拟态强网杯2021
fastjs
通过搜索字符串找到切入点位quickjs。
通过更改源码dump出字节码的汇编。
function sdfsfsdf(str,key){ var v,k,n,z,y,delta,mx,e,q,sum,p; if(str==""){ return(""); } v=str2long(str,true); k=str2long(key,false); n=v.length()-1; z=v[n]; y=v[0]; delta=2654435769; q=Math.floor(6+52/(n+1)); sum=0; while(q-->0){ sum=(sum+delta)&4294967295;//&0xffffffff e=(sum>>>2)&3; for(p=0;p<n;p++){ y=v[p+1]; mx=(((z>>>5)^(y<<2))+((y>>>3)^(z<<4)))^((sum^y)+(k[p&3^e]^z)); z=v[p]=(v[p]+mx)&4294967295; } y=v[0]; mx=(((z>>>5)^(y<<2))+((y>>>3)^(z<<4)))^((sum^y)+(k[p&3^e]^z)); z=v[n]=(v[n]+mx)&4294967295; } return(str2Hex(long2str(v,false))); } function xxxfss(){ function temp(input){ var output,chr1,chr2,chr3,enc1,enc2,enc3,enc4,i; output=""; chr3=""; enc4=""; i=0; chr1=input.charCodeAt(i++); chr2=input.charCodeAt(i++); chr3=input.charCodeAt(i++); enc1=chr1>>2; enc2=((chr1&3)<<4)|(chr2>>4); enc3=((chr2&15)<<2)|(chr3>>6); enc4=chr3&63; if(isNaN(chr2)){ enc4,enc3=64; if(isNaN(chr3)){ enc4=64; } } output=output+xxxfss._keyStr.charAt(enc1)+xxxfss._keyStr.charAt(enc2)+xxxfss._keyStr.charAt(enc3)+xxxfss._keyStr.charAt(enc4); chr3="",chr2="",chr1=""; enc4,enc3,enc2,enc1=""; if(i<input.length()){ return output; } } } function main(args){ var input,dfsfdsfsd,fwderf,target; if(args.length<1){ print("error"); return; } print("your input:"+args[0]); input=args[0]; dfsfdsfsd=xxxfss.dfsfs(input); dfdfwf3="no_thing_is_true"; fwderf=sdfsfsdf(dfsfdsfsd,dfdfwf3); if(fwderf.length!=112){ print("error"); return; } else{ target="05aed0ce441f80b5bc36af4c698509fc6cc3c97146353de5a95c6abea07fd4a7070932d86ac32d628672a59123e5972331db5dffe7057362"; if(fwderf==target){ print("yes"); return; } else{ print("error"); return; } } } var args; xxxfss._keyStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; xxxfss.dfsfs=tem; if(typeof scriptArgs != "undefined"){ args = scriptArgs; args.shift(); }else if(typeof arguments != "undefined"){ args = arguments; }else{ args="error"; } main(args);
quickjs汇编码和字节码
source: >>> asm: shr source: z=v[n]=(v[n]+mx)&4294967295; asm: get_loc0 0: v get_loc2 2: n to_propkey2 get_loc0 0: v get_loc2 2: n get_array_el get_loc8 6: mx add push_const8 3: 4294967295 and insert3 put_array_el put_loc3 3: z