CatCTFwp

NepnepxCATCTF 部分题解

by 没有眼的鱼

Reverse

The cat did it

脑筋急转弯

image-20230101210628524

问概率,首先排除直接算。选择看图像。

image-20230101210749364

缩小,发现一直在猫的内部,所以逃出去的概率是0%

1
CatCTF{md5(0%)}

StupidOrangeCat2

32位程序。打开文件,发现是个迷宫游戏

image-20230101204938711

似乎直接走就行了

image-20230101205026641

猜测是摩斯电码

喵是-,呜是.,对照码表翻译过来就是

1
CAT_IN_X_19_Y_39

image-20230101205216579

走到了之后提示要找key,IDA接管调试

尝试输入

image-20230101205359528

发现进到这个函数里面

image-20230101210042985

v6里面存的就是你的输入,v4是输出,v8是key

最后v4会和v5做比较

image-20230101210240285

就一个加密,直接写脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#include <iostream>
#include <Windows.h>
#include <cstring>

using namespace std;

unsigned long key[] = {
0x155E79F0, 0xF93946E8, 0x010E2D06, 0xC3BDE00F, 0x2918C682, 0xFBEA4880, 0xC521250E, 0x581CA38F,
0xDDD24F01, 0xFE861597, 0x4ED29058, 0xFC407DE8, 0x58AAAFE1, 0x7FD7D1CB, 0x26344632, 0x1BC00784,
0x554DECDB, 0x43688970, 0x552A77BA, 0xB1A0477B, 0xE4AED7C8, 0xE8731836, 0x035B1B59, 0x8F0577FF,
0x300327A4, 0x11A38C30, 0xCCCCCCCC, 0xCCCCCCCC
};

int main(){
unsigned long flag[] = {
0x936AB12C, 0xED8330B5, 0xEE5C5E88, 0xE10B508C
};

for (int j = 0; j < 4; j+=2) {
unsigned long x1 = flag[j];
unsigned long x2 = flag[j+1];
for(int i = 12; i >= 1; i--) {
unsigned long t1 = (x1 & (0x1F));
x2 = x2 - key[2*i+1];
x2 = (x2 << (0x20-t1)) | (x2 >> t1);
x2 = x2 ^ x1;

unsigned long t2 = (x2 & (0x1F));
x1 = x1 - key[2*i];
x1 = (x1 << (0x20-t2)) | (x1 >> t2);
x1 = x1 ^ x2;
}
x1 -= key[0];
x2 -= key[1];
string enc = "";
for(int i = 0; i < 4; i++) {
char c = x2 & 0xff;
enc = c + enc;
x2 = x2 >> 8;
}

for(int i = 0; i < 4; i++) {
char c = x1 & 0xff;
enc = c + enc;
x1 = x1 >> 8;
}
cout << enc;
}
}
1
LIKE_OR_LOVE_CAT

image-20230101210416211

答案正确,走出去就行了

image-20230101210514264

1
CatCTF{CAT_IN_X_19_Y_39_LIKE_OR_LOVE_CAT}