 179, 90, 241, 165, 165, 184, 82, 215, 246, 95, 135, 22, 56, 151, 39, 188, 58, 49, 245, 160, 153, 148, 168, 64, 135, 145, 162, 45, 180, 177, 37, 2, 69, 46, 110, 93, 0, 165, 154, 14, 248, 52, 43, 65, 207, 151, 92, 167, 43, 107, 223, 14, 147, 139, 204, 33, 71, 39, 201, 57, 247, 252, 100, 16, 158, 232, 241, 74, 221, 69, 90, 35, 100, 232, 209, 69, 31, 121, 120, 228, 70, 226, 190, 180, 144, 26, 160, 44, 226, 170, 12, 35, 93, 28, 116, 93, 154, 50, 53, 232, 160, 166, 6, 97, 150, 39, 54, 118, 156, 20, 185, 24, 164, 10, 133, 150, 24, 69, 219, 20, 113, 62, 241, 19, 43, 70, 22, 43, 30, 213, 50, 57, 187, 198, 83, 95, 43, 160, 249, 224, 222, 122, 83, 31, 195, 1, 129, 199, 84, 139, 60, 78, 183, 52, 108, 45, 180, 182, 243, 72, 192, 49, 97, 156, 71, 195, 180, 244, 133, 118, 140, 46, 200, 23, 244, 136, 247, 104, 219, 143, 190, 122, 64, 138, 148, 105, 32, 60, 97, 224, 59, 95, 228, 50, 20, 185, 90, 0, 231, 192, 197, 45, 47, 217, 51, 136, 212, 38, 111, 212, 230, 51, 141, 19, 184, 69, 252, 242, 137, 87, 157, 32, 156, 137, 120, 35, 185, 33, 125, 163, 225, 97, 147, 111, 3, 21, 137, 229, 224, 136, 160, 182, 97, 99, 160, 162, 106, 94, 5, 61, 42, 68, 150, 220, 22, 171, 110, 14, 61, 209, 173, 242, 209, 106, 168, 74, 7, 140, 157, 0, 92, 25, 101, 137, 25, 24, 107, 133, 97, 140, 88, 112, 70, 62, 236, 141, 155, 140, 26, 157, 0, 32, 138, 83, 82, 137, 27, 165, 187, 224, 134]

addArr = [[0]*256 for i in range(16)]
for n in range(16):
    for j in range(1,17):
        for k in range(16):
            v15 = j
            v16 = (k + (k | (16 * n)) - (k & ~(16 * n)))&0xff
            v17 = addBaseArr[v16]
            addArr[n][16 * j - 16 + k] = (v17 * v15+0x1000000)&0xff
input4 = [i for i in cmpArr]
for i in range(2):
    for n in range(16):
        for j in range(0x100):
            input4[(i<<8)+j]-=j
            input4[(i<<8)+j]=(input4[(i<<8)+j]+0x100)&0xff
            input4[(i<<8)+j]^=addArr[15-n][j]
        for j in range(0x100):
            # print(i,j,input4[(i<<8)+j])
            input4[(i<<8)+j] = reSubArr[input4[(i<<8)+j]]
        # print('==========',i,n,'===========\n',input4)

print(input4)
for i in input4:
    print(hex(i),end=",")
print()

逆向4fb0

~~函数分析~~ 太乱了，穷举了

#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <memory.h>
#include <string.h>
#include <math.h>
#include "defs.h"
#include <setjmp.h>
// #include <setimp.h>
typedef uint32_t uint;
typedef int8_t byte;
int key[8];
jmp_buf out;
void printArray(const char* name, uint8_t* v, size_t len)
{
    printf("========%s=========\n", name);
    for (size_t i = 0; i < len; i++) {
        printf("0x%02X,", v[i]);
        if (i && (i &7 )==7)printf("\n");
    }
    printf("\n=================\n");
}
typedef struct EditStru {
    uint8_t data[64];
    uint32_t cnt;
    uint32_t p1;
    uint64_t maxLen;
} EditStru;
uint32_t dword_7FF788114384 = 0x6a81;
uint8_t byte_7FF788114391 = 0x55;
uint32_t dword_7FF788114394 = 0x3fc3;
uint32_t byte_7FF788114398 = 0x14;
uint8_t byte_7FF788114388 = 0x73;
uint32_t dword_7FF78811438C = 0x69f9;
uint8_t byte_7FF788114390 = 0xd6;
uint8_t byte_7FF788114399 = 0xe9;
uint32_t dword_7FF78811439C = 0x6168;
uint32_t dword_7FF78811420C = 0x1489;
uint32_t dword_7FF788114210 = 0x4ab2;
uint32_t dword_7FF788114214 = 0x5e35;
uint32_t dword_7FF788114218 = 0x70d3;
uint32_t dword_7FF78811421C = 0x70b9;
uint32_t dword_7FF788114220 = 0x1c81;

uint8_t a3[] = {
    152, 47, 138, 66, 145, 68, 55, 113, 207, 251, 192, 181, 165, 219, 181, 233, 91, 194, 86, 57, 241, 17, 241, 89, 164, 130, 63, 146, 213, 94, 28, 171, 152, 170, 7, 216, 1, 91, 131, 18, 190, 133, 49, 36, 195, 125, 12, 85, 116, 93, 190, 114, 254, 177, 222, 128, 167, 6, 220, 155, 116, 241, 155, 193, 193, 105, 155, 228, 134, 71, 190, 239, 198, 157, 193, 15, 204, 161, 12, 36, 111, 44, 233, 45, 170, 132, 116, 74, 220, 169, 176, 92, 218, 136, 249, 118, 82, 81, 62, 152, 109, 198, 49, 168, 200, 39, 3, 176, 199, 127, 89, 191, 243, 11, 224, 198, 71, 145, 167, 213, 81, 99, 202, 6, 103, 41, 41, 20, 133, 10, 183, 39, 56, 33, 27, 46, 252, 109, 44, 77, 19, 13, 56, 83, 84, 115, 10, 101, 187, 10, 106, 118, 46, 201, 194, 129, 133, 44, 114, 146, 161, 232, 191, 162, 75, 102, 26, 168, 112, 139, 75, 194, 163, 81, 108, 199, 25, 232, 146, 209, 36, 6, 153, 214, 133, 53, 14, 244, 112, 160, 106, 16, 22, 193, 164, 25, 8, 108, 55, 30, 76, 119, 72, 39, 181, 188, 176, 52, 179, 12, 28, 57, 74, 170, 216, 78, 79, 202, 156, 91, 243, 111, 46, 104, 238, 130, 143, 116, 111, 99, 165, 120, 20, 120, 200, 132, 8, 2, 199, 140, 250, 255, 190, 144, 235, 108, 80, 164, 247, 163, 249, 190, 242, 120, 113, 198
};

__int64  extendSpace(_DWORD* a1, __int64 a2)
{
    int v2; // er9
    int v3; // er9
    int v4; // eax
    int v5; // esi
    unsigned __int64 v6; // kr00_8
    int v7; // eax
    unsigned __int64 v8; // kr08_8
    int v9; // edx
    int v10; // esi
    unsigned int v11; // eax
    int v12; // ecx
    int v13; // er9
    unsigned __int64 v14; // kr10_8
    int v15; // ecx
    unsigned __int64 v16; // kr18_8
    int v17; // esi
    int v18; // ecx
    unsigned int v19; // eax
    int v20; // eax
    int v21; // er8
    int v22; // esi
    int v23; // edx
    int v24; // esi
    int v25; // ecx
    int v26; // eax
    int v27; // esi
    int v28; // edi
    int v29; // eax
    int v30; // edx
    int v31; // eax
    int v32; // edx
    int v33; // eax
    int v34; // edx
    int v35; // ecx
    __int64 result; // rax
    unsigned int v37; // [rsp+2Ch] [rbp-25Ch]
    unsigned int i; // [rsp+2Ch] [rbp-25Ch]
    unsigned int v39; // [rsp+30h] [rbp-258h]
    unsigned int v40; // [rsp+34h] [rbp-254h]
    unsigned int v42; // [rsp+40h] [rbp-248h]
    unsigned int v43; // [rsp+44h] [rbp-244h]
    unsigned int v44; // [rsp+48h] [rbp-240h]
    unsigned int v45; // [rsp+4Ch] [rbp-23Ch]
    unsigned int v46; // [rsp+50h] [rbp-238h]
    unsigned int v47; // [rsp+54h] [rbp-234h]
    unsigned int v48; // [rsp+58h] [rbp-230h]
    int v49; // [rsp+5Ch] [rbp-22Ch]
    int v50[66]; // [rsp+70h] [rbp-218h]
    //__int64 a3[34]; // [rsp+178h] [rbp-110h] BYREF

    //printArray("test1",(uint8_t*) a1, 256);
    v37 = 2 * (dword_7FF78811420C | 0xFFFFEB77)
        - (~dword_7FF78811420C & 0xFFFFEB77)
        - (((unsigned __int16)dword_7FF78811420C | 0xEB77) & 0x1488);
    v42 = 2 * (dword_7FF788114210 | 0x4AB2) - 19122 - dword_7FF788114210;
    while (v37 < ~dword_7FF788114214 + (dword_7FF788114214 | 0x5E25) - (~dword_7FF788114214 | 0x5E25u))
    {
        v2 = *(char*)(a2 + (v42 ^ 1) + 2 - 2 * ((v42 & 1) == 0)) << 16;
        v3 = ~(v2 & (*(char*)(a2 + v42) << 24)) + v2 + (*(char*)(a2 + v42) << 24) + 1;
        v4 = *(char*)(a2 + (~v42 | 2) + (v42 | 2) + v42 + 1) << 8;
        v5 = *(char*)(a2 + (v42 | 3) + 3 - (~(_BYTE)v42 & 3));
        v50[v37] = (v5 | ~(~(v4 & v3) + v4 + v3 + 1)) + (v5 ^ (~(v4 & v3) + v4 + v3 + 1)) + ~(v4 & v3) + v4 + v3 + 1 + 1;
        v37 = 2 * (v37 & 1) + (v37 & 0xFFFFFFFE) + ((v37 & 1) == 0);
        v42 += (~v42 | 4) + (v42 | 4) + 1;
    }
    while (v37 < (~(_WORD)dword_7FF788114218 & 0x7093) + (dword_7FF788114218 | 0x7093u) - 28819)
    {
        v6 = (unsigned __int64)(unsigned int)v50[v37 - 2] << 15;
        v7 = ~(v6 & HIDWORD(v6)) + v6 + HIDWORD(v6) + 1;
        v8 = (unsigned __int64)(unsigned int)v50[v37 - 2] << 13;
        v9 = ~(v8 & HIDWORD(v8)) + v8 + HIDWORD(v8) + 1;
        v10 = (v9 & ~v7) + (v9 | v7) - v9;
        v11 = (unsigned int)v50[v37 - 2] >> 10;
        v12 = v50[v37 - 7];
        v13 = (v12 | ~(~v10 + (v11 | v10) - (v11 | ~v10)))
            + (v12 | (~v10 + (v11 | v10) - (v11 | ~v10)))
            + ~v10
            + (v11 | v10)
            - (v11 | ~v10)
            + 1;
        v14 = (unsigned __int64)(unsigned int)v50[v37 - 15] << 25;
        v15 = (v14 | ~HIDWORD(v14)) + (v14 ^ HIDWORD(v14)) + HIDWORD(v14) + 1;
        v16 = (unsigned __int64)(unsigned int)v50[v37 - 15] << 14;
        v17 = (~(v50[v37 - 15] << 14) & HIDWORD(v16)) + (v16 & ~HIDWORD(v16)) + (v16 & HIDWORD(v16));
        v18 = 2 * (v17 & ~v15) + v15 - v17;
        v19 = (unsigned int)v50[v37 - 15] >> 3;
        v20 = 2 * (v19 | v18) - v19 - v18 + ((2 * (v19 | v18) - v19 - v18) | v13) - ((2 * (v19 | v18) - v19 - v18) & ~v13);
        v21 = v50[v37 - 16];
        v50[v37] = 2 * (v21 & v20) + (~v21 & v20) + (v21 & ~v20);
        v37 += (~v37 | 1) + (v37 | 1) + 1;
    }
    v40 = a1[20];
    v44 = a1[21];
    v43 = a1[22];
    v48 = a1[23];
    v39 = a1[24];
    v46 = a1[25];
    v45 = a1[26];
    v47 = a1[27];
    for (i = 2 * (~(_WORD)dword_7FF78811421C & 0x70B9) + dword_7FF78811421C - 28857;
        i < (~(_WORD)dword_7FF788114220 & 0x1CC1) + -1 - (~dword_7FF788114220 | 0x1CC1u);
        i = 2 * (i & 1) + (i & 0xFFFFFFFE) + ((i & 1) == 0))
    {
        v22 = (~(v39 << 21) | (v39 >> 11)) + (v39 << 21) + ((v39 << 21) ^ (v39 >> 11)) + 1;
        v23 = ~(~((v39 << 26) & (v39 >> 6)) + (v39 << 26) + (v39 >> 6) + 1)
            + (v22 | (~((v39 << 26) & (v39 >> 6)) + (v39 << 26) + (v39 >> 6) + 1))
            - (v22 | ~(~((v39 << 26) & (v39 >> 6)) + (v39 << 26) + (v39 >> 6) + 1));
        v24 = (v39 << 7) + ((v39 << 7) ^ (v39 >> 25)) - ((v39 << 7) & ~(v39 >> 25));
        v25 = 2 * ((2 * (v24 | v23) - v24 - v23) & v47)
            + (~(2 * (v24 | v23) - v24 - v23) & v47)
            + ((2 * (v24 | v23) - v24 - v23) & ~v47);
        v26 = (v45 & ~v39 & ~(v46 & v39)) + (v45 & ~v39 | v46 & v39) - (v45 & ~v39);
        v27 = 2 * (v26 & v25) + (~v26 & v25) + (v26 & ~v25);
        // decryptString((__int64)&global_a1, global_a2, a3, 0x100u);
        v28 = *((_DWORD*)a3 + i);
        // encryptString((__int64)&global_a1, a3, global_a2, 0x100u);
        v29 = (v28 | ~v27) + (v28 | v27) + v27 + 1;
        v49 = 2 * (v50[i] & v29) + (~v50[i] & v29) + (v50[i] & ~v29);
        v30 = ~((v40 << 19) & (v40 >> 13)) + (v40 << 19) + (v40 >> 13) + 1;
        v31 = (v30 & ~((v40 << 30) + ((v40 << 30) ^ (v40 >> 2)) - ((v40 << 30) & ~(v40 >> 2))))
            + (v30 | ((v40 << 30) + ((v40 << 30) ^ (v40 >> 2)) - ((v40 << 30) & ~(v40 >> 2))))
            - v30;
        v32 = ~((v40 << 10) & (v40 >> 22)) + (v40 << 10) + (v40 >> 22) + 1;
        v33 = 2 * (v32 & ~v31) + v31 - v32;
        v34 = 2 * (v43 & v44 | ((v43 & v40 & ~(v44 & v40)) + (v43 & v40 | v44 & v40) - (v43 & v40)))
            - (v43 & v44)
            - ((v43 & v40 & ~(v44 & v40))
                + (v43 & v40 | v44 & v40)
                - (v43 & v40));
        v47 = v45;
        v45 = v46;
        v46 = v39;
        v39 = 2 * (v49 | v48) - (v49 & ~v48) - (~v49 & (v49 | v48));
        v48 = v43;
        v43 = v44;
        v44 = v40;
        v35 = 2 * (v34 | v33) - (v34 & ~v33) - (~v34 & (v34 | v33));
        v40 = (v35 | ~v49) + (v35 | v49) + v49 + 1;
    }
    a1[20] += (v40 | ~a1[20]) + (v40 | a1[20]) + 1;
    a1[21] = 2 * (v44 | a1[21]) - (v44 & ~a1[21]) - (~v44 & (v44 | a1[21]));
    a1[22] = 2 * (v43 | a1[22]) - (v43 & ~a1[22]) - (~v43 & (v43 | a1[22]));
    a1[23] = 2 * (v48 | ~a1[23]) + (v48 ^ a1[23]) - 2 * ~a1[23];
    a1[24] += (v39 | ~a1[24]) + (v39 | a1[24]) + 1;
    a1[25] = 2 * (v46 | ~a1[25]) + (v46 ^ a1[25]) - 2 * ~a1[25];
    a1[26] = 2 * (v45 | a1[26]) - (v45 & ~a1[26]) - (~v45 & (v45 | a1[26]));
    result = ~v47;
    a1[27] = 2 * (v47 & a1[27]) + (result & a1[27]) + (v47 & ~a1[27]);
    return result;
}
__int64  spreadByte(EditStru* a1, char* a2)
{
    _BYTE al4; // al
    _BYTE al8; // al
    __int64 result; // rax
    _BYTE var11; // [rsp+27h] [rbp-11h]
    _BYTE var11a; // [rsp+27h] [rbp-11h]
    _BYTE var11b; // [rsp+27h] [rbp-11h]
    _BYTE var11c; // [rsp+27h] [rbp-11h]
    _QWORD; // [rsp+28h] [rbp-10h]
    _QWORD; // [rsp+30h] [rbp-8h]

    var11 = a1->cnt;
    if (a1->cnt >= (~(_WORD)dword_7FF788114384 & 0x6AB9) + (dword_7FF788114384 | 0x6AB9u) - 27321)
    {
        var11b = (var11 | 1) + 1 - ((var11 & 1) == 0);
        a1->data[(char)a1->cnt] = 2 * (~byte_7FF788114391 & 0xD5) + byte_7FF788114391 + 43;
        while (var11b < (int)((dword_7FF788114394 | 0xFFFFC07D) - 16259 - (~dword_7FF788114394 & 0xFFFFC07D)))
        {
            al8 = var11b;
            var11b = (var11b | 1) + 1 - ((var11b & 1) == 0);
            a1->data[al8] = (~byte_7FF788114398 | 0xEC) + (byte_7FF788114398 | 0xEC) + byte_7FF788114398 + 1;
        }
        extendSpace((uint32*)a1, (__int64)a1);
        memset(a1, 0, 0x38u);
    }
    else
    {
        var11a = (~var11 | 1) + (var11 | 1) + var11 + 1;
        a1->data[(char)a1->cnt] = 2 * (~byte_7FF788114388 | 0xD) + (byte_7FF788114388 ^ 0xD) - 2 * ~byte_7FF788114388;
        while (var11a < (int)((dword_7FF78811438C | 0xFFFF963F) - 27073 - (~dword_7FF78811438C & 0xFFFF963F)))
        {
            al4 = var11a;
            var11a += (~var11a | 1) + (var11a | 1) + 1;
            a1->data[al4] = ~byte_7FF788114390 + (byte_7FF788114390 | 0xD6) - (~byte_7FF788114390 | 0xD6);
        }
    }
    a1->maxLen = 2 * (unsigned int)(8 * a1->cnt)
        + ((unsigned int)(8 * a1->cnt) ^ a1->maxLen)
        - 2 * ((unsigned int)(8 * a1->cnt) & ~a1->maxLen);
    a1->data[63] = a1->maxLen;
    a1->data[62] = BYTE1(a1->maxLen);
    a1->data[61] = BYTE2(a1->maxLen);
    a1->data[60] = BYTE3(a1->maxLen);
    a1->data[59] = BYTE4(a1->maxLen);
    a1->data[58] = (unsigned __int16)WORD2(a1->maxLen) >> 8;
    a1->data[57] = BYTE6(a1->maxLen);
    a1->data[56] = HIBYTE(a1->maxLen);
    extendSpace((uint32_t*)a1, (__int64)a1);
    for (var11c = 2 * (byte_7FF788114399 | 0xE9) + 23 - byte_7FF788114399;
        ;
        var11c = 2 * (var11c | 1) - ((var11c & 1) == 0) - ((var11c | 1) & 0xFE))
    {
        result = (unsigned int)var11c;
        if ((int)result >= 2 * (dword_7FF78811439C | 0x616C) - 24940 - dword_7FF78811439C)// 4
            break;
        a2[var11c] = *(_DWORD*)a1[1].data >> (24 - 8 * var11c);
        a2[2 * (var11c & 4) + (var11c & 0xFFFFFFFB) + (~var11c & 4)] = *(_DWORD*)&a1[1].data[4] >> (24 - 8 * var11c);
        a2[(var11c ^ 8) + 16 - 2 * (~var11c & 8)] = *(_DWORD*)&a1[1].data[8] >> (24 - 8 * var11c);
        a2[(var11c ^ 0xC) + 24 - 2 * (~var11c & 0xC)] = *(_DWORD*)&a1[1].data[12] >> (24 - 8 * var11c);
        a2[(var11c | 0x10) + 16 - (~var11c & 0x10)] = *(_DWORD*)&a1[1].data[16] >> (24 - 8 * var11c);
        a2[(~var11c | 0x14) + 1 + (var11c | 0x14) + var11c] = *(_DWORD*)&a1[1].data[20] >> (24 - 8 * var11c);
        a2[(~var11c | 0x18) + 1 + (var11c | 0x18) + var11c] = *(_DWORD*)&a1[1].data[24] >> (24 - 8 * var11c);
        a2[2 * (var11c & 0x1C) + (var11c & 0xFFFFFFE3) + (~var11c & 0x1C)] = *(_DWORD*)&a1[1].data[28] >> (24 - 8 * var11c);
    }
    return result;
}
char ess[1024] = { 97, 98, 99, 100, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 254, 92, 14, 136, 247, 127, 0, 0, 112, 126, 238, 85, 204, 1, 0, 0, 232, 249, 250, 30, 142, 0, 0, 0, 232, 249, 250, 30, 142, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 103, 230, 9, 106, 133, 174, 103, 187, 114, 243, 110, 60, 58, 245, 79, 165, 127, 82, 14, 81, 140, 104, 5, 155, 171, 217, 131, 31, 25, 205, 224, 91, 64, 128, 238, 85, 204, 1, 0, 0, 105, 106, 107, 108, 109, 110, 111, 0, 64, 0, 0, 0, 0, 0, 0, 0, 70, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 196, 175, 13, 136, 247, 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 176, 230, 15, 136, 247, 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 48, 243, 15, 136, 247, 127, 0, 0, 241, 175, 13, 136, 247, 127, 0, 0, 24, 243, 15, 136, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 112, 112, 17, 136, 247, 127, 0, 0, 254, 255, 255, 255, 255, 255, 255, 255, 48, 53, 238, 85, 204, 1, 0, 0, 240, 136, 238, 85, 204, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 96, 178, 13, 136, 247, 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 52, 112, 223, 84, 255, 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 81, 38, 180, 86, 255, 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 48, 251, 255, 255, 232, 4, 0, 0 };
// 待比较数据
char cmpData[] = { 106, 122, 167, 198, 82, 130, 140, 12, 179, 94, 91, 241, 175, 1, 186, 206, 92, 222, 112, 153, 180, 241, 113, 26, 183, 77, 253, 250, 60, 125, 31, 115, 232, 243, 49, 159, 36, 45, 229, 140, 77, 48, 137, 54, 32, 13, 62, 229, 250, 184, 168, 129, 138, 202, 62, 206, 77, 39, 114, 192, 122, 222, 76, 227, 34, 219, 86, 119, 47, 29, 178, 191, 22, 189, 240, 54, 125, 207, 189, 21, 160, 121, 130, 152, 90, 80, 104, 34, 125, 64, 79, 41, 99, 255, 40, 62, 197, 172, 31, 165, 185, 71, 182, 38, 179, 247, 61, 61, 115, 204, 41, 182, 240, 67, 7, 124, 171, 71, 248, 141, 142, 204, 127, 156, 71, 87, 196, 95, 145, 19, 131, 224, 118, 195, 88, 85, 237, 139, 70, 119, 169, 142, 60, 5, 48, 81, 237, 137, 218, 122, 166, 242, 189, 80, 182, 224, 135, 77, 11, 163, 42, 15, 178, 187, 180, 213, 106, 10, 170, 178, 124, 0, 180, 239, 15, 221,
106, 71, 188, 126, 178, 170, 12, 70, 116, 6, 156, 225, 59, 17, 253, 154, 218, 109, 163, 147, 226, 202, 217, 71, 129, 51, 77, 222, 78, 77, 174, 53, 76, 83, 41, 41, 193, 189, 106, 249, 43, 145, 111, 208, 165, 72, 146, 182, 254, 17, 7, 118, 48, 71, 41, 30, 123, 250, 171, 17, 155, 178, 18, 68, 9, 240, 188, 194, 25, 202, 83, 152, 189, 204, 143, 36, 201, 32, 160, 5, 189, 129, 130, 63, 125, 143, 178, 162, 70, 195, 86, 16, 247, 106, 177, 224, 162, 20, 128, 212, 35, 62, 86, 154, 70, 195, 164, 36, 51, 201, 210, 74, 142, 79, 5, 233, 48, 173, 241, 39, 123, 57, 208, 79, 191, 204, 119, 36, 53, 140, 230, 75, 44, 84, 142, 186, 215, 2, 19, 217, 179, 107, 37, 46, 238, 221, 100, 127, 218, 65, 51, 1, 110, 101, 194, 230, 76, 67, 105, 111, 37, 63, 46, 37, 157, 51, 180, 81, 125, 250, 81, 240, 198, 122, 206, 154, 154, 16,
64, 27, 106, 218, 52, 212, 88, 30, 167, 235, 37, 46, 92, 171, 213, 253, 195, 45, 17, 213, 207, 171, 66, 244, 168, 108, 104, 176, 49, 67, 136, 212, 44, 166, 203, 154, 254, 68, 193, 185, 91, 233, 96, 178, 245, 42, 204, 16, 28, 182, 209, 244, 153, 123, 97, 111, 10, 214, 245, 84, 23, 78, 91, 30, 24, 48, 143, 138, 136, 154, 147, 237, 80, 129, 15, 189, 204, 95, 26, 194, 78, 249, 34, 120, 145, 89, 116, 216, 35, 182, 24, 43, 87, 115, 169, 8, 179, 19, 49, 128, 242, 56, 207, 89, 73, 176, 66, 208, 217, 7, 137, 219, 29, 146, 50, 93, 174, 83, 62, 107, 4, 233, 57, 64, 55, 55, 226, 246, 117, 130, 174, 102, 46, 29, 124, 16, 8, 83, 73, 100, 79, 180, 229, 144, 19, 252, 137, 94, 142, 144, 66, 191, 154, 43, 75, 123, 206, 151 };
int main()
{
    /*es[0] = 'a';
    es[1] = 'b';
    es[2] = 'c';
    es[3] = 'd';*/
    char flag[65];
    memset(flag, 0, 65);
    char res[1024];
    char es[1024];
    memcpy(es, ess, 0x200);
    char dic[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{}_-+/";
    size_t len = strlen(dic);
    for (size_t i = 0; i < 16; i++) {
        int isOk = 0;
        for (size_t i1 = 0; i1 < len&&!isOk; i1++) {
            printf("%d %d %s\n",i, i1, es);
            fflush(stdout);
            for (size_t i2 = 0; i2 < len ; i2++) {
                for (size_t i3 = 0; i3 < len; i3++) {
                    for (size_t i4 = 0; i4 < len; i4++) {
                        memcpy(es, ess, 0x200);
                        es[0] = dic[i1];
                        es[1] = dic[i2];
                        es[2] = dic[i3];
                        es[3] = dic[i4];
                        spreadByte((EditStru*)es, res);
                        /*if (!strncmp(es, "abcd", 4)) {
                            printArray("res", (uint8_t*)res, 256);
                            printArray("cmp", (uint8_t*)cmpData, 8);
                        }*/
                        if (!memcmp(res, &cmpData[i*32], 32)) {
                            printf("%s\n", es);
                            printArray("flag4", (uint8_t*)es, 32);
                            memcpy(&flag[i * 4], es, 4);
                            fflush(stdout);
                            printf("%s\n", flag);
                            isOk = 1;
                        }
                    }
                }
            }

        }
    }
    printf("%s\n", flag);
    //spreadByte((EditStru*)es, res);
    //printArray("test", (uint8_t*)res, 32);
    return 0;
}

gdb穷举脚本(效率不足)

import gdb

cmpData = [106, 122, 167, 198, 82, 130, 140, 12, 179, 94, 91, 241, 175, 1, 186, 206, 92, 222, 112, 153, 180, 241, 113, 26, 183, 77, 253, 250, 60, 125, 31, 115, 232, 243, 49, 159, 36, 45, 229, 140, 77, 48, 137, 54, 32, 13, 62, 229, 250, 184, 168, 129, 138, 202, 62, 206, 77, 39, 114, 192, 122, 222, 76, 227, 34, 219, 86, 119, 47, 29, 178, 191, 22, 189, 240, 54, 125, 207, 189, 21, 160, 121, 130, 152, 90, 80, 104, 34, 125, 64, 79, 41, 99, 255, 40, 62, 197, 172, 31, 165, 185, 71, 182, 38, 179, 247, 61, 61, 115, 204, 41, 182, 240, 67, 7, 124, 171, 71, 248, 141, 142, 204, 127, 156, 71, 87, 196, 95, 145, 19, 131, 224, 118, 195, 88, 85, 237, 139, 70, 119, 169, 142, 60, 5, 48, 81, 237, 137, 218, 122, 166, 242, 189, 80, 182, 224, 135, 77, 11, 163, 42, 15, 178, 187, 180, 213, 106, 10, 170, 178, 124, 0, 180, 239, 15, 221, 106, 71, 188, 126, 178, 170, 12, 70, 116, 6, 156, 225, 59, 17, 253, 154, 218, 109, 163, 147, 226, 202, 217, 71, 129, 51, 77, 222, 78, 77, 174, 53, 76, 83, 41, 41, 193, 189, 106, 249, 43, 145, 111, 208, 165, 72, 146, 182, 254, 17, 7, 118, 48, 71, 41, 30, 123, 250, 171, 17, 155, 178, 18, 68, 9, 240, 188, 194, 25, 202, 83, 152, 189, 204, 143, 36, 201, 32, 160, 5, 189, 129, 130, 63, 125, 143, 178, 162, 70, 195, 86, 16, 247, 106, 177, 224, 162, 20, 128, 212, 35, 62, 86, 154, 70, 195, 164, 36, 51, 201, 210, 74, 142, 79, 5, 233, 48, 173, 241, 39, 123, 57, 208, 79, 191, 204, 119, 36, 53, 140, 230, 75, 44, 84, 142, 186, 215, 2, 19, 217, 179, 107, 37, 46, 238, 221, 100, 127, 218, 65, 51, 1, 110, 101, 194, 230, 76, 67, 105, 111, 37, 63, 46, 37, 157, 51, 180, 81, 125, 250, 81, 240, 198, 122, 206, 154, 154, 16, 64, 27, 106, 218, 52, 212, 88, 30, 167, 235, 37, 46, 92, 171, 213, 253, 195, 45, 17, 213, 207, 171, 66, 244, 168, 108, 104, 176, 49, 67, 136, 212, 44, 166, 203, 154, 254, 68, 193, 185, 91, 233, 96, 178, 245, 42, 204, 16, 28, 182, 209, 244, 153, 123, 97, 111, 10, 214, 245, 84, 23, 78, 91, 30, 24, 48, 143, 138, 136, 154, 147, 237, 80, 129, 15, 189, 204, 95, 26, 194, 78, 249, 34, 120, 145, 89, 116, 216, 35, 182, 24, 43, 87, 115, 169, 8, 179, 19, 49, 128, 242, 56, 207, 89, 73, 176, 66, 208, 217, 7, 137, 219, 29, 146, 50, 93, 174, 83, 62, 107, 4, 233, 57, 64, 55, 55, 226, 246, 117, 130, 174, 102, 46, 29, 124, 16, 8, 83, 73, 100, 79, 180, 229, 144, 19, 252, 137, 94, 142, 144, 66, 191, 154, 43, 75, 123, 206, 151]

# cmpData = [136, 212, 38, 111, 212, 230, 51, 141, 19, 184, 69, 252, 242, 137, 87, 157, 32, 156, 137, 120, 35, 185, 33, 125, 163, 225, 97, 147, 111, 3, 21, 137, 229, 224, 136, 160, 182, 97, 99, 160, 162, 106, 94, 5, 61, 42, 68, 150, 220, 22, 171, 110, 14, 61, 209, 173, 242, 209, 106, 168, 74, 7, 140, 157, 0, 92, 25, 101, 137, 25, 24, 107, 133, 97, 140, 88, 112, 70, 62, 236, 141, 155, 140, 26, 157, 0, 32, 138, 83, 82, 137, 27, 165, 187, 224, 134, 241, 175, 195, 20, 121, 82, 45, 108, 255, 30, 208, 104, 249, 57, 152, 240, 90, 140, 211, 178, 47, 92, 55, 215, 243, 7, 8, 79, 98, 209, 210, 112, 131, 153, 37, 154, 44, 79, 236, 63, 26, 82, 172, 156, 149, 35, 140, 88, 113, 148, 61, 185, 116, 14, 82, 171, 39, 32, 36, 233, 247, 13, 108, 29, 15, 118, 233, 37, 121, 213, 88, 110, 206, 14, 226, 178, 111, 74, 211, 229, 213, 197, 227, 75, 138, 205, 215, 103, 89, 39, 229, 44, 15, 102, 141, 13, 85, 67, 158, 148, 75, 60, 19, 11, 114, 18, 115, 45, 105, 226, 194, 195, 236, 21, 181, 179, 90, 241, 165, 165, 184, 82, 215, 246, 95, 135, 22, 56, 151, 39, 188, 58, 49, 245, 160, 153, 148, 168, 64, 135, 145, 162, 45, 180, 177, 37, 2, 69, 46, 110, 93, 0, 165, 154, 14, 248, 52, 43, 65, 207, 151, 92, 167, 43, 107, 223, 14, 147, 139, 204, 33, 71, 39, 201, 57, 247, 252, 100, 16, 158, 232, 241, 74, 221, 69, 90, 35, 100, 232, 209, 69, 31, 121, 120, 228, 70, 226, 190, 180, 144, 26, 160, 44, 226, 170, 12, 35, 93, 28, 116, 93, 154, 50, 53, 232, 160, 166, 6, 97, 150, 39, 54, 118, 156, 20, 185, 24, 164, 10, 133, 150, 24, 69, 219, 20, 113, 62, 241, 19, 43, 70, 22, 43, 30, 213, 50, 57, 187, 198, 83, 95, 43, 160, 249, 224, 222, 122, 83, 31, 195, 1, 129, 199, 84, 139, 60, 78, 183, 52, 108, 45, 180, 182, 243, 72, 192, 49, 97, 156, 71, 195, 180, 244, 133, 118, 140, 46, 200, 23, 244, 136, 247, 104, 219, 143, 190, 122, 64, 138, 148, 105, 32, 60, 97, 224, 59, 95, 228, 50, 20, 185, 90, 0, 231, 192, 197, 45, 47, 217, 51, 136, 212, 38, 111, 212, 230, 51, 141, 19, 184, 69, 252, 242, 137, 87, 157, 32, 156, 137, 120, 35, 185, 33, 125, 163, 225, 97, 147, 111, 3, 21, 137, 229, 224, 136, 160, 182, 97, 99, 160, 162, 106, 94, 5, 61, 42, 68, 150, 220, 22, 171, 110, 14, 61, 209, 173, 242, 209, 106, 168, 74, 7, 140, 157, 0, 92, 25, 101, 137, 25, 24, 107, 133, 97, 140, 88, 112, 70, 62, 236, 141, 155, 140, 26, 157, 0, 32, 138, 83, 82, 137, 27, 165, 187, 224, 134]

gdb.execute('file white-give.exe')
gdb.execute('set pagination off')
base = 0x7FF7880D0000
gdb.execute('b *0x%x'%(base+0x2582)) # test len
# gdb.execute('b *0x13f81279b') # encyrptString
gdb.execute('b *0x%x'%(base+0x27da)) # spreadByte
gdb.execute('b *0x%x'%(base+0x27df))

gdb.execute('run < input.txt')
gdb.execute('c')

def getData(s:str):
    lines = s.split('\n',-1)
    data = []
    for line in lines:
        line = line.split('	',-1)
        data+=[int(i[2:],base=16) for i in line[1:]]
    return data
tab = [i for i in b'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ{}_-+/']
# tab = [i for i in b'abcd']
tabl = len(tab)
outf = open('res.txt','w')
def brute(cnt):
    for i1 in range(tabl):
        for i2 in range(tabl):
            for i3 in range(tabl):
                for i4 in range(tabl):
                    gdb.execute('set $rip=0x%x'%(base+0x2700))
                    gdb.execute('c')
                    rdx=gdb.execute('p/x $rdx',to_string=True).split(' = ')[1]
                    # outf.write(gdb.execute('p/x $rdx',to_string=True)+'\r\n')
                    rdx = int(rdx[2:],base=16)
                    gdb.execute('set {char}$rcx=0x%x'%tab[i1])
                    gdb.execute('set {char}($rcx+1)=0x%x'%tab[i2])
                    gdb.execute('set {char}($rcx+2)=0x%x'%tab[i3])
                    gdb.execute('set {char}($rcx+3)=0x%x'%tab[i4])
                    # gdb.execute('set {char}$rcx=0x%x'%ord('a'))
                    # gdb.execute('set {char}($rcx+1)=0x%x'%ord('b'))
                    # gdb.execute('set {char}($rcx+2)=0x%x'%ord('c'))
                    # gdb.execute('set {char}($rcx+3)=0x%x'%ord('d'))
                    data = gdb.execute('x/32xb $rcx',to_string=True)
                    # gdb.execute('ni')
                    gdb.execute('c')
                    res = gdb.execute('x/32xb 0x%x'%rdx,to_string=True)
                    # outf.write('$rdx=0x%x\r\n'%rdx)
                    # outf.write(data+'\r\n')
                    # outf.write('\r\n')
                    # outf.write(res)
                    # outf.write(getData(res))
                    print(i1,i2,i3,i4)
                    data = getData(res)
                    # print('%c%c%c%c %s%s'%(tab[i1],tab[i2],tab[i3],tab[i4],str(data[0]),str(data[0]==cmpData[0])))
                    # print(type(data))
                    if data==cmpData[cnt*32:cnt*32+32]:
                        print('found'+str(data))
                        outf.write('%c%c%c%c\r\n'%(tab[i1],tab[i2],tab[i3],tab[i4]))
                        outf.write(str(data)+"\r\n")
                        outf.flush()
                        return '%c%c%c%c'%(tab[i1],tab[i2],tab[i3],tab[i4])
                    # if len(data)!=32:
                    #     outf.write(res+" "+str(data)+" "+str(len(data))+' len error\r\n')
                    #     exit(0)
flag = ''
for i in range(16):
    flag+=brute(i)
    print(flag)
    outf.write(flag+'\r\n')
outf.write(flag)
outf.close()

看了别人的wp知道前面是sha256。。

[rev]jumpjump

sub_408a70，408a80这两个函数应该是检查安全的

然后主要逻辑是input[i]=((input[i]^0x57)+4^0x33)

cmpData = [0x9, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x5b, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x56, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x5b, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0]
flag = ''
for i in range(0,len(cmpData),4):
    flag+=chr((cmpData[i]^0x33)-4^0x57)
print(flag)
# acf23b4e-764c-4a58-af1c-54073ac8ebea

感想：不能过于依赖ida的伪代码，有时候不准确，只是个参考

[rev]ancient

https://ctftime.org/writeup/26284

当时只知道穷举了，没看清程序逻辑。

后来知道那里的逻辑是两个大数相乘，可以从后向前穷举，我黑盒时没看出来，唉

另外还可以用mmap执行程序函数的方法，学到了。

======================================

乘法时用到了SSE指令

_mm_shuffle_epi32(mm128 a,mm8 b)

intel文档

DEFINE SELECT4(src, control) {
	CASE(control[1:0]) OF
	0:	tmp[31:0] := src[31:0]
	1:	tmp[31:0] := src[63:32]
	2:	tmp[31:0] := src[95:64]
	3:	tmp[31:0] := src[127:96]
	ESAC
	RETURN tmp[31:0]
}
dst[31:0] := SELECT4(a[127:0], imm8[1:0])
dst[63:32] := SELECT4(a[127:0], imm8[3:2])
dst[95:64] := SELECT4(a[127:0], imm8[5:4])
dst[127:96] := SELECT4(a[127:0], imm8[7:6])

_mm_add_epi32

FOR j := 0 to 3
	i := j*32
	dst[i+31:i] := a[i+31:i] + b[i+31:i]
ENDFOR

_mm_cvtsi128_si32 (__m128i a)

1	dst[31:0] := a[31:0]

================================

我的思路

尝试进行黑盒测试
脚本

import gdb
cmpData = [103, 243, 163, 202, 35, 88, 163, 209, 248, 193, 150, 227, 215, 133, 133, 254, 190, 123, 210, 130, 89, 244, 216, 240, 95, 245, 226, 85, 229, 44, 20, 220, 214, 244, 96, 249, 137, 132, 12, 112, 80, 184, 245, 222, 127, 255, 90, 200, 141, 97, 240, 2, 0]
def getData(s:str):
    lines = s.split('\n',-1)
    data = []
    for line in lines:
        line = line.split('	',-1)
        data+=[int(i[2:],base=16) for i in line[1:]]
    return data
base = 0x00401000
main = 0x880
keyFunc = 0xc30
nikeyFunc=0xc35
start = 0xbfa
def testInput():
    gdb.execute('file ancient')
    gdb.execute('set pagination off')
    gdb.execute('b *0x%x'%(base+keyFunc))
    gdb.execute('b *0x%x'%(base+nikeyFunc))
    gdb.execute('r')
    rsi = gdb.execute('p/x $rsi',to_string=True).split(' = ')[1]
    rsi = int(rsi[2:],base=16)
    rdi = gdb.execute('p/x $rdi',to_string=True).split(' = ')[1]
    rdi = int(rdi[2:],base=16)
    gdb.execute('c')
    res = gdb.execute('x/53xb 0x%x'%(rdi+126),to_string=True)
    data = getData(res)
    print(data)

[103, 243, 163, 202, 35, 88, 163, 209, 248, 193, 150, 227, 215, 133, 133, 254, 190, 123, 210, 130, 89, 244, 216, 240, 95, 245, 226, 85, 229, 44, 20, 220, 214, 244, 96, 249, 137, 132, 12, 112, 80, 184, 245, 222, 127, 255, 90, 200]

d3ctfabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy
[103, 243, 163, 202, 29, 17, 15, 91, 125, 172, 247, 49, 112, 127, 39, 50, 216, 18, 7, 28, 199, 108, 226, 48, 181, 134, 92, 91, 16, 153, 62, 212, 157, 212, 18, 112, 112, 198, 140, 146, 11, 177, 239, 195, 55, 199, 253, 126, 130, 224, 8]
d3ctf0bcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy
[103, 243, 163, 202, 25, 119, 59, 182, 223, 235, 61, 204, 92, 31, 202, 204, 180, 4, 129, 215, 49, 219, 56, 145, 178, 214, 255, 20, 168, 190, 102, 164, 153, 58, 16, 75, 235, 162, 28, 167, 141, 71, 60, 163, 224, 149, 106, 234, 161, 228, 2]
d3ctf01cdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy
[103, 243, 163, 202, 25, 114, 56, 118, 223, 235, 61, 204, 92, 31, 202, 204, 180, 4, 129, 215, 49, 219, 56, 145, 178, 214, 255, 20, 170, 16, 234, 244, 72, 6, 184, 128, 169, 106, 190, 98, 94, 77, 168, 144, 46, 156, 243, 74, 109, 240, 1]
d3ctfabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwx0
[103, 243, 163, 202, 29, 17, 15, 91, 125, 172, 247, 49, 112, 127, 39, 50, 216, 18, 7, 28, 199, 108, 226, 48, 181, 134, 92, 91, 16, 153, 62, 212, 157, 212, 18, 112, 112, 198, 140, 146, 11, 177, 239, 195, 55, 199, 253, 119, 27, 96, 4]
d3ctfabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvw10
[103, 243, 163, 202, 29, 17, 15, 91, 125, 172, 247, 49, 112, 127, 39, 50, 216, 18, 7, 28, 199, 108, 226, 48, 181, 134, 92, 91, 16, 153, 62, 212, 157, 212, 18, 112, 112, 198, 140, 146, 11, 177, 239, 195, 55, 199, 247, 68, 59, 96, 4]

可以看到当前面变的时候，后面也变了；后面变的时候，前面没变。所以应该从前向后DFS，脚本如下。

# coding=utf-8

import gdb
# from pwntool import *
import sys

cmpData = [103, 243, 163, 202, 35, 88, 163, 209, 248, 193, 150, 227, 215, 133, 133, 254, 190, 123, 210, 130, 89, 244, 216, 240, 95, 245, 226, 85, 229, 44, 20, 220, 214, 244, 96, 249, 137, 132, 12, 112, 80, 184, 245, 222, 127, 255, 90, 200, 141, 97, 240, 2, 0]
f = open('out.log','w')
f.write(str(cmpData)+'\n')
tab = [i for i in b'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-{}.+/']
l = len(tab)
def getData(s:str):
    lines = s.split('\n',-1)
    data = []
    for line in lines:
        line = line.split('	',-1)
        data+=[int(i[2:],base=16) for i in line[1:]]
    return data
base = 0x00401000
main = 0x880
keyFunc = 0xc30
nikeyFunc=0xc35
start = 0xbfa
# rdi rsi rdx rcx r8 r9
flag = 'd3ctf{' # +'W_i'
gdb.execute('file ancient')
gdb.execute('set pagination off')
gdb.execute('b *0x%x'%(base+keyFunc))
gdb.execute('b *0x%x'%(base+nikeyFunc))
gdb.execute('r')

def test1(i,initStr):
    # initStr = str(bytes(initArr),encoding='utf-8')
    hasRes=False
    print(i,initStr)
    gdb.execute('set $rip=0x%x'%(base+start))
    gdb.execute('c')
    rsi = gdb.execute('p/x $rsi',to_string=True).split(' = ')[1]
    rsi = int(rsi[2:],base=16)
    rdi = gdb.execute('p/x $rdi',to_string=True).split(' = ')[1]
    rdi = int(rdi[2:],base=16)
    for j in range(i):
        gdb.execute('set {char}($rsi+0x%x)=0x%x'%((126+j),ord(initStr[j])))
    for i1 in range(l):
        gdb.execute('set $rip=0x%x'%(base+start))
        gdb.execute('c')
        rsi = gdb.execute('p/x $rsi',to_string=True).split(' = ')[1]
        rsi = int(rsi[2:],base=16)
        rdi = gdb.execute('p/x $rdi',to_string=True).split(' = ')[1]
        rdi = int(rdi[2:],base=16)
        # print('rsi:',hex(rsi),'rdi:',hex(rdi))
        gdb.execute('set {char}($rsi+0x%x)=0x%x'%((126+i),tab[i1]))
                
        # print(gdb.execute('x/xs $rsi+126',to_string=True))
        # gdb.execute('ni')
        gdb.execute('c')
        res = gdb.execute('x/56xb 0x%x'%(rdi+126),to_string=True)
        data = getData(res)
        # print(data,cmpData[i])
        if(data[i-1]==cmpData[i-1]):
            print(data)
            print('found :',chr(tab[i1]))
            # flag+=chr(tab[i1])+chr(tab[i2])+chr(tab[i3])
            f.write(str(data)+"\n")
            if(i>50):
                f.write('LookHere\n')
                return
            f.write(str(i)+" "+initStr+chr(tab[i1])+'\n')
            # initArr[i-1]=tab[i1]
            if(not test1(i+1,initStr+chr(tab[i1]))):
                pass
            f.flush()
            hasRes=True
    return hasRes
test1(19,'d3ctf{w0W_sEems_u_b')

# print(flag)
f.close()
exit(0)

# d3ctf{w0W_sEems_u_bRe4k_uP_tHe_H1DdeN_s7R_By_Ae1tH_c0De}

但是这种方法只能穷举到d3ctf{w0W_sEems，然后尝试了一下输入正确的flag，结果继续向后了，说明大佬的想法正确，尝试从后向前穷举

==================================

大佬的方法：每一位只会影响之前的。。手工DFS

也就是从后向前穷举

==================================

按照ctftime wp的说法（相乘），如果穷举过程中如果中断了，就选一个差最小的。

https://ctftime.org/writeup/26284

GDB的脚本有点慢，所以笔者最多尝试了2byte穷举，这个wp使用的是mmap的方法穷举，加快了速度，可以使用3byte甚至4byte穷举

大佬的脚本（改成linux可以执行了。。）

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>

unsigned char key[] = {
    0x54, 0x67, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x61, 0x6e, 0x20, 0x61,
    0x6e, 0x63, 0x69, 0x65, 0x6e, 0x74, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
    0x67, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x72, 0x65, 0x70, 0x72, 0x65, 0x73,
    0x65, 0x6e, 0x74, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6f, 0x72, 0x69,
    0x67, 0x69, 0x6e, 0x20, 0x6f, 0x66, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x62,
    0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
    0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x69, 0x73, 0x6e, 0x27, 0x74, 0x20,
    0x69, 0x74, 0x2e, 0x20, 0x4c, 0x65, 0x74, 0x20, 0x6d, 0x65, 0x20, 0x73,
    0x65, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x73, 0x61, 0x79, 0x73, 0x20,
    0x30, 0x2c, 0x31, 0x2c, 0x32, 0x2c, 0x33, 0x2c, 0x34, 0x2c, 0x35, 0x2c,
    0x36, 0x2c, 0x37, 0x2e, 0x2e, 0x2e, 0x67, 0xf3, 0xa3, 0xca, 0x23, 0x58,
    0xa3, 0xd1, 0xf8, 0xc1, 0x96, 0xe3, 0xd7, 0x85, 0x85, 0xfe, 0xbe, 0x7b,
    0xd2, 0x82, 0x59, 0xf4, 0xd8, 0xf0, 0x5f, 0xf5, 0xe2, 0x55, 0xe5, 0x2c,
    0x14, 0xdc, 0xd6, 0xf4, 0x60, 0xf9, 0x89, 0x84, 0x0c, 0x70, 0x50, 0xb8,
    0xf5, 0xde, 0x7f, 0xff, 0x5a, 0xc8, 0x8d, 0x61, 0xf0, 0x02};
unsigned int key_len = 178;

unsigned char fixed[0x1000];

unsigned char printable[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_0123456789{}";
#define LEN (sizeof(printable) - 1)

inline static int same(unsigned char *a, unsigned char *b)
{
    int i;
    for (i = 0; i < key_len; i++)
    {
        if (*a == *b)
        {
            a++;
            b++;
        }
        else
        {
            break;
        }
    }
    return i - 131;
}

int main()
{
    int i, ii, iii, offset, temp;
    unsigned char output[0x800], input[0x800] = "This is an ancient string, it represents the origin of all binary characters, isn't it."
                                                " Let me see, it says 0,1,2,3,4,5,6,7..."
                                                "d3ctf{w0W_sEems_u_bRe4k_uP_tHe_H1DdeN_s7R_By_Ae1tH_c0De}";

    FILE*fd = fopen("./ancient", "rb");
    void*addr = mmap((void *)0x400000, 32768, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED| MAP_ANON, -1, 0);
    fread(addr,1024,26800/1024+1,fd);
    *(size_t *)0x407080 = (size_t)malloc;
    fclose(fd);
    mprotect((void *)0x400000, 32768, PROT_EXEC | PROT_READ);

    ((void (*)(unsigned char *, int))0x402110)(fixed, 16);
    ((void (*)(unsigned char *))0x402B60)(fixed);

    memset(output, 0, sizeof(output));
    offset = 126;
    printf("%c%c\n\n", input[offset - 2], input[offset - 1]);

    for(offset=126;offset<178;offset+=3){
      int isOk=0;
      for (i = 0; i < LEN&&!isOk; i++)
      {
          for (ii = 0; ii < LEN&&!isOk; ii++)
          {
              for (iii = 0; iii < LEN&&!isOk; iii++)
              {
                  input[offset] = printable[i];
                  input[offset + 1] = printable[ii];
                  input[offset + 2] = printable[iii];

                  ((void (*)(unsigned char *, int))0x402110)(fixed, 16);
                  ((void (*)(unsigned char *))0x402B60)(fixed);
                  ((void (*)(unsigned char *, unsigned char *, int, unsigned char *, int, int))0x403500)(output, input, 184, fixed, 126, 0);
                  temp = same(key, output);
                  if (44 <= temp)
                  {
                      printf("%d: %c%c%c\n", temp, printable[i], printable[ii], printable[iii]);
                      isOk=1;
                      // exit(EXIT_SUCCESS);
                  }
              }
          }
      }
    }

    return 0;
}

2021-03-01

google2021年3月

beginners

simple changes using intel xmm instructions, these are docs

https://software.intel.com/sites/landingpage/IntrinsicsGuide/#text=_mm_xor_si128&expand=6170

https://software.intel.com/sites/landingpage/IntrinsicsGuide/#text=_mm_shuffle_epi8&expand=5153

https://software.intel.com/sites/landingpage/IntrinsicsGuide/#text=_mm_add_epi32&expand=94

It is worthy to notice that the docs are operate on bits

from z3 import *
from Crypto.Util.number import long_to_bytes

xord = [118, 88, 180, 73, 141, 26, 95, 56, 212, 35, 248, 52, 235, 134, 249, 170]
addd = [239, 190, 173, 222, 173, 222, 225, 254, 55, 19, 55, 19, 102, 116, 99, 103]
shuffle = [2, 6, 7, 1, 5, 11, 9, 14, 3, 15, 4, 8, 10, 12, 13, 0]
xordw = 0
adddw = 0
pack = lambda x,i:x[i]|(x[i+1]<<8)|(x[i+2]<<16)|(x[i+3]<<24)
xorp = [pack(xord,i) for i in range(0,16,4)]
addp = [pack(addd,i) for i in range(0,16,4)]
for i in range(4):
    print(hex(xorp[i]),hex(addp[i]))
v = [BitVec("v%d"%i,32) for i in range(16)]
s = Solver()
for i in range(16):
    s.add(v[i]>=0)
    s.add(v[i]<=0xff)
for i in range(0,16,4):
    s.add((v[i]|(v[i+1]<<8)|(v[i+2]<<16)|(v[i+3]<<24))^xorp[i//4]==(v[shuffle[i]]|(v[shuffle[i+1]]<<8)|(v[shuffle[i+2]]<<16)|(v[shuffle[i+3]]<<24))+addp[i//4])
s.add(v[0]==ord('C'))
s.add(v[1]==ord('T'))
s.add(v[2]==ord('F'))
s.add(v[3]==ord('{'))
res = []
if s.check()==sat:
    m = s.model()
    print(m)
    for i in v:
        res.append(m[i].as_long())
print(res,bytes(res))

[rev]ANDROID

open the apk file with jadx, you can see the main algorithm. I’m sorry I can’t break out reverse algorithm, so I brute it.


public class Main{
    public static long[] m0(long a, long b) {
        if (a == 0) {
            return new long[]{0, 1};
        }
        long[] r = m0(b % a, a); 
        return new long[]{r[1] - ((b / a) * r[0]), r[0]};
    }
    
    static int a[] = new int[]{65, 112, 112, 97, 114, 101, 110, 116, 108, 121, 32, 116, 104, 105, 115, 32, 105, 115, 32, 110, 111, 116, 32, 116, 104, 101, 32, 102, 108, 97, 103, 46, 32, 87, 104, 97, 116, 39, 115, 32, 103, 111, 105, 110, 103, 32, 111, 110, 63};
    static long cmpData[] = new long[]{40999019, 2789358025L, 656272715, 18374979, 3237618335l, 1762529471, 685548119, 382114257, 1436905469, 2126016673, 3318315423l, 797150821};
    public static void main(String[] args){
        long num = 4294967296L;
        byte dic[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+{}_-/!?".getBytes();
        int l = dic.length;
        StringBuilder sbF = new StringBuilder();
        
        for(int i=0;i<cmpData.length;i++){
            boolean notOk=true;
            for(int i1=0;i1<l&&notOk;i1++){
                for(int i2=0;i2<l&&notOk;i2++){
                    for(int i3=0;i3<l&&notOk;i3++){
                        for(int i4=0;i4<l&&notOk;i4++){
                            long data = dic[i1]|(dic[i2]<<8)|(dic[i3]<<16)|(dic[i4]<<24);
                            if(((m0(data,num)[0]%num)+num)%num==cmpData[i]){
                                System.out.printf("0x%x\n",data);
                                System.out.printf("%c%c%c%c\n",dic[i1],dic[i2],dic[i3],dic[i4]);
                                sbF.append(new String(new byte[]{dic[i1],dic[i2],dic[i3],dic[i4]}));
                                notOk=false;
                            }
                        }
                    }
                }
            }
            
        }
        System.out.println(sbF.toString());
    }
}

.net

https://mrt4ntr4.github.io/GoogleCTF-dotNet/

使用了下面的库，在运行时会动态patch代码
https://github.com/pardeike/Harmony

dnspy在程序上右键->转到入口点可以直接找到入口点。

一步一步找到检测函数：输入长度是30，先把输入单个字符base64解码转成列表，

public static List<uint> GRUNDTAL_NORRVIKEN(string LINNMON)
	{
		List<uint> list = new List<uint>(LINNMON.Length);
		int num = 0;
		if (0 < LINNMON.Length)
		{
			do
			{
				list.Add(<Module>.DecodeBase64Bytewise((sbyte)LINNMON[num]));
				num++;
			}
			while (num < LINNMON.Length);
		}
		return list;
	}

然后判断每个字符都应该小于等于63。

执行按字节异或

public class FARGRIK
{
	// Token: 0x0600014B RID: 331 RVA: 0x00001948 File Offset: 0x00000D48
	public static void DAGSTORP(ref List<uint> primary, List<uint> filter)
	{
		int num = 0;
		if (0 < primary.Count)
		{
			do
			{
				primary[num] = (filter[num % filter.Count] ^ primary[num]);
				num++;
			}
			while (num < primary.Count);
		}
	}

计算checksum

internal static bool SMORBOLL(List<uint> IRMELIN)
	{
		if (IRMELIN.Count == 0)
		{
			return true;
		}
		uint num = 16U;
		int num2 = 0;
		if (0 < IRMELIN.Count)
		{
			do
			{
				if (num2 != IRMELIN.Count - 2)
				{
					num = IRMELIN[num2] + num;
					if (num2 % 2 == 0)
					{
						num = IRMELIN[num2] + num;
					}
					int num3 = num2;
					if (num3 - num3 / 3 * 3 == 0)
					{
						num = IRMELIN[num2] * 4294967294U + num;
					}
					int num4 = num2;
					if (num4 - num4 / 5 * 5 == 0)
					{
						num = IRMELIN[num2] * 4294967293U + num;
					}
					int num5 = num2;
					if (num5 - num5 / 7 * 7 == 0)
					{
						num = IRMELIN[num2] * 4U + num;
					}
				}
				num2++;
			}
			while (num2 < IRMELIN.Count);
		}
		return (((uint)((sbyte)IRMELIN[IRMELIN.Count - 2]) == (num & 63U)) ? 1 : 0) != 0;
	}

检测是否有重复

internal static bool VAXMYRA(List<uint> LYCKSELE)
	{
		int num = 0;
		if (0 < LYCKSELE.Count)
		{
			do
			{
				int num2 = 0;
				if (0 < num)
				{
					while (LYCKSELE[num] != LYCKSELE[num2])
					{
						num2++;
						if (num2 >= num)
						{
							goto IL_29;
						}
					}
					return false;
				}
				IL_29:
				num++;
			}
			while (num < LYCKSELE.Count);
			return true;
		}
		return true;
	}

最终检测

internal static string HEROISK(List<uint> MATHOPEN)
	{
		string result = "Invalid flag. Please check the number and try again.";
		if (!<Module>.VAXMYRA(MATHOPEN))
		{
			return result;
		}
		if (MATHOPEN[1] != 25U)
		{
			return result;
		}
		if (MATHOPEN[2] != 23U)
		{
			return result;
		}
		if (MATHOPEN[9] != 9U)
		{
			return result;
		}
		if (MATHOPEN[20] != 45U)
		{
			return result;
		}
		if (MATHOPEN[26] != 7U)
		{
			return result;
		}
		if (MATHOPEN[8] < 15U)
		{
			return result;
		}
		if (MATHOPEN[12] > 4U)
		{
			return result;
		}
		if (MATHOPEN[14] < 48U)
		{
			return result;
		}
		if (MATHOPEN[29] < 1U)
		{
			return result;
		}
		int num = (int)MATHOPEN[4];
		int num2 = (int)MATHOPEN[3];
		int num3 = (int)MATHOPEN[2];
		int num4 = (int)MATHOPEN[1];
		if (((MATHOPEN[0] + (uint)num4 + (uint)num + (uint)num3 + (uint)num2 - 130U <= 10U) ? 1 : 0) == 0)
		{
			return result;
		}
		num4 = (int)MATHOPEN[9];
		int num5 = (int)MATHOPEN[8];
		int num6 = (int)MATHOPEN[7];
		int num7 = (int)MATHOPEN[6];
		if (((MATHOPEN[5] + (uint)num7 + (uint)num6 + (uint)num5 + (uint)num4 - 140U <= 10U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num8 = (int)MATHOPEN[14];
		int num9 = (int)MATHOPEN[13];
		int num10 = (int)MATHOPEN[12];
		int num11 = (int)MATHOPEN[11];
		if (((MATHOPEN[10] + (uint)num11 + (uint)num10 + (uint)num9 + (uint)num8 - 150U <= 10U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num12 = (int)MATHOPEN[19];
		int num13 = (int)MATHOPEN[18];
		int num14 = (int)MATHOPEN[17];
		int num15 = (int)MATHOPEN[16];
		if (((MATHOPEN[15] + (uint)num15 + (uint)num14 + (uint)num13 + (uint)num12 - 160U <= 10U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num16 = (int)MATHOPEN[24];
		int num17 = (int)MATHOPEN[23];
		int num18 = (int)MATHOPEN[22];
		int num19 = (int)MATHOPEN[21];
		if (((MATHOPEN[20] + (uint)num19 + (uint)num18 + (uint)num17 + (uint)num16 - 170U <= 10U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num20 = (int)MATHOPEN[25];
		int num21 = (int)MATHOPEN[20];
		int num22 = (int)MATHOPEN[15];
		int num23 = (int)MATHOPEN[10];
		int num24 = (int)MATHOPEN[5];
		if (((MATHOPEN[0] + (uint)num24 + (uint)num23 + (uint)num22 + (uint)num21 + (uint)num20 - 172U <= 6U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num25 = (int)MATHOPEN[26];
		int num26 = (int)MATHOPEN[21];
		int num27 = (int)MATHOPEN[16];
		int num28 = (int)MATHOPEN[11];
		int num29 = (int)MATHOPEN[6];
		if (((MATHOPEN[1] + (uint)num29 + (uint)num28 + (uint)num27 + (uint)num26 + (uint)num25 - 162U <= 6U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num30 = (int)MATHOPEN[27];
		int num31 = (int)MATHOPEN[22];
		int num32 = (int)MATHOPEN[17];
		int num33 = (int)MATHOPEN[12];
		int num34 = (int)MATHOPEN[7];
		if (((MATHOPEN[2] + (uint)num34 + (uint)num33 + (uint)num32 + (uint)num31 + (uint)num30 - 152U <= 6U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num35 = (int)MATHOPEN[23];
		int num36 = (int)MATHOPEN[18];
		int num37 = (int)MATHOPEN[13];
		int num38 = (int)MATHOPEN[8];
		if (((MATHOPEN[3] + (uint)num38 + (uint)num37 + (uint)num36 + (uint)num35 - 142U <= 6U) ? 1 : 0) == 0)
		{
			return result;
		}
		int num39 = (int)MATHOPEN[29];
		int num40 = (int)MATHOPEN[24];
		int num41 = (int)MATHOPEN[19];
		int num42 = (int)MATHOPEN[14];
		int num43 = (int)MATHOPEN[9];
		if (((MATHOPEN[4] + (uint)num43 + (uint)num42 + (uint)num41 + (uint)num40 + (uint)num39 - 132U <= 6U) ? 1 : 0) == 0)
		{
			return result;
		}
		uint num44 = MATHOPEN[27] * 3U;
		uint num45 = (MATHOPEN[7] + num44) * 3U - MATHOPEN[5] * 13U;
		if (num45 - 57U > 28U)
		{
			return result;
		}
		num44 = MATHOPEN[20] * 5U;
		num44 = (MATHOPEN[14] << 2) - num44;
		num45 = MATHOPEN[22] * 3U + num44;
		if (num45 - 12U > 70U)
		{
			return result;
		}
		num44 = MATHOPEN[18] * 2U;
		num44 = (MATHOPEN[15] - num44) * 3U;
		uint num46 = MATHOPEN[16] * 2U;
		num46 = (MATHOPEN[14] + num46) * 2U + num44 - MATHOPEN[17] * 5U;
		if (MATHOPEN[13] + num46 != 0U)
		{
			return result;
		}
		num46 = MATHOPEN[6] * 2U;
		if (MATHOPEN[5] != num46)
		{
			return result;
		}
		if (MATHOPEN[29] + MATHOPEN[7] != 59U)
		{
			return result;
		}
		uint num47 = MATHOPEN[17] * 6U;
		if (MATHOPEN[0] != num47)
		{
			return result;
		}
		num47 = MATHOPEN[9] * 4U;
		if (MATHOPEN[8] != num47)
		{
			return result;
		}
		num47 = MATHOPEN[13] * 3U;
		if (MATHOPEN[11] << 1 != num47)
		{
			return result;
		}
		if (MATHOPEN[13] + MATHOPEN[29] + MATHOPEN[11] + MATHOPEN[4] != MATHOPEN[19])
		{
			return result;
		}
		uint num48 = MATHOPEN[12] * 13U;
		if (MATHOPEN[10] != num48)
		{
			return result;
		}
		return null;
	}

sprint

2021-02-28

git入门笔记

git 简明入门教程–runoob.com

git 教程–runoob.com

github 简明教程

设置用户名和email

1 2	git config --global user.name "runoob" git config --global user.email test@runoob.com

global选项用于指定全局的用户名和email，如果要为项目设置特定的，去掉该选项即可

设置默认的编辑器和差异比较工具

1 2	git config --global core.editor emacs git config --global merge.tool vimdiff

查看已有配置(实际文件位于~/.gitconfig或/etc/gitconfig)

1 2	git config --list git config user.name # 查看特定项

git工作流程

git 创建仓库

1 2	git init git init reponame # 创建一个目录

添加文件

1 2	git add 文件名 git commit -m "this is a commit"

clone 到本地

1	git clone 库名 # 后面可以跟本地文件夹名

分支管理

git branch  # 创建分支
git checkout # 切换分支
git merge # 合并分支
git branch -d # 删除分支

提交历史

1 2	git log git blame filename # 列表形式查看文件修改记录

标签功能

1	git tag # 打标签

github相关

ssh-keygen -t rsa -C "email" # 生成密钥
# 复制公钥到github
ssh -T git@github.com # 测试连接
git remote add 仓库名 # 添加仓库
git remote rm 仓库名 # 删除仓库