checkpass
tl;dr¶
IDA で頑張る
解法¶
Rev の中で解析が一番苦行でした。頑張って解析すると、以下のようなチェックである事が分かります。
st=input()
assert len(st)==32
X="0-31までの順列"
for i in range(4):
A="0-255までの順列"
B="0-31までの順列"
C=[]
D=[0]*32
for j in range(32):
C.append(A[st[j]])
for j in range(32):
D[X[j]]=C[B[j]]
st=D
check="長さ32の配列"
assert check==st
プログラム中の順列の値を特定するのがかなりの苦行で、全てが static にプログラム中に書かれている訳ではなく、全てが 1 回で保存される訳でもないので 1 回ずつ監視する必要がありました。
あとは、頑張って逆変換します。
inputindex=[0x0F,0x1B,0x19,0x13,0x16,0x08,0x04,0x18,0x14,0x0E,0x0B,0x09,0x0A,0x02,0x06,0x17,0x11,0x12,0x03,0x0D,0x0C,0x1A,0x07,0x05,0x1F,0x1C,0x1E,0x00,0x01,0x15,0x1D,0x10]
resindex=[0x08,0x19,0x1B,0x1C,0x11,0x0E,0x0C,0x0F,0x02,0x15,0x10,0x09,0x13,0x0A,0x0D,0x06,0x16,0x00,0x1E,0x01,0x04,0x1A,0x1D,0x03,0x1F,0x14,0x18,0x07,0x0B,0x17,0x05,0x12]
final=[0x1F,0x8D,0x50,0xBC,0xB8,0x22,0x3A,0xCB,0x04,0x62,0xAE,0xCB,0x3E,0x20,0x62,0x48,0x05,0x7B,0x7B,0x20,0xCD,0x3A,0x46,0xD7,0xCF,0xE6,0x9E,0x58,0xBC,0x7a,0x48,0x7b]
perm=[
0x11,0x83,0x4D,0x6F,0x1A,0x0A,0x91,0x35,0x5F,0x3E,0x80,0x14,0xA9,0xDA,0xF6,0x55,0xD4,0xE0,0x1,0xAE,0x77,0x9,0x21,0x65,0x9B,0xAA,0x56,0xA2,0x70,0x10,0xBE,0x86,0xF1,0x13,0x75,0x19,0x1E,0x67,0x7,0xF2,0x95,0x25,0x7C,0x69,0xEF,0xFE,0x44,0x0F,0x71,0xC3,0xED,0xEE,0x6A,0xA7,0xD0,0xB2,0x4C,0x59,0x2C,0xE3,0x2F,0x96,0x7F,0xE2,0xA5,0xE9,0xCC,0x2B,0x0C,0x76,0xC8,0x94,0x49,0xBB,0x17,0x2,0xEC,0x8C,0x64,0x0B,0x4,0xCB,0xBA,0xA6,0x1B,0x4F,0x15,0x79,0x97,0x82,0x41,0xBD,0x74,0x4B,0xB9,0x62,0xE6,0xC7,0xC0,0x54,0x50,0x93,0xF7,0xA0,0x0,0xE7,0xAC,0x3,0xDC,0x5A,0xE5,0xC1,0x1D,0x7E,0x3C,0x2A,0x4A,0xD6,0x6C,0xD9,0xDB,0xB3,0xA3,0x47,0x51,0x20,0x6,0x5B,0xFF,0x99,0x29,0xFD,0xC4,0xA1,0xFB,0x85,0xB1,0xDE,0x28,0xDD,0x66,0x34,0x58,0x24,0xC5,0x8D,0xEA,0xC6,0x60,0xF3,0xE1,0x9F,0xCF,0x23,0xAF,0x2E,0x40,0x5C,0x7D,0x18,0xC2,0x73,0xCD,0xAD,0x43,0x81,0x90,0x22,0x5E,0x2D,0xB5,0xF5,0xF0,0x98,0x26,0xD3,0xF9,0x6B,0xB4,0xD5,0x1C,0x1F,0x39,0x9E,0xB6,0x9C,0x88,0x45,0xD2,0x3D,0xA8,0x52,0xD1,0x46,0x16,0xCA,0xF4,0x6E,0x78,0x68,0x8,0x38,0x89,0xC9,0x92,0x0D,0xAB,0xB0,0x36,0xDF,0x3A,0x63,0xFA,0x27,0xBC,0xA4,0xB8,0x32,0x4E,0x0E,0x7B,0x72,0x6D,0x53,0x5D,0xD7,0x8E,0x37,0x57,0x30,0x87,0xEB,0x42,0x12,0x9A,0xBF,0x3B,0xE8,0xE4,0xB7,0x3F,0x61,0xCE,0x5,0xD8,0xFC,0xF8,0x31,0x84,0x9D,0x33,0x8B,0x7A,0x8F,0x48,0x8A
]
input=[0]*32
for i in range(32):
a=resindex[i]
b=inputindex[i]
input[b]=perm.index(final[a])
for i in range(32):
final[i]=input[i]
perm=[
0xCE,0x6A,0xEB,0xC5,0x47,0x16,0xE8,0xDC,0x8C,0x39,0xAF,0xB3,0x1F,0xC3,0x68,0x7E,0xFD,0x10,0xDA,0x3C,0x1E,0x15,0x57,0xA3,0xE3,0xA8,0x4E,0x5,0x0A,0x76,0x74,0xE0,0x97,0x77,0x93,0x9F,0x7B,0x71,0x31,0xF5,0x3B,0xAC,0xB4,0x9B,0xC6,0x5E,0x9A,0x37,0x22,0x1,0xD4,0x99,0x87,0xE4,0xAD,0xA7,0x6B,0x24,0x14,0x64,0x62,0xEA,0x52,0x7C,0x38,0x5C,0xCC,0xFC,0x23,0x54,0x48,0x25,0x9,0x95,0x2E,0xB1,0x34,0xE1,0xFF,0x17,0x3A,0xEF,0xC9,0x50,0x3E,0xFB,0x72,0xD0,0x4D,0x2A,0x4B,0xA6,0xF4,0x85,0xCA,0x0,0x30,0xC1,0x6C,0x46,0x35,0xDD,0x84,0x94,0x2F,0x56,0xE9,0x6D,0x55,0x6,0x8B,0x36,0x9E,0x5D,0xD5,0x3F,0x90,0x60,0x67,0xF6,0x88,0xB0,0x79,0xD8,0xA1,0xFA,0x2,0x8D,0x49,0xF1,0x81,0x82,0xB9,0x43,0x69,0xEE,0x5B,0x4,0xE2,0x61,0x0E,0xB7,0xC0,0xF0,0x28,0xA9,0x73,0x83,0x1C,0xBE,0x4C,0x13,0x75,0x91,0x1B,0xCD,0xBD,0x7F,0x0C,0x86,0x1A,0xA4,0xD2,0x8A,0xF7,0x44,0x45,0xAB,0x32,0x42,0xCF,0xDE,0x19,0x8E,0x4F,0x6F,0x6E,0xC7,0xB8,0xED,0xA5,0x41,0xC8,0x29,0x0D,0x96,0x59,0x63,0xD6,0xBA,0xF8,0x3D,0xDB,0x9D,0x78,0x98,0x26,0xA2,0xFE,0x2C,0xBC,0x27,0x89,0x3,0x51,0xD3,0x11,0xD9,0x65,0xE7,0xE6,0x33,0x0F,0x92,0xB5,0x9C,0xBF,0xCB,0x18,0x70,0xC4,0x7,0xAE,0x7D,0xB2,0x2D,0x8F,0xC2,0x20,0xF2,0xAA,0x40,0xD7,0x12,0x1D,0xB6,0x58,0x5A,0xA0,0x2B,0x4A,0xF3,0x0B,0xF9,0x5F,0x8,0xDF,0x7A,0xEC,0x66,0xBB,0xE5,0x53,0xD1,0x21,0x80
]
inputindex=[0x1F,0x08,0x06,0x09,0x15,0x1E,0x1D,0x16,0x12,0x0A,0x1B,0x13,0x10,0x01,0x0E,0x18,0x0C,0x07,0x0F,0x02,0x11,0x14,0x17,0x0B,0x1A,0x1C,0x0D,0x00,0x03,0x19,0x05,0x04]
for i in range(32):
a=resindex[i]
b=inputindex[i]
input[b]=perm.index(final[a])
for i in range(32):
final[i]=input[i]
perm=[
0x69,0x2,0x64,0x13,0x4B,0x0D2,0x0E4,0x0F5,0x84,0x0EC,0x0C0,0x0E1,0x48,0x12,0x5B,0x94,0x0B5,0x8B,0x0ED,0x65,0x57,0x0D0,0x0F,0x3E,0x37,0x88,0x0D3,0x0E0,0x34,0x0E8,0x2D,0x9B,0x0AD,0x46,0x2A,0x1F,0x59,0x2E,0x6C,0x0C8,0x0E,0x0DE,0x6A,0x0B6,0x79,0x87,0x22,0x97,0x0C5,0x14,0x19,0x0DD,0x0C1,0x0B7,0x90,0x42,0x0B3,0x0EB,0x0E7,0x17,0x4D,0x55,0x0FE,0x0D,0x0F6,0x33,0x0C6,0x0E6,0x6D,0x0E2,0x0B1,0x3,0x47,0x0F3,0x26,0x0FC,0x16,0x1B,0x0C2,0x28,0x7,0x60,0x0AC,0x76,0x8D,0x6F,0x61,0x0CB,0x6B,0x80,0x9D,0x15,0x0AF,0x38,0x0B0,0x0D1,0x0D4,0x58,0x3D,0x83,0x0FB,0x0A6,0x1A,0x0A3,0x73,0x78,0x24,0x0E5,0x41,0x0EA,0x0CC,0x3F,0x0F9,0x8F,0x0BE,0x9F,0x6E,0x44,0x49,0x0BB,0x0A7,0x4C,0x40,0x0B2,0x0F2,0x31,0x0CA,0x0D7,0x0E9,0x0B8,0x72,0x0B9,0x54,0x32,0x5C,0x0D5,0x0C7,0x4A,0x11,0x8,0x0BA,0x75,0x0DC,0x0BD,0x7D,0x18,0x62,0x27,0x91,0x8A,0x74,0x0CD,0x35,0x98,0x7B,0x5,0x0C3,0x43,0x0A5,0x0F1,0x29,0x0FF,0x71,0x0E3,0x4E,0x52,0x25,0x51,0x0C4,0x2F,0x1E,0x95,0x0AB,0x66,0x56,0x92,0x7F,0x0A,0x20,0x0DA,0x93,0x0D6,0x0B4,0x39,0x10,0x9E,0x0D8,0x0BC,0x4,0x0CE,0x5D,0x8E,0x8C,0x3A,0x0A9,0x0,0x0DF,0x0FA,0x3B,0x67,0x68,0x53,0x7A,0x0A2,0x45,0x4F,0x7C,0x6,0x0A4,0x81,0x1C,0x89,0x0D9,0x0A0,0x2C,0x21,0x96,0x0A1,0x5F,0x77,0x0AE,0x86,0x82,0x9C,0x0AA,0x0F4,0x0DB,0x0CF,0x0BF,0x0A8,0x63,0x0F8,0x0B,0x9,0x3C,0x0C9,0x0EF,0x0F0,0x2B,0x5A,0x0EE,0x99,0x1,0x30,0x85,0x5E,0x7E,0x36,0x1D,0x0FD,0x50,0x70,0x0C,0x9A,0x23,0x0F7
]
inputindex=[0x19,0x0C,0x03,0x0E,0x0B,0x07,0x12,0x16,0x1F,0x13,0x1E,0x15,0x17,0x09,0x18,0x00,0x05,0x1C,0x1D,0x10,0x1B,0x01,0x0F,0x08,0x06,0x14,0x0D,0x11,0x02,0x04,0x1A,0x0A]
for i in range(32):
a=resindex[i]
b=inputindex[i]
input[b]=perm.index(final[a])
for i in range(32):
final[i]=input[i]
perm=[
0x0A5,0x0E0,0x82,0x8,0x68,0x38,0x16,0x0FD,0x0BD,0x0AD,0x14,0x7E,0x0AB,0x1E,0x0EB,0x0A6,0x0CF,0x36,0x37,0x0CC,0x0E9,0x88,0x4F,0x3A,0x0C3,0x6,0x5D,0x0AF,0x95,0x0F,0x0B3,0x58,0x92,0x0FC,0x8C,0x0E5,0x60,0x2B,0x0C2,0x69,0x66,0x22,0x0B8,0x0D,0x0EF,0x84,0x5F,0x0A0,0x0D7,0x6E,0x2A,0x0CB,0x46,0x2C,0x0F1,0x0B1,0x0A9,0x0DE,0x0D5,0x0B7,0x0CE,0x39,0x62,0x0E8,0x70,0x0C,0x21,0x0C6,0x64,0x7D,0x0BB,0x0C1,0x98,0x20,0x2,0x0FF,0x7F,0x55,0x6B,0x6C,0x0F4,0x54,0x0F0,0x56,0x0C9,0x57,0x9D,0x0D0,0x0C5,0x81,0x43,0x67,0x0DF,0x0F8,0x47,0x0B5,0x79,0x9F,0x3C,0x1F,0x9C,0x18,0x80,0x9A,0x8D,0x30,0x0D9,0x94,0x2F,0x42,0x50,0x35,0x74,0x11,0x8E,0x4E,0x0C4,0x4,0x0B0,0x0E1,0x5C,0x3D,0x72,0x0C7,0x19,0x6A,0x4D,0x49,0x3,0x15,0x91,0x99,0x1A,0x5,0x0C0,0x0E7,0x52,0x8B,0x6F,0x59,0x0F9,0x85,0x0D3,0x0BC,0x25,0x0CD,0x0B6,0x0DB,0x0EC,0x5B,0x7B,0x0F6,0x0AA,0x73,0x1D,0x0FE,0x26,0x41,0x3E,0x0A3,0x53,0x0ED,0x5A,0x34,0x0EA,0x0AC,0x17,0x90,0x10,0x33,0x63,0x0A7,0x0D2,0x76,0x0F7,0x0BE,0x83,0x4A,0x7A,0x0A,0x0DC,0x45,0x0D6,0x48,0x0EE,0x24,0x0F2,0x44,0x12,0x31,0x1C,0x32,0x0DA,0x5E,0x23,0x2D,0x0A8,0x0A4,0x0,0x1B,0x40,0x78,0x65,0x7C,0x71,0xD8,0x87,0xDD,0x1,0x3B,0x4B,0xBF,0x27,0x61,0x6D,0x0B,0xA1,0xE3,0xD1,0x51,0x9E,0xD4,0xFB,0xAE,0xFA,0xF3,0xB4,0x0E,0xCA,0x93,0x9,0xC8,0xB9,0x97,0x75,0x4C,0xE4,0x96,0x3F,0x9B,0x77,0xE6,0x29,0x13,0x7,0xB2,0x2E,0x89,0x28,0xE2,0xA2,0x8F,0x8A,0x86,0xF5,0xBA
]
inputindex=[0x0C,0x1F,0x11,0x16,0x01,0x0A,0x0F,0x05,0x13,0x03,0x1A,0x14,0x06,0x10,0x00,0x18,0x08,0x0B,0x17,0x04,0x09,0x15,0x12,0x0D,0x07,0x1E,0x02,0x1C,0x19,0x1B,0x1D,0x0E]
for i in range(32):
a=resindex[i]
b=inputindex[i]
input[b]=perm.index(final[a])
print("picoCTF{",end='')
for i in range(32):
print(chr(input[i]),end='')
print("}")
最終更新日: 2021年4月8日