TGCTF2025--ReWp

Re

Base64

魔改b64

密文已知

AwLdOEVEhIWtajB2CbCWCbTRVsFFC8hirfiXC9gWH9HQayCJVbB8CIF=

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
_BYTE *__fastcall base64(__int64 Source)
{
  __int64 v2; // rbx
  __int64 v3; // rbp
  int v4; // edx
  int n2; // edi
  int n2_2; // edx
  __int64 n2_3; // r14
  size_t Size; // rcx
  _BYTE *v9; // r8
  __int64 v10; // r9
  unsigned __int64 v11; // rdx
  int v12; // ecx
  unsigned int n0x40; // ecx
  unsigned int n0x40_3; // eax
  int v15; // eax
  int v16; // eax
  int v17; // eax
  int v18; // edi
  __int64 v19; // rdx
  int v20; // eax
  int v21; // eax
  int v22; // ecx
  unsigned int n0x40_2; // edx
  int n0x40_5; // ecx
  int v25; // eax
  int v26; // ecx
  unsigned int n0x40_1; // ecx
  unsigned int n0x40_4; // eax
  char GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[80]; // [rsp+20h] [rbp-68h] BYREF
  int n2_1; // [rsp+90h] [rbp+8h]

  v2 = -1LL;
  strcpy(
    GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb,
    "GLp/+Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9iebI");
  do
    ++v2;
  while ( *(_BYTE *)(Source + v2) );
  v3 = 0LL;
  v4 = (int)v2 / 3;
  if ( (_DWORD)v2 == 3 * ((int)v2 / 3) )
  {
    n2 = 0;
    n2_2 = 4 * v4;
  }
  else if ( (int)v2 % 3 == 1 )
  {
    n2 = 1;
    n2_2 = 4 * v4 + 4;
  }
  else if ( (int)v2 % 3 == 2 )
  {
    n2 = 2;
    n2_2 = 4 * v4 + 4;
  }
  else
  {
    n2 = n2_1;
    n2_2 = n2_1;
  }
  n2_3 = n2_2;
  Size = n2_2 + 1LL;
  if ( n2_2 == -1LL )
    Size = -1LL;
  v9 = malloc(Size);
  if ( (int)v2 - n2 > 0 )
  {
    v10 = Source + 2;
    v11 = ((int)v2 - n2 - 1LL) / 3uLL + 1;
    do
    {
      v3 += 4LL;
      v12 = *(unsigned __int8 *)(v10 - 2) >> 2;
      v10 += 3LL;
      n0x40 = v12 + 24;
      n0x40_3 = n0x40 - 64;
      if ( n0x40 <= 0x40 )
        n0x40_3 = n0x40;
      v9[v3 - 4] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[n0x40_3];
      v15 = ((*(unsigned __int8 *)(v10 - 4) >> 4) | (16 * (*(_BYTE *)(v10 - 5) & 3))) - 40;
      if ( ((*(unsigned __int8 *)(v10 - 4) >> 4) | (16 * (*(_BYTE *)(v10 - 5) & 3u))) + 24 <= 0x40 )
        v15 = ((*(unsigned __int8 *)(v10 - 4) >> 4) | (16 * (*(_BYTE *)(v10 - 5) & 3))) + 24;
      v9[v3 - 3] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v15];
      v16 = ((*(unsigned __int8 *)(v10 - 3) >> 6) | (4 * (*(_BYTE *)(v10 - 4) & 0xF))) - 40;
      if ( ((*(unsigned __int8 *)(v10 - 3) >> 6) | (4 * (*(_BYTE *)(v10 - 4) & 0xFu))) + 24 <= 0x40 )
        v16 = ((*(unsigned __int8 *)(v10 - 3) >> 6) | (4 * (*(_BYTE *)(v10 - 4) & 0xF))) + 24;
      v9[v3 - 2] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v16];
      v17 = (*(_BYTE *)(v10 - 3) & 0x3F) - 40;
      if ( (*(_BYTE *)(v10 - 3) & 0x3Fu) + 24 <= 0x40 )
        v17 = (*(_BYTE *)(v10 - 3) & 0x3F) + 24;
      v9[v3 - 1] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v17];
      --v11;
    }
    while ( v11 );
  }
  v18 = n2 - 1;
  if ( !v18 )
  {
    v25 = (*(unsigned __int8 *)((int)v2 + Source - 1) >> 2) - 40;
    if ( (*(unsigned __int8 *)((int)v2 + Source - 1) >> 2) + 24 <= 0x40u )
      v25 = (*(unsigned __int8 *)((int)v2 + Source - 1) >> 2) + 24;
    v9[n2_3 - 4] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v25];
    v26 = *(_BYTE *)((int)v2 + Source - 1) & 3;
    *(_WORD *)&v9[n2_3 - 2] = 15677;
    n0x40_1 = 16 * v26 + 24;
    n0x40_4 = n0x40_1 - 64;
    if ( n0x40_1 <= 0x40 )
      n0x40_4 = n0x40_1;
    v9[n2_3 - 3] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[n0x40_4];
    goto LABEL_37;
  }
  if ( v18 != 1 )
  {
LABEL_37:
    v9[n2_3] = 0;
    return v9;
  }
  v19 = Source + (int)v2;
  v20 = (*(unsigned __int8 *)(v19 - 2) >> 2) - 40;
  if ( (*(unsigned __int8 *)(v19 - 2) >> 2) + 24 <= 0x40u )
    v20 = (*(unsigned __int8 *)(v19 - 2) >> 2) + 24;
  v9[n2_3 - 4] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v20];
  v21 = ((*(unsigned __int8 *)(v19 - 1) >> 4) | (16 * (*(_BYTE *)(v19 - 2) & 3))) - 40;
  if ( ((*(unsigned __int8 *)(v19 - 1) >> 4) | (16 * (*(_BYTE *)(v19 - 2) & 3u))) + 24 <= 0x40 )
    v21 = ((*(unsigned __int8 *)(v19 - 1) >> 4) | (16 * (*(_BYTE *)(v19 - 2) & 3))) + 24;
  v9[n2_3 - 3] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[v21];
  v22 = *(_BYTE *)(v19 - 1) & 0xF;
  *(_WORD *)&v9[n2_3 - 1] = 61;
  n0x40_2 = 4 * v22 + 24;
  n0x40_5 = 4 * v22 - 40;
  if ( n0x40_2 <= 0x40 )
    n0x40_5 = n0x40_2;
  v9[n2_3 - 2] = GLp__Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9ieb[n0x40_5];
  return v9;
}

加密流程有魔改了，半天脚本不对

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
def decode_custom_base64(encoded_str):
    # Custom alphabet from the IDA decompilation
    alphabet = "GLp/+Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9iebI"

    # Create reverse mapping dictionary
    reverse_alphabet = {c: i for i, c in enumerate(alphabet)}

    # Remove padding if present
    encoded_str = encoded_str.rstrip('=')

    decoded_bytes = bytearray()
    buffer = 0
    bits_collected = 0

    for c in encoded_str:
        if c not in reverse_alphabet:
            continue  # skip invalid characters

        # Reverse the arithmetic operations from encoding
        index = reverse_alphabet[c]
        index = (index - 24) % 64  # Reverse the +24 during encoding

        # Standard base64 decoding logic
        buffer = (buffer << 6) | index
        bits_collected += 6

        if bits_collected >= 8:
            bits_collected -= 8
            decoded_bytes.append((buffer >> bits_collected) & 0xff)
            buffer &= (1 << bits_collected) - 1

    return bytes(decoded_bytes)

# Example usage:
encoded = "AwLdOEVEhIWtajB2CbCWCbTRVsFFC8hirfiXC9gWH9HQayCJVbB8CIF="
decoded = decode_custom_base64(encoded)
print(decoded)
#HZNUCTF{ad162c-2d94-434d-9222-b65dc76a32}

水果忍者

unity逆向，moon编译的

dnspy打开发现aes加密

XTEA

xtea解密，xtea的key是动态生成的，其他的无太大区别

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char *v3; // rdi
  __int64 i; // rcx
  int v5; // eax
  int v6; // edi
  char v8[32]; // [rsp+0h] [rbp-20h] BYREF
  char v9; // [rsp+20h] [rbp+0h] BYREF
  unsigned int delta; // [rsp+24h] [rbp+4h] BYREF
  void *Block; // [rsp+48h] [rbp+28h]
  void *key; // [rsp+68h] [rbp+48h]
  _DWORD v13[15]; // [rsp+88h] [rbp+68h] BYREF
  int j; // [rsp+C4h] [rbp+A4h]
  int k; // [rsp+E4h] [rbp+C4h]
  int m; // [rsp+104h] [rbp+E4h]
  int v17; // [rsp+1D4h] [rbp+1B4h]

  v3 = &v9;
  for ( i = 66LL; i; --i )
  {
    *(_DWORD *)v3 = 0xCCCCCCCC;
    v3 += 4;
  }
  sub_1400113A2(&unk_1400220A7);
  srand(0x7E8u);
  sub_140011181();
  printf("Welcome to HZNUCTF!!!\n");
  printf("Plz input the cipher:\n");
  delta = 0;
  if ( (unsigned int)judge_cipher("%d", (unsigned int)&delta) == 1 )
  {
    printf("Plz input the flag:\n");
    Block = malloc(0x21uLL);
    key = malloc(0x10uLL);
    if ( (unsigned int)judge_cipher("%s", (const char *)Block) == 1 )
    {
      for ( j = 0; j < 32; j += 4 )
      {
        v17 = *((char *)Block + j + 3) | (*((char *)Block + j + 2) << 8) | (*((char *)Block + j + 1) << 16) | (*((char *)Block + j) << 24);
        v13[j / 4] = v17;
      }
      key_init(key);
      for ( k = 0; k < 7; ++k )
        xtea(delta, &v13[k], &v13[k + 1], key);
      for ( m = 0; m < 8; ++m )
      {
        if ( v13[m] != enc[m] )
        {
          printf("wrong_wrong!!!");
          exit(1);
        }
      }
      printf("Congratulation!!!");
      free(Block);
      free(key);
      v5 = 0;
    }
    else
    {
      printf("Invalid input.\n");
      free(Block);
      free(key);
      v5 = 1;
    }
  }
  else
  {
    printf("Invalid input.\n");
    v5 = 1;
  }
  v6 = v5;
  sub_14001133E(v8, &unk_14001AD40);
  return v6;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
unsigned int *__fastcall sub_140011A10(int a1, unsigned int *a2, unsigned int *a3, __int64 a4)
{
  unsigned int *result; // rax
  unsigned int v5; // [rsp+24h] [rbp+4h]
  unsigned int v6; // [rsp+44h] [rbp+24h]
  unsigned int v7; // [rsp+64h] [rbp+44h]
  int i; // [rsp+84h] [rbp+64h]

  sub_1400113A2((__int64)&unk_1400220A7);
  v5 = *a2;
  v6 = *a3;
  v7 = 0;
  for ( i = 0; i < 32; ++i )
  {
    v5 += (*(_DWORD *)(a4 + 4LL * (v7 & 3)) + v7) ^ (v6 + ((v6 >> 5) ^ (16 * v6)));
    v7 -= a1;
    v6 += (*(_DWORD *)(a4 + 4LL * ((v7 >> 11) & 3)) + v7) ^ (v5 + ((v5 >> 5) ^ (16 * v5)));
  }
  *a2 = v5;
  result = a3;
  *a3 = v6;
  return result;
}

这题有种子，key是固定的，但是delta不好搞，emmm，好吧，确实是misc味

种子因为环境不同直接动调取

此题有调试混淆

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
void decrypt(uint32_t v[2], uint32_t const key[4]) {
    unsigned int i;
    uint32_t v0 = v[0], v1 = v[1], delta = 0x9E3779B9, sum = delta * (-32);
    for (i=0; i < 32; i++) {
        v1 -= (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);
        sum += delta;
        v0 -= (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);

    }
    v[0] = v0; v[1] = v1;
}

int main() {
    uint32_t const k[4] = {0x19f8,0x11be,0x991,0x3418};
    uint32_t enc[] = {0x8ccb2324,0x9a7741a,0xfb3c678d,0xf6083a79,0xf1cc241b,0x39fa59f2,0xf2abe1cc,0x17189f72};
    for(int i=6; i>=0; i-=1){  //倒着解密
        decrypt(&enc[i], k);
    }
    for (int i = 0; i < 8; i++) {  
        for (int m = 3; m>=0; m--) {
            printf("%c", (enc[i] >> (8 * m)) & 0xff);
        }
    }
    return 0;
}
//HZNUCTF{ae6-9f57-4b74-b423-98eb}
/*
#include <string.h>
#include<stdio.h>
int main(){
	srand(0x7E8u);
	for(int i=0;i<4;i++){
		int a=rand();
		printf("%x,",a);
	} 
	 
	return 0;
}
*/

蛇年的本命语言

pyc 3.8版本，代码修复后如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# uncompyle6 version 3.9.2
# Python bytecode version base 3.8.0 (3413)
# Decompiled from: Python 3.8.20 (default, Oct  3 2024, 15:19:54) [MSC v.1929 64 bit (AMD64)]
# Embedded file name: output.py
from collections import Counter
print("Welcome to HZNUCTF!!!")
print("Plz input the flag:")
flag = input()
a1 = Counter(flag)
# a2 = "".join((str(a1[oOooo0OOO]) for oOooo0OOO in))
a2 = "".join(str(a1[i]) for i in flag)
print("ans1: ", end="")
print(a2)
if a2 != "111111116257645365477364777645752361":
    print("wrong_wrong!!!")
    exit(1)
iiIII = ""
for i in flag:
    if a1[i] > 0:
        iiIII += i + str(a1[i])
        a1[i] = 0
    else:
        v = [ord(i) for i in iiIII]
        judge = [
            7 * v[0] == 504,
            9 * v[0] - 5 * v[1] == 403,
            2 * v[0] - 5 * v[1] + 10 * v[2] == 799,
            3 * v[0] + 8 * v[1] + 15 * v[2] + 20 * v[3] == 2938,
            5 * v[0] + 15 * v[1] + 20 * v[2] - 19 * v[3] + 1 * v[4] == 2042,
            7 * v[0] + 1 * v[1] + 9 * v[2] - 11 * v[3] + 2 * v[4] + 5 * v[5] == 1225,
            11 * v[0] + 22 * v[1] + 33 * v[2] + 44 * v[3] + 55 * v[4] + 66 * v[5] - 77 * v[6] == 7975,
            21 * v[0] + 23 * v[1] + 3 * v[2] + 24 * v[3] - 55 * v[4] + 6 * v[5] - 7 * v[6] + 15 * v[7] == 229,
            2 * v[0] + 26 * v[1] + 13 * v[2] + 0 * v[3] - 65 * v[4] + 15 * v[5] + 29 * v[6] + 1 * v[7] + 20 * v[8] == 2107,
            10 * v[0] + 7 * v[1] + -9 * v[2] + 6 * v[3] + 7 * v[4] + 1 * v[5] + 22 * v[6] + 21 * v[7] - 22 * v[8] + 30 * v[9] == 4037,
            15 * v[0] + 59 * v[1] + 56 * v[2] + 66 * v[3] + 7 * v[4] + 1 * v[5] - 122 * v[6] + 21 * v[7] + 32 * v[8] + 3 * v[9] - 10 * v[10] == 4950,
            13 * v[0] + 66 * v[1] + 29 * v[2] + 39 * v[3] - 33 * v[4] + 13 * v[5] - 2 * v[6] + 42 * v[7] + 62 * v[8] + 1 * v[9] - 10 * v[10] + 11 * v[11] == 12544,
            23 * v[0] + 6 * v[1] + 29 * v[2] + 3 * v[3] - 3 * v[4] + 63 * v[5] - 25 * v[6] + 2 * v[7] + 32 * v[8] + 1 * v[9] - 10 * v[10] + 11 * v[11] - 12 * v[12] == 6585,
            223 * v[0] + 6 * v[1] - 29 * v[2] - 53 * v[3] - 3 * v[4] + 3 * v[5] - 65 * v[6] + 0 * v[7] + 36 * v[8] + 1 * v[9] - 15 * v[10] + 16 * v[11] - 18 * v[12] + 13 * v[13] == 6893,
            29 * v[0] + 13 * v[1] - 9 * v[2] - 93 * v[3] + 33 * v[4] + 6 * v[5] + 65 * v[6] + 1 * v[7] - 36 * v[8] + 0 * v[9] - 16 * v[10] + 96 * v[11] - 68 * v[12] + 33 * v[13] - 14 * v[14] == 1883,
            69 * v[0] + 77 * v[1] - 93 * v[2] - 12 * v[3] + 0 * v[4] + 0 * v[5] + 1 * v[6] + 16 * v[7] + 36 * v[8] + 6 * v[9] + 19 * v[10] + 66 * v[11] - 8 * v[12] + 38 * v[13] - 16 * v[14] + 15 * v[15] == 8257,
            23 * v[0] + 2 * v[1] - 3 * v[2] - 11 * v[3] + 12 * v[4] + 24 * v[5] + 1 * v[6] + 6 * v[7] + 14 * v[8] - 0 * v[9] + 1 * v[10] + 68 * v[11] - 18 * v[12] + 68 * v[13] - 26 * v[14] + 15 * v[15] - 16 * v[16] == 5847,
            24 * v[0] + 0 * v[1] - 1 * v[2] - 15 * v[3] + 13 * v[4] + 4 * v[5] + 16 * v[6] + 67 * v[7] + 146 * v[8] - 50 * v[9] + 16 * v[10] + 6 * v[11] - 1 * v[12] + 69 * v[13] - 27 * v[14] + 45 * v[15] - 6 * v[16] + 17 * v[17] == 18257,
            25 * v[0] + 26 * v[1] - 89 * v[2] + 16 * v[3] + 19 * v[4] + 44 * v[5] + 36 * v[6] + 66 * v[7] - 150 * v[8] - 250 * v[9] + 166 * v[10] + 126 * v[11] - 11 * v[12] + 690 * v[13] - 207 * v[14] + 46 * v[15] + 6 * v[16] + 7 * v[17] - 18 * v[18] == 12591,
            5 * v[0] + 26 * v[1] + 8 * v[2] + 160 * v[3] + 9 * v[4] - 4 * v[5] + 36 * v[6] + 6 * v[7] - 15 * v[8] - 20 * v[9] + 66 * v[10] + 16 * v[11] - 1 * v[12] + 690 * v[13] - 20 * v[14] + 46 * v[15] + 6 * v[16] + 7 * v[17] - 18 * v[18] + 19 * v[19] == 52041,
            29 * v[0] - 26 * v[1] + 0 * v[2] + 60 * v[3] + 90 * v[4] - 4 * v[5] + 6 * v[6] + 6 * v[7] - 16 * v[8] - 21 * v[9] + 69 * v[10] + 6 * v[11] - 12 * v[12] + 69 * v[13] - 20 * v[14] - 46 * v[15] + 65 * v[16] + 0 * v[17] - 1 * v[18] + 39 * v[19] - 20 * v[20] == 20253,
            45 * v[0] - 56 * v[1] + 10 * v[2] + 650 * v[3] - 900 * v[4] + 44 * v[5] + 66 * v[6] - 6 * v[7] - 6 * v[8] - 21 * v[9] + 9 * v[10] - 6 * v[11] - 12 * v[12] + 69 * v[13] - 2 * v[14] - 406 * v[15] + 651 * v[16] + 2 * v[17] - 10 * v[18] + 69 * v[19] - 0 * v[20] + 21 * v[21] == 18768,
            555 * v[0] - 6666 * v[1] + 70 * v[2] + 510 * v[3] - 90 * v[4] + 499 * v[5] + 66 * v[6] - 66 * v[7] - 610 * v[8] - 221 * v[9] + 9 * v[10] - 23 * v[11] - 102 * v[12] + 6 * v[13] + 2050 * v[14] - 406 * v[15] + 665 * v[16] + 333 * v[17] + 100 * v[18] + 609 * v[19] + 777 * v[20] + 201 * v[21] - 22 * v[22] == 111844,
            1 * v[0] - 22 * v[1] + 333 * v[2] + 4444 * v[3] - 5555 * v[4] + 6666 * v[5] - 666 * v[6] + 676 * v[7] - 660 * v[8] - 22 * v[9] + 9 * v[10] - 73 * v[11] - 107 * v[12] + 6 * v[13] + 250 * v[14] - 6 * v[15] + 65 * v[16] + 39 * v[17] + 10 * v[18] + 69 * v[19] + 777 * v[20] + 201 * v[21] - 2 * v[22] + 23 * v[23] == 159029,
            520 * v[0] - 222 * v[1] + 333 * v[2] + 4 * v[3] - 56655 * v[4] + 6666 * v[5] + 666 * v[6] + 66 * v[7] - 60 * v[8] - 220 * v[9] + 99 * v[10] + 73 * v[11] + 1007 * v[12] + 7777 * v[13] + 2500 * v[14] + 6666 * v[15] + 605 * v[16] + 390 * v[17] + 100 * v[18] + 609 * v[19] + 99999 * v[20] + 210 * v[21] + 232 * v[22] + 23 * v[23] - 24 * v[24] == 2762025,
            1323 * v[0] - 22 * v[1] + 333 * v[2] + 4 * v[3] - 55 * v[4] + 666 * v[5] + 666 * v[6] + 66 * v[7] - 660 * v[8] - 220 * v[9] + 99 * v[10] + 3 * v[11] + 100 * v[12] + 777 * v[13] + 2500 * v[14] + 6666 * v[15] + 605 * v[16] + 390 * v[17] + 100 * v[18] + 609 * v[19] + 9999 * v[20] + 210 * v[21] + 232 * v[22] + 23 * v[23] - 24 * v[24] + 25 * v[25] == 1551621,
            777 * v[0] - 22 * v[1] + 6969 * v[2] + 4 * v[3] - 55 * v[4] + 666 * v[5] - 6 * v[6] + 96 * v[7] - 60 * v[8] - 220 * v[9] + 99 * v[10] + 3 * v[11] + 100 * v[12] + 777 * v[13] + 250 * v[14] + 666 * v[15] + 65 * v[16] + 90 * v[17] + 100 * v[18] + 609 * v[19] + 999 * v[20] + 21 * v[21] + 232 * v[22] + 23 * v[23] - 24 * v[24] + 25 * v[25] - 26 * v[26] == 948348,
            97 * v[0] - 22 * v[1] + 6969 * v[2] + 4 * v[3] - 56 * v[4] + 96 * v[5] - 6 * v[6] + 96 * v[7] - 60 * v[8] - 20 * v[9] + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[16] + 90 * v[17] + -2 * v[18] + 609 * v[19] + 0 * v[20] + 21 * v[21] + 2 * v[22] + 23 * v[23] - 24 * v[24] + 25 * v[25] - 26 * v[26] + 27 * v[27] == 777044,
            177 * v[0] - 22 * v[1] + 699 * v[2] + 64 * v[3] - 56 * v[4] - 96 * v[5] - 66 * v[6] + 96 * v[7] - 60 * v[8] - 20 * v[9] + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[16] + 0 * v[17] + -2 * v[18] + 69 * v[19] + 0 * v[20] + 21 * v[21] + 222 * v[22] + 23 * v[23] - 224 * v[24] + 25 * v[25] - 26 * v[26] + 27 * v[27] - 28 * v[28] == 185016,
            77 * v[0] - 2 * v[1] + 6 * v[2] + 6 * v[3] - 96 * v[4] - 9 * v[5] - 6 * v[6] + 96 * v[7] - 0 * v[8] - 20 * v[9] + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[16] + 0 * v[17] + -2 * v[18] + 9 * v[19] + 0 * v[20] + 21 * v[21] + 222 * v[22] + 23 * v[23] - 224 * v[24] + 26 * v[25] - -58 * v[26] + 27 * v[27] - 2 * v[28] + 29 * v[29] == 130106]
        if all(judge):
            print("Congratulation!!!")
        else:
            print("wrong_wrong!!!")

z3解密看一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
from z3 import *


def solve_equations():
    # 创建求解器实例
    s = Solver()

    # 创建30个整数变量
    v = [Int(f'v_{i}') for i in range(30)]

    # 添加方程约束
    s.add(7 * v[0] == 504)
    s.add(9 * v[0] - 5 * v[1] == 403)
    s.add((2 * v[0] - 5 * v[1]) + 10 * v[2] == 799)
    s.add(3 * v[0] + 8 * v[1] + 15 * v[2] + 20 * v[3] == 2938)
    s.add((5 * v[0] + 15 * v[1] + 20 * v[2] - 19 * v[3]) + 1 * v[4] == 2042)
    s.add((7 * v[0] + 1 * v[1] + 9 * v[2] - 11 * v[3]) + 2 * v[4] + 5 * v[5] == 1225)
    s.add(11 * v[0] + 22 * v[1] + 33 * v[2] + 44 * v[3] + 55 * v[4] + 66 * v[5] - 77 * v[6] == 7975)
    s.add(((21 * v[0] + 23 * v[1] + 3 * v[2] + 24 * v[3] - 55 * v[4]) + 6 * v[5] - 7 * v[6]) + 15 * v[7] == 229)
    s.add((2 * v[0] + 26 * v[1] + 13 * v[2] + 0 * v[3] - 65 * v[4]) + 15 * v[5] + 29 * v[6] + 1 * v[7] + 20 * v[
        8] == 2107)
    s.add((10 * v[0] + 7 * v[1] + -9 * v[2] + 6 * v[3] + 7 * v[4] + 1 * v[5] + 22 * v[6] + 21 * v[7] - 22 * v[8]) + 30 *
          v[9] == 4037)
    s.add(
        (15 * v[0] + 59 * v[1] + 56 * v[2] + 66 * v[3] + 7 * v[4] + 1 * v[5] - 122 * v[6]) + 21 * v[7] + 32 * v[8] + 3 *
        v[9] - 10 * v[10] == 4950)
    s.add((((13 * v[0] + 66 * v[1] + 29 * v[2] + 39 * v[3] - 33 * v[4]) + 13 * v[5] - 2 * v[6]) + 42 * v[7] + 62 * v[
        8] + 1 * v[9] - 10 * v[10]) + 11 * v[11] == 12544)
    s.add((((23 * v[0] + 6 * v[1] + 29 * v[2] + 3 * v[3] - 3 * v[4]) + 63 * v[5] - 25 * v[6]) + 2 * v[7] + 32 * v[
        8] + 1 * v[9] - 10 * v[10]) + 11 * v[11] - 12 * v[12] == 6585)
    s.add(((((223 * v[0] + 6 * v[1] - 29 * v[2] - 53 * v[3] - 3 * v[4]) + 3 * v[5] - 65 * v[6]) + 0 * v[7] + 36 * v[
        8] + 1 * v[9] - 15 * v[10]) + 16 * v[11] - 18 * v[12]) + 13 * v[13] == 6893)
    s.add(((((29 * v[0] + 13 * v[1] - 9 * v[2] - 93 * v[3]) + 33 * v[4] + 6 * v[5] + 65 * v[6] + 1 * v[7] - 36 * v[
        8]) + 0 * v[9] - 16 * v[10]) + 96 * v[11] - 68 * v[12]) + 33 * v[13] - 14 * v[14] == 1883)
    s.add((((69 * v[0] + 77 * v[1] - 93 * v[2] - 12 * v[3]) + 0 * v[4] + 0 * v[5] + 1 * v[6] + 16 * v[7] + 36 * v[
        8] + 6 * v[9] + 19 * v[10] + 66 * v[11] - 8 * v[12]) + 38 * v[13] - 16 * v[14]) + 15 * v[15] == 8257)
    s.add(((((23 * v[0] + 2 * v[1] - 3 * v[2] - 11 * v[3]) + 12 * v[4] + 24 * v[5] + 1 * v[6] + 6 * v[7] + 14 * v[
        8] - 0 * v[9]) + 1 * v[10] + 68 * v[11] - 18 * v[12]) + 68 * v[13] - 26 * v[14]) + 15 * v[15] - 16 * v[
              16] == 5847)
    s.add((((((24 * v[0] + 0 * v[1] - 1 * v[2] - 15 * v[3]) + 13 * v[4] + 4 * v[5] + 16 * v[6] + 67 * v[7] + 146 * v[
        8] - 50 * v[9]) + 16 * v[10] + 6 * v[11] - 1 * v[12]) + 69 * v[13] - 27 * v[14]) + 45 * v[15] - 6 * v[
               16]) + 17 * v[17] == 18257)
    s.add(((((25 * v[0] + 26 * v[1] - 89 * v[2]) + 16 * v[3] + 19 * v[4] + 44 * v[5] + 36 * v[6] + 66 * v[7] - 150 * v[
        8] - 250 * v[9]) + 166 * v[10] + 126 * v[11] - 11 * v[12]) + 690 * v[13] - 207 * v[14]) + 46 * v[15] + 6 * v[
              16] + 7 * v[17] - 18 * v[18] == 12591)
    s.add((((((5 * v[0] + 26 * v[1] + 8 * v[2] + 160 * v[3] + 9 * v[4] - 4 * v[5]) + 36 * v[6] + 6 * v[7] - 15 * v[
        8] - 20 * v[9]) + 66 * v[10] + 16 * v[11] - 1 * v[12]) + 690 * v[13] - 20 * v[14]) + 46 * v[15] + 6 * v[
               16] + 7 * v[17] - 18 * v[18]) + 19 * v[19] == 52041)
    s.add(((((((29 * v[0] - 26 * v[1]) + 0 * v[2] + 60 * v[3] + 90 * v[4] - 4 * v[5]) + 6 * v[6] + 6 * v[7] - 16 * v[
        8] - 21 * v[9]) + 69 * v[10] + 6 * v[11] - 12 * v[12]) + 69 * v[13] - 20 * v[14] - 46 * v[15]) + 65 * v[
               16] + 0 * v[17] - 1 * v[18]) + 39 * v[19] - 20 * v[20] == 20253)
    s.add((((((((45 * v[0] - 56 * v[1]) + 10 * v[2] + 650 * v[3] - 900 * v[4]) + 44 * v[5] + 66 * v[6] - 6 * v[7] - 6 *
               v[8] - 21 * v[9]) + 9 * v[10] - 6 * v[11] - 12 * v[12]) + 69 * v[13] - 2 * v[14] - 406 * v[15]) + 651 *
            v[16] + 2 * v[17] - 10 * v[18]) + 69 * v[19] - 0 * v[20]) + 21 * v[21] == 18768)
    s.add((((((555 * v[0] - 6666 * v[1]) + 70 * v[2] + 510 * v[3] - 90 * v[4]) + 499 * v[5] + 66 * v[6] - 66 * v[
        7] - 610 * v[8] - 221 * v[9]) + 9 * v[10] - 23 * v[11] - 102 * v[12]) + 6 * v[13] + 2050 * v[14] - 406 * v[
               15]) + 665 * v[16] + 333 * v[17] + 100 * v[18] + 609 * v[19] + 777 * v[20] + 201 * v[21] - 22 * v[
              22] == 111844)
    s.add((((((((1 * v[0] - 22 * v[1]) + 333 * v[2] + 4444 * v[3] - 5555 * v[4]) + 6666 * v[5] - 666 * v[6]) + 676 * v[
        7] - 660 * v[8] - 22 * v[9]) + 9 * v[10] - 73 * v[11] - 107 * v[12]) + 6 * v[13] + 250 * v[14] - 6 * v[
                15]) + 65 * v[16] + 39 * v[17] + 10 * v[18] + 69 * v[19] + 777 * v[20] + 201 * v[21] - 2 * v[22]) + 23 *
          v[23] == 159029)
    s.add((((520 * v[0] - 222 * v[1]) + 333 * v[2] + 4 * v[3] - 56655 * v[4]) + 6666 * v[5] + 666 * v[6] + 66 * v[
        7] - 60 * v[8] - 220 * v[9]) + 99 * v[10] + 73 * v[11] + 1007 * v[12] + 7777 * v[13] + 2500 * v[14] + 6666 * v[
              15] + 605 * v[16] + 390 * v[17] + 100 * v[18] + 609 * v[19] + 99999 * v[20] + 210 * v[21] + 232 * v[
              22] + 23 * v[23] - 24 * v[24] == 2762025)
    s.add(((((1323 * v[0] - 22 * v[1]) + 333 * v[2] + 4 * v[3] - 55 * v[4]) + 666 * v[5] + 666 * v[6] + 66 * v[
        7] - 660 * v[8] - 220 * v[9]) + 99 * v[10] + 3 * v[11] + 100 * v[12] + 777 * v[13] + 2500 * v[14] + 6666 * v[
               15] + 605 * v[16] + 390 * v[17] + 100 * v[18] + 609 * v[19] + 9999 * v[20] + 210 * v[21] + 232 * v[
               22] + 23 * v[23] - 24 * v[24]) + 25 * v[25] == 1551621)
    s.add((((((777 * v[0] - 22 * v[1]) + 6969 * v[2] + 4 * v[3] - 55 * v[4]) + 666 * v[5] - 6 * v[6]) + 96 * v[7] - 60 *
            v[8] - 220 * v[9]) + 99 * v[10] + 3 * v[11] + 100 * v[12] + 777 * v[13] + 250 * v[14] + 666 * v[15] + 65 *
           v[16] + 90 * v[17] + 100 * v[18] + 609 * v[19] + 999 * v[20] + 21 * v[21] + 232 * v[22] + 23 * v[23] - 24 *
           v[24]) + 25 * v[25] - 26 * v[26] == 948348)
    s.add(((((((97 * v[0] - 22 * v[1]) + 6969 * v[2] + 4 * v[3] - 56 * v[4]) + 96 * v[5] - 6 * v[6]) + 96 * v[7] - 60 *
             v[8] - 20 * v[9]) + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[
                16] + 90 * v[17] + -2 * v[18] + 609 * v[19] + 0 * v[20] + 21 * v[21] + 2 * v[22] + 23 * v[23] - 24 * v[
                24]) + 25 * v[25] - 26 * v[26]) + 27 * v[27] == 777044)
    s.add((((((177 * v[0] - 22 * v[1]) + 699 * v[2] + 64 * v[3] - 56 * v[4] - 96 * v[5] - 66 * v[6]) + 96 * v[7] - 60 *
             v[8] - 20 * v[9]) + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[
                16] + 0 * v[17] + -2 * v[18] + 69 * v[19] + 0 * v[20] + 21 * v[21] + 222 * v[22] + 23 * v[23] - 224 * v[
                24]) + 25 * v[25] - 26 * v[26]) + 27 * v[27] - 28 * v[28] == 185016)
    s.add(((((((77 * v[0] - 2 * v[1]) + 6 * v[2] + 6 * v[3] - 96 * v[4] - 9 * v[5] - 6 * v[6]) + 96 * v[7] - 0 * v[
        8] - 20 * v[9]) + 99 * v[10] + 3 * v[11] + 10 * v[12] + 707 * v[13] + 250 * v[14] + 666 * v[15] + -9 * v[
                 16] + 0 * v[17] + -2 * v[18] + 9 * v[19] + 0 * v[20] + 21 * v[21] + 222 * v[22] + 23 * v[23] - 224 * v[
                 24]) + 26 * v[25] - -58 * v[26]) + 27 * v[27] - 2 * v[28]) + 29 * v[29] == 130106)

    # 检查是否有解
    if s.check() == sat:
        m = s.model()
        # 提取解
        solution = [m[v[i]].as_long() for i in range(30)]
        return solution
    else:
        return None


# 求解并打印结果
solution = solve_equations()
if solution:
    print("解找到:")
    for i, val in enumerate(solution):
        print(f"v[{i}] = {val}")
else:
    print("无解")
# H1Z1N1U1C1T1F1{1a6d275f7-463}1

一开始没反应过来，以为Counter是按顺序的

后来发现了

1
2
3
#if a2 != "11111111 625764  53654  77364 77764  5752361":
# H1Z1N1U1C1T1F1{1 a:6 d:2 7:5 f:7 -:4 6:3 }1
#HZNUCTF{ad7fa-76a7-ff6a-fffa-7f7d6a}
TGCTF2025--ReWp
https://alenirving.github.io/2025/04/13/TGCTF2025/
作者
Ma5k
发布于
2025年4月13日
许可协议