2020 GKCTF

Misc

Pokémon

有点脑洞题，flag就在103国道那

flag{PokEmon_14_CutE}

Crypto

小学生的密码学

e(x)=11x+6(mod26)

密文：welcylk

仿射密码，a=11，b=6

再base64就行

flag{c29yY2VyeQ==}

babycrypto

2019强网杯challenge 2原题，RSA解密，给了p高128位

import gmpy2
from Crypto.Util.number import long_to_bytes

n = 0xb119849bc4523e49c6c038a509a74cda628d4ca0e4d0f28e677d57f3c3c7d0d876ef07d7581fe05a060546fedd7d061d3bc70d679b6c5dd9bc66c5bdad8f2ef898b1e785496c4989daf716a1c89d5c174da494eee7061bcb6d52cafa337fc2a7bba42c918bbd3104dff62ecc9d3704a455a6ce282de0d8129e26c840734ffd302bec5f0a66e0e6d00b5c50fa57c546cff9d7e6a978db77997082b4cb927df9847dfffef55138cb946c62c9f09b968033745b5b6868338c64819a8e92a827265f9abd409359a9471d8c3a2631b80e5b462ba42336717700998ff38536c2436e24ac19228cd2d7a909ead1a8494ff6c3a7151e888e115b68cc6a7a8c6cf8a6c005
e = 65537
p = 0xe4e4b390c1d201dae2c00a4669c0865cc5767bc444f5d310f3cfc75872d96feb89e556972c99ae20753e3314240a52df5dccd076a47c6b5d11b531b92d901b2b512aeb0b263bbfd624fe3d52e5e238beeb581ebe012b2f176a4ffd1e0d2aa8c4d3a2656573b727d4d3136513a931428b92826225b6d0e735440b613a8336ffa3
enc = 1422566584480199878714663051468143513667934216213366733442059106529451931078271460363335887054199577950679102659270179475911101747625120544429262334214483688332111552004535828182425152965223599160129610990036911146029170033592055768983427904835395850414634659565092191460875900237711597421272312032796440948509724492027247376113218678183443222364531669985128032971256792532015051829041230203814090194611041172775368357197854451201260927117792277559690205342515437625417792867692280849139537687763919269337822899746924269847694138899165820004160319118749298031065800530869562704671435709578921901495688124042302500361
q = n // p
phin = (p - 1) * (q - 1)
d = gmpy2.invert(e, phin)
flag = pow(enc, d, n)
flag = long_to_bytes(flag)
print(flag)

flag{3d0914a1-1e97-4822-a745-c7e20c5179b9}

Reverse

Check_1n

首先让输入开机密码，定位到密码错误处

上面aHelloworld就是开机密码，HelloWorld。开机之后打开打砖块，打开之后，上面不用做，后面弹出flag

flag{f5dfd0f5-0343-4642-8f28-9adbb74c4ede}

Chelly's identity

代码分析

程序可以分为四个部分

输入复制

通过动态调试可以知道，代码第61~68行在进行赋值操作，将输入的值复制到m中

长度检测

sub_BD11BD函数，检测输入字符串长度是否为16

加密函数

sub_BD1721函数为加密函数

进入sub_BD16E0函数

这个函数可以静态分析，也可以动态调试出结果，这里是产生2~128的质数，存储在v10中

下面的while循环，使用v9遍历整个输入字符串，for循环累加小于v9的质数到v7，最后将v9与v7异或。这就是整个的加密过程。

判定函数

打开sub_491852函数，这里也是动态调试，了解到就是将加密后的m与已知字符数组比较

脚本

# -*- coding:utf-8 -*-

def create_num():
    num = []
    for i in range(2, 129):
        flag = False
        for j in range(2, i):
            if i % j == 0:
                flag = True
                break
        if not flag:
            num.append(i)
    return num


def add_num(n, num):
    sum = 0
    for i in num:
        if i >= n:
            break
        sum += i
    return sum


a = [438, 1176, 1086, 377, 377, 1600, 924, 377, 1610, 924, 637, 639, 376, 566, 836, 830]
num = create_num()
flag = ''
for x in a:
    for n in range(256):
        sum = add_num(n, num)
        if n ^ sum == x:
            flag += chr(n)
            break
print ('flag{' + flag + '}')

get flag！

flag{Ch11y_1s_EG0IST}

BabyDriver

这道题实际就是迷宫问题，但是他的键码对应方向是难点。对应代码在

找出了四个判断方向的键值：23,37,36,38，根据if条件下对v5进行加减16，加减1，判断出分别代表上下左右

这实际就是当初学汇编时的键盘扫描码：https://www.plantation-productions.com/Webster/www.artofasm.com/DOS/ch20/CH20-1.html

分别对应 I，K，J，L

接着就手动解迷宫：LKKKLLKLKKKLLLKKKLLLLLL

md5加密后：403950a6f64f7fc4b655dea696997851

flag{403950a6f64f7fc4b655dea696997851}

EzMachine

这是一道伪虚拟机题目，比起网鼎杯那道就难了...

VM分析

动态调试，找到主要的代码段

再到IDA中找到对应的代码处

这里加了混淆，我们首先需要去混淆：401594h处change bytes，改变首位为nop(90)，再将下面全部代码转换为data，最后强制分析成代码，得到

off_4448F4中存放着opcode对应操作的函数

转换得到伪代码：（代码来自：https://apeng.fun/2020/05/24/2020GKCTF/#more）

code = [0x01, 0x03, 0x03, 0x05, 0x00, 0x00, 0x11, 0x00, 0x00, 0x01, 0x01, 0x11, 0x0C, 0x00, 0x01, 0x0D, 0x0A, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x02, 0x00, 0x01, 0x00, 0x11, 0x0C, 0x00, 0x02, 0x0D, 0x2B, 0x00, 0x14, 0x00, 0x02, 0x01, 0x01, 0x61, 0x0C, 0x00, 0x01, 0x10, 0x1A, 0x00, 0x01, 0x01, 0x7A, 0x0C, 0x00, 0x01, 0x0F, 0x1A, 0x00, 0x01, 0x01, 0x47, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x06, 0x00, 0x01, 0x0B, 0x24, 0x00, 0x01, 0x01, 0x41, 0x0C, 0x00, 0x01, 0x10, 0x24, 0x00, 0x01, 0x01, 0x5A, 0x0C, 0x00, 0x01, 0x0F, 0x24, 0x00, 0x01, 0x01, 0x4B, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x07, 0x00, 0x01, 0x01, 0x01, 0x10, 0x09, 0x00, 0x01, 0x03, 0x01, 0x00, 0x03, 0x00, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x0B, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x00, 0x00, 0x02, 0x05, 0x00, 0x02, 0x01, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x01, 0x00, 0x02, 0x00, 0x00, 0x02, 0x00, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x00, 0x00, 0x02, 0x09, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x03, 0x00, 0x02, 0x00, 0x00, 0x02, 0x02, 0x00, 0x02, 0x05, 0x00, 0x02, 0x03, 0x00, 0x02, 0x03, 0x00, 0x02, 0x01, 0x00, 0x02, 0x07, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0B, 0x00, 0x02, 0x02, 0x00, 0x02, 0x01, 0x00, 0x02, 0x02, 0x00, 0x02, 0x07, 0x00, 0x02, 0x02, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x02, 0x00, 0x02, 0x02, 0x00, 0x01, 0x02, 0x01, 0x13, 0x01, 0x02, 0x04, 0x00, 0x00, 0x0C, 0x00, 0x01, 0x0E, 0x5B, 0x00, 0x01, 0x01, 0x22, 0x0C, 0x02, 0x01, 0x0D, 0x59, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x4E, 0x00, 0x01, 0x03, 0x00, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x00]
ip = 0
sp = 0
bp = 0
stack = [0 for i in range(256)]
R = [0 for i in range(8)]

while ip < len(code):
    op = code[ip]
    if op == 0:
        ip+=1
    elif op == 1:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[oprnd1] = oprnd2
        print("%3d: "%(ip-3),"mov R%d, %d"%(oprnd1, oprnd2))
    elif op == 2:
        oprnd1 = code[ip+1]
        sp+=1
        ip+=3
        stack[sp] = oprnd1
        print("%3d: "%(ip-3),"push %d"%oprnd1)
    elif op == 3:
        oprnd1 = code[ip+1]
        sp+=1
        ip+=3
        stack[sp] = R[oprnd1]
        print("%3d: "%(ip-3),"push R%d"%oprnd1)
    elif op == 4:
        oprnd1 = code[ip+1]
        
        ip+=3
        R[oprnd1] = stack[sp]
        sp-=1
        print("%3d: "%(ip-3),"pop R%d"%oprnd1)
    elif op == 5:
        
        ip+=3
        print("%3d: "%(ip-3),"puts something")
    elif op == 6:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[oprnd1] += R[oprnd2]
        print("%3d: "%(ip-3),"add R%d, R%d"%(oprnd1, oprnd2))
    elif op == 7:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[oprnd1] -= R[oprnd2]
        print("%3d: "%(ip-3),"sum R%d, R%d"%(oprnd1, oprnd2))
    elif op == 8:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[oprnd1] *= R[oprnd2]
        print("%3d: "%(ip-3),"mul R%d, R%d"%(oprnd1, oprnd2))
    elif op == 9:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[0] = R[oprnd1] // R[oprnd2]
        R[1] = R[oprnd1] % R[oprnd2]
        print("%3d: "%(ip-3),"div R%d, R%d"%(oprnd1, oprnd2))
    elif op == 10:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[oprnd1] ^= R[oprnd2]
        print("%3d: "%(ip-3),"xor R%d, R%d"%(oprnd1, oprnd2))
    elif op == 11:
        ip = 3*code[ip+1]-3
        print("%3d: "%(ip-3),"jmp %d"%oprnd1)
    elif op == 12:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        ip+=3
        R[3] = R[oprnd1] - R[oprnd2]
        print("%3d: "%(ip-3),"cmp R%d, R%d"%(oprnd1, oprnd2), R[oprnd1], R[oprnd2])
    elif op == 13:
        oprnd1 = code[ip+1]
        print("%3d: "%ip,"jz %d"%(3*oprnd1-3))
        if R[3]:
            ip += 3
        else:
            ip = 3*code[ip+1]-3
        
    elif op == 14:
        
        oprnd1 = code[ip+1]
        print("%3d: "%ip,"jnz %d"%(3*oprnd1-3))
        if R[3]:
            ip = 3*code[ip+1]-3
        else:
            ip += 3
    elif op == 15:
        
        oprnd1 = code[ip+1]
        print("%3d: "%ip,"jg %d"%(3*oprnd1-3))
        if R[3]<=0:
            ip += 3
        else:
            ip = 3*code[ip+1]-3
    elif op == 16:
        
        oprnd1 = code[ip+1]
        print("%3d: "%ip,"jb %d"%(3*oprnd1-3))
        if R[3]>=0:
            ip += 3
        else:
            ip = 3*code[ip+1]-3
    elif op == 17:
        # input
        buf = [0 for i in range(17)]
        buf = list(b"?lag{1234567890a}")
        R[0] = len(buf)
        ip+=3
        print("%3d: "%(ip-3),"input")
    elif op == 18:
        length = code[ip+2] - code[ip+1]
        buf[code[ip+1]:code[ip+2]] = [0 for i in range(length)]
        ip=3
        print("%3d: "%(ip-3),"memset")
    elif op == 19:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        R[oprnd1] = stack[bp+R[oprnd2]]
        ip+=3
        print("%3d: "%(ip-3),"mov R%d, [bp+R%d]"%(oprnd1, oprnd2))
    elif op == 20:
        oprnd1 = code[ip+1]
        oprnd2 = code[ip+2]
        R[oprnd1] = buf[R[oprnd2]]
        ip+=3
        print("%3d: "%(ip-3),"mov R%d, buf[R%d]"%(oprnd1, oprnd2))
    elif op == 0xff:
        print("%3d: "%(ip-3),"death")
        exit(0)

脚本

model = [2, 2, 12, 2, 7, 2, 1, 2, 11, 7, 7, 1, 3, 3, 5, 2, 0, 3, 15, 5, 9, 0, 15, 5, 13, 0, 0, 1, 12, 1, 5, 0, 13, 7]
enc = [(model[2 * i + 1] * 16 + model[2 * i]) for i in range(17)]
flag = [0]*17
print(enc)
for i in range(len(enc)):
    tmp1 = (enc[i] - 1) ^ 71
    tmp2 = (enc[i] + 1) ^ 75
    if ord('a') <= tmp1 <= ord('z'):
        flag.append(tmp1)
    elif ord('A') <= tmp2 <= ord('Z'):
        flag.append(tmp2)
    else:
        flag.append(enc[i])
print(''.join([chr(x) for x in flag]))

get flag！

flag{Such_A_EZVM}