DEADCTF WP

clev1L Lv3
  2024-08-06 21:26:13 2024-08-06 21:26:13 Created   2025-02-23 12:29:57 2025-02-23 12:29:57 Updated  5.1k Words  30 Mins  

JavaCPScript

通过测试发现每一位加密独立，在下图位置插入语句打印加密后的结果，直接爆破，2h爆出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import subprocess
from string import ascii_letters,digits,ascii_uppercase,ascii_lowercase
from tqdm import tqdm
enc=[3895813, 3893664,3895583,3893639,3919755,3893694,3871506,3871544,3810527,3921672,3913158,3813122,3869603,3813209,3910936,3911023,3896081,3822626,3913160,3919793,3822653,3895614,3820987,3820987,3932159,3911025,3893657,3921671,3820578,3921709,3921698,3910918,]
sign=[0]*32
dic='''ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{|}-_!"#$%&'()*+,-.<=>?@[\]^_`~'''
command = 'node --stack-size=1000000000 main.js'
base="*"*32
for j in tqdm(dic):
    trydata=base.replace("*",j)
    print("[!]try:"+trydata)
    open("input","w").write(trydata)
    result = subprocess.run(command, shell=True, text=True, capture_output=True)
    out=result.stdout.strip("\n").split("\n")
    data=[eval(i) for i in out][::-1]
    print(data)
    for k in range(len(enc)):
        if enc[k]==data[k] and sign[k]==0:
            sign[k] = 1
            base=base[:k]+j+base[k+1:]
    if sum(sign)==len(sign):
        print("[+]found flag:",base)
        exit()
    else:
        print("[!]not found:",sign.count(0))

FlagChecker

解包后查看so，大致可以看出为一个虚拟机

每个执行操作的地方打断点

……

用脚本打印信息，输入测试flag：DEAD{run_pybyt3c0d3_w1th_C_4P1!}，这里测试的flag就是真的flag，可以拿任意符合格式flag进行测试

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
from ida_hexrays import *
from ida_dbg import *
from idaapi import *
from idautils import *
from idc import *
from ida_kernwin import *
def rol(val, r_bits, max_bits=64):
    """循环左移操作"""
    return ((val << r_bits) & (2**max_bits - 1)) | (val >> (max_bits - r_bits))

def ror(val, r_bits, max_bits=64):
    """循环右移操作"""
    return (val >> r_bits) | ((val << (max_bits - r_bits)) & (2**max_bits - 1))
'''自定义调试器钩子类'''
class dbg_hooks_t(ida_dbg.DBG_Hooks):
    '''继承自父类DBG_Hooks'''
    def __init__(self):
        ida_dbg.DBG_Hooks.__init__(self)

    def dbg_suspend_process(self):
        if here()!=0x7f37e8fd5b3c:
            op=idc.GetDisasm(here())
            tmp="".join(op.split()[1:]).split(",")
            op=op.split()[0]
            ip1=eval("cpu."+tmp[0].strip())
            ip2 =eval("cpu."+tmp[1].strip())
            result=0
            if op=="add":
                result=ip1+ip2
            if op=="xor":
                result=ip1^ip2
            if op=="sub":
                result=(ip1-ip2)&0xffffffffffffffff
            if op=="shl":
                result=(ip1<<ip2)&0xffffffffffffffff
            if op=="shr":
                result=(ip1>>ip2)&0xffffffffffffffff
            if op=="rol":
                result=rol(ip1,ip2)&0xffffffffffffffff
            if op=="ror":
                result=ror(ip1,ip2)&0xffffffffffffffff



            print("{} {}, {}     result={}".format(op,hex(ip1),hex(ip2),hex(result)))
            continue_process()



'''安装/卸载钩子'''
if 'tmp_dbg_hooks' not in dir():
    tmp_dbg_hooks = dbg_hooks_t()
    tmp_dbg_hooks.hook()
    print('[+] tmp dbg hook success')
else:
    tmp_dbg_hooks.unhook()
    del tmp_dbg_hooks
    print('[+] tmp dbg unhook success')

拿到调试信息加密逻辑分为两段

第一段

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
xor 0x0, 0x0     result=0x0
xor 0x0, 0x0     result=0x0
xor 0x0, 0x0     result=0x0
add 0x0, 0x6e75727b44414544     result=0x6e75727b44414544
add 0x0, 0x6e75727b44414544     result=0x6e75727b44414544
and 0x6e75727b44414544, 0xff     result=0x0
xor 0x44, 0x28     result=0x6c
xor 0x0, 0x6c     result=0x6c
shl 0x6c, 0x8     result=0x6c00
shr 0x6e75727b44414544, 0x8     result=0x6e75727b444145
xor 0x6c, 0x6c     result=0x0
add 0x0, 0x6e75727b444145     result=0x6e75727b444145
and 0x6e75727b444145, 0xff     result=0x0
xor 0x45, 0xb1     result=0xf4
xor 0x6c00, 0xf4     result=0x6cf4
shl 0x6cf4, 0x8     result=0x6cf400
shr 0x6e75727b444145, 0x8     result=0x6e75727b4441
xor 0xf4, 0xf4     result=0x0
add 0x0, 0x6e75727b4441     result=0x6e75727b4441
and 0x6e75727b4441, 0xff     result=0x0
xor 0x41, 0x61     result=0x20
xor 0x6cf400, 0x20     result=0x6cf420
shl 0x6cf420, 0x8     result=0x6cf42000
shr 0x6e75727b4441, 0x8     result=0x6e75727b44
xor 0x20, 0x20     result=0x0
add 0x0, 0x6e75727b44     result=0x6e75727b44
and 0x6e75727b44, 0xff     result=0x0
xor 0x44, 0x6e     result=0x2a
xor 0x6cf42000, 0x2a     result=0x6cf4202a
shl 0x6cf4202a, 0x8     result=0x6cf4202a00
shr 0x6e75727b44, 0x8     result=0x6e75727b
xor 0x2a, 0x2a     result=0x0
add 0x0, 0x6e75727b     result=0x6e75727b
and 0x6e75727b, 0xff     result=0x0
xor 0x7b, 0x3     result=0x78
xor 0x6cf4202a00, 0x78     result=0x6cf4202a78
shl 0x6cf4202a78, 0x8     result=0x6cf4202a7800
shr 0x6e75727b, 0x8     result=0x6e7572
xor 0x78, 0x78     result=0x0
add 0x0, 0x6e7572     result=0x6e7572
and 0x6e7572, 0xff     result=0x0
xor 0x72, 0x8c     result=0xfe
xor 0x6cf4202a7800, 0xfe     result=0x6cf4202a78fe
shl 0x6cf4202a78fe, 0x8     result=0x6cf4202a78fe00
shr 0x6e7572, 0x8     result=0x6e75
xor 0xfe, 0xfe     result=0x0
add 0x0, 0x6e75     result=0x6e75
and 0x6e75, 0xff     result=0x0
xor 0x75, 0x55     result=0x20
xor 0x6cf4202a78fe00, 0x20     result=0x6cf4202a78fe20
shl 0x6cf4202a78fe20, 0x8     result=0x6cf4202a78fe2000
shr 0x6e75, 0x8     result=0x6e
xor 0x20, 0x20     result=0x0
add 0x0, 0x6e     result=0x6e
and 0x6e, 0xff     result=0x0
xor 0x6e, 0x33     result=0x5d
xor 0x6cf4202a78fe2000, 0x5d     result=0x6cf4202a78fe205d
xor 0x6e75727b44414544, 0x6e75727b44414544     result=0x0
add 0x0, 0x6cf4202a78fe205d     result=0x6cf4202a78fe205d
xor 0x6e, 0x6e     result=0x0
xor 0x5d, 0x5d     result=0x0
xor 0x6cf4202a78fe205d, 0x6cf4202a78fe205d     result=0x0
add 0x0, 0x633374796279705f     result=0x633374796279705f
add 0x0, 0x633374796279705f     result=0x633374796279705f
and 0x633374796279705f, 0xff     result=0x0
xor 0x5f, 0xca     result=0x95
xor 0x0, 0x95     result=0x95
shl 0x95, 0x8     result=0x9500
shr 0x633374796279705f, 0x8     result=0x63337479627970
xor 0x95, 0x95     result=0x0
add 0x0, 0x63337479627970     result=0x63337479627970
and 0x63337479627970, 0xff     result=0x0
xor 0x70, 0x5a     result=0x2a
xor 0x9500, 0x2a     result=0x952a
shl 0x952a, 0x8     result=0x952a00
shr 0x63337479627970, 0x8     result=0x633374796279
xor 0x2a, 0x2a     result=0x0
add 0x0, 0x633374796279     result=0x633374796279
and 0x633374796279, 0xff     result=0x0
xor 0x79, 0xbd     result=0xc4
xor 0x952a00, 0xc4     result=0x952ac4
shl 0x952ac4, 0x8     result=0x952ac400
shr 0x633374796279, 0x8     result=0x6333747962
xor 0xc4, 0xc4     result=0x0
add 0x0, 0x6333747962     result=0x6333747962
and 0x6333747962, 0xff     result=0x0
xor 0x62, 0xa3     result=0xc1
xor 0x952ac400, 0xc1     result=0x952ac4c1
shl 0x952ac4c1, 0x8     result=0x952ac4c100
shr 0x6333747962, 0x8     result=0x63337479
xor 0xc1, 0xc1     result=0x0
add 0x0, 0x63337479     result=0x63337479
and 0x63337479, 0xff     result=0x0
xor 0x79, 0x8a     result=0xf3
xor 0x952ac4c100, 0xf3     result=0x952ac4c1f3
shl 0x952ac4c1f3, 0x8     result=0x952ac4c1f300
shr 0x63337479, 0x8     result=0x633374
xor 0xf3, 0xf3     result=0x0
add 0x0, 0x633374     result=0x633374
and 0x633374, 0xff     result=0x0
xor 0x74, 0xce     result=0xba
xor 0x952ac4c1f300, 0xba     result=0x952ac4c1f3ba
shl 0x952ac4c1f3ba, 0x8     result=0x952ac4c1f3ba00
shr 0x633374, 0x8     result=0x6333
xor 0xba, 0xba     result=0x0
add 0x0, 0x6333     result=0x6333
and 0x6333, 0xff     result=0x0
xor 0x33, 0xa3     result=0x90
xor 0x952ac4c1f3ba00, 0x90     result=0x952ac4c1f3ba90
shl 0x952ac4c1f3ba90, 0x8     result=0x952ac4c1f3ba9000
shr 0x6333, 0x8     result=0x63
xor 0x90, 0x90     result=0x0
add 0x0, 0x63     result=0x63
and 0x63, 0xff     result=0x0
xor 0x63, 0x85     result=0xe6
xor 0x952ac4c1f3ba9000, 0xe6     result=0x952ac4c1f3ba90e6
xor 0x633374796279705f, 0x633374796279705f     result=0x0
add 0x0, 0x952ac4c1f3ba90e6     result=0x952ac4c1f3ba90e6
xor 0x63, 0x63     result=0x0
xor 0xe6, 0xe6     result=0x0
xor 0x952ac4c1f3ba90e6, 0x952ac4c1f3ba90e6     result=0x0
add 0x0, 0x687431775f336430     result=0x687431775f336430
add 0x0, 0x687431775f336430     result=0x687431775f336430
and 0x687431775f336430, 0xff     result=0x0
xor 0x30, 0x57     result=0x67
xor 0x0, 0x67     result=0x67
shl 0x67, 0x8     result=0x6700
shr 0x687431775f336430, 0x8     result=0x687431775f3364
xor 0x67, 0x67     result=0x0
add 0x0, 0x687431775f3364     result=0x687431775f3364
and 0x687431775f3364, 0xff     result=0x0
xor 0x64, 0x13     result=0x77
xor 0x6700, 0x77     result=0x6777
shl 0x6777, 0x8     result=0x677700
shr 0x687431775f3364, 0x8     result=0x687431775f33
xor 0x77, 0x77     result=0x0
add 0x0, 0x687431775f33     result=0x687431775f33
and 0x687431775f33, 0xff     result=0x0
xor 0x33, 0xee     result=0xdd
xor 0x677700, 0xdd     result=0x6777dd
shl 0x6777dd, 0x8     result=0x6777dd00
shr 0x687431775f33, 0x8     result=0x687431775f
xor 0xdd, 0xdd     result=0x0
add 0x0, 0x687431775f     result=0x687431775f
and 0x687431775f, 0xff     result=0x0
xor 0x5f, 0x2f     result=0x70
xor 0x6777dd00, 0x70     result=0x6777dd70
shl 0x6777dd70, 0x8     result=0x6777dd7000
shr 0x687431775f, 0x8     result=0x68743177
xor 0x70, 0x70     result=0x0
add 0x0, 0x68743177     result=0x68743177
and 0x68743177, 0xff     result=0x0
xor 0x77, 0x5d     result=0x2a
xor 0x6777dd7000, 0x2a     result=0x6777dd702a
shl 0x6777dd702a, 0x8     result=0x6777dd702a00
shr 0x68743177, 0x8     result=0x687431
xor 0x2a, 0x2a     result=0x0
add 0x0, 0x687431     result=0x687431
and 0x687431, 0xff     result=0x0
xor 0x31, 0xd8     result=0xe9
xor 0x6777dd702a00, 0xe9     result=0x6777dd702ae9
shl 0x6777dd702ae9, 0x8     result=0x6777dd702ae900
shr 0x687431, 0x8     result=0x6874
xor 0xe9, 0xe9     result=0x0
add 0x0, 0x6874     result=0x6874
and 0x6874, 0xff     result=0x0
xor 0x74, 0x96     result=0xe2
xor 0x6777dd702ae900, 0xe2     result=0x6777dd702ae9e2
shl 0x6777dd702ae9e2, 0x8     result=0x6777dd702ae9e200
shr 0x6874, 0x8     result=0x68
xor 0xe2, 0xe2     result=0x0
add 0x0, 0x68     result=0x68
and 0x68, 0xff     result=0x0
xor 0x68, 0xfd     result=0x95
xor 0x6777dd702ae9e200, 0x95     result=0x6777dd702ae9e295
xor 0x687431775f336430, 0x687431775f336430     result=0x0
add 0x0, 0x6777dd702ae9e295     result=0x6777dd702ae9e295
xor 0x68, 0x68     result=0x0
xor 0x95, 0x95     result=0x0
xor 0x6777dd702ae9e295, 0x6777dd702ae9e295     result=0x0
add 0x0, 0x7d213150345f435f     result=0x7d213150345f435f
add 0x0, 0x7d213150345f435f     result=0x7d213150345f435f
and 0x7d213150345f435f, 0xff     result=0x0
xor 0x5f, 0x73     result=0x2c
xor 0x0, 0x2c     result=0x2c
shl 0x2c, 0x8     result=0x2c00
shr 0x7d213150345f435f, 0x8     result=0x7d213150345f43
xor 0x2c, 0x2c     result=0x0
add 0x0, 0x7d213150345f43     result=0x7d213150345f43
and 0x7d213150345f43, 0xff     result=0x0
xor 0x43, 0x8c     result=0xcf
xor 0x2c00, 0xcf     result=0x2ccf
shl 0x2ccf, 0x8     result=0x2ccf00
shr 0x7d213150345f43, 0x8     result=0x7d213150345f
xor 0xcf, 0xcf     result=0x0
add 0x0, 0x7d213150345f     result=0x7d213150345f
and 0x7d213150345f, 0xff     result=0x0
xor 0x5f, 0x7b     result=0x24
xor 0x2ccf00, 0x24     result=0x2ccf24
shl 0x2ccf24, 0x8     result=0x2ccf2400
shr 0x7d213150345f, 0x8     result=0x7d21315034
xor 0x24, 0x24     result=0x0
add 0x0, 0x7d21315034     result=0x7d21315034
and 0x7d21315034, 0xff     result=0x0
xor 0x34, 0xfb     result=0xcf
xor 0x2ccf2400, 0xcf     result=0x2ccf24cf
shl 0x2ccf24cf, 0x8     result=0x2ccf24cf00
shr 0x7d21315034, 0x8     result=0x7d213150
xor 0xcf, 0xcf     result=0x0
add 0x0, 0x7d213150     result=0x7d213150
and 0x7d213150, 0xff     result=0x0
xor 0x50, 0xae     result=0xfe
xor 0x2ccf24cf00, 0xfe     result=0x2ccf24cffe
shl 0x2ccf24cffe, 0x8     result=0x2ccf24cffe00
shr 0x7d213150, 0x8     result=0x7d2131
xor 0xfe, 0xfe     result=0x0
add 0x0, 0x7d2131     result=0x7d2131
and 0x7d2131, 0xff     result=0x0
xor 0x31, 0xd9     result=0xe8
xor 0x2ccf24cffe00, 0xe8     result=0x2ccf24cffee8
shl 0x2ccf24cffee8, 0x8     result=0x2ccf24cffee800
shr 0x7d2131, 0x8     result=0x7d21
xor 0xe8, 0xe8     result=0x0
add 0x0, 0x7d21     result=0x7d21
and 0x7d21, 0xff     result=0x0
xor 0x21, 0xa7     result=0x86
xor 0x2ccf24cffee800, 0x86     result=0x2ccf24cffee886
shl 0x2ccf24cffee886, 0x8     result=0x2ccf24cffee88600
shr 0x7d21, 0x8     result=0x7d
xor 0x86, 0x86     result=0x0
add 0x0, 0x7d     result=0x7d
and 0x7d, 0xff     result=0x0
xor 0x7d, 0x75     result=0x8
xor 0x2ccf24cffee88600, 0x8     result=0x2ccf24cffee88608
xor 0x7d213150345f435f, 0x7d213150345f435f     result=0x0
add 0x0, 0x2ccf24cffee88608     result=0x2ccf24cffee88608

不难看出只是个异或逻辑，还原一下算法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
def process(inputs):
    # 输入的四个64位数
    num1 = inputs[0]
    num2 = inputs[1]
    num3 = inputs[2]
    num4 = inputs[3]

    # 初始化一些变量
    result = 0
    temp1 = num1
    temp2 = num2
    temp3 = num3
    temp4 = num4

    data = [0x28, 0xb1, 0x61, 0x6e, 0x3, 0x8c, 0x55, 0x33, 0xca, 0x5a, 0xbd, 0xa3, 0x8a, 0xce, 0xa3, 0x85, 0x57, 0x13,
            0xee, 0x2f, 0x5d, 0xd8, 0x96, 0xfd, 0x73, 0x8c, 0x7b, 0xfb, 0xae, 0xd9, 0xa7, 0x75]
    results=[]
    # 对第一个数进行处理
    for i in range(8):
        byte = temp1 & 0xff
        temp1 >>= 8
        xor_result = byte ^ data[0+i]
        result = (result << 8) | xor_result
    results.append(result)
    result = 0
    # 对第二个数进行处理
    for i in range(8):
        byte = temp2 & 0xff
        temp2 >>= 8
        xor_result = byte ^ data[1+i]
        result = (result << 8) | xor_result
    results.append(result)
    result = 0
    # 对第三个数进行处理
    for i in range(8):
        byte = temp3 & 0xff
        temp3 >>= 8
        xor_result = byte ^ data[2+i]
        result = (result << 8) | xor_result
    results.append(result)
    result = 0
    # 对第四个数进行处理
    for i in range(8):
        byte = temp4 & 0xff
        temp4 >>= 8
        xor_result = byte ^ data[3+i]
        result = (result << 8) | xor_result
    results.append(result)
    return results



# 示例输入
input=list(map(ord,"DEAD{run_pybyt3c0d3_w1th_C_4P1!}"))
input=[int.from_bytes(input[i:i+8],"little") for i in range(0,len(input),8)]
output = process(input)
for i in output:
    print(hex(i))

第二段

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
sub 0x2ccf24cffee88608, 0x952ac4c1f3ba90e6     result=0x97a4600e0b2df522
sub 0x6777dd702ae9e295, 0xa5b577c2fb57f719     result=0xc1c265ad2f91eb7c
sub 0x6cf4202a78fe205d, 0x97a4600e0b2df522     result=0xd54fc01c6dd02b3b
add 0xd54fc01c6dd02b3b, 0x92bfddfec2f52f3b     result=0x1680f9e1b30c55a76
xor 0xc1c265ad2f91eb7c, 0xcadc9ba99a2ae444     result=0xb1efe04b5bb0f38
sub 0x97a4600e0b2df522, 0x37e4241df14718d     result=0x94261dcc2c198395
xor 0x94261dcc2c198395, 0x952ac4c1f3ba90e6     result=0x10cd90ddfa31373
rol 0x10cd90ddfa31373, 0x2d     result=0x626e60219b21bbf4
sub 0x626e60219b21bbf4, 0x680f9e1b30c55a76     result=0xfa5ec2066a5c617e
xor 0xb1efe04b5bb0f38, 0xa324444e39c3e7e7     result=0xa83aba4a8c78e8df
ror 0x680f9e1b30c55a76, 0x2c     result=0xe1b30c55a76680f9
ror 0x952ac4c1f3ba90e6, 0x9     result=0x734a956260f9dd48
sub 0xe1b30c55a76680f9, 0xa83aba4a8c78e8df     result=0x3978520b1aed981a
add 0x734a956260f9dd48, 0xa83aba4a8c78e8df     result=0x11b854faced72c627
ror 0x1b854faced72c627, 0x34     result=0x54faced72c6271b8
sub 0xa83aba4a8c78e8df, 0x5350ea4003b419e1     result=0x54e9d00a88c4cefe
sub 0xfa5ec2066a5c617e, 0x54faced72c6271b8     result=0xa563f32f3df9efc6
add 0xa563f32f3df9efc6, 0x54e9d00a88c4cefe     result=0xfa4dc339c6bebec4
xor 0xfa4dc339c6bebec4, 0x7d27118487b24a4c     result=0x876ad2bd410cf488
rol 0x54e9d00a88c4cefe, 0x26     result=0x3133bf953a7402a2
sub 0x876ad2bd410cf488, 0x3978520b1aed981a     result=0x4df280b2261f5c6e
xor 0x54faced72c6271b8, 0xb948cbbf8c616936     result=0xedb20568a003188e
ror 0xedb20568a003188e, 0x3c     result=0xdb20568a003188ee
rol 0x3978520b1aed981a, 0x39     result=0x3472f0a41635db30
xor 0x3472f0a41635db30, 0x8c27c187b5925ea7     result=0xb8553123a3a78597
sub 0xb8553123a3a78597, 0x4df280b2261f5c6e     result=0x6a62b0717d882929
add 0xdb20568a003188ee, 0x6a62b0717d882929     result=0x1458306fb7db9b217
sub 0x3133bf953a7402a2, 0x6011664a1feadd72     result=0xd122594b1a892530
sub 0x4df280b2261f5c6e, 0xc6b76b35dc565f4b     result=0x873b157c49c8fd23
rol 0x6a62b0717d882929, 0x3a     result=0xa5a98ac1c5f620a4
ror 0x458306fb7db9b217, 0x38     result=0x8306fb7db9b21745
xor 0xd122594b1a892530, 0x873b157c49c8fd23     result=0x56194c375341d813
xor 0x56194c375341d813, 0x5d13d65e4a7935dd     result=0xb0a9a691938edce
xor 0xa5a98ac1c5f620a4, 0xb0a9a691938edce     result=0xaea310a8dccecd6a
rol 0x873b157c49c8fd23, 0x1e     result=0x12723f48e1cec55f
xor 0xb0a9a691938edce, 0x78f00494b1fd4117     result=0x73fa9efda8c5acd9
add 0x73fa9efda8c5acd9, 0xaea310a8dccecd6a     result=0x1229dafa685947a43
xor 0x8306fb7db9b21745, 0xaea310a8dccecd6a     result=0x2da5ebd5657cda2f
rol 0x2da5ebd5657cda2f, 0xd     result=0xbd7aacaf9b45e5b4
sub 0xbd7aacaf9b45e5b4, 0x15a37cdf4f1c5ece     result=0xa7d72fd04c2986e6
rol 0x12723f48e1cec55f, 0x3f     result=0x89391fa470e762af
rol 0xa7d72fd04c2986e6, 0x1a     result=0x4130a61b9a9f5cbf
xor 0x89391fa470e762af, 0xaea310a8dccecd6a     result=0x279a0f0cac29afc5
sub 0xaea310a8dccecd6a, 0x23683b20a006c3f1     result=0x8b3ad5883cc80979
sub 0x279a0f0cac29afc5, 0x8b3ad5883cc80979     result=0x9c5f39846f61a64c
sub 0x4130a61b9a9f5cbf, 0x9c5f39846f61a64c     result=0xa4d16c972b3db673
ror 0x8b3ad5883cc80979, 0x2a     result=0x620f32025e62ceb5
add 0x229dafa685947a43, 0x3f3cd0b931fb83ba     result=0x61da805fb78ffdfd
add 0x61da805fb78ffdfd, 0x24ace0da2a14ef6d     result=0x86876139e1a4ed6a
sub 0xa4d16c972b3db673, 0x620f32025e62ceb5     result=0x42c23a94ccdae7be
ror 0x86876139e1a4ed6a, 0x2e     result=0x84e78693b5aa1a1d
sub 0x620f32025e62ceb5, 0x9e69f9d52fe5a72a     result=0xc3a5382d2e7d278b
xor 0x9c5f39846f61a64c, 0x42c23a94ccdae7be     result=0xde9d0310a3bb41f2
rol 0x84e78693b5aa1a1d, 0x39     result=0x3b09cf0d276b5434
sub 0xc3a5382d2e7d278b, 0xde9d0310a3bb41f2     result=0xe508351c8ac1e599
xor 0x42c23a94ccdae7be, 0x9f0093fa7d70e962     result=0xddc2a96eb1aa0edc
sub 0xddc2a96eb1aa0edc, 0xde9d0310a3bb41f2     result=0xff25a65e0deeccea
xor 0x3b09cf0d276b5434, 0xe508351c8ac1e599     result=0xde01fa11adaab1ad
add 0xe508351c8ac1e599, 0x79584d73a695110c     result=0x15e6082903156f6a5
sub 0xff25a65e0deeccea, 0xde01fa11adaab1ad     result=0x2123ac4c60441b3d
rol 0xde9d0310a3bb41f2, 0x27     result=0xdda0f96f4e818851
rol 0xde01fa11adaab1ad, 0x37     result=0xd6ef00fd08d6d558
xor 0x2123ac4c60441b3d, 0xd6ef00fd08d6d558     result=0xf7ccacb16892ce65
xor 0xd6ef00fd08d6d558, 0x7b66780079bcf18d     result=0xad8978fd716a24d5
sub 0x5e6082903156f6a5, 0xf7ccacb16892ce65     result=0x6693d5dec8c42840
add 0xdda0f96f4e818851, 0x273e52f26ceb226b     result=0x104df4c61bb6caabc
xor 0xf7ccacb16892ce65, 0xa1d8a9d784041e4     result=0xfdd1262c10d28f81
add 0xfdd1262c10d28f81, 0x4df4c61bb6caabc     result=0x102b0728dcc3f3a3d
add 0x4df4c61bb6caabc, 0x54aca4906a29539b     result=0x598bf0f22595fe57
sub 0xad8978fd716a24d5, 0x2b0728dcc3f3a3d     result=0xaad9066fa52aea98
add 0x6693d5dec8c42840, 0xaad9066fa52aea98     result=0x1116cdc4e6def12d8
add 0xaad9066fa52aea98, 0x598bf0f22595fe57     result=0x10464f761cac0e8ef
sub 0x598bf0f22595fe57, 0x982a5ed5ad23b3f5     result=0xc161921c78724a62
add 0x116cdc4e6def12d8, 0x29dd2db2114bf812     result=0x3b4a0a007f3b0aea
sub 0x3b4a0a007f3b0aea, 0x464f761cac0e8ef     result=0x36e5129eb47a21fb
xor 0x36e5129eb47a21fb, 0x464f761cac0e8ef     result=0x3281e5ff7ebac914
rol 0x464f761cac0e8ef, 0xd     result=0x9eec39581d1de08c
add 0x3281e5ff7ebac914, 0x14051b581ba4a8ec     result=0x468701579a5f7200
ror 0xc161921c78724a62, 0x3a     result=0x5864871e1c9298b0
xor 0x2b0728dcc3f3a3d, 0x498e0b410bee2b9e     result=0x4b3e79ccc7d111a3
xor 0x7d, 0x7d     result=0x0
xor 0x8, 0x8     result=0x0
xor 0x0, 0x468701579a5f7200     result=0x468701579a5f7200
shr 0x468701579a5f7200, 0x20     result=0x46870157
xor 0x0, 0x468701579a5f7200     result=0x468701579a5f7200
xor 0x46870157, 0xba885960     result=0xfc0f5837
xor 0xfc0f5837, 0x468701579a5f7200     result=0x4687015766502a37
xor 0x468701579a5f7200, 0x4687015766502a37     result=0xfc0f5837
xor 0x4687015766502a37, 0xfc0f5837     result=0x468701579a5f7200
xor 0x468701579a5f7200, 0xefac3c8c     result=0x4687015775f34e8c
xor 0x4687015775f34e8c, 0xfc0f5837     result=0x4687015789fc16bb
xor 0xfc0f5837, 0x4687015789fc16bb     result=0x4687015775f34e8c
xor 0x4687015789fc16bb, 0x4687015775f34e8c     result=0xfc0f5837
xor 0xfc0f5837, 0x1e64ba90     result=0xe26be2a7
xor 0xe26be2a7, 0x4687015775f34e8c     result=0x468701579798ac2b
xor 0x4687015775f34e8c, 0x468701579798ac2b     result=0xe26be2a7
xor 0x468701579798ac2b, 0xe26be2a7     result=0x4687015775f34e8c
xor 0x4687015775f34e8c, 0xf47c0b5     result=0x468701577ab48e39
shl 0x468701577ab48e39, 0x20     result=0x7ab48e3900000000
xor 0x468701579a5f7200, 0x468701579a5f7200     result=0x0
xor 0x0, 0x7ab48e3900000000     result=0x7ab48e3900000000
xor 0x7ab48e3900000000, 0xe26be2a7     result=0x7ab48e39e26be2a7
xor 0x7ab48e3900000000, 0x7ab48e3900000000     result=0x0
xor 0xe26be2a7, 0xe26be2a7     result=0x0
xor 0x0, 0x4b3e79ccc7d111a3     result=0x4b3e79ccc7d111a3
shr 0x4b3e79ccc7d111a3, 0x20     result=0x4b3e79cc
xor 0x0, 0x4b3e79ccc7d111a3     result=0x4b3e79ccc7d111a3
xor 0x4b3e79cc, 0xba885960     result=0xf1b620ac
xor 0xf1b620ac, 0x4b3e79ccc7d111a3     result=0x4b3e79cc3667310f
xor 0x4b3e79ccc7d111a3, 0x4b3e79cc3667310f     result=0xf1b620ac
xor 0x4b3e79cc3667310f, 0xf1b620ac     result=0x4b3e79ccc7d111a3
xor 0x4b3e79ccc7d111a3, 0xefac3c8c     result=0x4b3e79cc287d2d2f
xor 0x4b3e79cc287d2d2f, 0xf1b620ac     result=0x4b3e79ccd9cb0d83
xor 0xf1b620ac, 0x4b3e79ccd9cb0d83     result=0x4b3e79cc287d2d2f
xor 0x4b3e79ccd9cb0d83, 0x4b3e79cc287d2d2f     result=0xf1b620ac
xor 0xf1b620ac, 0x1e64ba90     result=0xefd29a3c
xor 0xefd29a3c, 0x4b3e79cc287d2d2f     result=0x4b3e79ccc7afb713
xor 0x4b3e79cc287d2d2f, 0x4b3e79ccc7afb713     result=0xefd29a3c
xor 0x4b3e79ccc7afb713, 0xefd29a3c     result=0x4b3e79cc287d2d2f
xor 0x4b3e79cc287d2d2f, 0xf47c0b5     result=0x4b3e79cc273aed9a
shl 0x4b3e79cc273aed9a, 0x20     result=0x273aed9a00000000
xor 0x4b3e79ccc7d111a3, 0x4b3e79ccc7d111a3     result=0x0
xor 0x0, 0x273aed9a00000000     result=0x273aed9a00000000
xor 0x273aed9a00000000, 0xefd29a3c     result=0x273aed9aefd29a3c
xor 0x273aed9a00000000, 0x273aed9a00000000     result=0x0
xor 0xefd29a3c, 0xefd29a3c     result=0x0
xor 0x0, 0x9eec39581d1de08c     result=0x9eec39581d1de08c
shr 0x9eec39581d1de08c, 0x20     result=0x9eec3958
xor 0x0, 0x9eec39581d1de08c     result=0x9eec39581d1de08c
xor 0x9eec3958, 0xba885960     result=0x24646038
xor 0x24646038, 0x9eec39581d1de08c     result=0x9eec3958397980b4
xor 0x9eec39581d1de08c, 0x9eec3958397980b4     result=0x24646038
xor 0x9eec3958397980b4, 0x24646038     result=0x9eec39581d1de08c
xor 0x9eec39581d1de08c, 0xefac3c8c     result=0x9eec3958f2b1dc00
xor 0x9eec3958f2b1dc00, 0x24646038     result=0x9eec3958d6d5bc38
xor 0x24646038, 0x9eec3958d6d5bc38     result=0x9eec3958f2b1dc00
xor 0x9eec3958d6d5bc38, 0x9eec3958f2b1dc00     result=0x24646038
xor 0x24646038, 0x1e64ba90     result=0x3a00daa8
xor 0x3a00daa8, 0x9eec3958f2b1dc00     result=0x9eec3958c8b106a8
xor 0x9eec3958f2b1dc00, 0x9eec3958c8b106a8     result=0x3a00daa8
xor 0x9eec3958c8b106a8, 0x3a00daa8     result=0x9eec3958f2b1dc00
xor 0x9eec3958f2b1dc00, 0xf47c0b5     result=0x9eec3958fdf61cb5
shl 0x9eec3958fdf61cb5, 0x20     result=0xfdf61cb500000000
xor 0x9eec39581d1de08c, 0x9eec39581d1de08c     result=0x0
xor 0x0, 0xfdf61cb500000000     result=0xfdf61cb500000000
xor 0xfdf61cb500000000, 0x3a00daa8     result=0xfdf61cb53a00daa8
xor 0xfdf61cb500000000, 0xfdf61cb500000000     result=0x0
xor 0x3a00daa8, 0x3a00daa8     result=0x0
xor 0x0, 0x5864871e1c9298b0     result=0x5864871e1c9298b0
shr 0x5864871e1c9298b0, 0x20     result=0x5864871e
xor 0x0, 0x5864871e1c9298b0     result=0x5864871e1c9298b0
xor 0x5864871e, 0xba885960     result=0xe2ecde7e
xor 0xe2ecde7e, 0x5864871e1c9298b0     result=0x5864871efe7e46ce
xor 0x5864871e1c9298b0, 0x5864871efe7e46ce     result=0xe2ecde7e
xor 0x5864871efe7e46ce, 0xe2ecde7e     result=0x5864871e1c9298b0
xor 0x5864871e1c9298b0, 0xefac3c8c     result=0x5864871ef33ea43c
xor 0x5864871ef33ea43c, 0xe2ecde7e     result=0x5864871e11d27a42
xor 0xe2ecde7e, 0x5864871e11d27a42     result=0x5864871ef33ea43c
xor 0x5864871e11d27a42, 0x5864871ef33ea43c     result=0xe2ecde7e
xor 0xe2ecde7e, 0x1e64ba90     result=0xfc8864ee
xor 0xfc8864ee, 0x5864871ef33ea43c     result=0x5864871e0fb6c0d2
xor 0x5864871ef33ea43c, 0x5864871e0fb6c0d2     result=0xfc8864ee
xor 0x5864871e0fb6c0d2, 0xfc8864ee     result=0x5864871ef33ea43c
xor 0x5864871ef33ea43c, 0xf47c0b5     result=0x5864871efc796489
shl 0x5864871efc796489, 0x20     result=0xfc79648900000000
xor 0x5864871e1c9298b0, 0x5864871e1c9298b0     result=0x0
xor 0x0, 0xfc79648900000000     result=0xfc79648900000000
xor 0xfc79648900000000, 0xfc8864ee     result=0xfc796489fc8864ee

写个脚本转化一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
s='''sub 0x2ccf24cffee88608, 0x952ac4c1f3ba90e6     result=0x97a4600e0b2df522
sub 0x6777dd702ae9e295, 0xa5b577c2fb57f719     result=0xc1c265ad2f91eb7c
sub 0x6cf4202a78fe205d, 0x97a4600e0b2df522     result=0xd54fc01c6dd02b3b
add 0xd54fc01c6dd02b3b, 0x92bfddfec2f52f3b     result=0x1680f9e1b30c55a76
xor 0xc1c265ad2f91eb7c, 0xcadc9ba99a2ae444     result=0xb1efe04b5bb0f38
sub 0x97a4600e0b2df522, 0x37e4241df14718d     result=0x94261dcc2c198395
xor 0x94261dcc2c198395, 0x952ac4c1f3ba90e6     result=0x10cd90ddfa31373
rol 0x10cd90ddfa31373, 0x2d     result=0x626e60219b21bbf4
sub 0x626e60219b21bbf4, 0x680f9e1b30c55a76     result=0xfa5ec2066a5c617e
xor 0xb1efe04b5bb0f38, 0xa324444e39c3e7e7     result=0xa83aba4a8c78e8df
ror 0x680f9e1b30c55a76, 0x2c     result=0xe1b30c55a76680f9
ror 0x952ac4c1f3ba90e6, 0x9     result=0x734a956260f9dd48
sub 0xe1b30c55a76680f9, 0xa83aba4a8c78e8df     result=0x3978520b1aed981a
add 0x734a956260f9dd48, 0xa83aba4a8c78e8df     result=0x11b854faced72c627
ror 0x1b854faced72c627, 0x34     result=0x54faced72c6271b8
sub 0xa83aba4a8c78e8df, 0x5350ea4003b419e1     result=0x54e9d00a88c4cefe
sub 0xfa5ec2066a5c617e, 0x54faced72c6271b8     result=0xa563f32f3df9efc6
add 0xa563f32f3df9efc6, 0x54e9d00a88c4cefe     result=0xfa4dc339c6bebec4
xor 0xfa4dc339c6bebec4, 0x7d27118487b24a4c     result=0x876ad2bd410cf488
rol 0x54e9d00a88c4cefe, 0x26     result=0x3133bf953a7402a2
sub 0x876ad2bd410cf488, 0x3978520b1aed981a     result=0x4df280b2261f5c6e
xor 0x54faced72c6271b8, 0xb948cbbf8c616936     result=0xedb20568a003188e
ror 0xedb20568a003188e, 0x3c     result=0xdb20568a003188ee
rol 0x3978520b1aed981a, 0x39     result=0x3472f0a41635db30
xor 0x3472f0a41635db30, 0x8c27c187b5925ea7     result=0xb8553123a3a78597
sub 0xb8553123a3a78597, 0x4df280b2261f5c6e     result=0x6a62b0717d882929
add 0xdb20568a003188ee, 0x6a62b0717d882929     result=0x1458306fb7db9b217
sub 0x3133bf953a7402a2, 0x6011664a1feadd72     result=0xd122594b1a892530
sub 0x4df280b2261f5c6e, 0xc6b76b35dc565f4b     result=0x873b157c49c8fd23
rol 0x6a62b0717d882929, 0x3a     result=0xa5a98ac1c5f620a4
ror 0x458306fb7db9b217, 0x38     result=0x8306fb7db9b21745
xor 0xd122594b1a892530, 0x873b157c49c8fd23     result=0x56194c375341d813
xor 0x56194c375341d813, 0x5d13d65e4a7935dd     result=0xb0a9a691938edce
xor 0xa5a98ac1c5f620a4, 0xb0a9a691938edce     result=0xaea310a8dccecd6a
rol 0x873b157c49c8fd23, 0x1e     result=0x12723f48e1cec55f
xor 0xb0a9a691938edce, 0x78f00494b1fd4117     result=0x73fa9efda8c5acd9
add 0x73fa9efda8c5acd9, 0xaea310a8dccecd6a     result=0x1229dafa685947a43
xor 0x8306fb7db9b21745, 0xaea310a8dccecd6a     result=0x2da5ebd5657cda2f
rol 0x2da5ebd5657cda2f, 0xd     result=0xbd7aacaf9b45e5b4
sub 0xbd7aacaf9b45e5b4, 0x15a37cdf4f1c5ece     result=0xa7d72fd04c2986e6
rol 0x12723f48e1cec55f, 0x3f     result=0x89391fa470e762af
rol 0xa7d72fd04c2986e6, 0x1a     result=0x4130a61b9a9f5cbf
xor 0x89391fa470e762af, 0xaea310a8dccecd6a     result=0x279a0f0cac29afc5
sub 0xaea310a8dccecd6a, 0x23683b20a006c3f1     result=0x8b3ad5883cc80979
sub 0x279a0f0cac29afc5, 0x8b3ad5883cc80979     result=0x9c5f39846f61a64c
sub 0x4130a61b9a9f5cbf, 0x9c5f39846f61a64c     result=0xa4d16c972b3db673
ror 0x8b3ad5883cc80979, 0x2a     result=0x620f32025e62ceb5
add 0x229dafa685947a43, 0x3f3cd0b931fb83ba     result=0x61da805fb78ffdfd
add 0x61da805fb78ffdfd, 0x24ace0da2a14ef6d     result=0x86876139e1a4ed6a
sub 0xa4d16c972b3db673, 0x620f32025e62ceb5     result=0x42c23a94ccdae7be
ror 0x86876139e1a4ed6a, 0x2e     result=0x84e78693b5aa1a1d
sub 0x620f32025e62ceb5, 0x9e69f9d52fe5a72a     result=0xc3a5382d2e7d278b
xor 0x9c5f39846f61a64c, 0x42c23a94ccdae7be     result=0xde9d0310a3bb41f2
rol 0x84e78693b5aa1a1d, 0x39     result=0x3b09cf0d276b5434
sub 0xc3a5382d2e7d278b, 0xde9d0310a3bb41f2     result=0xe508351c8ac1e599
xor 0x42c23a94ccdae7be, 0x9f0093fa7d70e962     result=0xddc2a96eb1aa0edc
sub 0xddc2a96eb1aa0edc, 0xde9d0310a3bb41f2     result=0xff25a65e0deeccea
xor 0x3b09cf0d276b5434, 0xe508351c8ac1e599     result=0xde01fa11adaab1ad
add 0xe508351c8ac1e599, 0x79584d73a695110c     result=0x15e6082903156f6a5
sub 0xff25a65e0deeccea, 0xde01fa11adaab1ad     result=0x2123ac4c60441b3d
rol 0xde9d0310a3bb41f2, 0x27     result=0xdda0f96f4e818851
rol 0xde01fa11adaab1ad, 0x37     result=0xd6ef00fd08d6d558
xor 0x2123ac4c60441b3d, 0xd6ef00fd08d6d558     result=0xf7ccacb16892ce65
xor 0xd6ef00fd08d6d558, 0x7b66780079bcf18d     result=0xad8978fd716a24d5
sub 0x5e6082903156f6a5, 0xf7ccacb16892ce65     result=0x6693d5dec8c42840
add 0xdda0f96f4e818851, 0x273e52f26ceb226b     result=0x104df4c61bb6caabc
xor 0xf7ccacb16892ce65, 0xa1d8a9d784041e4     result=0xfdd1262c10d28f81
add 0xfdd1262c10d28f81, 0x4df4c61bb6caabc     result=0x102b0728dcc3f3a3d
add 0x4df4c61bb6caabc, 0x54aca4906a29539b     result=0x598bf0f22595fe57
sub 0xad8978fd716a24d5, 0x2b0728dcc3f3a3d     result=0xaad9066fa52aea98
add 0x6693d5dec8c42840, 0xaad9066fa52aea98     result=0x1116cdc4e6def12d8
add 0xaad9066fa52aea98, 0x598bf0f22595fe57     result=0x10464f761cac0e8ef
sub 0x598bf0f22595fe57, 0x982a5ed5ad23b3f5     result=0xc161921c78724a62
add 0x116cdc4e6def12d8, 0x29dd2db2114bf812     result=0x3b4a0a007f3b0aea
sub 0x3b4a0a007f3b0aea, 0x464f761cac0e8ef     result=0x36e5129eb47a21fb
xor 0x36e5129eb47a21fb, 0x464f761cac0e8ef     result=0x3281e5ff7ebac914
rol 0x464f761cac0e8ef, 0xd     result=0x9eec39581d1de08c
add 0x3281e5ff7ebac914, 0x14051b581ba4a8ec     result=0x468701579a5f7200
ror 0xc161921c78724a62, 0x3a     result=0x5864871e1c9298b0
xor 0x2b0728dcc3f3a3d, 0x498e0b410bee2b9e     result=0x4b3e79ccc7d111a3
xor 0x7d, 0x7d     result=0x0
xor 0x8, 0x8     result=0x0
xor 0x0, 0x468701579a5f7200     result=0x468701579a5f7200
shr 0x468701579a5f7200, 0x20     result=0x46870157
xor 0x0, 0x468701579a5f7200     result=0x468701579a5f7200
xor 0x46870157, 0xba885960     result=0xfc0f5837
xor 0xfc0f5837, 0x468701579a5f7200     result=0x4687015766502a37
xor 0x468701579a5f7200, 0x4687015766502a37     result=0xfc0f5837
xor 0x4687015766502a37, 0xfc0f5837     result=0x468701579a5f7200
xor 0x468701579a5f7200, 0xefac3c8c     result=0x4687015775f34e8c
xor 0x4687015775f34e8c, 0xfc0f5837     result=0x4687015789fc16bb
xor 0xfc0f5837, 0x4687015789fc16bb     result=0x4687015775f34e8c
xor 0x4687015789fc16bb, 0x4687015775f34e8c     result=0xfc0f5837
xor 0xfc0f5837, 0x1e64ba90     result=0xe26be2a7
xor 0xe26be2a7, 0x4687015775f34e8c     result=0x468701579798ac2b
xor 0x4687015775f34e8c, 0x468701579798ac2b     result=0xe26be2a7
xor 0x468701579798ac2b, 0xe26be2a7     result=0x4687015775f34e8c
xor 0x4687015775f34e8c, 0xf47c0b5     result=0x468701577ab48e39
shl 0x468701577ab48e39, 0x20     result=0x7ab48e3900000000
xor 0x468701579a5f7200, 0x468701579a5f7200     result=0x0
xor 0x0, 0x7ab48e3900000000     result=0x7ab48e3900000000
xor 0x7ab48e3900000000, 0xe26be2a7     result=0x7ab48e39e26be2a7
xor 0x7ab48e3900000000, 0x7ab48e3900000000     result=0x0
xor 0xe26be2a7, 0xe26be2a7     result=0x0
xor 0x0, 0x4b3e79ccc7d111a3     result=0x4b3e79ccc7d111a3
shr 0x4b3e79ccc7d111a3, 0x20     result=0x4b3e79cc
xor 0x0, 0x4b3e79ccc7d111a3     result=0x4b3e79ccc7d111a3
xor 0x4b3e79cc, 0xba885960     result=0xf1b620ac
xor 0xf1b620ac, 0x4b3e79ccc7d111a3     result=0x4b3e79cc3667310f
xor 0x4b3e79ccc7d111a3, 0x4b3e79cc3667310f     result=0xf1b620ac
xor 0x4b3e79cc3667310f, 0xf1b620ac     result=0x4b3e79ccc7d111a3
xor 0x4b3e79ccc7d111a3, 0xefac3c8c     result=0x4b3e79cc287d2d2f
xor 0x4b3e79cc287d2d2f, 0xf1b620ac     result=0x4b3e79ccd9cb0d83
xor 0xf1b620ac, 0x4b3e79ccd9cb0d83     result=0x4b3e79cc287d2d2f
xor 0x4b3e79ccd9cb0d83, 0x4b3e79cc287d2d2f     result=0xf1b620ac
xor 0xf1b620ac, 0x1e64ba90     result=0xefd29a3c
xor 0xefd29a3c, 0x4b3e79cc287d2d2f     result=0x4b3e79ccc7afb713
xor 0x4b3e79cc287d2d2f, 0x4b3e79ccc7afb713     result=0xefd29a3c
xor 0x4b3e79ccc7afb713, 0xefd29a3c     result=0x4b3e79cc287d2d2f
xor 0x4b3e79cc287d2d2f, 0xf47c0b5     result=0x4b3e79cc273aed9a
shl 0x4b3e79cc273aed9a, 0x20     result=0x273aed9a00000000
xor 0x4b3e79ccc7d111a3, 0x4b3e79ccc7d111a3     result=0x0
xor 0x0, 0x273aed9a00000000     result=0x273aed9a00000000
xor 0x273aed9a00000000, 0xefd29a3c     result=0x273aed9aefd29a3c
xor 0x273aed9a00000000, 0x273aed9a00000000     result=0x0
xor 0xefd29a3c, 0xefd29a3c     result=0x0
xor 0x0, 0x9eec39581d1de08c     result=0x9eec39581d1de08c
shr 0x9eec39581d1de08c, 0x20     result=0x9eec3958
xor 0x0, 0x9eec39581d1de08c     result=0x9eec39581d1de08c
xor 0x9eec3958, 0xba885960     result=0x24646038
xor 0x24646038, 0x9eec39581d1de08c     result=0x9eec3958397980b4
xor 0x9eec39581d1de08c, 0x9eec3958397980b4     result=0x24646038
xor 0x9eec3958397980b4, 0x24646038     result=0x9eec39581d1de08c
xor 0x9eec39581d1de08c, 0xefac3c8c     result=0x9eec3958f2b1dc00
xor 0x9eec3958f2b1dc00, 0x24646038     result=0x9eec3958d6d5bc38
xor 0x24646038, 0x9eec3958d6d5bc38     result=0x9eec3958f2b1dc00
xor 0x9eec3958d6d5bc38, 0x9eec3958f2b1dc00     result=0x24646038
xor 0x24646038, 0x1e64ba90     result=0x3a00daa8
xor 0x3a00daa8, 0x9eec3958f2b1dc00     result=0x9eec3958c8b106a8
xor 0x9eec3958f2b1dc00, 0x9eec3958c8b106a8     result=0x3a00daa8
xor 0x9eec3958c8b106a8, 0x3a00daa8     result=0x9eec3958f2b1dc00
xor 0x9eec3958f2b1dc00, 0xf47c0b5     result=0x9eec3958fdf61cb5
shl 0x9eec3958fdf61cb5, 0x20     result=0xfdf61cb500000000
xor 0x9eec39581d1de08c, 0x9eec39581d1de08c     result=0x0
xor 0x0, 0xfdf61cb500000000     result=0xfdf61cb500000000
xor 0xfdf61cb500000000, 0x3a00daa8     result=0xfdf61cb53a00daa8
xor 0xfdf61cb500000000, 0xfdf61cb500000000     result=0x0
xor 0x3a00daa8, 0x3a00daa8     result=0x0
xor 0x0, 0x5864871e1c9298b0     result=0x5864871e1c9298b0
shr 0x5864871e1c9298b0, 0x20     result=0x5864871e
xor 0x0, 0x5864871e1c9298b0     result=0x5864871e1c9298b0
xor 0x5864871e, 0xba885960     result=0xe2ecde7e
xor 0xe2ecde7e, 0x5864871e1c9298b0     result=0x5864871efe7e46ce
xor 0x5864871e1c9298b0, 0x5864871efe7e46ce     result=0xe2ecde7e
xor 0x5864871efe7e46ce, 0xe2ecde7e     result=0x5864871e1c9298b0
xor 0x5864871e1c9298b0, 0xefac3c8c     result=0x5864871ef33ea43c
xor 0x5864871ef33ea43c, 0xe2ecde7e     result=0x5864871e11d27a42
xor 0xe2ecde7e, 0x5864871e11d27a42     result=0x5864871ef33ea43c
xor 0x5864871e11d27a42, 0x5864871ef33ea43c     result=0xe2ecde7e
xor 0xe2ecde7e, 0x1e64ba90     result=0xfc8864ee
xor 0xfc8864ee, 0x5864871ef33ea43c     result=0x5864871e0fb6c0d2
xor 0x5864871ef33ea43c, 0x5864871e0fb6c0d2     result=0xfc8864ee
xor 0x5864871e0fb6c0d2, 0xfc8864ee     result=0x5864871ef33ea43c
xor 0x5864871ef33ea43c, 0xf47c0b5     result=0x5864871efc796489
shl 0x5864871efc796489, 0x20     result=0xfc79648900000000
xor 0x5864871e1c9298b0, 0x5864871e1c9298b0     result=0x0
xor 0x0, 0xfc79648900000000     result=0xfc79648900000000
xor 0xfc79648900000000, 0xfc8864ee     result=0xfc796489fc8864ee
'''.split("\n")
a1=[0x6cf4202a78fe205d,0x952ac4c1f3ba90e6,0x6777dd702ae9e295,0x2ccf24cffee88608]
dic={}
for i in range(len(a1)):
    dic[str(hex(a1[i]))]="a1[{}]".format(i)
a=2
for i in s:
    if "result" in i:
        result=hex(eval(i.split("result=")[1])&0xffffffffffffffff)
        ip="".join(i.split("result=")[0].strip().split()[1:3]).split(",")
        ip1,ip2=ip[0].strip(),ip[1].strip()
        try:
            ip1=dic[ip1]
        except:
            pass
        try:
            ip2=dic[ip2]
        except:
            pass
        dic[result]="a{}".format(a)
        op=i.split("result=")[0].strip().split()[0]
        if op=="sub":
            op="-"
        if op=="and":
            op="&"
        if op=="xor":
            op="^"
        if op=="shl":
            op="<<"
        if op=="shr":
            op=">>"
        if op=="add":
            op="+"
        if op=="rol" or op=="ror":
            print("a{}=({}(".format(a,op),ip1,",",ip2,"))&0xffffffffffffffff")
        else:
            print("a{}=(".format(a),ip1,op,ip2,")&0xffffffffffffffff")
        a+=1

    else:
        print(i)

转化的结果为，根据result和 动调加密完的结果找到正确的地方插入赋值语句a1[0]=a103，a1[1]=a125……

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
a2=( a1[3] - a1[1] )&0xffffffffffffffff
a3=( a1[2] - 0xa5b577c2fb57f719 )&0xffffffffffffffff
a4=( a1[0] - a2 )&0xffffffffffffffff
a5=( a4 + 0x92bfddfec2f52f3b )&0xffffffffffffffff
a6=( a3 ^ 0xcadc9ba99a2ae444 )&0xffffffffffffffff
a7=( a2 - 0x37e4241df14718d )&0xffffffffffffffff
a8=( a7 ^ a1[1] )&0xffffffffffffffff
a9=(rol( a8 , 0x2d ))&0xffffffffffffffff
a10=( a9 - a5 )&0xffffffffffffffff
a11=( a6 ^ 0xa324444e39c3e7e7 )&0xffffffffffffffff
a12=(ror( a5 , 0x2c ))&0xffffffffffffffff
a13=(ror( a1[1] , 0x9 ))&0xffffffffffffffff
a14=( a12 - a11 )&0xffffffffffffffff
a15=( a13 + a11 )&0xffffffffffffffff
a16=(ror( a15 , 0x34 ))&0xffffffffffffffff
a17=( a11 - 0x5350ea4003b419e1 )&0xffffffffffffffff
a18=( a10 - a16 )&0xffffffffffffffff
a19=( a18 + a17 )&0xffffffffffffffff
a20=( a19 ^ 0x7d27118487b24a4c )&0xffffffffffffffff
a21=(rol( a17 , 0x26 ))&0xffffffffffffffff
a22=( a20 - a14 )&0xffffffffffffffff
a23=( a16 ^ 0xb948cbbf8c616936 )&0xffffffffffffffff
a24=(ror( a23 , 0x3c ))&0xffffffffffffffff
a25=(rol( a14 , 0x39 ))&0xffffffffffffffff
a26=( a25 ^ 0x8c27c187b5925ea7 )&0xffffffffffffffff
a27=( a26 - a22 )&0xffffffffffffffff
a28=( a24 + a27 )&0xffffffffffffffff
a29=( a21 - 0x6011664a1feadd72 )&0xffffffffffffffff
a30=( a22 - 0xc6b76b35dc565f4b )&0xffffffffffffffff
a31=(rol( a27 , 0x3a ))&0xffffffffffffffff
a32=(ror( a28 , 0x38 ))&0xffffffffffffffff
a33=( a29 ^ a30 )&0xffffffffffffffff
a34=( a33 ^ 0x5d13d65e4a7935dd )&0xffffffffffffffff
a35=( a31 ^ a34 )&0xffffffffffffffff
a36=(rol( a30 , 0x1e ))&0xffffffffffffffff
a37=( a34 ^ 0x78f00494b1fd4117 )&0xffffffffffffffff
a38=( a37 + a35 )&0xffffffffffffffff
a39=( a32 ^ a35 )&0xffffffffffffffff
a40=(rol( a39 , 0xd ))&0xffffffffffffffff
a41=( a40 - 0x15a37cdf4f1c5ece )&0xffffffffffffffff
a42=(rol( a36 , 0x3f ))&0xffffffffffffffff
a43=(rol( a41 , 0x1a ))&0xffffffffffffffff
a44=( a42 ^ a35 )&0xffffffffffffffff
a45=( a35 - 0x23683b20a006c3f1 )&0xffffffffffffffff
a46=( a44 - a45 )&0xffffffffffffffff
a47=( a43 - a46 )&0xffffffffffffffff
a48=(ror( a45 , 0x2a ))&0xffffffffffffffff
a49=( a38 + 0x3f3cd0b931fb83ba )&0xffffffffffffffff
a50=( a49 + 0x24ace0da2a14ef6d )&0xffffffffffffffff
a51=( a47 - a48 )&0xffffffffffffffff
a52=(ror( a50 , 0x2e ))&0xffffffffffffffff
a53=( a48 - 0x9e69f9d52fe5a72a )&0xffffffffffffffff
a54=( a46 ^ a51 )&0xffffffffffffffff
a55=(rol( a52 , 0x39 ))&0xffffffffffffffff
a56=( a53 - a54 )&0xffffffffffffffff
a57=( a51 ^ 0x9f0093fa7d70e962 )&0xffffffffffffffff
a58=( a57 - a54 )&0xffffffffffffffff
a59=( a55 ^ a56 )&0xffffffffffffffff
a60=( a56 + 0x79584d73a695110c )&0xffffffffffffffff
a61=( a58 - a59 )&0xffffffffffffffff
a62=(rol( a54 , 0x27 ))&0xffffffffffffffff
a63=(rol( a59 , 0x37 ))&0xffffffffffffffff
a64=( a61 ^ a63 )&0xffffffffffffffff
a65=( a63 ^ 0x7b66780079bcf18d )&0xffffffffffffffff
a66=( a60 - a64 )&0xffffffffffffffff
a67=( a62 + 0x273e52f26ceb226b )&0xffffffffffffffff
a68=( a64 ^ 0xa1d8a9d784041e4 )&0xffffffffffffffff
a69=( a68 + a67 )&0xffffffffffffffff
a70=( a67 + 0x54aca4906a29539b )&0xffffffffffffffff
a71=( a65 - a69 )&0xffffffffffffffff
a72=( a66 + a71 )&0xffffffffffffffff
a73=( a71 + a70 )&0xffffffffffffffff
a74=( a70 - 0x982a5ed5ad23b3f5 )&0xffffffffffffffff
a75=( a72 + 0x29dd2db2114bf812 )&0xffffffffffffffff
a76=( a75 - a73 )&0xffffffffffffffff
a77=( a76 ^ a73 )&0xffffffffffffffff
a78=(rol( a73 , 0xd ))&0xffffffffffffffff
a79=( a77 + 0x14051b581ba4a8ec )&0xffffffffffffffff
a80=(ror( a74 , 0x3a ))&0xffffffffffffffff
a81=( a69 ^ 0x498e0b410bee2b9e )&0xffffffffffffffff
a82=( 0x7d ^ 0x7d )&0xffffffffffffffff
a83=( 0x8 ^ 0x8 )&0xffffffffffffffff
a84=( a83 ^ a79 )&0xffffffffffffffff
a85=( a84 >> 0x20 )&0xffffffffffffffff
a86=( a83 ^ a84 )&0xffffffffffffffff
a87=( a85 ^ 0xba885960 )&0xffffffffffffffff
a88=( a87 ^ a86 )&0xffffffffffffffff
a89=( a86 ^ a88 )&0xffffffffffffffff
a90=( a88 ^ a89 )&0xffffffffffffffff
a91=( a90 ^ 0xefac3c8c )&0xffffffffffffffff
a92=( a91 ^ a89 )&0xffffffffffffffff
a93=( a89 ^ a92 )&0xffffffffffffffff
a94=( a92 ^ a93 )&0xffffffffffffffff
a95=( a94 ^ 0x1e64ba90 )&0xffffffffffffffff
a96=( a95 ^ a93 )&0xffffffffffffffff
a97=( a93 ^ a96 )&0xffffffffffffffff
a98=( a96 ^ a97 )&0xffffffffffffffff
a99=( a98 ^ 0xf47c0b5 )&0xffffffffffffffff
a100=( a99 << 0x20 )&0xffffffffffffffff
a101=( a90 ^ a90 )&0xffffffffffffffff
a102=( a101 ^ a100 )&0xffffffffffffffff
a103=( a102 ^ a97 )&0xffffffffffffffff
a1[0]=a103




a104=( a102 ^ a102 )&0xffffffffffffffff
a105=( a97 ^ a97 )&0xffffffffffffffff
a106=( a105 ^ a81 )&0xffffffffffffffff
a107=( a106 >> 0x20 )&0xffffffffffffffff
a108=( a105 ^ a106 )&0xffffffffffffffff
a109=( a107 ^ 0xba885960 )&0xffffffffffffffff
a110=( a109 ^ a108 )&0xffffffffffffffff
a111=( a108 ^ a110 )&0xffffffffffffffff
a112=( a110 ^ a111 )&0xffffffffffffffff
a113=( a112 ^ 0xefac3c8c )&0xffffffffffffffff
a114=( a113 ^ a111 )&0xffffffffffffffff
a115=( a111 ^ a114 )&0xffffffffffffffff
a116=( a114 ^ a115 )&0xffffffffffffffff
a117=( a116 ^ 0x1e64ba90 )&0xffffffffffffffff
a118=( a117 ^ a115 )&0xffffffffffffffff
a119=( a115 ^ a118 )&0xffffffffffffffff
a120=( a118 ^ a119 )&0xffffffffffffffff
a121=( a120 ^ 0xf47c0b5 )&0xffffffffffffffff
a122=( a121 << 0x20 )&0xffffffffffffffff
a123=( a112 ^ a112 )&0xffffffffffffffff
a124=( a123 ^ a122 )&0xffffffffffffffff
a125=( a124 ^ a119 )&0xffffffffffffffff
a1[1]=a125









a126=( a124 ^ a124 )&0xffffffffffffffff
a127=( a119 ^ a119 )&0xffffffffffffffff
a128=( a127 ^ a78 )&0xffffffffffffffff
a129=( a128 >> 0x20 )&0xffffffffffffffff
a130=( a127 ^ a128 )&0xffffffffffffffff
a131=( a129 ^ 0xba885960 )&0xffffffffffffffff
a132=( a131 ^ a130 )&0xffffffffffffffff
a133=( a130 ^ a132 )&0xffffffffffffffff
a134=( a132 ^ a133 )&0xffffffffffffffff
a135=( a134 ^ 0xefac3c8c )&0xffffffffffffffff
a136=( a135 ^ a133 )&0xffffffffffffffff
a137=( a133 ^ a136 )&0xffffffffffffffff
a138=( a136 ^ a137 )&0xffffffffffffffff
a139=( a138 ^ 0x1e64ba90 )&0xffffffffffffffff
a140=( a139 ^ a137 )&0xffffffffffffffff
a141=( a137 ^ a140 )&0xffffffffffffffff
a142=( a140 ^ a141 )&0xffffffffffffffff
a143=( a142 ^ 0xf47c0b5 )&0xffffffffffffffff
a144=( a143 << 0x20 )&0xffffffffffffffff
a145=( a134 ^ a134 )&0xffffffffffffffff
a146=( a145 ^ a144 )&0xffffffffffffffff
a147=( a146 ^ a141 )&0xffffffffffffffff
a1[2]=a147





a148=( a146 ^ a146 )&0xffffffffffffffff
a149=( a141 ^ a141 )&0xffffffffffffffff
a150=( a149 ^ a80 )&0xffffffffffffffff
a151=( a150 >> 0x20 )&0xffffffffffffffff
a152=( a149 ^ a150 )&0xffffffffffffffff
a153=( a151 ^ 0xba885960 )&0xffffffffffffffff
a154=( a153 ^ a152 )&0xffffffffffffffff
a155=( a152 ^ a154 )&0xffffffffffffffff
a156=( a154 ^ a155 )&0xffffffffffffffff
a157=( a156 ^ 0xefac3c8c )&0xffffffffffffffff
a158=( a157 ^ a155 )&0xffffffffffffffff
a159=( a155 ^ a158 )&0xffffffffffffffff
a160=( a158 ^ a159 )&0xffffffffffffffff
a161=( a160 ^ 0x1e64ba90 )&0xffffffffffffffff
a162=( a161 ^ a159 )&0xffffffffffffffff
a163=( a159 ^ a162 )&0xffffffffffffffff
a164=( a162 ^ a163 )&0xffffffffffffffff
a165=( a164 ^ 0xf47c0b5 )&0xffffffffffffffff
a166=( a165 << 0x20 )&0xffffffffffffffff
a167=( a156 ^ a156 )&0xffffffffffffffff
a168=( a167 ^ a166 )&0xffffffffffffffff
a169=( a168 ^ a163 )&0xffffffffffffffff
a1[3]=a169

然后z3解，异或即可拿到flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
from z3 import *
a1 = [BitVec(('%d' % i), 65) for i in range(4)]
x=Solver()

def rol(value, shift, bit_width=64):
    """ Rotate Left """
    return ((value << shift) | (value >> (bit_width - shift))) & ((1 << bit_width) - 1)

def ror(value, shift, bit_width=64):
    """ Rotate Right """
    return ((value >> shift) | (value << (bit_width - shift))) & ((1 << bit_width) - 1)

a2=( a1[3] - a1[1] )&0xffffffffffffffff
a3=( a1[2] - 0xa5b577c2fb57f719 )&0xffffffffffffffff
a4=( a1[0] - a2 )&0xffffffffffffffff
a5=( a4 + 0x92bfddfec2f52f3b )&0xffffffffffffffff


a6=( a3 ^ 0xcadc9ba99a2ae444 )&0xffffffffffffffff
a7=( a2 - 0x37e4241df14718d )&0xffffffffffffffff
a8=( a7 ^ a1[1] )&0xffffffffffffffff
a9=(rol( a8 , 0x2d ))&0xffffffffffffffff
a10=( a9 - a5 )&0xffffffffffffffff
a11=( a6 ^ 0xa324444e39c3e7e7 )&0xffffffffffffffff


a12=(ror( a5 , 0x2c ))&0xffffffffffffffff
a13=(ror( a1[1] , 0x9 ))&0xffffffffffffffff
a14=( a12 - a11 )&0xffffffffffffffff
a15=( a13 + a11 )&0xffffffffffffffff
a16=(ror( a15 , 0x34 ))&0xffffffffffffffff
a17=( a11 - 0x5350ea4003b419e1 )&0xffffffffffffffff



a18=( a10 - a16 )&0xffffffffffffffff
a19=( a18 + a17 )&0xffffffffffffffff




a20=( a19 ^ 0x7d27118487b24a4c )&0xffffffffffffffff





a21=(rol( a17 , 0x26 ))&0xffffffffffffffff
a22=( a20 - a14 )&0xffffffffffffffff
a23=( a16 ^ 0xb948cbbf8c616936 )&0xffffffffffffffff
a24=(ror( a23 , 0x3c ))&0xffffffffffffffff
a25=(rol( a14 , 0x39 ))&0xffffffffffffffff
a26=( a25 ^ 0x8c27c187b5925ea7 )&0xffffffffffffffff
a27=( a26 - a22 )&0xffffffffffffffff
a28=( a24 + a27 )&0xffffffffffffffff
a29=( a21 - 0x6011664a1feadd72 )&0xffffffffffffffff
a30=( a22 - 0xc6b76b35dc565f4b )&0xffffffffffffffff
a31=(rol( a27 , 0x3a ))&0xffffffffffffffff
a32=(ror( a28 , 0x38 ))&0xffffffffffffffff
a33=( a29 ^ a30 )&0xffffffffffffffff
a34=( a33 ^ 0x5d13d65e4a7935dd )&0xffffffffffffffff
a35=( a31 ^ a34 )&0xffffffffffffffff
a36=(rol( a30 , 0x1e ))&0xffffffffffffffff
a37=( a34 ^ 0x78f00494b1fd4117 )&0xffffffffffffffff
a38=( a37 + a35 )&0xffffffffffffffff
a39=( a32 ^ a35 )&0xffffffffffffffff
a40=(rol( a39 , 0xd ))&0xffffffffffffffff
a41=( a40 - 0x15a37cdf4f1c5ece )&0xffffffffffffffff
a42=(rol( a36 , 0x3f ))&0xffffffffffffffff
a43=(rol( a41 , 0x1a ))&0xffffffffffffffff
a44=( a42 ^ a35 )&0xffffffffffffffff
a45=( a35 - 0x23683b20a006c3f1 )&0xffffffffffffffff
a46=( a44 - a45 )&0xffffffffffffffff
a47=( a43 - a46 )&0xffffffffffffffff
a48=(ror( a45 , 0x2a ))&0xffffffffffffffff
a49=( a38 + 0x3f3cd0b931fb83ba )&0xffffffffffffffff
a50=( a49 + 0x24ace0da2a14ef6d )&0xffffffffffffffff
a51=( a47 - a48 )&0xffffffffffffffff
a52=(ror( a50 , 0x2e ))&0xffffffffffffffff
a53=( a48 - 0x9e69f9d52fe5a72a )&0xffffffffffffffff
a54=( a46 ^ a51 )&0xffffffffffffffff
a55=(rol( a52 , 0x39 ))&0xffffffffffffffff
a56=( a53 - a54 )&0xffffffffffffffff
a57=( a51 ^ 0x9f0093fa7d70e962 )&0xffffffffffffffff
a58=( a57 - a54 )&0xffffffffffffffff
a59=( a55 ^ a56 )&0xffffffffffffffff
a60=( a56 + 0x79584d73a695110c )&0xffffffffffffffff
a61=( a58 - a59 )&0xffffffffffffffff
a62=(rol( a54 , 0x27 ))&0xffffffffffffffff
a63=(rol( a59 , 0x37 ))&0xffffffffffffffff
a64=( a61 ^ a63 )&0xffffffffffffffff
a65=( a63 ^ 0x7b66780079bcf18d )&0xffffffffffffffff
a66=( a60 - a64 )&0xffffffffffffffff
a67=( a62 + 0x273e52f26ceb226b )&0xffffffffffffffff
a68=( a64 ^ 0xa1d8a9d784041e4 )&0xffffffffffffffff
a69=( a68 + a67 )&0xffffffffffffffff
a70=( a67 + 0x54aca4906a29539b )&0xffffffffffffffff
a71=( a65 - a69 )&0xffffffffffffffff
a72=( a66 + a71 )&0xffffffffffffffff
a73=( a71 + a70 )&0xffffffffffffffff
a74=( a70 - 0x982a5ed5ad23b3f5 )&0xffffffffffffffff
a75=( a72 + 0x29dd2db2114bf812 )&0xffffffffffffffff
a76=( a75 - a73 )&0xffffffffffffffff
a77=( a76 ^ a73 )&0xffffffffffffffff
a78=(rol( a73 , 0xd ))&0xffffffffffffffff
a79=( a77 + 0x14051b581ba4a8ec )&0xffffffffffffffff
a80=(ror( a74 , 0x3a ))&0xffffffffffffffff
a81=( a69 ^ 0x498e0b410bee2b9e )&0xffffffffffffffff



a82=( 0x7d ^ 0x7d )&0xffffffffffffffff
a83=( 0x8 ^ 0x8 )&0xffffffffffffffff
a84=( a83 ^ a79 )&0xffffffffffffffff
a85=( a84 >> 0x20 )&0xffffffffffffffff
a86=( a83 ^ a84 )&0xffffffffffffffff
a87=( a85 ^ 0xba885960 )&0xffffffffffffffff
a88=( a87 ^ a86 )&0xffffffffffffffff
a89=( a86 ^ a88 )&0xffffffffffffffff
a90=( a88 ^ a89 )&0xffffffffffffffff
a91=( a90 ^ 0xefac3c8c )&0xffffffffffffffff
a92=( a91 ^ a89 )&0xffffffffffffffff
a93=( a89 ^ a92 )&0xffffffffffffffff
a94=( a92 ^ a93 )&0xffffffffffffffff
a95=( a94 ^ 0x1e64ba90 )&0xffffffffffffffff
a96=( a95 ^ a93 )&0xffffffffffffffff
a97=( a93 ^ a96 )&0xffffffffffffffff
a98=( a96 ^ a97 )&0xffffffffffffffff
a99=( a98 ^ 0xf47c0b5 )&0xffffffffffffffff
a100=( a99 << 0x20 )&0xffffffffffffffff
a101=( a90 ^ a90 )&0xffffffffffffffff
a102=( a101 ^ a100 )&0xffffffffffffffff
a103=( a102 ^ a97 )&0xffffffffffffffff
a1[0]=a103




a104=( a102 ^ a102 )&0xffffffffffffffff
a105=( a97 ^ a97 )&0xffffffffffffffff
a106=( a105 ^ a81 )&0xffffffffffffffff
a107=( a106 >> 0x20 )&0xffffffffffffffff
a108=( a105 ^ a106 )&0xffffffffffffffff
a109=( a107 ^ 0xba885960 )&0xffffffffffffffff
a110=( a109 ^ a108 )&0xffffffffffffffff
a111=( a108 ^ a110 )&0xffffffffffffffff
a112=( a110 ^ a111 )&0xffffffffffffffff
a113=( a112 ^ 0xefac3c8c )&0xffffffffffffffff
a114=( a113 ^ a111 )&0xffffffffffffffff
a115=( a111 ^ a114 )&0xffffffffffffffff
a116=( a114 ^ a115 )&0xffffffffffffffff
a117=( a116 ^ 0x1e64ba90 )&0xffffffffffffffff
a118=( a117 ^ a115 )&0xffffffffffffffff
a119=( a115 ^ a118 )&0xffffffffffffffff
a120=( a118 ^ a119 )&0xffffffffffffffff
a121=( a120 ^ 0xf47c0b5 )&0xffffffffffffffff
a122=( a121 << 0x20 )&0xffffffffffffffff
a123=( a112 ^ a112 )&0xffffffffffffffff
a124=( a123 ^ a122 )&0xffffffffffffffff
a125=( a124 ^ a119 )&0xffffffffffffffff
a1[1]=a125









a126=( a124 ^ a124 )&0xffffffffffffffff
a127=( a119 ^ a119 )&0xffffffffffffffff
a128=( a127 ^ a78 )&0xffffffffffffffff
a129=( a128 >> 0x20 )&0xffffffffffffffff
a130=( a127 ^ a128 )&0xffffffffffffffff
a131=( a129 ^ 0xba885960 )&0xffffffffffffffff
a132=( a131 ^ a130 )&0xffffffffffffffff
a133=( a130 ^ a132 )&0xffffffffffffffff
a134=( a132 ^ a133 )&0xffffffffffffffff
a135=( a134 ^ 0xefac3c8c )&0xffffffffffffffff
a136=( a135 ^ a133 )&0xffffffffffffffff
a137=( a133 ^ a136 )&0xffffffffffffffff
a138=( a136 ^ a137 )&0xffffffffffffffff
a139=( a138 ^ 0x1e64ba90 )&0xffffffffffffffff
a140=( a139 ^ a137 )&0xffffffffffffffff
a141=( a137 ^ a140 )&0xffffffffffffffff
a142=( a140 ^ a141 )&0xffffffffffffffff
a143=( a142 ^ 0xf47c0b5 )&0xffffffffffffffff
a144=( a143 << 0x20 )&0xffffffffffffffff
a145=( a134 ^ a134 )&0xffffffffffffffff
a146=( a145 ^ a144 )&0xffffffffffffffff
a147=( a146 ^ a141 )&0xffffffffffffffff
a1[2]=a147





a148=( a146 ^ a146 )&0xffffffffffffffff
a149=( a141 ^ a141 )&0xffffffffffffffff
a150=( a149 ^ a80 )&0xffffffffffffffff
a151=( a150 >> 0x20 )&0xffffffffffffffff
a152=( a149 ^ a150 )&0xffffffffffffffff
a153=( a151 ^ 0xba885960 )&0xffffffffffffffff
a154=( a153 ^ a152 )&0xffffffffffffffff
a155=( a152 ^ a154 )&0xffffffffffffffff
a156=( a154 ^ a155 )&0xffffffffffffffff
a157=( a156 ^ 0xefac3c8c )&0xffffffffffffffff
a158=( a157 ^ a155 )&0xffffffffffffffff
a159=( a155 ^ a158 )&0xffffffffffffffff
a160=( a158 ^ a159 )&0xffffffffffffffff
a161=( a160 ^ 0x1e64ba90 )&0xffffffffffffffff
a162=( a161 ^ a159 )&0xffffffffffffffff
a163=( a159 ^ a162 )&0xffffffffffffffff
a164=( a162 ^ a163 )&0xffffffffffffffff
a165=( a164 ^ 0xf47c0b5 )&0xffffffffffffffff
a166=( a165 << 0x20 )&0xffffffffffffffff
a167=( a156 ^ a156 )&0xffffffffffffffff
a168=( a167 ^ a166 )&0xffffffffffffffff
a169=( a168 ^ a163 )&0xffffffffffffffff
a1[3]=a169


x.add(a1[0]==0x7AB48E39E26BE2A7,a1[1]==0x273AED9AEFD29A3C,a1[2]==0xFDF61CB53A00DAA8,a1[3]==0xFC796489FC8864EE)


if x.check() == sat:
    model = x.model()
    print(model)



result=[7850935417204252765,
10748619797969932518,
7455671181961192085,
3228839933601416712]
data=[0x28, 0xb1, 0x61, 0x6e, 0x3, 0x8c, 0x55, 0x33, 0xca, 0x5a, 0xbd, 0xa3, 0x8a, 0xce, 0xa3, 0x85, 0x57, 0x13, 0xee, 0x2f, 0x5d, 0xd8, 0x96, 0xfd, 0x73, 0x8c, 0x7b, 0xfb, 0xae, 0xd9, 0xa7, 0x75]
xordata=[int.from_bytes(data[i:i+8],"big") for i in range(0,len(data),8)]
import libnum
for i in range(0,len(result)):
    result[i]^=xordata[i]
    print(libnum.n2s(result[i]).decode(),end="")
  • Title: DEADCTF WP
  • Author: clev1L
  • Created at : 2024-08-06 21:26:13
  • Updated at : 2025-02-23 12:29:57
  • Link: https://github.com/clev1l/2024/08/06/deadctf-re-wp/
  • License: This work is licensed under CC BY-NC-SA 4.0.
Comments
On this page
DEADCTF WP
  1. JavaCPScript
  2. FlagChecker
    1. 第一段
    2. 第二段