2024国城杯wp

clev1L Lv3
  2024-12-08 10:09:23 2024-12-08 10:09:23 Created   2025-01-20 19:22:37 2025-01-20 19:22:37 Updated  1.8k Words  11 Mins  

Crush’s_secret

xxtea

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
from ctypes import *
import libnum

def MX(z, y, sum1, k, p, e):
    return c_uint32(((z.value >> 5 ^ y.value << 2) + (y.value >> 3 ^ z.value << 4)) ^ (
                (sum1.value ^ y.value) + (k[(p & 3) ^ e.value] ^ z.value)))


def btea(v, k, n, delta):
    if n > 1:
        sum1 = c_uint32(0)
        z = c_uint32(v[n - 1])
        rounds = 6 + 52 // n
        e = c_uint32(0)

        while rounds > 0:
            sum1.value += delta
            e.value = ((sum1.value >> 2) & 3)
            for p in range(n - 1):
                y = c_uint32(v[p + 1])
                v[p] = c_uint32(v[p] + MX(z, y, sum1, k, p, e).value).value
                z.value = v[p]

            y = c_uint32(v[0])
            v[n - 1] = c_uint32(v[n - 1] + MX(z, y, sum1, k, n - 1, e).value).value
            z.value = v[n - 1]
            rounds -= 1
    else:
        sum1 = c_uint32(0)
        n = -n
        rounds = 6 + 52 // n
        sum1.value = rounds * delta
        y = c_uint32(v[0])
        e = c_uint32(0)

        while rounds > 0:
            e.value = ((sum1.value >> 2) & 3)
            for p in range(n - 1, 0, -1):
                z = c_uint32(v[p - 1])
                v[p] = c_uint32(v[p] - MX(z, y, sum1, k, p, e).value).value
                y.value = v[p]

            z = c_uint32(v[n - 1])
            v[0] = c_uint32(v[0] - MX(z, y, sum1, k, 0, e).value).value
            y.value = v[0]
            sum1.value -= delta
            rounds -= 1

    return v



if __name__ == '__main__':
    enc = [1517703050, 95477623, 4043431785, 4190195444, 670053776, 2113090127, 775040372, 2401896892, 2883756247, 204081662, 898182066, 1403763218]
    flag = ''
    for i in range(0, len(enc), 2):
        a = enc[i:i + 2]
        k = [85988116, 1375809856, 85988116, 1375809856]

        delta = -0x61C88647
        n = len(a)
        res = btea(a, k, -n, delta)

        for i in res:
            flag += (libnum.n2s(i)[::-1].decode())
        print(flag)

round

base部分就中间两位调换了

round部分可以诸位爆破，因为每一位都可能多解，那就得递归

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
public class Round {

    /* loaded from: classes.dex */
    public static class Result {
        private int num;
        private int rip;

        public Result(int i, int i2) {
            this.num = i;
            this.rip = i2;
        }

        public int getNum() {
            return this.num;
        }

        public int getRip() {
            return this.rip;
        }
    }

    public static boolean round(int[] iArr, String str) {
        Result add;
        int length = str.length();
        int[] iArr2 = new int[length];
        int[] iArr3 = {352, 646, 752, 882, 65, 0, 122, 0, 0, 7, 350, 360};
        int i = 33;
        for (int i2 = 0; i2 < str.length(); i2++) {
            int charAt = str.charAt(i2);
            for (int i3 = 0; i3 < 32; i3++) {
                int i4 = (((iArr[i] ^ charAt) % 5) + 5) % 5;
                if (i4 == 0) {
                    add = add(iArr, charAt, i);
                } else if (i4 == 1) {
                    add = sub(iArr, charAt, i);
                } else if (i4 == 2) {
                    add = xor(iArr, charAt, i);
                } else if (i4 == 3) {
                    add = shl(charAt, i);
                } else if (i4 == 4) {
                    add = shr(charAt, i);
                } else {
                    add = new Result(charAt, i);
                }
                charAt = add.getNum();
                i = add.getRip();
            }
            iArr2[i2] = charAt;
        }

        for (int i5 = 0; i5 < length; i5++) {
            if (iArr2[i5] != iArr3[i5]) {
                return false;
            }
        }
        return true;
    }

    public static Result add(int[] iArr, int i, int i2) {
        int i3 = (((i + iArr[i2]) % 1024) + 1024) % 1024;
        return new Result(i3, (i2 + i3) % 1024);
    }

    public static Result sub(int[] iArr, int i, int i2) {
        int i3 = (((i - iArr[i2]) % 1024) + 1024) % 1024;
        return new Result(i3, (i2 + i3) % 1024);
    }

    public static Result xor(int[] iArr, int i, int i2) {
        int i3 = (iArr[i2] ^ i) % 1024;
        return new Result(i3, (i2 + i3) % 1024);
    }

    public static Result shl(int i, int i2) {
        int i3 = (i >> 3) % 1024;
        return new Result(i3, (i2 + i3) % 1024);
    }

    public static Result shr(int i, int i2) {
        int i3 = (i << 3) % 1024;
        return new Result(i3, (i2 + i3) % 1024);
    }
    public static boolean isValidInput(String str) {
        return str.matches("[a-zA-Z_]*");
    }

    public static void crack(int level, String base,int[] iArr) {
        if(level==12){
            System.out.println(base);
            return;
        }
        for (int i = 0; i <= 128; i++) {
            char ch = (char) i;
            // 判断是否是可打印字符
            if (!Character.isISOControl(ch) && !Character.isWhitespace(ch)) {
                String test=base.concat(String.valueOf(ch));
                if(round(iArr,test) && isValidInput(test)){
                    crack(level+1,test,iArr);
                }
            }
        }
    }

    public static void main(String[] args) {

        int[] iArr={924, 967, 912, 973, 921, 936, 916, 926, 942, 963, 930, 927, 912, 971, 924, 961, 909, 956, 896, 906, 946, 991, 958, 899, 900, 991, 904, 981, 897, 944, 908, 902, 902, 1003, 906, 951, 952, 995, 948, 1001, 949, 900, 952, 946, 906, 999, 902, 955, 940, 1015, 928, 1021, 937, 920, 932, 942, 926, 1011, 914, 943, 928, 1019, 940, 1009, 989, 1004, 976, 986, 994, 911, 1006, 979, 980, 911, 984, 901, 977, 992, 988, 982, 1014, 923, 1018, 967, 968, 915, 964, 921, 965, 1012, 968, 962, 1018, 919, 1014, 971, 1020, 935, 1008, 941, 1017, 968, 1012, 1022, 974, 931, 962, 1023, 1008, 939, 1020, 929, 1005, 988, 992, 1002, 978, 959, 990, 995, 996, 959, 1000, 949, 993, 976, 1004, 998, 806, 843, 810, 791, 792, 835, 788, 841, 789, 804, 792, 786, 810, 839, 806, 795, 780, 855, 768, 861, 777, 824, 772, 782, 830, 851, 818, 783, 768, 859, 780, 849, 829, 780, 816, 826, 770, 879, 782, 819, 820, 879, 824, 869, 817, 768, 828, 822, 790, 891, 794, 807, 808, 883, 804, 889, 805, 788, 808, 802, 794, 887, 790, 811, 860, 775, 848, 781, 857, 872, 852, 862, 878, 771, 866, 863, 848, 779, 860, 769, 845, 892, 832, 842, 882, 799, 894, 835, 836, 799, 840, 789, 833, 880, 844, 838, 838, 811, 842, 887, 888, 803, 884, 809, 885, 836, 888, 882, 842, 807, 838, 891, 876, 823, 864, 829, 873, 856, 868, 878, 862, 819, 850, 879, 864, 827, 876, 817, 669, 684, 656, 666, 674, 719, 686, 659, 660, 719, 664, 709, 657, 672, 668, 662, 694, 731, 698, 647, 648, 723, 644, 729, 645, 692, 648, 642, 698, 727, 694, 651, 700, 743, 688, 749, 697, 648, 692, 702, 654, 739, 642, 703, 688, 747, 700, 737, 685, 668, 672, 682, 658, 767, 670, 675, 676, 767, 680, 757, 673, 656, 684, 678, 742, 651, 746, 727, 728, 643, 724, 649, 725, 740, 728, 722, 746, 647, 742, 731, 716, 663, 704, 669, 713, 760, 708, 718, 766, 659, 754, 719, 704, 667, 716, 657, 765, 716, 752, 762, 706, 687, 718, 755, 756, 687, 760, 677, 753, 704, 764, 758, 726, 699, 730, 743, 744, 691, 740, 697, 741, 724, 744, 738, 730, 695, 726, 747, 540, 583, 528, 589, 537, 552, 532, 542, 558, 579, 546, 543, 528, 587, 540, 577, 525, 572, 512, 522, 562, 607, 574, 515, 516, 607, 520, 597, 513, 560, 524, 518, 518, 619, 522, 567, 568, 611, 564, 617, 565, 516, 568, 562, 522, 615, 518, 571, 556, 631, 544, 637, 553, 536, 548, 558, 542, 627, 530, 559, 544, 635, 556, 625, 605, 620, 592, 602, 610, 527, 622, 595, 596, 527, 600, 517, 593, 608, 604, 598, 630, 539, 634, 583, 584, 531, 580, 537, 581, 628, 584, 578, 634, 535, 630, 587, 636, 551, 624, 557, 633, 584, 628, 638, 590, 547, 578, 639, 624, 555, 636, 545, 621, 604, 608, 618, 594, 575, 606, 611, 612, 575, 616, 565, 609, 592, 620, 614, 422, 459, 426, 407, 408, 451, 404, 457, 405, 420, 408, 402, 426, 455, 422, 411, 396, 471, 384, 477, 393, 440, 388, 398, 446, 467, 434, 399, 384, 475, 396, 465, 445, 396, 432, 442, 386, 495, 398, 435, 436, 495, 440, 485, 433, 384, 444, 438, 406, 507, 410, 423, 424, 499, 420, 505, 421, 404, 424, 418, 410, 503, 406, 427, 476, 391, 464, 397, 473, 488, 468, 478, 494, 387, 482, 479, 464, 395, 476, 385, 461, 508, 448, 458, 498, 415, 510, 451, 452, 415, 456, 405, 449, 496, 460, 454, 454, 427, 458, 503, 504, 419, 500, 425, 501, 452, 504, 498, 458, 423, 454, 507, 492, 439, 480, 445, 489, 472, 484, 494, 478, 435, 466, 495, 480, 443, 492, 433, 285, 300, 272, 282, 290, 335, 302, 275, 276, 335, 280, 325, 273, 288, 284, 278, 310, 347, 314, 263, 264, 339, 260, 345, 261, 308, 264, 258, 314, 343, 310, 267, 316, 359, 304, 365, 313, 264, 308, 318, 270, 355, 258, 319, 304, 363, 316, 353, 301, 284, 288, 298, 274, 383, 286, 291, 292, 383, 296, 373, 289, 272, 300, 294, 358, 267, 362, 343, 344, 259, 340, 265, 341, 356, 344, 338, 362, 263, 358, 347, 332, 279, 320, 285, 329, 376, 324, 334, 382, 275, 370, 335, 320, 283, 332, 273, 381, 332, 368, 378, 322, 303, 334, 371, 372, 303, 376, 293, 369, 320, 380, 374, 342, 315, 346, 359, 360, 307, 356, 313, 357, 340, 360, 354, 346, 311, 342, 363, 156, 199, 144, 205, 153, 168, 148, 158, 174, 195, 162, 159, 144, 203, 156, 193, 141, 188, 128, 138, 178, 223, 190, 131, 132, 223, 136, 213, 129, 176, 140, 134, 134, 235, 138, 183, 184, 227, 180, 233, 181, 132, 184, 178, 138, 231, 134, 187, 172, 247, 160, 253, 169, 152, 164, 174, 158, 243, 146, 175, 160, 251, 172, 241, 221, 236, 208, 218, 226, 143, 238, 211, 212, 143, 216, 133, 209, 224, 220, 214, 246, 155, 250, 199, 200, 147, 196, 153, 197, 244, 200, 194, 250, 151, 246, 203, 252, 167, 240, 173, 249, 200, 244, 254, 206, 163, 194, 255, 240, 171, 252, 161, 237, 220, 224, 234, 210, 191, 222, 227, 228, 191, 232, 181, 225, 208, 236, 230, 38, 75, 42, 23, 24, 67, 20, 73, 21, 36, 24, 18, 42, 71, 38, 27, 12, 87, 0, 93, 9, 56, 4, 14, 62, 83, 50, 15, 0, 91, 12, 81, 61, 12, 48, 58, 2, 111, 14, 51, 52, 111, 56, 101, 49, 0, 60, 54, 22, 123, 26, 39, 40, 115, 36, 121, 37, 20, 40, 34, 26, 119, 22, 43, 92, 7, 80, 13, 89, 104, 84, 94, 110, 3, 98, 95, 80, 11, 92, 1, 77, 124, 64, 74, 114, 31, 126, 67, 68, 31, 72, 21, 65, 112, 76, 70, 70, 43, 74, 119, 120, 35, 116, 41, 117, 68, 120, 114, 74, 39, 70, 123, 108, 55, 96, 61, 105, 88, 100, 110, 94, 51, 82, 111, 96, 59, 108, 49};
        crack(0,"",iArr);
    }
}
  • Title: 2024国城杯wp
  • Author: clev1L
  • Created at : 2024-12-08 10:09:23
  • Updated at : 2025-01-20 19:22:37
  • Link: https://github.com/clev1l/2024/12/08/2024国城杯wp/
  • License: This work is licensed under CC BY-NC-SA 4.0.
Comments
On this page
2024国城杯wp
  1. Crush’s_secret
  2. round