下载链接：链接：https://pan.baidu.com/s/108rCS0nwO0K9ZNHhDF3i9g
提取码：bubu
比赛还有两三天猜结束，先写好wp，剩下三道都是一解的。。
rev
warmup-rev（199 solves / 389 points）
爆破就可以了，爆破l的位置。
d=[-72, 7, -58, 2, -33, 1, -102, 65, 13, -64,
21, 14, -45, -11, -48, -7, -1, 3, 47, -65, 3, -18,
-73, 40, -27, -73, -13, 0, 0, -68, 10, 45, 13]
s="4n_3nd0th3rm1c_rxn_4b50rb5_3n3rgy"
f=[]
for i in range(len(d)):
f.append(ord(s[i])-d[i])
print(f)
print(bytearray(f))
print(f[-6:]+f[0:2]+f[2:-6])
#f[-6:]+f[0:i]+[i:-6]
for i in range(len(f)-6):
a=f[-6:] +f[i:-6]+ f[0:i]
#print(a)
for k in range(len(a)):
if k%2==0:
e=3 * (k // 2)
a[k]=a[k]- e
if b'flag' in bytearray(a) :
print(bytearray(a))
#b'3nth4lpy_0f_5y5}flag{1ncr34s3_1n_'
#flag{1ncr34s3_1n_3nth4lpy_0f_5y5}
sneks（148 solves / 424 points）
逐个爆破。
import sys
def f(n):
if n == 0:
return 0
if n == 1 or n == 2:
return 1
x = f(n >> 1)
y = f(n // 2 + 1)
return g(x, y, not n & 1)
def e(b, j):
return 5 * f(b) - 7 ** j
def d(v):
return v << 1
def g(x, y, l):
if l:
return h(x, y)
return x ** 2 + y ** 2
def h(x, y):
return x * j(x, y)
def j(x, y):
return 2 * y - x
def main():
s=[9273726921930789991758, 166410277506205636620946 ,836211434898484229672 ,
15005205362068960832084 ,226983740520068639569752018 ,4831629526120101632815236,
203649875442 ,1845518257930330962016244 ,12649370320429973923353618, 203569403526,
435667762588547882430552 ,2189229958341597036774, 175967536338, 339384890916,
319404344993454853352 ,-9165610218896 ,435667762522082586241848, 3542248016531591176336,
319401089522705178152 ,-22797257207834556 ,12649370160845441339659218,
269256367990614644192076, -7819641564003064368 ,594251092837631751966918564 ]
for k in range(0x20,0x7f):
inp = bytes('flag{'+chr(k), 'utf-8')
a = []
for i, c in enumerate(inp):
a.append(e(c, i))
for c in a:
if s[5]==(d(c)):#与flag已知长度对应
print(a)
print(chr(k))
multidimensional(90 solves / 458 points)
t=[[8, 65, -18, -21, -15, 55],
[8, 48, 57, 63, -13, 5],
[16, -5, -26, 54, -7, -2],
[48, 49, 65, 57, 2, 10],
[9, -2, -1, -9, -11, -10],
[56, 53, 18, 42, -28, 5]]
f=[['h', 'e', 'y', '_', 's', 'i'],
['n', 'c', 'e', '_', 'w', 'h'],
[ 'e', 'n', '_', 'w', 'a', 's'],
['_', 't', 'i', 'm', 'e', '_'],
['a', '_', 'd', 'i', 'm', 'e'],
['n', 's', 'i', 'o', 'n', '?']]
for j in range(6):
for i in range(6):
f[i][j]=chr(ord(f[i][j])-t[j][i])
f=[['`', ']', 'i', '/', 'j', '1'], ['-', '3', 'j', '.', 'y', '3'], ['w', '5', 'y', '6', 'b', 'a'], ['t', '5', '3', '4', 'n', '5'], ['p', 'l', 'k', 'g', 'x', 'x81'], ['7', 'n', 'k', 'e', 'x', ':']]
def space(f,n=35):
f[(35 - n) // 6][(35 - n) % 6] = chr(ord(f[(35 - n) // 6][(35 - n) % 6])+(n //6) + (n % 6))
if(n!=0):
n-=1
space(f,n)
space(f)
d=[['j', 'f', 'q', '6', 'p', '6'], ['6', ';', 'q', '4', '~', '7'], ['x7f', '<', 'x7f', ';', 'f', 'd'], ['{', ';', '8', '8', 'q', '7'], ['v', 'q', 'o', 'j', 'z', 'x82'], ['<', 'r', 'n', 'g', 'y', ':']]
for i in range(6):
for j in range(6):
d[i][j]=chr(ord(d[i][j])-(i + 6 - j))
print(d)
#[['d', 'a', 'm', '3', 'n', '5'],
# ['/', '5', 'l', '0', '{', '5'],
# ['w', '5', 'y', '6', 'b', 'a'],
# ['r', '3', '1', '2', 'l', '3'],
# ['l', 'h', 'g', 'c', 't', '}'],
# ['1', 'h', 'e', '_', 'r', '4']]
#将上方二维数组竖列变换
d=[['1', 'l', 'r', 'w', '/', 'd'],
['h', 'h', '3', '5', '5', 'a'],
['e', 'g', '1', 'y', 'l', 'm'],
['_', 'c', '2', '6', '0', '3'],
['r', 't', 'l', 'b', '{', 'n'],
['4', '}', '3', 'a', '5', '5']]
for i in range(6):
for k in range(6):
print(d[i][k],end='')
d="""[[f, l, a, g, {, t], [h, 3, _, g, 4, t], [3, w, 4, y, _, b], [3, t, 2, 3, 3, n], [_, d, 1, m, 3, n], [5, 1, 0, n, 5, }]]"""
print('
')
print(d.replace('[','').replace(']','').replace(', ',''))
#flag{th3_g4t3w4y_b3t233n_d1m3n510n5}
scrambler (54 solves / 477 points)
#两两调换位置
d="""QQ.ap(OOOaQa.a($/FF.F/ZOZ..aQaQ/aa(a(ZZaaF.Q^FaZ,S/..(^]aF.FF.pFF-(==SFa/aOo.=/aFM/,.,Z=/aF/aQ/*<Q(^-OSZOO=a]Q](Q<].a~/ao/aYZaF=aQa]Q^FOZFsQn/^FOh.*aZ.OaaO/(Q.SZ</ QQ,a(OFaFF((QQQaQQ/^/Q.O-F(Z(=gQQ=k,OSF=F.a/]Q=Z(Qa(ao=a:ZQ/QpJ]/QQF.=FZ]QkFS^=Q:QQZQFa=."OS(=^Q.^Ja/(/Z^]F:]//./.Q=F=Ya/SO/]Oas=apS=(..)(.aF/(oZ(a/~.,,ZZZ/Oq=(.QF":.|O($FZ./(]]FO]FO.Oo"F+QO/FqY/Z-(a.=/F/aa/.=OZOFQ(=Z./pOa((O]..Q/]Q((a(]/aaSZJ.Q(*F]<//Fa/|]QFQZ(=S.ZQQZOFQa:Q/aQO=(]..a/^(QOQoF////(^kF-a-"""
d="""(kZs~o-"a-~Z(h-(Z-Fa:-"""
flag=list(d)
for i in range(0, len(flag), 2):
flag[i], flag[i + 1] = flag[(i + 1)], flag[i]
print(''.join(flag))
#'QQa(pOOaOaQa.$(F/.F/FOZ.Za.aQ/Qaaa(Z(aZFaQ.F^ZaS,./(.]^FaF..FFp-F=(S=aFa/oO=.a/MF,/,.=Za//FQa*/Q<^(O-ZSOOa=Q](]<Q.]~aa//oYaaZ=FQa]a^QOFFZQs/nF^hO*.ZaO.aa/OQ(S.<Z /QQa,O(aFFF((QQaQQQ^/Q/O.F-Z(=(Qg=Q,kSO=F.F/aQ]Z=Q((aoaa=Z:/QpQ]JQ/FQ=.ZFQ]Fk^SQ=Q:ZQFQ=a".SO=(Q^^.aJ(/Z/]^:F/]././=Q=FaYS//OO]saa=Sp(=..()a./Fo((Z/a.~,,ZZ/ZqO(=Q."F.:O|$(ZF/.](F]]OOFO."o+FOQF/YqZ/(-.a/=/Faa./O=OZQF=(.Zp/aO((]O../QQ](((a/]aaZS.J(QF*<]//aF|/Q]QF(ZS=Z.QQOZQF:a/QQa=O](../a(^OQoQ/F//(/k^-F-a'
#恢复排序
=[]
random.seed(1618514508)
#print(f)
#print((f))
sh='QQa.(pOOaOaQa.$(F/.F/FOZ.Za.aQ/Qaaa(Z(aZFaQ.F^ZaS,./(.]^FaF..FFp-F=(S=aFa/oO=.a/MF,/,.=Za//FQa*/Q<^(O-ZSOOa=Q](]<Q.]~aa//oYaaZ=FQa]a^QOFFZQs/nF^hO*.ZaO.aa/OQ(S.<Z /QQa,O(aFFF((QQaQQQ^/Q/O.F-Z(=(Qg=Q,kSO=F.F/aQ]Z=Q((aoaa=Z:/QpQ]JQ/FQ=.ZFQ]Fk^SQ=Q:ZQFQ=a".SO=(Q^^.aJ(/Z/]^:F/]././=Q=FaYS//OO]saa=Sp(=..()a./Fo((Z/a.~,,ZZ/ZqO(=Q."F.:O|$(ZF/.](F]]OOFO."o+FOQF/YqZ/(-.a/=/Faa./O=OZQF=(.Zp/aO((]O../QQ](((a/]aaZS.J(QF*<]//aF|/Q]QF(ZS=Z.QQOZQF:a/QQa=O](../a(^OQoQ/F//(/k^-F-a'
for i in range(len(sh)):
f.append((i))
f=list(f)
random.shuffle(f)
shh=list(sh)
#print(len(shh))
d=[0]*len(sh)
for i in range(len(f)):
d[f[i]]=shh[i]
print("".join(d))
#(:-FQ=/aZQ(F="/.FZSaQ=(FaZ./Q*=Fa./Q=FZa(./QFa=F./Q=a.S/F=./aQZ(=F(as./Y"JO,^/<Q^O/.QFQ/.O~-F(Q:=Q./:-F(=QF/(QZaQF=aaaaaaZ.=ZaF/Q.ZaF=.aZ/FQ=Fa./QZaF=./FaQ=aF.Z/Q=a/Qa=a.//aQ/.aZkFo(h"n$qa|g*q.pF)OskQ=(.-Q/F=(aZ.pQ/=O/aZO^./QF./QapZ].(/Q]=F.(/QZ]F/]/(Za]F]QaF(/ZaF]=/.Q(aZF=aFa]p(OQa(Qa]OpF(/a]FS(SSSS(OQ/.OQS./(]OSF]ZOQF(]ZFa]OQ]F(a.(a]FQ(]FQOaS(|a]/OFQF]Z+(aOQ(F]a (:-<O./QOYJo,O^/,QO(Z.</QO/QO,SYJoO/.QOa^.(/QZaO(./QZa^*$./Q(Za^O.(/Za^O(.Z^a/^QO,oOM-^:o,^Oo,O.~<.Qk
#查表恢复
def rel(s):
for i in range(20):
s=chr(x.index(s)+32)
return s
d="""(:-FQ=/aZQ(F="/.FZSaQ=(FaZ./Q*=Fa./Q=FZa(./QFa=F./Q=a.S/F=./aQZ(=F(as./Y"JO,^/<Q^O/.QFQ/.O~-F(Q:=Q./:-F(=QF/(QZaQF=aaaaaaZ.=ZaF/Q.ZaF=.aZ/FQ=Fa./QZaF=./FaQ=aF.Z/Q=a/Qa=a.//aQ/.aZkFo(h"n$qa|g*q.pF)OskQ=(.-Q/F=(aZ.pQ/=O/aZO^./QF./QapZ].(/Q]=F.(/QZ]F/]/(Za]F]QaF(/ZaF]=/.Q(aZF=aFa]p(OQa(Qa]OpF(/a]FS(SSSS(OQ/.OQS./(]OSF]ZOQF(]ZFa]OQ]F(a.(a]FQ(]FQOaS(|a]/OFQF]Z+(aOQ(F]a (:-<O./QOYJo,O^/,QO(Z.</QO/QO,SYJoO/.QOa^.(/QZaO(./QZa^*$./Q(Za^O.(/Za^O(.Z^a/^QO,oOM-^:o,^Oo,O.~<.Qk"""
for k in range(len(d)):
print((rel(d[k])),end='')
#asdfijoewiafj{opfw2eijafewpoi4jfepoijfweapoifejfpoijep2ofjpoeiwajfae}pox{cnkvo3ivnopifiopnqdfaisjiposdfajifoaiweifjeeeeeewpjwefoipwefjpewofijfepoiwefjpofeijefpwoijeoiejepooeiopew flag{71me5t4mp_fun} ijapdiofjaewp_iojnoewnvpoifpoie_wbpaoibjfpaoiwbfoboawebfbiefaowefbjopiaewfjefeb_anieaiebn_faoebf2a2222aniopni2poabn2fbwnifabwfebnibfaepaebfiabfine2a5ebonfifbw8aeniafbe9asd3npoinxclknvokinawp3oinoink2xclnopinevpaoiwenapoiwev41poiawevnpaowevnapwveovinklnzdvslkvnlknpq3pi
#flag{71me5t4mp_fun}