国城杯2024

round

都是爆破
解base

table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"  
enc = 'Y5Wk'  
for i in enc:  
    print(table.index(i), end=',')  
tmp = [24,57,22,36,]  
A = [0, 2, 1, 3]  
for i in range(32, 125):  
    for j in range(32, 125):  
        for k in range(32, 125):  
            crack = [i, j, k]  
            crack2 = int('0x' + bytes(crack).hex(), 16)  
            if (crack2 >> ((3 - A[0]) * 6) & 63) == tmp[0] and (crack2 >> ((3 - A[1]) * 6) & 63) == tmp[1] and (crack2 >> ((3 - A[2]) * 6) & 63) == tmp[2] and (crack2 >> ((3 - A[3]) * 6) & 63) == tmp[3]:  
                print(crack)  
                break 

求盒子：

key = 'c9m1bRmfY5Wk'  
iArr = [0] * 1024  
for i in range(1024):  
    iArr[1023 - i] = i  
for j in range(1024):  
    iArr[j] = iArr[j] ^ ord(key[j % len(key)])  
print(iArr)

爆破vm

from string import *  
key = 'c9m1bRmfY5Wk'  
iArr = [0] * 1024  
for i in range(1024):  
    iArr[1023 - i] = i  
for j in range(1024):  
    iArr[j] = iArr[j] ^ ord(key[j % len(key)])  
#iArr
def add(iArr, i, i2):  
    i3 = (((i + iArr[i2]) % 1024) + 1024) % 1024  
    return i3, ((i2 + i3) % 1024)  
def sub(iArr, i, i2):  
    i3 = (((i - iArr[i2]) % 1024) + 1024) % 1024  
    return i3, ((i2 + i3) % 1024)  
def xor(iArr, i, i2):  
    i3 = (iArr[i2] ^ i) % 1024  
    return (i3, (i2 + i3) % 1024)  
def shl(i, i2):  
    i3 = (i >> 3) % 1024  
    return (i3, (i2 + i3) % 1024)  
def shr(i, i2):  
    i3 = (i << 3) % 1024  
    return (i3, (i2 + i3) % 1024)  
enc = [352, 646, 752, 882, 65, 0, 122, 0, 0, 7, 350, 360]  
crack = ascii_letters + '_'  
tmp2 = 33  
  
def cul(tmp2, k, flag):  
    if k == 12:  
        print(flag)  
        return  
    for charAt in crack:  
        i = tmp2  
        tmp = charAt  
        charAt = ord(charAt)  
        for i3 in range(32):  
            i4 = (((iArr[i] ^ charAt) % 5) + 5) % 5  
            if i4 == 0:  
                charAt, i = add(iArr, charAt, i)  
            elif i4 == 1:  
                charAt, i = sub(iArr, charAt, i)  
            elif i4 == 2:  
                charAt, i = xor(iArr, charAt, i)  
            elif i4 == 3:  
                charAt, i = shl(charAt, i)  
            elif i4 == 4:  
                charAt, i = shr(charAt, i)  
        if charAt == enc[k]:  
            cul(i, k+1, flag+tmp)  
cul(tmp2, 0, '')
#_rounD_we_go

crush's_secret3

直接动调，自动smc
是一个修改了delta的xxtea
直接套脚本就行