{"id":36,"date":"2026-04-14T15:14:45","date_gmt":"2026-04-14T07:14:45","guid":{"rendered":"https:\/\/www.seekinthevortex.cn\/?p=36"},"modified":"2026-04-14T15:14:45","modified_gmt":"2026-04-14T07:14:45","slug":"2025-%e7%be%8a%e5%9f%8e%e6%9d%af-2","status":"publish","type":"post","link":"https:\/\/www.seekinthevortex.cn\/index.php\/2026\/04\/14\/2025-%e7%be%8a%e5%9f%8e%e6%9d%af-2\/","title":{"rendered":"2025 \u7f8a\u57ce\u676f"},"content":{"rendered":"

GD1<\/h1>\n

godot\u5f15\u64ce\u5f00\u53d1\u7684\u6e38\u620f
\n\u4e0a\u7f51\u4e0a\u4e0b\u8f7d\u4e00\u4e2a\u5de5\u5177\u5c31\u80fd\u53cd\u7f16\u8bd1\u8d44\u6e90,\u5c31\u4e0d\u7ec6\u8bf4\u4e86.<\/p>\n

PLUS<\/h1>\n

\u9996\u5148\u89c2\u5bdf\u5230\u7a0b\u5e8f,\u7ed9\u4e86\u6211\u4eec\u4e00\u4e2ainit.pyd\u6587\u4ef6\u548c\u4e00\u4e2a\u7ecf\u8fc7\u4e86\u6df7\u6dc6\u7684\u4ee3\u7801.
\n\u9996\u5148\u53ef\u4ee5\u5316\u7b80\u4ee3\u7801\u7684\u8868\u8fbe\u5f0f,\u8ba9\u4ee3\u7801\u53d8\u5f97\u66f4\u52a0\u5bb9\u6613\u8bfb\u4e00\u4e9b(\u4f46\u662f\u8fd9\u91cc\u8fd0\u884c\u4e0d\u4e86…\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48…).<\/p>\n

m(exec(3214),955,926)(e)\nm(exec(3132),999,691)(e)\nm(exec(4020),955,exec(50720),)(e)\nm(exec(3635),44,591)(e)\nm(exec(4020),1036, i(exec(9578)).encode())(e)\nm(exec(3635),39,1036)(e)\nm(exec(3635),43,44)(e)\nm(exec(3635),40,7)(e)\nm(exec(3311), 955, 972)(e)\np(exec(1334)) if (b(m(exec(3637), 1036, 44)(e)).decode() == exec(28274)) else p(exec(3113)) #type:ignore\n<\/code><\/pre>\n
\u53ef\u4ee5\u53d1\u73b0\u9891\u7e41\u8c03\u7528\u4e86\u4e00\u4e9b\u5947\u602a\u7684\u4e1c\u897f,\u57fa\u672c\u4e0a\u53ef\u4ee5\u731c\u6d4b\u662finit.pyd\u4e2d\u7684\u4e1c\u897f
\n\u501f\u7528python\u7684\u6a21\u5757\u5206\u6790\u4e00\u4e0binti.pyd,\u4fbf\u4e8e\u6211\u4eec\u5206\u6790.
\ninit\u76f8\u5f53\u4e8e\u5c31\u662f\u4e00\u4e2aclass,\u6211\u4eec\u8c03\u7528\u7684\u5c31\u662f\u5b83\u7684\u6210\u5458\u51fd\u6570<\/p>\n
import init\n\nprint(help(init)) # \u663e\u793a\u6a21\u5757\u4e2d\u51fd\u6570\u7684\u76f8\u5173\u4fe1\u606f\nprint(dir(init))  # \u663e\u793a\u6a21\u5757\u4e2d\u7684\u5bfc\u51fa\u51fd\u6570\n<\/code><\/pre>\n
(py3.9) PS D:\\Microsoftdownload\\9a25567db24384ae94d40bf325c53792\\tempdir\\REVERSE\u9644\u4ef6\\chal\\chal>python .\\plus_simplified.py\nHelp on module init:\n\nNAME\n    init\n\nFUNCTIONS\n    a2b_hex(hexstr, \/)\n        Binary data of hexadecimal representation.\n\n        hexstr must contain an even number of hex digits (upper or lower case).\n        This function is also available as "unhexlify()".\n\n    exec(x)\n\n    exit = eval(source, globals=None, locals=None, \/)\n        Evaluate the given source in the context of globals and locals.\n\n        The source may be a string representing a Python expression\n        or a code object as returned by compile().\n        The globals must be a dictionary and locals can be any mapping,\n        defaulting to the current globals and locals.\n        If only globals is given, locals defaults to it.\n\n    i = input(prompt=None, \/)\n        Read a string from standard input.  The trailing newline is stripped.\n\n        The prompt string, if given, is printed to standard output without a\n        trailing newline before reading input.\n\n        If the user hits EOF (*nix: Ctrl-D, Windows: Ctrl-Z+Return), raise EOFError.\n        On *nix systems, readline is used if available.\n\n    p = print(...)\n        print(value, ..., sep=' ', end='\\n', file=sys.stdout, flush=False)\n\n        Prints the values to a stream, or to sys.stdout by default.\n        Optional keyword arguments:\n        file:  a file-like object (stream); defaults to the current sys.stdout.\n        sep:   string inserted between values, default a space.\n        end:   string appended after the last value, default a newline.\n        flush: whether to forcibly flush the stream.\n\nDATA\n    __test__ = {}\n    e = <unicorn.unicorn_py3.arch.intel.UcIntel object>\n\nFILE\n    d:\\microsoftdownload\\9a25567db24384ae94d40bf325c53792\\tempdir\\reverse\u9644\u4ef6\\chal\\chal\\init.pyd\n\nNone\n['__builtins__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__spec__', '__test__', 'a2b_hex', 'b', 'c', 'e', 'exec', 'exit', 'i', 'int', 'm', 'p']\n<\/code><\/pre>\n
\u901a\u8fc7file init.pyd<\/code>\u53ef\u4ee5\u67e5\u770b\u8fd9\u4e2a\u6587\u4ef6\u7684\u5c5e\u6027,\u8bf4\u660e\u662f\u5728Windows\u4e0apyd\u6587\u4ef6,\u76f8\u5f53\u4e8e\u52a8\u6001\u94fe\u63a5\u5e93<\/p>\n
\u276f file init.pyd\ninit.pyd: PE32+ executable (DLL) (GUI) x86-64, for MS Windows\n<\/code><\/pre>\n
\u63a5\u4e0b\u6765\u901a\u8fc7hook\u65b9\u6cd5\u6765\u67e5\u770b,\u628a\u4e0b\u9762\u8fd9\u6bb5\u4ee3\u7801\u52a0\u5230\u4ee3\u7801\u524d<\/p>\n
from init import *\nimport init\n\noriginals = {}\n\nfor name in ['exec', 'i', 'p', 'b', 'a2b_hex']:\n    if hasattr(init, name): # \u68c0\u67e5init\u4e2d\u662f\u5426\u6709\u5217\u8868\u4e2d\u5bf9\u5e94\u7684\u5c5e\u6027\n        ori = getattr(init, name) # \u5982\u679c\u6709,\u5c31\u4fdd\u5b58\u5230originals\u4e2d\n        originals[name] = ori\n\n        # \u6784\u5efahook\u51fd\u6570\n        def make_hook(fn_name, fn_original):\n            # \u56e0\u4e3a\u6211\u4eec\u4e0d\u77e5\u9053\u53c2\u6570\u662f\u4ec0\u4e48\u6837\u7684,\u6240\u4ee5\u6211\u4eec\u8fd9\u6837\u5199\n            def wrapper(*args, **kwargs):\n                print(f"[{fn_name}] args: {args}")\n                res = fn_original(*args, **kwargs)\n                print(f"[{fn_name}] args: {res}")\n                return res\n            return wrapper\n        \n        globals()[name] = make_hook(name, ori)\n<\/code><\/pre>\n
[exec] args: (30792292888306032,)\n[exec] args: mem_map\n[exec] args: (30792292888306032,)\n[exec] args: mem_map\n[exec] args: (2018003706771258569829,)\n[exec] args: mem_write\n[exec] args: (2154308209104587365050518702243508477825638429417674506632669006169365944097218288620502508770072595029515733547630393909115142517795439449349606840082096284733042186109675198923974401239556369486310477745337218358380860128987662749468317325542233718690074933730651941880380559453,)\n[exec] args: b'\\xf3\\x0f\\x1e\\xfaUH\\x89\\xe5H\\x89}\\xe8\\x89u\\xe4\\x89\\xd0\\x88E\\xe0\\xc7E\\xfc\\x00\\x00\\x00\\x00\\xebL\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x00\\x8d\\x0c\\xc5\\x00\\x00\\x00\\x00\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x002E\\xe0\\x8d4\\x01\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x00\\xc1\\xe0\\x05\\x89\\xc1\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x8d\\x14\\x0e\\x88\\x10\\x83E\\xfc\\x01\\x8bE\\xfc;E\\xe4r\\xac\\x90\\x90]'\n[exec] args: (2110235738289946063973,)\n[exec] args: reg_write\n[exec] args: (2018003706771258569829,)\n[exec] args: mem_write\n[exec] args: (520485229507545392928716380743873332979750615584,)\n[exec] args: [+]input your flag:\n[i] args: ('[+]input your flag: ',)\n[+]input your flag: 11112222\n[i] args: 11112222\n[exec] args: (2110235738289946063973,)\n[exec] args: reg_write\n[exec] args: (2110235738289946063973,)\n[exec] args: reg_write\n[exec] args: (2110235738289946063973,)\n[exec] args: reg_write\n[exec] args: (1871008466716552426100,)\n[exec] args: emu_start\n[exec] args: (7882826979490488676,)\n[exec] args: mem_read\n[b] args: (bytearray(b'\\xde\\xde\\xde\\xde\\x05\\x05\\x05\\x05\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07\\x07'),)\n[b] args: b'3t7e3gUFBQUHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc='\n[exec] args: (636496797464929889819018589958474261894226380884858896837050849823120096559828809884712107801783610237788137002972622711849132377866432975817021,)\n[exec] args: 425MvHMxtLqZ3ty3RZkw3mwwulNRjkswbpkDMK+3CDCOtbe6kzAqPyrcEAI=\n[exec] args: (31084432670685473,)\n[exec] args: no way!\n[p] args: ('no way!',)\nno way!\n[p] args: None\n<\/code><\/pre>\n
\u53d1\u73b0\u4e86\u5173\u952e\u7684\u4e24\u6bb5\u6570\u636e<\/p>\n
[exec] args: b'\\xf3\\x0f\\x1e\\xfaUH\\x89\\xe5H\\x89}\\xe8\\x89u\\xe4\\x89\\xd0\\x88E\\xe0\\xc7E\\xfc\\x00\\x00\\x00\\x00\\xebL\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x00\\x8d\\x0c\\xc5\\x00\\x00\\x00\\x00\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x002E\\xe0\\x8d4\\x01\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x0f\\xb6\\x00\\xc1\\xe0\\x05\\x89\\xc1\\x8bU\\xfcH\\x8bE\\xe8H\\x01\\xd0\\x8d\\x14\\x0e\\x88\\x10\\x83E\\xfc\\x01\\x8bE\\xfc;E\\xe4r\\xac\\x90\\x90]'\n[exec] args: 425MvHMxtLqZ3ty3RZkw3mwwulNRjkswbpkDMK+3CDCOtbe6kzAqPyrcEAI=\n<\/code><\/pre>\n
\u53cd\u6c47\u7f16\u4e0a\u9762\u7684\u5b57\u8282\u7801,\u53ef\u4ee5\u53d1\u73b0\u5c31\u662f\u4e00\u6bb5\u52a0\u5bc6
\n\u800c\u4e0b\u9762\u7684base64\u5e94\u8be5\u5c31\u662f\u5bc6\u6587<\/p>\n
void __fastcall __noreturn encode(__int64 a, unsigned int range, char key)\n{\n   unsigned int i; \/\/ [rsp+1Ch] [rbp-4h]\n\n    for ( i = 0; i < range; ++i )\n        a[i] = 8 * a[i] + (key ^ a[i]) + 32 * a[i];\n}\n<\/code><\/pre>\n
\u63a5\u4e0b\u6765\u5c31\u53ef\u4ee5\u7f16\u5199\u89e3\u5bc6\u4ee3\u7801\u4e86,\u4f46\u662f\u56e0\u4e3akey\u4e0d\u77e5\u9053,\u9700\u8981\u7206\u7834\u4e00\u4e0b<\/p>\n
cipher = [\n    0xe3,0x6e,0x4c,0xbc,0x73,0x31,0xb4,0xba,0x99,0xde,0xdc,0xb7,0x45,0x99,0x30,0xde,\n    0x6c,0x30,0xba,0x53,0x51,0x8e,0x4b,0x30,0x6e,0x99,0x03,0x30,0xaf,0xb7,0x08,0x30,\n    0x8e,0xb5,0xb7,0xba,0x93,0x30,0x2a,0x3f,0x2a,0xdc,0x10,0x02\n]\n\ndef decrypt_with_key(enc_bytes, key):\n    """\n    \u7528\u7ed9\u5b9a\u5bc6\u94a5\u7206\u7834\u89e3\u5bc6\n    """\n    plain = []\n    for c in enc_bytes:\n        bruteforce = [orig for orig in range(256) if ((40 * orig + (key ^ orig)) & 0xff) == c]\n        if not bruteforce:\n            return None\n        printable = [c for c in bruteforce if 32 <= c <= 126]\n        chosen = printable[0] if printable else bruteforce[0]\n        plain.append(chosen)\n    return bytes(plain)\n\ndef main():\n    # \u7206\u7834key\n    for key in range(256):\n        pt = decrypt_with_key(cipher, key)\n        if pt is None:\n            continue\n        # \u5df2\u77e5\u660e\u6587\u5f00\u5934\u662f "DASCTF"\n        if pt.startswith(b"DASCTF"):\n            print("Found key:", key)\n            try:\n                print("Plaintext:", pt.decode('utf-8'))\n            except UnicodeDecodeError:\n                # \u82e5\u5305\u542b\u975e UTF-8 \u5b57\u7b26\uff0c\u663e\u793a repr\n                print("Plaintext (repr):", repr(pt))\n            break\n    else:\n        print("No key found that yields prefix 'DASCTF'.")\n\nif __name__ == "__main__":\n    main()\n<\/code><\/pre>\n
flag:DASCTF{un1c0rn_1s_u4fal_And_h0w_ab0ut_exec?}<\/code><\/p>\n
Key<\/h1>\n
\u4ee3\u7801\u5206\u6790<\/h2>\n
\u770b\u5230\u9644\u4ef6\u4e2d\u7ed9\u4e86key.exe\u548csrc.py
\nsrc.py\u662f\u88abparamor\u4fdd\u62a4\u4e86\u7684\u7a0b\u5e8f<\/p>\n
\u5148\u7528pyinstxtracotr.py\u89e3\u5305\u4e00\u4e0bkey.exe,\u518d\u7528pycdc\u53cd\u7f16\u8bd1\u4e00\u4e0bkey.pyc.
\n\u4f46\u662f\u5947\u602a\u7684\u4f1a\u53d1\u73b0\u4f1a\u53cd\u7f16\u8bd1\u5931\u8d25,\u8bf4\u662f\u9b54\u672f\u5934\u8bc6\u522b\u8d25,\u770b\u4e86\u4e00\u4e0b\u662fpy3.13,\u6000\u7591\u662fpycdc\u7248\u672c\u592a\u4f4e,\u6240\u4ee5\u91cd\u65b0clone\u7f16\u8bd1\u4e86\u4e00\u4e0b,\u8fd9\u4e0b\u6ca1\u95ee\u9898,\u4f46\u662f\u8fd8\u662f\u6ca1\u529e\u6cd5\u5168\u90e8\u7f16\u8bd1.<\/p>\n
\u6ca1\u529e\u6cd5\u53ea\u80fd\u7528pycdas\u770b\u5b57\u8282\u7801\u4e86,\u53ef\u4ee5\u8ba9ai\u5e2e\u6211\u4eec\u6062\u590d\u51fa\u5927\u6982\u7684\u51fd\u6570\u903b\u8f91(ai\u592a\u597d\u7528\u4e86\u4f60\u77e5\u9053\u5417).<\/p>\n
import ast\nimport types\nimport sys\n\n# \u76ee\u6807\u52a0\u5bc6\u7ed3\u679c\uff08\u9700\u8981\u5339\u914d\u7684\u503c\uff09\no0o0o0 = [105084753, 3212558540, 351342182, 844102737, 2002504052, \n          356536456, 2463183122, 615034880, 1156203296]\n\n\ndef changli(o0o0o1, o0o0o2, o0o0o3):\n    """TEA\u52a0\u5bc6\u7b97\u6cd5\u7684\u4e00\u8f6e"""\n    o0o0o4 = 2269471011  # delta\u503c\n    o0o0o5 = o0o0o3 & 0xFFFFFFFF\n    o0o0o6 = ((o0o0o3 >> 8) ^ 305419896) & 0xFFFFFFFF\n    o0o0o7 = ((o0o0o3 << 4) ^ 2271560481) & 0xFFFFFFFF\n    o0o0o8 = ((o0o0o3 >> 12) ^ 2882400000) & 0xFFFFFFFF\n    \n    o0o0o9 = o0o0o1 & 0xFFFFFFFF\n    o0o0o10 = o0o0o2 & 0xFFFFFFFF\n    o0o0o11 = 0\n    \n    # 32\u8f6e\u52a0\u5bc6\n    for _ in range(32):\n        o0o0o11 = (o0o0o11 + o0o0o4) & 0xFFFFFFFF\n        o0o0o9 = (o0o0o9 + (((o0o0o10 << 4) + o0o0o5) ^ (o0o0o10 + o0o0o11) ^ \n                  ((o0o0o10 >> 4) + o0o0o6))) & 0xFFFFFFFF\n        o0o0o10 = (o0o0o10 + (((o0o0o9 << 4) + o0o0o7) ^ (o0o0o9 + o0o0o11) ^ \n                   ((o0o0o9 >> 4) + o0o0o8))) & 0xFFFFFFFF\n    \n    return (o0o0o9, o0o0o10)\n\n\ndef Shorekeeper(o0o0o12):\n    """\u5c0632\u4f4d\u6570\u5b57\u62c6\u5206\u4e3a\u9ad816\u4f4d\u548c\u4f4e16\u4f4d"""\n    o0o0o13 = o0o0o12 >> 16\n    o0o0o14 = o0o0o12 & 65535\n    return (o0o0o13, o0o0o14)\n\n\ndef Kathysia(o0o0o15, o0o0o16):\n    """\u5c06\u4e24\u4e2a16\u4f4d\u6570\u5b57\u5408\u5e76\u4e3a32\u4f4d\u6570\u5b57"""\n    return (o0o0o15 << 16) | (o0o0o16 + 0)\n\n\ndef Phrolova(o0o0o17):\n    """\u52a8\u6001\u751f\u6210Carlotta\u51fd\u6570\uff08\u5305\u542b\u6df7\u6dc6\u4ee3\u7801\uff09"""\n    o0oA = "Carlotta"\n    o0oB = ['o0oC', 'o0oD', 'o0oE', 'o0oF']\n    o0oG = []\n    \n    # \u6784\u5efa\u51fd\u6570\u4f53\uff08\u5305\u542b\u4e00\u4e9b\u8ff7\u60d1\u6027\u7684\u8ba1\u7b97\uff09\n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oH", ctx=ast.Store())],\n        value=ast.Constant(value=305419896)\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oI", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.Name(id="o0oE", ctx=ast.Load()),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oJ", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.Name(id="o0oE", ctx=ast.Load()),\n                op=ast.RShift(),\n                right=ast.Constant(value=16)\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oK", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.Name(id="o0oE", ctx=ast.Load()),\n                op=ast.BitXor(),\n                right=ast.Name(id="o0oF", ctx=ast.Load())\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oL", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.Name(id="o0oE", ctx=ast.Load()),\n                    op=ast.RShift(),\n                    right=ast.Constant(value=8)\n                ),\n                op=ast.BitXor(),\n                right=ast.Name(id="o0oF", ctx=ast.Load())\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oM", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.Name(id="o0oH", ctx=ast.Load()),\n                    op=ast.Mult(),\n                    right=ast.BinOp(\n                        left=ast.Name(id="o0oF", ctx=ast.Load()),\n                        op=ast.Add(),\n                        right=ast.Constant(value=1)\n                    )\n                ),\n                op=ast.BitAnd(),\n                right=ast.Constant(value=4294967295)\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=4294967295)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oN", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.BinOp(\n                        left=ast.Name(id="o0oD", ctx=ast.Load()),\n                        op=ast.LShift(),\n                        right=ast.Constant(value=5)\n                    ),\n                    op=ast.Add(),\n                    right=ast.Name(id="o0oI", ctx=ast.Load())\n                ),\n                op=ast.BitXor(),\n                right=ast.BinOp(\n                    left=ast.Name(id="o0oD", ctx=ast.Load()),\n                    op=ast.Add(),\n                    right=ast.Name(id="o0oM", ctx=ast.Load())\n                )\n            ),\n            op=ast.BitXor(),\n            right=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.Name(id="o0oD", ctx=ast.Load()),\n                    op=ast.RShift(),\n                    right=ast.Constant(value=5)\n                ),\n                op=ast.Add(),\n                right=ast.Name(id="o0oJ", ctx=ast.Load())\n            )\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oP", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.Name(id="o0oC", ctx=ast.Load()),\n                op=ast.Add(),\n                right=ast.Name(id="o0oN", ctx=ast.Load())\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oN", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.BinOp(\n                        left=ast.Name(id="o0oP", ctx=ast.Load()),\n                        op=ast.LShift(),\n                        right=ast.Constant(value=5)\n                    ),\n                    op=ast.Add(),\n                    right=ast.Name(id="o0oK", ctx=ast.Load())\n                ),\n                op=ast.BitXor(),\n                right=ast.BinOp(\n                    left=ast.Name(id="o0oP", ctx=ast.Load()),\n                    op=ast.Add(),\n                    right=ast.Name(id="o0oM", ctx=ast.Load())\n                )\n            ),\n            op=ast.BitXor(),\n            right=ast.BinOp(\n                left=ast.BinOp(\n                    left=ast.Name(id="o0oP", ctx=ast.Load()),\n                    op=ast.RShift(),\n                    right=ast.Constant(value=5)\n                ),\n                op=ast.Add(),\n                right=ast.Name(id="o0oL", ctx=ast.Load())\n            )\n        )\n    ))\n    \n    o0oG.append(ast.Assign(\n        targets=[ast.Name(id="o0oQ", ctx=ast.Store())],\n        value=ast.BinOp(\n            left=ast.BinOp(\n                left=ast.Name(id="o0oD", ctx=ast.Load()),\n                op=ast.Add(),\n                right=ast.Name(id="o0oN", ctx=ast.Load())\n            ),\n            op=ast.BitAnd(),\n            right=ast.Constant(value=65535)\n        )\n    ))\n    \n    o0oG.append(ast.Return(\n        value=ast.Tuple(\n            elts=[\n                ast.Name(id="o0oP", ctx=ast.Load()),\n                ast.Name(id="o0oQ", ctx=ast.Load())\n            ],\n            ctx=ast.Load()\n        )\n    ))\n    \n    # \u521b\u5efa\u51fd\u6570\u5b9a\u4e49\n    o0oU = ast.FunctionDef(\n        name=o0oA,\n        args=ast.arguments(\n            posonlyargs=[],\n            args=[ast.arg(arg=a) for a in o0oB],\n            kwonlyargs=[],\n            kw_defaults=[],\n            defaults=[]\n        ),\n        body=o0oG,\n        decorator_list=[]\n    )\n    \n    # \u6dfb\u52a0\u4e00\u4e9b\u8ff7\u60d1\u6027\u7684\u51fd\u6570\uff08\u4e0d\u5f71\u54cd\u5b9e\u9645\u903b\u8f91\uff09\n    o0oV = ast.parse("""\ndef _tea_helper_func(a, b, c):\n    magic1 = (a ^ b) & 0xDEADBEEF\n    magic2 = (c << 3) | (a >> 5)\n    return (magic1 + magic2 - (b & 0xCAFEBABE)) & 0xFFFFFFFF\n\ndef _fake_tea_round(x, y):\n    return ((x * 0x9E3779B9) ^ (y + 0x12345678)) & 0xFFFFFFFF\n\n_tea_magic_delta = 0x9E3779B9 ^ 0x12345678\n_tea_dummy_keys = [0x1111, 0x2222, 0x3333, 0x4444]\n""").body\n    \n    # \u521b\u5efa\u6a21\u5757\n    o0oW = ast.Module(body=[o0oU] + o0oV, type_ignores=[])\n    ast.fix_missing_locations(o0oW)\n    \n    # \u7f16\u8bd1\u5e76\u6267\u884c\n    o0oX = compile(o0oW, filename="<tea_obf_ast>", mode="exec")\n    o0oY = {}\n    exec(o0oX, o0oY)\n    \n    # \u5c06\u51fd\u6570\u6dfb\u52a0\u5230\u5168\u5c40\u547d\u540d\u7a7a\u95f4\n    if o0oA in o0oY:\n        o0o0o17[o0oA] = o0oY[o0oA]\n\n\ndef shouan(o0o0o32):\n    """\u4e3b\u5904\u7406\u903b\u8f91"""\n    if len(o0o0o32) != 9:\n        raise ValueError("\u9700\u8981\u8f93\u51659\u4e2akey")\n    \n    o0o0o35 = []\n    \n    # \u5bf9\u6bcf\u4e2akey\u8fdb\u884c\u5904\u7406\n    for o0o0o49, o0o0o34 in enumerate(o0o0o32):\n        o0o0o33 = o0o0o49 * o0o0o49  # i * i\n        \n        # \u62c6\u5206\u4e3a\u9ad8\u4f4e16\u4f4d\n        o0o0o36, o0o0o37 = Shorekeeper(o0o0o34)\n        \n        # \u4f7f\u7528Carlotta\u51fd\u6570\u5904\u7406\n        o0o0o38, o0o0o39 = Carlotta(o0o0o36, o0o0o37, o0o0o49 + 2025, o0o0o33)\n        \n        # \u5408\u5e76\u7ed3\u679c\n        o0o0o40 = Kathysia(o0o0o38, o0o0o39)\n        o0o0o35.append(o0o0o40)\n    \n    o0o0o41 = []\n    \n    # \u5bf9\u76f8\u90bb\u7684\u503c\u8fdb\u884cTEA\u52a0\u5bc6\n    for i in range(8):\n        o0o0o35[i], o0o0o35[i + 1] = changli(o0o0o35[i], o0o0o35[i + 1], 2025)\n        o0o0o41.append(o0o0o35[i])\n    \n    o0o0o41.append(o0o0o35[8])\n    \n    return o0o0o41\n\n\ndef jinhsi():\n    """\u4e3b\u5165\u53e3\u51fd\u6570"""\n    print("\u8bf7\u8f93\u51659\u4e2a\u6570\u5b57:")\n    \n    try:\n        o0o0o46 = input().strip()\n        \n        # \u89e3\u6790\u8f93\u5165\n        if "," in o0o0o46:\n            o0o0o42 = o0o0o46.split(",")\n        else:\n            o0o0o42 = o0o0o46.split()\n        \n        if len(o0o0o42) != 9:\n            print("\u9519\u8bef: \u9700\u8981\u8f93\u51659\u4e2a\u6570")\n            return\n        \n        o0o0o43 = []\n        for o0o0o44 in o0o0o42:\n            try:\n                o0o0o45 = int(o0o0o44.strip())\n                o0o0o43.append(o0o0o45)\n            except ValueError:\n                print(f"\u9519\u8bef: '{o0o0o44}' \u4e0d\u662f\u6709\u6548\u7684\u6574\u6570")\n                return\n        \n        # \u5904\u7406\u8f93\u5165\u5e76\u9a8c\u8bc1\n        o0o0o48 = shouan(o0o0o43)\n        \n        if o0o0o48 == o0o0o0:\n            print("\u6b63\u786e!\u8fd9\u662f\u771f\u6b63\u7684key")\n            sys.exit(0)\n        else:\n            print("\u9519\u8bef!\u8fd9\u4e0d\u662f\u6b63\u786e\u7684key")\n            print(f"\u4f60\u7684\u7ed3\u679c: {o0o0o48}")\n            sys.exit(0)\n            \n    except Exception as o0o0o47:\n        print(f"\u53d1\u751f\u9519\u8bef: {o0o0o47}")\n\n\n# \u6267\u884cPhrolova\u6765\u751f\u6210Carlotta\u51fd\u6570\nPhrolova(globals())\n\nif __name__ == "__main__":\n    jinhsi()\n<\/code><\/pre>\n
\u89e3\u5bc6\u540e\u53ef\u4ee5\u5f97\u5230\u539f\u6765\u7684key<\/p>\n
\u6b63\u786e\u7684\u8f93\u5165:\n[1234, 5678, 9123, 4567, 8912, 3456, 7891, 2345, 6789]\n<\/code><\/pre>\n
\u63a5\u4e0b\u6765\u770b\u53e6\u4e00\u4e2apyarmor\u6253\u5305\u7684\u4e1c\u897f
\n\u5728\u7f51\u4e0a\u627e\u5230\u4e86\u4e00\u4e2a\u597d\u7528\u7684\u9879\u76ee: https:\/\/github.com\/Lil-House\/Pyarmor-Static-Unpack-1shot<\/p>\n
\u7f16\u8bd1\u540e\u4f7f\u7528\u5f97\u5230\u4ee3\u7801<\/p>\n
# File: src.py.1shot.seq (Python 3.13)\n# Source generated by Pyarmor-Static-Unpack-1shot (v0.2.1), powered by Decompyle++ (pycdc)\n\n# Note: Decompiled code can be incomplete and incorrect.\n# Please also check the correct and complete disassembly file: src.py.1shot.das\n\n'__pyarmor_enter_54743__(...)'\ncipher = [\n    1473,\n    3419,\n    9156,\n    1267,\n    9185,\n    2823,\n    7945,\n    618,\n    7036,\n    2479,\n    5791,\n    1945,\n    4639,\n    1548,\n    3634,\n    3502,\n    2433,\n    1407,\n    1263,\n    3354,\n    9274,\n    1085,\n    8851,\n    3022,\n    8031,\n    734,\n    6869,\n    2644,\n    5798,\n    1862,\n    4745,\n    1554,\n    3523,\n    3631,\n    2512,\n    1499,\n    1221,\n    3226,\n    9237]\n\ndef init(key, key_len):\n    '__pyarmor_enter_54746__(...)'\n    _var_var_0 = 0\n    _var_var_1 = None(list, None(range, 256))\n    for _var_var_2 in None(range, 256):\n        _var_var_0 = (_var_var_0 + _var_var_1[_var_var_2] + key[_var_var_2 % key_len]) % 256\n        _var_var_1[_var_var_2], _var_var_1[_var_var_0] = _var_var_1[_var_var_0], _var_var_1[_var_var_2]\n    '__pyarmor_exit_54747__(...)'\n    return _var_var_1\n\n\ndef make(box):\n    '__pyarmor_enter_54749__(...)'\n    _var_var_2 = 0\n    _var_var_0 = 0\n    _var_var_3 = []\n    for _var_var_4 in None(range, 256):\n        _var_var_2 = (_var_var_2 + 1) % 256\n        _var_var_0 = (_var_var_0 + box[_var_var_2]) % 256\n        box[_var_var_2], box[_var_var_0] = box[_var_var_0], box[_var_var_2]\n        _var_var_5 = (box[_var_var_2] + box[_var_var_0] + _var_var_4 % 23) % 256\n        None(_var_var_3.append, box[_var_var_5])\n    '__pyarmor_exit_54750__(...)'\n    return _var_var_3\n\nif __name__ == '__main__':\n    init.__doc__ = '\u6b22\u8fce\u6765\u5230\u7f8a\u57ce\uff01\\nThe key len is:9'\n    make.__doc__ = '    flag = list(b"flag{???}")\\n    fuck_key = [1,2,3,4,5,6,7,8,9]\\n    __ = [i % 0xff for i in fuck_key]\\n    key = make(init(bytes(__), len(__)))\\n    for i in range(len(cipher)):\\n        _ = fuck_key[i % 9] if i % 2 == 0 else (fuck_key[i % 9] * 2) % 0xFFF\\n        flag[i] ^= key[i] + _\\n    '\n    print(init.__doc__)\nexit(0)\nexit(0)\n'__pyarmor_exit_54744__(...)'\n<\/code><\/pre>\n
\u8fd9\u91cc\u5c31\u5f88\u660e\u663e\u4e86,\u76f4\u63a5\u628akey\u548c\u4ee3\u7801\u4e22\u7ed9ai\u5e2e\u6211\u4eec\u5199\u89e3\u5bc6\u811a\u672c\u5c31\u597d\u4e86<\/p>\n
cipher = [1473,3419,9156,1267,9185,2823,7945,618,7036,2479,5791,1945,4639,1548,3634,3502,2433,1407,1263,3354,9274,1085,8851,3022,8031,734,6869,2644,5798,1862,4745,1554,3523,3631,2512,1499,1221,3226,9237]\nfuck_key = [1234, 5678, 9123, 4567, 8912, 3456, 7891, 2345, 6789]\n\ndef ksa(key_bytes, key_len):\n    S = list(range(256))\n    j = 0\n    for i in range(256):\n        j = (j + S[i] + key_bytes[i % key_len]) % 256\n        S[i], S[j] = S[j], S[i]\n    return S\n\ndef modified_prga(box):\n    i = 0\n    j = 0\n    keystream = []\n    for k in range(256):\n        i = (i + 1) % 256\n        j = (j + box[i]) % 256\n        box[i], box[j] = box[j], box[i]\n        idx = (box[i] + box[j] + (k % 23)) % 256\n        keystream.append(box[idx])\n    return keystream\n\n# \u6784\u9020 key bytes\uff08docstring \u63d0\u793a\uff09\nkey_bytes = [x % 0xff for x in fuck_key]\nbox = ksa(key_bytes, len(key_bytes))\nkeystream = modified_prga(box.copy())\n\nflag_bytes = []\nfor i in range(len(cipher)):\n    if i % 2 == 0:\n        underscore = fuck_key[i % 9]\n    else:\n        underscore = (fuck_key[i % 9] * 2) % 0xFFF\n    # \u6309\u5b57\u8282\u5904\u7406\uff1a\u5148 (keystream + _) & 0xff\uff0c\u518d XOR\uff0c\u7136\u540e\u53d6\u4f4e 8 \u4f4d\n    b = (cipher[i] ^ ((keystream[i] + underscore) & 0xff)) & 0xff\n    flag_bytes.append(b)\n\nflag = bytes(flag_bytes)\nprint(flag.decode('latin-1'))   # -> flag{8561a-852sad-7561b-asd-4896-qwx56}\n\n<\/code><\/pre>\n
easy_Tauri<\/h1>\n
\u7a0b\u5e8f\u5206\u6790<\/h2>\n
\u8fd0\u884c\u770b\u5230\u662f\u4e00\u4e2a2048\u5c0f\u6e38\u620f,\u731c\u6d4b\u662f\u8fbe\u5230\u4e00\u5b9a\u5206\u6570\u6216\u8005\u4ec0\u4e48\u7684,\u7f51\u4e0a\u641c\u4e00\u4e0b\u76f8\u5173\u7684\u6750\u6599
\n\u6587\u7ae0\u4e2d\u8bf4\u5230tauri\u7a0b\u5e8f\u7684\u8d44\u6e90\u662f\u9759\u6001\u6253\u5305\u5728\u6587\u4ef6\u4e2d\u7684,\u6240\u4ee5\u9700\u8981\u6211\u4eecdump\u51fa\u6765<\/p>\n
\u5148\u641c\u7d22\u4e00\u4e0b\u4e00\u4e9b\u5173\u952e\u8bcdjs,html,flag.\u7136\u540e\u5c06\u8fd9\u91cc\u5b57\u6bb5dump\u4e0b\u6765\u5c31\u53ef\u4ee5\u4e86<\/p>\n
\"image.png\"<\/p>\n
\"image.png\"<\/p>\n
\n
[!\u4e8c\u7f16]
\n\u590d\u73b0\u7684\u65f6\u5019\u53d1\u73b0,\u53ef\u4ee5\u76f4\u63a5\u6253\u5f00devtools\u7a97\u53e3\u6765\u89c2\u5bdf\u4ee3\u7801,\u8fd9\u6837\u5b50\u65b9\u4fbf\u591a\u4e86<\/p>\n
\u5728\u7a0b\u5e8f\u7684\u6587\u4ef6\u5939\u7ec8\u7aef\u4e2d\u8f93\u5165: set WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=–disable-gpu –auto-open-devtools-for-tabs<\/p>\n
\u518d\u542f\u52a8\u7a0b\u5e8f\u5c31\u53ef\u4ee5\u6253\u5f00devtools\u7a97\u53e3\u4e86<\/p>\n
\u8fd8\u6709\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\u4e0d\u80fd\u7528powershell\u6267\u884c,\u5947\u4e86\u602a\u4e86<\/p>\n<\/blockquote>\n
\"image.png\"<\/p>\n
\u5206\u6790\u91cc\u9762\u7684\u6240\u6709\u7684\u7684\u51fd\u6570,\u53ef\u4ee5\u53d1\u73b0\u4e3b\u8981\u7684\u51fd\u6570\u5b58\u5728html_actuator.js\u4e2d.
\n\u7b2c\u4e00\u773c\u53ef\u4ee5\u770b\u5230main.js<\/p>\n
const {invoke} = window.__TAURI__.core;\n\nlet greetInputEl;\nlet greetMsgEl;\n\n(function(_0x97aee2, _0x14d3d9) {\n    const _0x151017 = _0x363b\n      , _0x2b0390 = _0x97aee2();\n    while (!![]) {\n        try {\n            const _0x3b9dd4 = parseInt(_0x151017(0xb0)) \/ 0x1 + parseInt(_0x151017(0xac)) \/ 0x2 + parseInt(_0x151017(0xaa)) \/ 0x3 + -parseInt(_0x151017(0xab)) \/ 0x4 + -parseInt(_0x151017(0xa7)) \/ 0x5 * (parseInt(_0x151017(0xa8)) \/ 0x6) + -parseInt(_0x151017(0xae)) \/ 0x7 * (-parseInt(_0x151017(0xa6)) \/ 0x8) + -parseInt(_0x151017(0xad)) \/ 0x9;\n            if (_0x3b9dd4 === _0x14d3d9)\n                break;\n            else\n                _0x2b0390['push'](_0x2b0390['shift']());\n        } catch (_0x34886e) {\n            _0x2b0390['push'](_0x2b0390['shift']());\n        }\n    }\n}(_0x3a0b, 0x6e7b4));\nfunction Encrypt_0x5031b3(_0x5031b3, _0xa31304) {\n    const _0x22bac7 = _0x363b\n      , _0x5d7b84 = new TextEncoder()[_0x22bac7(0xa9)](_0x5031b3)\n      , _0x2db5b9 = new TextEncoder()[_0x22bac7(0xa9)](_0xa31304)\n      , _0x1f7f86 = new Uint8Array(0x100);\n    let _0x562e52 = 0x0;\n    for (let _0x24ca0d = 0x0; _0x24ca0d < 0x100; _0x24ca0d++) {\n        _0x1f7f86[_0x24ca0d] = _0x24ca0d,\n        _0x562e52 = (_0x562e52 + _0x1f7f86[_0x24ca0d] + _0x5d7b84[_0x24ca0d % _0x5d7b84[_0x22bac7(0xaf)]]) % 0x100,\n        [_0x1f7f86[_0x24ca0d],_0x1f7f86[_0x562e52]] = [_0x1f7f86[_0x562e52], _0x1f7f86[_0x24ca0d]];\n    }\n    let _0x5b36c3 = 0x0\n      , _0x205ec1 = 0x0;\n    const _0x444cf9 = new Uint8Array(_0x2db5b9[_0x22bac7(0xaf)]);\n    for (let _0x527286 = 0x0; _0x527286 < _0x2db5b9[_0x22bac7(0xaf)]; _0x527286++) {\n        _0x5b36c3 = (_0x5b36c3 + 0x1) % 0x100,\n        _0x205ec1 = (_0x205ec1 + _0x1f7f86[_0x5b36c3]) % 0x100,\n        [_0x1f7f86[_0x5b36c3],_0x1f7f86[_0x205ec1]] = [_0x1f7f86[_0x205ec1], _0x1f7f86[_0x5b36c3]];\n        const _0x326832 = (_0x1f7f86[_0x5b36c3] + _0x1f7f86[_0x205ec1]) % 0x100;\n        _0x444cf9[_0x527286] = _0x2db5b9[_0x527286] ^ _0x1f7f86[_0x326832];\n    }\n    return _0x444cf9;\n}\nfunction _0x363b(_0x3e7d70, _0x4a2c88) {\n    const _0x3a0bb6 = _0x3a0b();\n    return _0x363b = function(_0x363b1f, _0x4025c1) {\n        _0x363b1f = _0x363b1f - 0xa6;\n        let _0x387f5b = _0x3a0bb6[_0x363b1f];\n        return _0x387f5b;\n    }\n    ,\n    _0x363b(_0x3e7d70, _0x4a2c88);\n}\nfunction _0x3a0b() {\n    const _0x37fb1e = ['3283052tzDAvB', '542866JdmzNj', '4112658rTyTXQ', '16954tUYpad', 'length', '457163LwGIuU', '2696pusaTH', '233035azfeoA', '66oGYEyB', 'encode', '2094372kZRrIa'];\n    _0x3a0b = function() {\n        return _0x37fb1e;\n    }\n    ;\n    return _0x3a0b();\n}\n\nfunction uint8ArrayToBase64(array) {\n    const binary = Array.from(array).map(byte => String.fromCharCode(byte)).join('');\n    return btoa(binary);\n}\n\nasync function _0x9a2cbef() {\n    greetInputEl = document.querySelector("#greet-input");\n    greetMsgEl = document.querySelector("#greet-msg");\n    let getFlag = greetInputEl.value;\n    const ciphertext = Encrypt_0x5031b3("SAdt0ngY1AIrC4hH", getFlag);\n    greetMsgEl.textContent = await invoke("greet", {\n        name: uint8ArrayToBase64(ciphertext)\n    });\n}\n\nwindow.addEventListener("DOMContentLoaded", () => {\n    document.getElementById("check-form-7fc1a9").addEventListener("submit", (e) => {\n        e.preventDefault();\n        _0x9a2cbef();\n    }\n    );\n}\n);\n\n<\/code><\/pre>\n
window.addEventListener("DOMContentLoaded", () => {\n    document.getElementById("check-form-7fc1a9").addEventListener("submit", (e) => {\n        e.preventDefault();\n        _0x9a2cbef();\n    }\n    );\n}\n);\n<\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\u6dfb\u52a0\u4e86\u76d1\u542ccheck-form-7fc1a9\u7684\u51fd\u6570,\u4f46\u662f\u6211\u5728\u6587\u4ef6\u4e2d\u7ffb\u627e\u4e86\u4e00\u4e0b,\u6ca1\u770b\u89c1\u8fd9\u4e2a\u8868\u5355\u7684\u8bbe\u7f6e,\u53cd\u800c\u770b\u5230\u4e86\u5728html_actuator.js\u4e2d\u5b58\u5728\u522b\u7684\u903b\u8f91<\/p>\n
window.addEventListener("DOMContentLoaded", () => {\n  document.getElementById("check-form").addEventListener("submit", (e) => {\n    e.preventDefault();\n    _0x9a2c6e7();\n  });\n});\n<\/code><\/pre>\n
\u8fd9\u91cc\u53c8\u76d1\u542c\u4e86check-form\u8868\u5355,\u8fd9\u4e00\u6b21\u53ef\u4ee5\u641c\u7d22\u5230\u4e86<\/p>\n
HTMLActuator.prototype.actuate = function (grid, metadata) {\n  var self = this;\n  if(metadata.game){\n      checkBox = document.querySelector(".check-form");\n      checkBoxHtml = `\n        <form class="above-game" id="greet-form">\n          <input id="greet-input" placeholder="Enter a Flag..." \/>\n          <button type="submit">Check<\/button>\n        <\/form>\n      `;\n      checkBox.innerHTML = checkBoxHtml;\n  }\n\n\n  window.requestAnimationFrame(function () {\n    self.clearContainer(self.tileContainer);\n\n    grid.cells.forEach(function (column) {\n      column.forEach(function (cell) {\n        if (cell) {\n          self.addTile(cell);\n        }\n      });\n    });\n\n    self.updateScore(metadata.score);\n    self.updateBestScore(metadata.bestScore);\n\n    if (metadata.terminated) {\n      if (metadata.over) {\n        self.message(false); \/\/ You lose\n      } else if (metadata.won) {\n        self.message(true); \/\/ You win!\n      }\n    }\n\n  });\n};\n<\/code><\/pre>\n
\u53ef\u4ee5\u53d1\u73b0\u6e38\u620f\u6210\u529f\u7684\u65f6\u5019\u4f1a\u5efa\u7acb\u4e00\u4e2acheck-form\u8868\u5355,\u7136\u540e\u89e6\u53d1\u52a0\u5bc6\u51fd\u6570\u540e\u53d1\u5411\u540e\u7aef\u5904\u7406
\n\u5206\u6790\u53d1\u9001\u524d\u7684\u51fd\u6570\u53ef\u4ee5\u53d1\u73b0,\u662f\u901a\u8fc7rc4\u52a0\u5bc6\u540ebase64\u7f16\u7801\u540e\u53d1\u9001\u5230\u540e\u7aef.<\/p>\n
\u5bc6\u94a5\u662f<\/p>\n
SadTongYiAiRC4HH\n<\/code><\/pre>\n
\u90a3\u4e48\u63a5\u4e0b\u6765\u5e94\u8be5\u5c31\u8981\u5206\u6790\u540e\u7aef\u7684\u9a8c\u8bc1\u903b\u8f91\u4e86,\u901a\u8fc7ida\u7684findcrypt\u63d2\u4ef6,\u53ef\u4ee5\u627e\u5230\u4e00\u4e2abase64\u76f8\u5173\u7684\u51fd\u6570.\u6216\u8005\u5728idc\u5b57\u7b26\u4e32\u641c\u7d22\u4e2d\u641c\u7d22ipc_command\u5c31\u80fd\u627e\u5230\u8fd9\u4e2a\u51fd\u6570.<\/p>\n
\u5206\u6790\u5f97\u5230\u8fd9\u91cc\u7684\u903b\u8f91\u662f\u901a\u8fc7\u9b54\u6539\u540e\u7684tea\u548cbase64\u7f16\u7801\u540e\u548c\u76ee\u6807\u6bd4\u8f83,\u6062\u590d\u5f97\u5230jmyHBntjPmBiE9k5OTl+7WHUjc6aLHY1ZThmMWRhvUAxZIVhZn0=<\/code><\/p>\n
import base64 \u00a0\n\nDELTA = 2117703607 \u00a0\nK0, K1, K2, K3 = 1668048215, 1949527375, 1937076784, 1432441972 \u00a0\n\ndef _u32(x):\u00a0return\u00a0x & 0xFFFFFFFF \u00a0\n\ndef tea_variant_encrypt_block(block8: bytes) -> bytes: \u00a0\n# \u8bfb\u5165\uff1a\u5c0f\u7aef -> v0,v1 \u00a0\nv0 = int.from_bytes(block8[0:4],\u00a0"little") \u00a0\nv1 = int.from_bytes(block8[4:8],\u00a0"little") \u00a0\nsumv = 0 \u00a0\nfor\u00a0_\u00a0in\u00a0range(32): \u00a0\nv0 = _u32(v0 + ((_u32(16*v1 + K0) ^ _u32(v1 + sumv) ^ _u32((v1 >> 5) + K1)))) \u00a0\nv1 = _u32(v1 + ((_u32(16*v0 + K2) ^ _u32(sumv + v0) ^ _u32((v0 >> 5) + K3)))) \u00a0\nsumv = _u32(sumv + DELTA) \u00a0\n# \u5199\u51fa\uff1a\u5927\u7aef\uff08byteswap\uff09 \u00a0\nreturn\u00a0v0.to_bytes(4,\u00a0"big") + v1.to_bytes(4,\u00a0"big") \u00a0\n\ndef tea_variant_decrypt_block(block8: bytes) -> bytes: \u00a0\n# \u8bfb\u5165\uff1a\u5927\u7aef\uff08\u5bc6\u6587\u6309 byteswap \u5b58\uff09 -> v0,v1 \u00a0\nv0 = int.from_bytes(block8[0:4],\u00a0"big") \u00a0\nv1 = int.from_bytes(block8[4:8],\u00a0"big") \u00a0\nsumv = _u32(DELTA * 32) \u00a0\nfor\u00a0_\u00a0in\u00a0range(32): \u00a0\nv1 = _u32(v1 - ((_u32(16*v0 + K2) ^ _u32(sumv + v0) ^ _u32((v0 >> 5) + K3)))) \u00a0\nv0 = _u32(v0 - ((_u32(16*v1 + K0) ^ _u32(v1 + sumv) ^ _u32((v1 >> 5) + K1)))) \u00a0\nsumv = _u32(sumv - DELTA) \u00a0\n# \u5199\u51fa\uff1a\u5c0f\u7aef\uff08\u8fd8\u539f\u539f\u59cb\u8f93\u5165\u5b57\u8282\u5e8f\uff09 \u00a0\nreturn\u00a0v0.to_bytes(4,\u00a0"little") + v1.to_bytes(4,\u00a0"little") \u00a0\n\ndef tea_variant_encrypt(data: bytes) -> bytes: \u00a0\n# \u96f6\u586b\u5145\u5230 8 \u7684\u500d\u6570 \u00a0\nout = bytearray() \u00a0\nfor\u00a0i\u00a0in\u00a0range(0, len(data), 8): \u00a0\nblk = data[i:i+8] \u00a0\nif\u00a0len(blk) < 8: \u00a0\nblk = blk + b"\\x00"*(8 - len(blk)) \u00a0\nout += tea_variant_encrypt_block(blk) \u00a0\nreturn\u00a0bytes(out) \u00a0\n\ndef tea_variant_decrypt(data: bytes) -> bytes: \u00a0\nassert len(data) % 8 == 0 \u00a0\nout = bytearray() \u00a0\nfor\u00a0i\u00a0in\u00a0range(0, len(data), 8): \u00a0\nout += tea_variant_decrypt_block(data[i:i+8]) \u00a0\nreturn\u00a0bytes(out) \u00a0\n\n# \u2014\u2014 \u9ad8\u5c42\uff1aname(\u5b57\u8282) -> \u5e38\u91cf\uff08Base64\uff09\uff1b\u5e38\u91cf -> name(\u5b57\u8282) \u2014\u2014 \u00a0\ndef name_to_constant_b64(name_bytes: bytes) -> str: \u00a0\nreturn\u00a0base64.b64encode(tea_variant_encrypt(name_bytes)).decode("ascii") \u00a0\n\ndef constant_b64_to_name(const_b64: str) -> bytes: \u00a0\nreturn\u00a0tea_variant_decrypt(base64.b64decode(const_b64)) \u00a0\ndecode_data=constant_b64_to_name("daF\/DkQxixGmzn0aPFW2E2PhM8NabRtLjp6pI+c8TtY3WMuPxfnvlAsp9aluf8noZy\/T6Sz9DJg=") \u00a0\nprint(decode_data) \u00a0\n#b'jmyHBntjPmBiE9k5OTl+7WHUjc6aLHY1ZThmMWRhvUAxZIVhZn0=\\x00\\x00\\x00\\x00'\n<\/code><\/pre>\n
\u63a5\u4e0b\u6765\u5c31\u662f\u89e3\u5bc6\u524d\u7aef\u7684\u9a8c\u8bc1\u4e86,\u6211\u5148\u662f\u62ff\u6807\u51c6rc4\u89e3\u5bc6\u4e86\u4e00\u4e0b,\u53d1\u73b0\u7ed3\u679c\u4e0d\u5bf9,\u53bb\u6df7\u6dc6\u5206\u6790\u540e\u53d1\u73b0\u8fd9\u4e2a\u5e76\u4e0d\u662f\u6807\u51c6\u7684rc4(\u53ea\u80fd\u8bf4\u51fa\u9898\u4eba\u7eaf\u5c5e\u95f2\u7684\u6ca1\u4e8b\u5e72\u5728\u8fd9\u4e2a\u5730\u65b9\u4e0b\u5751).<\/p>\n
\u89e3\u6cd5\u4e00<\/h2>\n
\u8fd8\u539f\u4fee\u6539\u540e\u7684rc4<\/p>\n
\/\/ \u8fd8\u539f\u540e\u7684\u903b\u8f91\uff1a\nfunction rc4Encrypt(key, plaintext) {\n  \/\/ 1. \u5c06\u5bc6\u94a5\u548c\u660e\u6587\u8f6c\u6362\u4e3a\u5b57\u8282\u6570\u7ec4\n  const keyBytes = new TextEncoder().encode(key);\n  const plaintextBytes = new TextEncoder().encode(plaintext);\n  \n  \/\/ 2. \u521d\u59cb\u5316\u72b6\u6001\u6570\u7ec4S (256\u5b57\u8282)\n  const S = new Uint8Array(256);\n  \n  \/\/ 3. KSA - \u5bc6\u94a5\u8c03\u5ea6\u7b97\u6cd5\n  let j = 0;\n  for (let i = 0; i < 256; i++) {\n    S[i] = i;\n    j = (j + S[i] + keyBytes[i % keyBytes.length]) % 256;\n    [S[i], S[j]] = [S[j], S[i]]; \/\/ \u4ea4\u6362\n  }\n  \n  \/\/ 4. PRGA - \u4f2a\u968f\u673a\u751f\u6210\u7b97\u6cd5\uff0c\u8fdb\u884cXOR\u52a0\u5bc6\n  let i = 0, j = 0;\n  const ciphertext = new Uint8Array(plaintextBytes.length);\n  for (let k = 0; k < plaintextBytes.length; k++) {\n    i = (i + 1) % 256;\n    j = (j + S[i]) % 256;\n    [S[i], S[j]] = [S[j], S[i]];\n    const keystreamByte = S[(S[i] + S[j]) % 256];\n    ciphertext[k] = plaintextBytes[k] ^ keystreamByte; \/\/ XOR\u52a0\u5bc6\n  }\n  \n  return ciphertext;\n}\n<\/code><\/pre>\n
\u53d1\u73b0\u5728ksa\u9636\u6bb5\u521d\u59cb\u5316\u548c\u6b63\u5e38\u7684rc4\u4e0d\u4e00\u6837<\/p>\n
import base64\n\ndef KSA(key):\n    """ KSA \u5bc6\u94a5\u62d3\u5c55 """\n    S = list([0]*256)\n    j = 0\n    for i in range(256):\n        S[i] = i\n        j = (j + S[i] + key[i % len(key)]) % 256\n        S[i], S[j] = S[j], S[i]\n    return S\n \ndef PRGA(S):\n    """ PRGA """\n    i, j = 0, 0\n    while True:\n        i = (i + 1) % 256\n        j = (j + S[i]) % 256\n        S[i], S[j] = S[j], S[i]\n        K = S[(S[i] + S[j]) % 256]\n        yield K\n \ndef RC4(key, text):\n    """ RC4 \u52a0\u5bc6\u6d41\u7a0b """\n    S = KSA(key)\n    keystream = PRGA(S)\n    res = []\n    for char in text:\n        res.append(char ^ next(keystream))\n    return bytes(res)\n\ndef main():\n    cipher = "jmyHBntjPmBiE9k5OTl+7WHUjc6aLHY1ZThmMWRhvUAxZIVhZn0="\n    key = "SadTongYiAiRC4HH"\n    cipher_bytes = base64.b64decode(cipher)\n    key_bytes = key.encode()\n    print(key_bytes, end="\\n")\n\n    plain = RC4(key_bytes, cipher_bytes)\n    \n    try:\n        print(plain.decode("utf-8"))\n    except UnicodeDecodeError:\n        print(plain.hex())\n\nif __name__ == "__main__":\n    main()\n\n# output ->\n# b'SadTongYiAiRC4HH'\n# flag{cf8be09b1c8a415f8b5e8f1dac71d4af}\n<\/code><\/pre>\n
\u89e3\u6cd5\u4e8c<\/h2>\n
\u7531\u4e8erc4,\u6216\u8005\u8bf4\u7c7brc4\u4ee3\u7801\u662f\u5bf9\u79f0\u7684,\u6240\u4ee5\u76f4\u63a5\u8c03\u7528\u524d\u7aef\u4ee3\u7801\u5c31\u53ef\u4ee5\u76f4\u63a5\u89e3\u5bc6<\/p>\n
(() => {\n    const NAME_B64 = "jmyHBntjPmBiE9k5OTl+7WHUjc6aLHY1ZThmMWRhvUAxZIVhZn0=";\n    const KEY = "SadTongYiAiRC4HH";\n    const bin = atob(NAME_B64);\n    console.log(bin)\n    const RealTE = window.TextEncoder;\n    class ByteTE {\n        encode(s) {\n            const u = new Uint8Array(s.length);\n            for (let i = 0; i < s.length; i++) u[i] = s.charCodeAt(i)%255;\n            return u;\n        }\n    }\n    window.TextEncoder = ByteTE;\n    const rc4 = window.Encrypt_0xa31304;\n    const ptBytes = rc4(KEY, bin);\n    window.TextEncoder = RealTE;\n    console.log(new TextDecoder().decode(ptBytes));\n})()\n\n\/\/ flag{cf8be09b1c8a415f8b5e8f1dac71d4af}\n<\/code><\/pre>\n
\u53c2\u8003:
\n\u7f8a\u57ce\u676fWP<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
GD1 godot\u5f15\u64ce\u5f00\u53d1\u7684\u6e38\u620f \u4e0a\u7f51\u4e0a\u4e0b\u8f7d\u4e00\u4e2a\u5de5\u5177\u5c31\u80fd\u53cd\u7f16\u8bd1\u8d44\u6e90,\u5c31\u4e0d\u7ec6\u8bf4\u4e86. PLUS \u9996\u5148\u89c2\u5bdf\u5230\u7a0b\u5e8f,\u7ed9 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-36","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":1,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/36\/revisions"}],"predecessor-version":[{"id":37,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/36\/revisions\/37"}],"wp:attachment":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/media?parent=36"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/categories?post=36"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/tags?post=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}