ycdxsb CTF / writeup12 分钟 读完 (大约 1788 个字)  0次访问

5space 线下决赛部分 writeup

所以爱会消失对不对

babybrain#

比赛的时候用pin试了前几个9876还以为是坑，没坚持下去，我真tm脑残

step1 pin一下试试#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
import os
import sys
import subprocess

class Shell(object):
    def runCmd(self, cmd):
        res = subprocess.Popen(cmd, shell=True, stdin=subprocess.PIPE,
                               stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
        sout, serr = res.communicate()
        return res.returncode, sout, serr, res.pid

    def initPin(self, cmd):
        res = subprocess.Popen(cmd, shell=True, stdin=subprocess.PIPE,
                               stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
        self.res = res

    def pinWrite(self, input):
        self.res.stdin.write(input)

    def pinRun(self):
        sout, serr = self.res.communicate()
        return sout, serr

#cmd = './pin -t ./source/tools/ManualExamples/obj-intel64/inscount0.so -- ./Goodbye1_dump'

cmd = './pin -t ./source/tools/ManualExamples/obj-intel64/inscount0.so -- ./babybrain/bf babybrain/brain0'

shell = Shell()

s = ""
import string
chs=string.printable
length = 30
chs = string.digits
for i in range(length):
    max_num = 0
    max_ch = ""
    for ch in chs:
        tmp = s + ch +(length-len(s)-1)*'*'+'\n'
        shell.initPin(cmd)
        shell.pinWrite(tmp)
        sout,serr = shell.pinRun()
        with open('inscount.out') as f:
            count = f.readline().split(' ')[1]
        count = int(count)
        print(count,tmp,sout)
        if(count>max_num):
            max_num = count
            max_ch = ch
    s+=max_ch
    print(max_num,max_ch)
    print('flag:'+s)

用pin可以找到如下规律

1
2
3
4
(56705377, '9876114514********************\n', 'good\n')
(44776176, '9876114514114514**************\n', 'good\n')
(32847021, '9876114514114514114514********\n', 'good\n')
(20917774, '9876114514114514114514114514**\n', 'good\n')

也就是说9876(114514)[1,]是结果的规律，从题目看是一个payload同时过所有的brain，修改一下challenge找规律

step2 找规律#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/bin/env python3

import string
import subprocess
import hashlib

brain_num = 6

def md5(x):
    m = hashlib.md5()
    m.update(x)
    return m.hexdigest()

def check_brain(brain, thought):
    p = subprocess.run(["./bf", brain], input=(thought+'\n').encode(), stdout=subprocess.PIPE)
    r = p.stdout.strip()
    return r == b"good"

if __name__ == "__main__":
    #print("Do you know what a baby is thinking in his brain?")
    #print("If there are multiple answers, give me the shortest one.")
    #thought = input("> ").strip()
    #assert all(x in string.digits for x in thought)
    for _ in range(1,120):
        thought = '9876'+'114514'*_
        flag = True
        count = 0
        out = []
        for i in range(brain_num):
            #print("check",i)

            if not check_brain("brain%d"%i, thought):
                #print("wrong")
                flag = False
                out.append(0)
                #break
            else:
                out.append(1)
                count+=1
        print(_,out,count)
        if(flag):
            print("flag{%s}" % md5(thought.encode()))
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
1 [1, 0, 1, 0, 0, 0] 2
2 [1, 0, 0, 0, 0, 0] 1
3 [1, 1, 0, 0, 1, 0] 3
4 [1, 0, 0, 0, 0, 0] 1
5 [1, 0, 0, 0, 0, 0] 1
6 [1, 1, 0, 1, 0, 0] 3
7 [1, 0, 0, 0, 0, 0] 1
8 [1, 0, 1, 0, 0, 0] 2
9 [1, 1, 0, 0, 0, 0] 2
10 [1, 0, 0, 0, 0, 0] 1
11 [1, 0, 0, 0, 0, 0] 1
12 [1, 1, 0, 0, 0, 0] 2
13 [1, 0, 0, 0, 0, 0] 1
14 [1, 0, 0, 0, 0, 0] 1
15 [1, 1, 1, 0, 0, 0] 3
16 [1, 0, 0, 0, 1, 0] 2
17 [1, 0, 0, 1, 0, 0] 2
18 [1, 1, 0, 0, 0, 0] 2
19 [1, 0, 0, 0, 0, 0] 1
20 [1, 0, 0, 0, 0, 0] 1
21 [1, 1, 0, 0, 0, 0] 2
22 [1, 0, 1, 0, 0, 0] 2
23 [1, 0, 0, 0, 0, 0] 1
24 [1, 1, 0, 0, 0, 0] 2
25 [1, 0, 0, 0, 0, 0] 1
26 [1, 0, 0, 0, 0, 0] 1
27 [1, 1, 0, 0, 0, 0] 2
28 [1, 0, 0, 1, 0, 0] 2
29 [1, 0, 1, 0, 1, 0] 3
30 [1, 1, 0, 0, 0, 0] 2
31 [1, 0, 0, 0, 0, 0] 1
32 [1, 0, 0, 0, 0, 0] 1
33 [1, 1, 0, 0, 0, 0] 2
34 [1, 0, 0, 0, 0, 1] 2
35 [1, 0, 0, 0, 0, 0] 1
36 [1, 1, 1, 0, 0, 0] 3
37 [1, 0, 0, 0, 0, 0] 1
38 [1, 0, 0, 0, 0, 0] 1
39 [1, 1, 0, 1, 0, 0] 3
40 [1, 0, 0, 0, 0, 0] 1
41 [1, 0, 0, 0, 0, 0] 1
42 [1, 1, 0, 0, 1, 0] 3
43 [1, 0, 1, 0, 0, 0] 2
44 [1, 0, 0, 0, 0, 0] 1
45 [1, 1, 0, 0, 0, 0] 2
46 [1, 0, 0, 0, 0, 0] 1
47 [1, 0, 0, 0, 0, 0] 1
48 [1, 1, 0, 0, 0, 0] 2
49 [1, 0, 0, 0, 0, 0] 1
50 [1, 0, 1, 1, 0, 0] 3
51 [1, 1, 0, 0, 0, 0] 2
52 [1, 0, 0, 0, 0, 0] 1
53 [1, 0, 0, 0, 0, 0] 1
54 [1, 1, 0, 0, 0, 0] 2
55 [1, 0, 0, 0, 1, 0] 2
56 [1, 0, 0, 0, 0, 0] 1
57 [1, 1, 1, 0, 0, 0] 3
58 [1, 0, 0, 0, 0, 0] 1
59 [1, 0, 0, 0, 0, 0] 1
60 [1, 1, 0, 0, 0, 0] 2
61 [1, 0, 0, 1, 0, 0] 2
62 [1, 0, 0, 0, 0, 0] 1
63 [1, 1, 0, 0, 0, 0] 2
64 [1, 0, 1, 0, 0, 0] 2
65 [1, 0, 0, 0, 0, 0] 1
66 [1, 1, 0, 0, 0, 0] 2
67 [1, 0, 0, 0, 0, 0] 1
68 [1, 0, 0, 0, 1, 0] 2
69 [1, 1, 0, 0, 0, 0] 2
70 [1, 0, 0, 0, 0, 0] 1
71 [1, 0, 1, 0, 0, 1] 3
72 [1, 1, 0, 1, 0, 0] 3
73 [1, 0, 0, 0, 0, 0] 1
74 [1, 0, 0, 0, 0, 0] 1
75 [1, 1, 0, 0, 0, 0] 2
76 [1, 0, 0, 0, 0, 0] 1
77 [1, 0, 0, 0, 0, 0] 1
78 [1, 1, 1, 0, 0, 0] 3
79 [1, 0, 0, 0, 0, 0] 1
80 [1, 0, 0, 0, 0, 0] 1
81 [1, 1, 0, 0, 1, 0] 3
82 [1, 0, 0, 0, 0, 0] 1
83 [1, 0, 0, 1, 0, 0] 2
84 [1, 1, 0, 0, 0, 0] 2
85 [1, 0, 1, 0, 0, 0] 2
86 [1, 0, 0, 0, 0, 0] 1
87 [1, 1, 0, 0, 0, 0] 2
88 [1, 0, 0, 0, 0, 0] 1
89 [1, 0, 0, 0, 0, 0] 1
90 [1, 1, 0, 0, 0, 0] 2
91 [1, 0, 0, 0, 0, 0] 1
92 [1, 0, 1, 0, 0, 0] 2
93 [1, 1, 0, 0, 0, 0] 2
94 [1, 0, 0, 1, 1, 0] 3
95 [1, 0, 0, 0, 0, 0] 1
96 [1, 1, 0, 0, 0, 0] 2
97 [1, 0, 0, 0, 0, 0] 1
98 [1, 0, 0, 0, 0, 0] 1
99 [1, 1, 1, 0, 0, 0] 3
100 [1, 0, 0, 0, 0, 0] 1
101 [1, 0, 0, 0, 0, 0] 1
102 [1, 1, 0, 0, 0, 0] 2
103 [1, 0, 0, 0, 0, 0] 1
104 [1, 0, 0, 0, 0, 0] 1
105 [1, 1, 0, 1, 0, 0] 3
106 [1, 0, 1, 0, 0, 0] 2
107 [1, 0, 0, 0, 1, 0] 2
108 [1, 1, 0, 0, 0, 1] 3
109 [1, 0, 0, 0, 0, 0] 1
110 [1, 0, 0, 0, 0, 0] 1
111 [1, 1, 0, 0, 0, 0] 2
112 [1, 0, 0, 0, 0, 0] 1
113 [1, 0, 1, 0, 0, 0] 2
114 [1, 1, 0, 0, 0, 0] 2
115 [1, 0, 0, 0, 0, 0] 1
116 [1, 0, 0, 1, 0, 0] 2
117 [1, 1, 0, 0, 0, 0] 2
118 [1, 0, 0, 0, 0, 0] 1
119 [1, 0, 0, 0, 0, 0] 1

step3 CRT#

可以看到以下情况为1

1
2
3
4
5
6
brain0 1
brain1 3*i
brain2 1+7*i
brain3 6+11*i
brain4 3+13*i
brain5 34+37*i

这就是求一个crt了，求x满足以下条件即可

1
2
3
4
5
x % 3 == 0
x % 7 == 1
x % 11 == 6
x % 13 == 3
x % 37 == 34

结果为

1
2
sage: crt([0,1,6,3,34],[3,7,11,13,37])
54720
1
2
3
root@5c619b760e10:~/retools/pin/babybrain# python3 challenge.py
54720 [1, 1, 1, 1, 1, 1] 6
flag{b65acea9321f62a03d4b28fe689508c6}

rkey#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
flag=open("flag","r").read()
import os
import random
import hashlib
from Crypto.Util.number import bytes_to_long,long_to_bytes
from Crypto.Cipher import AES

def init(r):
    sl=[]
    for _ in range(624):
        x=os.urandom(4)
        sl.append(bytes_to_long(x))
    st = (3, tuple(sl + [0]), None)
    r.setstate(st)
    
def gsu(r):
    return r.getstate()[1][-1] % 624

def ss(r,sl,u):
    s = (3, tuple(sl + [u]), None)
    r.setstate(s)

def gsl(r):
    return r.getstate()[1][:-1]

def renc(r,rkey):
    sl=gsl(r)
    su=gsu(r)
    nsl=[]
    for i in sl:
        nsl.append(i^rkey)
    ss(r,nsl,su)


if __name__ == "__main__":
    init(random)
    for _ in range(624):
        print(random.getrandbits(32),end=",")
        renc(random,_%256)
    key=long_to_bytes(random.getrandbits(128))
    h=AES.new(key,AES.MODE_ECB)
    print(h.encrypt(flag.encode().zfill(48)).hex())

和普通的MT19937预测差别不大，只是题目中一直通过renc函数对state进行异或改变，所以异或恢复回来即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
from random import *

from Crypto.Util.number import bytes_to_long, long_to_bytes
from Crypto.Cipher import AES


def invert_right(m, l, val=''):
    length = 32
    mx = 0xffffffff
    if val == '':
        val = mx
    i, res = 0, 0
    while i*l < length:
        mask = (mx << (length-l) & mx) >> i*l
        tmp = m & mask
        m = m ^ tmp >> l & val
        res += tmp
        i += 1
    return res


def invert_left(m, l, val):
    length = 32
    mx = 0xffffffff
    i, res = 0, 0
    while i*l < length:
        mask = (mx >> (length-l) & mx) << i*l
        tmp = m & mask
        m ^= tmp << l & val
        res |= tmp
        i += 1
    return res


def invert_temper(m):
    m = invert_right(m, 18)
    m = invert_left(m, 15, 4022730752)
    m = invert_left(m, 7, 2636928640)
    m = invert_right(m, 11)
    return m


def clone_mt(record):
    state = [invert_temper(i) for i in record]
    gen = Random()
    gen.setstate((3, tuple(state+[0]), None))
    return gen


def init(r):
    sl = []
    for _ in range(624):
        x = os.urandom(4)
        sl.append(bytes_to_long(x))
    st = (3, tuple(sl + [0]), None)
    r.setstate(st)


def gsu(r):
    return r.getstate()[1][-1] % 624


def ss(r, sl, u):
    s = (3, tuple(sl + [u]), None)
    r.setstate(s)


def gsl(r):
    return r.getstate()[1][:-1]


def renc(r, rkey):
    sl = gsl(r)
    su = gsu(r)
    nsl = []
    for i in sl:
        nsl.append(i ^ rkey)
    ss(r, nsl, su)


with open('output', 'r') as f:
    numbers = f.readline().strip().split(',')
ciphertext = numbers[-1]
prng = list(map(int, numbers[:624]))

record = prng

state = [invert_temper(i) for i in record]
for i in range(624):
    for j in range(0, i):
        state[i] ^= (j % 256)
        
gen = Random()
gen.setstate((3, tuple(state+[0]), None))
g = gen
tmp = []
for i in range(624):
    tmp.append(g.getrandbits(32))
    renc(g, i % 256)
key = long_to_bytes(g.getrandbits(128))

print(ciphertext)
h = AES.new(key, AES.MODE_ECB)
print(h.decrypt(long_to_bytes(int(ciphertext, 16))))
# b'0000000000flag{5FSB8f5ZRwouow77tT09V4icpflf0AIg}'

crypto_linear#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
import random
#from secret import flag
from Crypto.Util.number import getPrime
from hashlib import sha256

N = 128
#assert flag.startswith(b"flag{")
#assert flag.endswith(b"}")
#assert sha256(flag.encode()).hexdigest() == 'cf8b3aa0b672218fa4c7b64eb82186b9d2d022f8faea2a1259e7c9fc5725c196'
flag = 'flag{'+'a'*32+'}'


def lfsr(R, mask):
    feedback = R & mask
    feed_bit = bin(feedback)[2:].count("1") & 1
    output_bit = R & 1
    state = (R >> 1) | (feed_bit << (N - 1))
    return state, output_bit


def gen_lcg(bit_length):
    m = getPrime(bit_length)
    a = random.randint(1, m)
    b = random.randint(1, m)
    return (a, b, m)


def next(state, a, b, m):
    return (a * state + b) % m


def leak(seed, a, b, m):
    state = seed
    for i in range(32):
        state = next(state, a, b, m)
        print(str(state >> 128))


def main():
    outputs = ''
    state = getPrime(N)
    print(state)
    mask = int(flag[5:-1], 16)
    assert mask.bit_length() == N
    for _ in range(237):
        state, output_bit = lfsr(state, mask)
        outputs += str(output_bit)
    seed = int(outputs, 2)
    a, b, m = gen_lcg(2*N)
    print(a)
    print(b)
    print(m)
    seed = next(seed, a, b, m)
    leak(seed, a, b, m)

main()
'''
197234424440462279706886095021989893603
14795840725848724233989125515381332891983447763911838803860161229073761165459
46856731968181268756048136355293380676858169739364057598770342358628231105837
75395323186914723695383746297731220829260297827914721397090336698050785547901
136252050295979513578524586196889171948
74159806199029176365391514660175453445
149009261329273670617645548606230622069
10804653241785352036362691068732736466
8301866905629821931833736018745870696
157855582728403457694964231929562653354
178027817844712429743828235794152230122
80034824078666750068565497570794144445
170373875544515217159377257439355857413
212173471024808766218767490865913392646
95467817412140832591838699989464945653
173475962624021238667335879772637670470
81228038826202736980181080253070973426
38517665965602217903989903052781616297
46317216313784340947138237859397553178
73480604487960250667527460166934447951
181632542873120638719727356775589934086
20942574859167575225267568077383208513
38652426910419634089323803603851872337
45320099645552147689201245689226315649
159381067221751927173322401473016180375
193506543095896556423712674109718555846
104424148854666757299886973298137655262
128843388729958406286436691041300045263
185545719480113124900452350138120090653
52962693230539519899467724304596006290
174467298993457220087453407135470977097
108748490990737778209782462542797272925
94970284329938606345438744396772890917
158383211690414095044606007624481697156
35675324836784472216060017492844885509
149209120676432244783142365900170210500
'''

从题目看到，先是一个lfsr，其中flag作为mask，将结果通过一个LCG隐藏

step1 LCG解seed#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
a = 14795840725848724233989125515381332891983447763911838803860161229073761165459
b = 46856731968181268756048136355293380676858169739364057598770342358628231105837
m = 75395323186914723695383746297731220829260297827914721397090336698050785547901

h = [0, 136252050295979513578524586196889171948,
     74159806199029176365391514660175453445,
     149009261329273670617645548606230622069,
     10804653241785352036362691068732736466,
     8301866905629821931833736018745870696,
     157855582728403457694964231929562653354,
     178027817844712429743828235794152230122,
     80034824078666750068565497570794144445,
     170373875544515217159377257439355857413,
     212173471024808766218767490865913392646,
     95467817412140832591838699989464945653,
     173475962624021238667335879772637670470,
     81228038826202736980181080253070973426,
     38517665965602217903989903052781616297,
     46317216313784340947138237859397553178,
     73480604487960250667527460166934447951,
     181632542873120638719727356775589934086,
     20942574859167575225267568077383208513,
     38652426910419634089323803603851872337,
     45320099645552147689201245689226315649,
     159381067221751927173322401473016180375,
     193506543095896556423712674109718555846,
     104424148854666757299886973298137655262,
     128843388729958406286436691041300045263,
     185545719480113124900452350138120090653,
     52962693230539519899467724304596006290,
     174467298993457220087453407135470977097,
     108748490990737778209782462542797272925,
     94970284329938606345438744396772890917,
     158383211690414095044606007624481697156,
     35675324836784472216060017492844885509,
     149209120676432244783142365900170210500]

for i in range(len(h)):
    h[i] <<= 128
A = [1]
B = [0]
for i in range(1, len(h)-1):
    A.append(a*A[i-1] % m)
    B.append((a*B[i-1]+a*h[i]+b-h[i+1]) % m)
print(A[1:])
print(B[1:])

M = matrix(ZZ, 33, 33)

for i in range(31):
    M[i, i] = m
    M[31, i] = A[i]
    M[32, i] = B[i]
    M[i, 31] = M[i, 32] = 0
M[31, 31] = 1
M[32, 32] = 2 ^ 128
M[31, 32] = 0
vl = M.LLL()[0]
l1 = vl[-2]
h1 = h[1]
s1 = l1+h1
s0 = ((s1 - b)*inverse_mod(a, m)) % m
seed = ((s0 - b)*inverse_mod(a, m)) % m
print(seed)
# 172249955599053439033078493520693122929584790340636422377323636607140227

step2 爆破恢复mask#

题目给出了237位结果，而我们要恢复mask的话需要256位结果才行爆破，2**19==524288还是可以接受的，在爆破出mask（即flag）后可以通过sha256进行筛选

ctfwiki方法#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from sage.all_cmdline import *
from hashlib import sha256
from tqdm import tqdm
GF2 = GF(2)


def pad(m):
    pad_length = 19 - len(m)
    return pad_length*'0' + m


seed = 172249955599053439033078493520693122929584790340636422377323636607140227
N = 128
# range(267150,267151)
for _ in tqdm(range(2**19)):
    a = bin(seed)[2:]
    a = a + pad(bin(_)[2:])
    #print(a, len(a))

    A = []
    for i in range(128):
        A.append([int(op) for op in a[i:i+128]])
    A = matrix(GF2, A)
    # print A.rank()
    if A.rank() != 128:
        continue
    last = a[128:]
    b = [int(op) for op in last]
    b = vector(GF2, b)

    mask = A.solve_right(b)
    sss = ''
    for x in range(128):
        sss += str(mask[x])
    sss = sss[::-1]
    mask = int(sss, 2)
    mask = hex(mask)
    flag = 'flag{' + mask[2:] + '}'
    if sha256(flag.encode()).hexdigest() == 'cf8b3aa0b672218fa4c7b64eb82186b9d2d022f8faea2a1259e7c9fc5725c196':
        print(flag)
        exit(0)
# flag{a53bde3404aaab1dbb8412542eede2ef}
BM算法#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
from tqdm import tqdm
from hashlib import sha256
# https://raw.github.com/bozhu/BMA/master/bma.py
def Berlekamp_Massey_algorithm(sequence):
    N = len(sequence)
    s = sequence[:]

    for k in range(N):
        if s[k] == 1:
            break
    f = set([k + 1, 0])  # use a set to denote polynomial
    l = k + 1

    g = set([0])
    a = k
    b = 0

    for n in range(k + 1, N):
        d = 0
        for ele in f:
            d ^= s[ele + n - l]

        if d == 0:
            b += 1
        else:
            if 2 * l > n:
                f ^= set([a - b + ele for ele in g])
                b += 1
            else:
                temp = f.copy()
                f = set([b - a + ele for ele in f]) ^ g
                l = n + 1 - l
                g = temp
                a = b
                b = n - l + 1

    # output the polynomial
    def print_poly(polynomial):
        lis = sorted(polynomial, reverse=True)
        mask = [0]*(lis[0])
        for i in lis[1:]:
            mask[i] = 1
        mask = "".join(list(map(str, mask)))
        mask = mask[::-1]
        return int(mask,2)

    return (print_poly(f), l)

N = 128


if __name__ == '__main__':
    #seq = (0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0)
    seq = 172249955599053439033078493520693122929584790340636422377323636607140227
    seq = bin(seq)[2:]

    for i in tqdm(range(2**19)):
        out = seq + bin(i)[2:].zfill(19)
        out = list(map(int, list(out)))
        (mask, span) = Berlekamp_Massey_algorithm(out)
        mask = hex(mask)
        flag = 'flag{' + mask[2:] + '}'
        if sha256(flag.encode()).hexdigest() == 'cf8b3aa0b672218fa4c7b64eb82186b9d2d022f8faea2a1259e7c9fc5725c196':
            print(flag)
            exit(0)

参考资料#

#

喜欢这篇文章？打赏一下作者吧

评论

关注我

链接

归档

订阅更新

邮件订阅，更新早知道

分类

最新文章

标签

AI2
CTF48
CVE4
Fuzz1
FuzzingBook1
HEVD5
NLP1
PyQt512
ROP Emporium2
Toddler's Bottle21
Web1
automatic analyse10
binary analyse1
codeql5
crypto7
fuzz3
life2
linux kernel2
machine learning1
mobile security1
others1
paper18
pentest3
pwn24
pwnable.kr21
re5
research20
security18
security situation awareness2
stack overflow3
tools2
windows8
work1
writeup5
数据库11
×