xmmword_1400033E0 xmmword 10000000E000000150000000Fh .rdata:00000001400033E0 ; DATA XREF: main+39↑r .rdata:00000001400033F0 xmmword_1400033F0 xmmword 1FFFFFFFB0000000FFFFFFFC3h .rdata:00000001400033F0 ; DATA XREF: main+55↑r .rdata:0000000140003400 xmmword_140003400 xmmword 50000000A0000000500000009h .rdata:0000000140003400 ; DATA XREF: main+19↑r .rdata:0000000140003410 dword_140003410 dd 0FFFFFFFDh ; DATA XREF: main+47↑r .rdata:0000000140003414 db 0Fh .rdata:0000000140003415 db 0 .rdata:0000000140003416 db 0 .rdata:0000000140003417 db 0 .rdata:0000000140003418 db 15h .rdata:0000000140003419 db 0 .rdata:000000014000341A db 0 .rdata:000000014000341B db 0 .rdata:000000014000341C db 19h .rdata:000000014000341D db 0 .rdata:000000014000341E db 0 .rdata:000000014000341F db 0 .rdata:0000000140003420 unk_140003420 db 72h ; r ; DATA XREF: main+8F↑r .rdata:0000000140003421 db 20h .rdata:0000000140003422 db 66h ; f .rdata:0000000140003423 db 6Ch ; l .rdata:0000000140003424 db 61h ; a .rdata:0000000140003425 db 67h ; g .rdata:0000000140003426 db 3Ah ; : .rdata:0000000140003427 db 0 .rdata:0000000140003428 db 77h ; w .rdata:0000000140003429 db 72h ; r .rdata:000000014000342A db 6Fh ; o .rdata:000000014000342B db 6Eh ; n .rdata:000000014000342C db 67h ; g .rdata:000000014000342D db 0 .rdata:000000014000342E db 52h ; R .rdata:000000014000342F db 69h ; i .rdata:0000000140003430 unk_140003430 db 50h ; P ; DATA XREF: main+63↑r .rdata:0000000140003431 db 6Ch ; l .rdata:0000000140003432 db 65h ; e .rdata:0000000140003433 db 61h ; a .rdata:0000000140003434 db 73h ; s .rdata:0000000140003435 db 65h ; e .rdata:0000000140003436 db 20h .rdata:0000000140003437 db 69h ; i .rdata:0000000140003438 db 6Eh ; n .rdata:0000000140003439 db 70h ; p .rdata:000000014000343A db 75h ; u .rdata:000000014000343B db 74h ; t .rdata:000000014000343C db 20h .rdata:000000014000343D db 79h ; y .rdata:000000014000343E db 6Fh ; o .rdata:000000014000343F db 75h ; u .rdata:0000000140003440 unk_140003440 db 8 ; DATA XREF: main+29↑r .rdata:0000000140003441 db 0 .rdata:0000000140003442 db 0 .rdata:0000000140003443 db 0 .rdata:0000000140003444 db 17h .rdata:0000000140003445 db 0 .rdata:0000000140003446 db 0 .rdata:0000000140003447 db 0 .rdata:0000000140003448 db 1 .rdata:0000000140003449 db 0 .rdata:000000014000344A db 0 .rdata:000000014000344B db 0 .rdata:000000014000344C db 0FDh .rdata:000000014000344D db 0FFh .rdata:000000014000344E db 0FFh .rdata:000000014000344F db 0FFh
publicclasstest{ publicstaticinta(char paramChar){ int i; if (paramChar < '') { i = paramChar; } else { i = a(Character.toString(paramChar)); } return i; }
publicstaticinta(String paramString){ int i = paramString.length(); int j = 0; if (i > 0) j = paramString.getBytes(StandardCharsets.UTF_8)[0] & 0xFF; return j; }
publicstatic String b(String paramString){ try { MessageDigest messageDigest = MessageDigest.getInstance("SHA"); byte[] arrayOfByte = messageDigest.digest(paramString.getBytes("UTF-8")); StringBuffer stringBuffer = new StringBuffer(); for (byte b = 0; b < arrayOfByte.length; b++) { int i = arrayOfByte[b] & 0xFF; if (i < 16) stringBuffer.append("0"); stringBuffer.append(Integer.toHexString(i)); } return stringBuffer.toString(); } catch (Exception exception) { System.out.println(exception.toString()); exception.printStackTrace(); return""; } }
defdrawPoints(self, qp): qp.setPen(QPen(Qt.black, 2)) with open('./inp.txt', 'r') as inp: data = inp.read().split('s3cR3t:') print(data) for i in data: try: x = int(i.split(' ')[0]) y = int(i.split(' ')[1]) qp.drawPoint(x, y) except: pass
h = 31497596336552470100084187834926304075869321337353584228754801815485197854209104578876574798202880445492465226847681886628987815101276129299179423009194336979092146458547058477361338454307308727787100367492619524471399054846173175096003547542362283035506046981301967777510149938655352986115892410982908002343 p = 126982824744410328945797087760338772632266265605499464155168564006938381164343998332297867219509875837758518332737386292044402913405044815273140449332476472286262639891581209911570020757347401235079120185293696746139599783586620242086604902725583996821566303642800016358224555557587702599076109172899781757727 c = 81425203325802096867547935279460713507554656326547202848965764201702208123530941439525435560101593619326780304160780819803407105746324025686271927329740552019112604285594877520543558401049557343346169993751022158349472011774064975266164948244263318723437203684336095564838792724505516573209588002889586264735
v1 = vector(ZZ, [1, h]) v2 = vector(ZZ, [0, p]) m = matrix([[1, h], [0, p]]) shortest_vector = m.LLL()[0] f, g = shortest_vector print(f, g) f = abs(f) g = abs(g)
a = f*c % p % g m = a * inverse_mod(f, g) % g print(m)
最终flag: minil{l1Ii5n0tea5y}
f**k&base
这道题就是上面那道的变种. 用brainfuck解密一下source.txt:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
from Crypto.Util.number import * q=getPrime(1024) f=getPrime(511) g=getPrime(511) while g<pow(q/4,0.5) and g>pow(q/2,0.5): g=getPrime(511) f_inv_q=inverse(f,q) h=f_inv_q*g%q m=bytes_to_long(b'flag')#flag is base**(flag) r=getPrime(510) e=(r*h+m)%q print f print g print q print e
解密脚本:
1 2 3 4 5 6 7 8 9 10 11 12
# sage
p = 172620634756442326936446284386446310176482010539257694929884002472846127607264743380697653537447369089693337723649017402105400257863085638725058903969478143249108126132543502414741890867122949021941524916405444824353100158506448429871964258931750339247018885114052623963451658829116065142400435131369957050799 c = 130055004464808383851466991915980644718382040848563991873041960765504627910537316320531719771695727709826775790697704799143461018934672453482988811575574961674813001940313918329737944758875566038617074550624823884742484696611063406222986507537981571075140436761436815079809518206635499600341038593553079293254
f = 4685394431238242086047454699939574117865082734421802876855769683954689809016908045500281898911462887906190042764753834184270447603004244910544167081517863 g = 5326402554595682620065287001809742915798424911036766723537742672943459577709829465021452623299712724999868094408519004699993233519540500859134358256211397
a = f*c % p % g m = a * inverse_mod(f, g) % g print(m) # m = 629250774757584627131327668302148468