Iris2025 WP

Now this will run on my 486?

动调能找到异或

数据拿出来解密

import libnum
data1=[0x0BF51B0D7,0x75CC547B,0x4F0FD83A,0x0A2117744,0x0ECD0CEC6,0x2E19F9FA,0x32EA83D9,0x0E5EB61E0,]
data2=[0x0CC38C2BE,0x0EAA2018,0x1078B74D,0x0DB631232,0x98A0A199,0x42789493,0x5685E086,0x98CA4085,]
for i in range(len(data1)):
    print(libnum.n2s(data1[i]^data2[i]).decode()[::-1],end="")

Crispy Kelp

复现完算法解密即可

'''加密'''
data1 = 1111
rd = [0x00000016, 0x0000006E, 0x00000008, 0x0000009F, 0x0000005D, 0x00000069, 0x00000001, 0x000000F8, 0x000000C0,
      0x0000006D, 0x000000A7, 0x00000021]
test = [ord(i) for i in "flagflagflag"]
for i in range(len(test)):
    test[i] = (test[i] ^ rd[i]) + data1

test2 = [0] * len(test)
for i in range(len(test)):
    test2[i] = (test[i] ^ rd[i]) + data1


runes = test + [data1] + test2

# 将 Unicode 码点转换为字符串
string = ''.join(chr(rune) for rune in runes)

# 将字符串编码为 UTF-8 字节
utf8_bytes = string.encode('utf-8')

temp = list(utf8_bytes)

table = "0123456789abcdef"

enc = ""

for i in range(len(temp)):
    enc += table[temp[i] >> 4] + table[temp[i] & 0xf]


'''解密'''
enc=open(r"kelpfile","r").read()
temp = []
for i in range(0, len(enc), 2):
    temp.append((table.index(enc[i]) << 4) + table.index(enc[i + 1]))
# 将 UTF-8 字节序列转换为字符串
string = bytes(temp).decode('utf-8')

# 将字符串转换为 Unicode 码点列表
runes = [ord(char) for char in string]
idx = len(runes) // 2
test = runes[:idx]
data1 = runes[idx]
test2 = runes[idx + 1:]
rd = []
for i in range(len(test)):
    rd.append((test2[i] - data1) ^ test[i])
for i in range(len(test)):
    test[i] = (test[i] - data1) ^ rd[i]
print("".join(map(chr, test)))
#irisctf{k3lp_1s_4_h34lthy_r3pl4c3m3n7_f0r_ch1p5}

bunny jumper

慢慢跟算法

enc=[
  "dW1wanVrcGp",
  151986214,
  "dW1wanZtcGp",
  168894767,
  "dW1wahVtcGp",
  143414,
  "dW1wanVtEGp",
  202515241,
  "dW1x6nVtcGp",
  219753011,
  "dW1wcn89cGp",
  268849,
  "dW1xKnVucSp",
  18095146,
  "dW1xKhU9cGp",
  35464242,
  "dW1wOnVsMAp",
  51128620,
  "dW1wQnBtaGp",
  51782960,
  "dW1x6zVv8Gp",
  68360487,
  "dW1wCnVt1Wp",
  85665324,
  "dW1waXVv+mp",
  84281399,
  "dW1xL3ZtcGp",
  102047534,
  "dW1wfnVtEG9",
  253767992,
  "dW1x6nVFcH5",
  118959923,
  "dW1wanfucH5",
  119284279,
  "dW1xKPZtcGp",
  135141663,
  "dW1xKiVtdmp",
  152903206,
  "dW1xKtVtdmp",
  153103667,
  "dW1xKn9ucGp",
  168895531,
  "dW1xL3VucGp",
  185603370,
  "dW1x6PVtWGp",
  236723758,
  "dW1wCnVFcG9",
  286799160,
  "dW1xLHXNcGp",
  387656501,
  "dW1xKnVFWH5",
  320086583,
  "dW1xKnVFcS9",
  303307048,
  "dW1wQtXNWGp",
  170208564,
][::-1]
import base64
def b64d(str1,string1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"):
    return base64.b64decode(str1.translate(str.maketrans(string1,"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")))
def fun(argc):
    temp=list(b64d(argc))
    for i in range(len(temp)):
        temp[i]^=ord("jump"[i%4])
    bins=[]
    for i in temp:
        bins+=list(bin(i)[2:].rjust(8,"0"))
    i=0
    length=[]
    while i<len(bins):
        if bins[i]!="1":
            length.append(0)
            i+=1
        else:
            length.append(int("".join(bins[i+1:i+5][::-1]),2))
            i+=5
    dic={}
    for i in range(len(length)):
        if length[i]!=0:
            dic[chr(i)]=length[i]
    result=""
    if len(dic)==1:
        for j in dic.keys():
            result+=j*4
    elif len(dic)==3:
        for j in dic.keys():
            if dic[j]==1:
                result+=j*2
            else:
                result+=j
    else:
        result+="".join(dic.keys())
    return result
def fun2(data):
    return list(data.to_bytes(4,"little"))


for i in range(0,len(enc),2):
    s=fun("anVtcGp1bXBq"+enc[i+1]+"1bXBqdW1wanVtcGp1bXBqdQ==")
    idx=fun2(enc[i])
    print(idx,s)

# 输入数据
data = [
    ([52, 45, 37, 10], "bdhn"),
    ([40, 25, 20, 18], "_nwy"),
    ([55, 34, 20, 19], "_nrw"),
    ([53, 43, 27, 23], "_aah"),
    ([56, 53, 24, 17], "aan}"),
    ([46, 30, 28, 14], "__br"),
    ([42, 21, 16, 11], "_ann"),
    ([43, 36, 17, 10], "_hnn"),
    ([51, 45, 32, 9], "_duu"),
    ([38, 30, 29, 9], "_euu"),
    ([31, 25, 14, 8], "_bff"),
    ([55, 34, 28, 7], "nrr{"),
    ([51, 47, 23, 7], "__n{"),
    ([56, 49, 32, 15], "cuu}"),
    ([46, 31, 21, 6], "_aff"),
    ([55, 8, 6, 5], "ffrt"),
    ([44, 38, 27, 5], "aatu"),
    ([39, 25, 19, 4], "__cn"),
    ([48, 37, 22, 3], "biss"),
    ([44, 41, 12, 3], "asyy"),
    ([50, 36, 29, 2], "_eei"),
    ([42, 28, 20, 1], "_rrw"),
    ([49, 26, 4, 0], "cchi"),
    ([51, 42, 25, 13], "____"),
    ([41, 35, 18, 12], "yyyy"),
    ([54, 48, 2, 0], "iiii"),
    ([47, 33, 17, 10], "nnnn"),
    ([38, 32, 15, 9], "uuuu"),
][::-1]

# 初始化 flag 的数组
flag = [''] * 57  # 假设 flag 长度为 57

def solve(index, flag):
    print(index,"".join(flag))
    # 递归结束条件：所有组都处理完
    if index == len(data):
        return ''.join(flag)  # 返回拼接结果

    positions, chars = data[index]
    unique_permutations = set()  # 用于存储唯一排列

    # 手动生成去重排列
    def generate_permutations(chars, path):
        if len(path) == len(chars):
            unique_permutations.add(tuple(path))
            return
        for i, c in enumerate(chars):
            if i > 0 and chars[i] == chars[i - 1] and not used[i - 1]:
                continue
            if not used[i]:
                used[i] = True
                generate_permutations(chars, path + [c])
                used[i] = False

    # 标记数组，用于控制排列生成
    chars = sorted(chars)  # 排序以便去重处理
    used = [False] * len(chars)
    generate_permutations(chars, [])

    for perm in unique_permutations:  # 遍历所有唯一排列
        temp_flag = flag[:]  # 创建 flag 的临时副本
        valid = True

        # 尝试将排列填入对应位置
        for pos, char in zip(positions, perm):
            if temp_flag[pos] == '' or temp_flag[pos] == char:
                temp_flag[pos] = char
            else:
                valid = False  # 冲突时标记为无效
                break

        if valid:  # 如果当前排列有效，则递归尝试下一个组
            result = solve(index + 1, temp_flag)
            if result:  # 如果找到解，则返回结果
                return result

    return None  # 无法找到解时返回 None

# 调用递归函数，从第 0 组开始
result = solve(0, flag)
print("Recovered flag:", result)
#irisctf{funny_bunny_was_a_hare_funny_bunny_had_nice_hair}