[SICTF]Re题解 – Sw'Blog

打到一半打洛杉矶周大福去了0.0

[签到]Baby_C++

这个直接看得到，没啥好说的

Ez_pyc

# uncompyle6 version 3.9.0
# Python bytecode version base 3.8.0 (3413)
# Decompiled from: Python 3.8.6 (tags/v3.8.6:db45529, Sep 23 2020, 15:52:53) [MSC v.1927 64 bit (AMD64)]
# Embedded file name: E:\CTF����\ez_pyc\233.py
# Compiled at: 2024-02-16 10:29:12
# Size of source mod 2**32: 1218 bytes
import hashlib
k = [['#'] * 10,
 [
  '#', 0, 1, 9] + [0] * 3 + [3, 0, 7],
 [
  '#', 8] + [0] * 8,
 [
  '#', 4] + [0] * 5 + [2, 0, 0],
 [
  '#'] + [0] * 4 + [3] + [0] * 4,
 [
  '#', 5] + [0] * 3 + [6, 0, 0, 2, 0],
 [
  '#', 0, 7] + [0] * 5 + [3, 1],
 [
  '#'] + [0] * 9,
 [
  "'#'", 0, 0, 8, 0, 9, 0, 7, 0, 0],
 [
  '#'] + [0] * 9]
cnt = 0
s = str(int(input(), 16))
try:
    for x in s:
        if x not in [str(t) for t in range(1, 10)]:
            s[cnt + 43690] = 1
    else:
        for i in range(1, len(k)):
            for j in range(1, len(k[i])):
                if k[i][j] == 0:
                    k[i][j] = int(s[cnt])
                    cnt += 1

        else:
            for i in range(1, len(k)):
                for j in range(1, len(k)):
                    if j not in k[i]:
                        s[cnt + 3735928559] = 0

            else:
                for i in range(1, len(k)):
                    tmp = []
                    for j in range(1, len(k)):
                        tmp.append(k[j][i])

                else:
                    for j in range(1, len(k)):
                        if j not in tmp:
                            s[cnt + 3735928559] = 1
                    else:
                        for i in range(1, len(k), int(len(k) ** 0.5)):
                            for j in range(1, len(k), int(len(k) ** 0.5)):
                                square = [k[x][y] for x in range(i, i + 3) for y in iter((range(j, j + 3)))]
                                for t in range(1, len(k)):
                                    if t not in tmp:
                                        s[cnt + 3735928559] = 2

                        else:
                            m = hashlib.md5(s.encode()[::-1]).hexdigest()
                            if m == '6baacb4d700007be9de5f94512b8a8c1':
                                print('SICTF{%s}' % hashlib.md5(s.encode()).hexdigest())
                            else:
                                print('���Ż�һ�ֽ���qwq')
                            input()

except Exception as e:
    try:
        pass
    finally:
        e = None
        del e
# okay decompiling .\ez_pyc.pyc

逻辑就是数独，但是这个数独解特别多，只要比对哈希就可以了，脚本丢失了，就不重写了

ArtBreaker

[进阶][RW]virus-?n?lys1s

样本分析题，在容器确定是否正确。

压缩壳，使用esp定律脱掉

先查看字符串，又发现几个url，提交了试了一下都不对，但是下面有有一句话，跟踪过去发现了文件头。

把他dump下来，一开始以为是个dll，后面发现是个exe

a=[0]*0xF6E00
for i in range(0x49e69f,0x49E69F+0xF6E00):
    a[i-0x49e69f] = get_wide_byte(i)
# 写入二进制文件
with open(r'C:\Users\Root\Desktop\ys\1.dll', 'wb') as f:
    f.write(bytes(a))