{"id":40,"date":"2026-04-14T15:15:17","date_gmt":"2026-04-14T07:15:17","guid":{"rendered":"https:\/\/www.seekinthevortex.cn\/?p=40"},"modified":"2026-04-14T15:15:17","modified_gmt":"2026-04-14T07:15:17","slug":"actf-deeptx-%e9%80%86%e5%90%91%e5%a4%8d%e7%8e%b0%e7%ac%94%e8%ae%b0","status":"publish","type":"post","link":"https:\/\/www.seekinthevortex.cn\/index.php\/2026\/04\/14\/actf-deeptx-%e9%80%86%e5%90%91%e5%a4%8d%e7%8e%b0%e7%ac%94%e8%ae%b0\/","title":{"rendered":"ACTF deeptx \u9006\u5411\u590d\u73b0\u7b14\u8bb0"},"content":{"rendered":"

\u65f6\u9694\u8fd9\u4e48\u4e45,\u7ec8\u4e8e\u65ad\u65ad\u7eed\u7eed\u7684\u628a\u8fd9\u9053\u9898\u770b\u5b8c\u4e86.
\n\u4e0d\u5f97\u4e0d\u8bf4\u6d59\u5927\u7684\u270c\u6c34\u5e73\u8fd8\u662f\u592a\u9ad8\u4e86.\u505a\u7684\u90a3\u53eb\u4e00\u4e2a\u75db\u82e6(\u4e5f\u6709\u53ef\u80fd\u662f\u6211\u592a\u83dc\u7684\u539f\u56e0:)<\/p>\n

\u521d\u89c1<\/h1>\n

\u600e\u4e48\u501f\u52a9\u5de5\u5177\u62ff\u5230\u6c47\u7f16\u8fd9\u91cc\u5c31\u4e0d\u8d58\u8ff0\u4e86,\u7f51\u4e0a\u8bb8\u591aWP\u90fd\u6709\u5199\u4e86
\n\u4e5f\u53ef\u4ee5\u53c2\u8003\u963f\u91cc\u4e91CTF\u7684\u4e00\u9053\u9898\u76ee<\/p>\n

\u8fd9\u91cc\u9644\u4e0a\u94fe\u63a5\u963f\u91cc\u4e91CTF2025 Writeup – \u661f\u76df\u5b89\u5168\u56e2\u961f<\/a><\/p>\n

int __fastcall main(int argc, const char **argv, const char **envp)\n{\n  int v3; \/\/ ebx\n  char v5[512]; \/\/ [rsp+0h] [rbp-8C0h] BYREF\n  unsigned __int8 *v6; \/\/ [rsp+200h] [rbp-6C0h] BYREF\n  unsigned __int8 *v7; \/\/ [rsp+208h] [rbp-6B8h] BYREF\n  char v8[1024]; \/\/ [rsp+210h] [rbp-6B0h] BYREF\n  char v9[4]; \/\/ [rsp+610h] [rbp-2B0h] BYREF\n  int v10; \/\/ [rsp+614h] [rbp-2ACh]\n  int v11; \/\/ [rsp+618h] [rbp-2A8h]\n  __int16 v12; \/\/ [rsp+61Eh] [rbp-2A2h]\n  int v13; \/\/ [rsp+620h] [rbp-2A0h]\n  char v14[14]; \/\/ [rsp+642h] [rbp-27Eh] BYREF\n  char v15[256]; \/\/ [rsp+650h] [rbp-270h] BYREF\n  __int64 v16; \/\/ [rsp+750h] [rbp-170h] BYREF\n  __int64 v17_blockdim_x; \/\/ [rsp+858h] [rbp-68h] BYREF\n  unsigned int v18; \/\/ [rsp+860h] [rbp-60h]\n  __int64 v19_griddim_x; \/\/ [rsp+864h] [rbp-5Ch] BYREF\n  unsigned int v20; \/\/ [rsp+86Ch] [rbp-54h]\n  __int64 v21; \/\/ [rsp+870h] [rbp-50h] BYREF\n  unsigned int v22; \/\/ [rsp+878h] [rbp-48h]\n  __int64 v23; \/\/ [rsp+87Ch] [rbp-44h] BYREF\n  unsigned int v24; \/\/ [rsp+884h] [rbp-3Ch]\n  __int64 v25; \/\/ [rsp+888h] [rbp-38h] BYREF\n  unsigned int v26; \/\/ [rsp+890h] [rbp-30h]\n  __int64 v27; \/\/ [rsp+894h] [rbp-2Ch] BYREF\n  unsigned int v28; \/\/ [rsp+89Ch] [rbp-24h]\n  char *v29; \/\/ [rsp+8A0h] [rbp-20h]\n  void *ptr; \/\/ [rsp+8A8h] [rbp-18h]\n\n  std::ifstream::basic_ifstream(v15, "flag.bmp", 4LL);\/\/ \u8bfb\u53d6\u540d\u4e3a flag.bmp \u7684\u6587\u4ef6\uff08\u4e8c\u8fdb\u5236\u6a21\u5f0f\uff09\n  if ( (unsigned __int8)std::ios::operator!(&v16) )\n  {\n    v3 = -1;\n  }\n  else\n  {\n    std::istream::read((std::istream *)v15, v14, 14LL);\/\/ \u8bfb\u53d6 BMP \u6587\u4ef6\u7684\u524d 14 \u5b57\u8282\uff08\u6587\u4ef6\u5934\uff09\u548c\u63a5\u4e0b\u6765\u7684 40 \u5b57\u8282\uff08\u4fe1\u606f\u5934\uff09\u3002\n    std::istream::read((std::istream *)v15, v9, 40LL);\n    if ( v10 == 256 )                           \/\/ \u9a8c\u8bc1\u5173\u952e\u5b57\u6bb5\n    {\n      if ( v11 == 256 )\n      {\n        if ( v12 == 8 )\n        {\n          if ( v13 )\n          {\n            v3 = -1;\n          }\n          else\n          {\n            std::istream::read((std::istream *)v15, v8, 1024LL);\/\/ \/\/ \u8bfb\u53d6\u8c03\u8272\u677f\n            ptr = malloc(0x10000uLL);\n            v29 = (char *)malloc(0x10000uLL);   \/\/ \n                                                \/\/ \n                                                \/\/ \n            cudaMemcpyToSymbol<unsigned char [256]>(&cuda_sbox, &sbox, 256LL, 0LL, 1LL);\n            cudaMemcpyToSymbol<unsigned char [256]>(&cuda_tbox, &tbox, 256LL, 0LL, 1LL);\n            cudaMemcpyToSymbol<float [256]>(&cuda_motion, &motion, 1024LL, 0LL, 1LL);\/\/ \n                                                \/\/ \n                                                \/\/ \n            cudaMalloc<unsigned char>(&v7, 0x10000LL);\n            cudaMalloc<unsigned char>(&v6, 0x10000LL);\/\/ \n                                                \/\/ \n                                                \/\/ \n                                                \/\/ \n            std::istream::read((std::istream *)v15, (char *)ptr, 0x10000LL);\/\/ \u8bfb\u53d6\u56fe\u50cf\u50cf\u7d20\u6570\u636e\n            std::ifstream::close(v15);\n            cudaMemcpy(v7, ptr, 0x10000LL, 1LL);\/\/ \u5c06\u56fe\u50cf\u6570\u636e\u4f20\u8f93\u5230 GPU\n                                                \/\/ \n                                                \/\/ \n                                                \/\/ \n            dim3::dim3((dim3 *)&v17_blockdim_x, 256, 1, 1);\n            dim3::dim3((dim3 *)&v19_griddim_x, 256, 1, 1);\n            if ( !(unsigned int)_cudaPushCallConfiguration(v19_griddim_x, v20, v17_blockdim_x, v18, 0LL, 0LL) )\n              Layer1(v7, v6);                   \/\/ \u524d\u4e00\u4e2a\u53c2\u6570\u662f\u8f93\u5165\uff0c\u540e\u4e00\u4e2a\u53c2\u6570\u662f\u8f93\u51fa\n            cudaDeviceSynchronize();\n            dim3::dim3((dim3 *)&v21, 256, 1, 1);\n            dim3::dim3((dim3 *)&v23, 256, 1, 1);\/\/ \n                                                \/\/ \n                                                \/\/ \n                                                \/\/ \n            if ( !(unsigned int)_cudaPushCallConfiguration(v23, v24, v21, v22, 0LL, 0LL) )\n              Layer2(v6, v7);\n            cudaDeviceSynchronize();\n            dim3::dim3((dim3 *)&v25, 256, 1, 1);\n            dim3::dim3((dim3 *)&v27, 256, 1, 1);\/\/ \n                                                \/\/ \n                                                \/\/ \n                                                \/\/ \n            if ( !(unsigned int)_cudaPushCallConfiguration(v27, v28, v25, v26, 0LL, 0LL) )\n              Layer3(v7, v6);\n            cudaDeviceSynchronize();\n            cudaMemcpy(v29, v6, 0x10000LL, 2LL);\/\/ \u4fdd\u5b58\u7ed3\u679c\n                                                \/\/ \n                                                \/\/ \n                                                \/\/ \n            std::ofstream::basic_ofstream(v5, "deep_flag.bmp", 4LL);\/\/ \u751f\u6210\u65b0\u56fe\u7247\n            std::ostream::write((std::ostream *)v5, v14, 14LL);\n            std::ostream::write((std::ostream *)v5, v9, 40LL);\n            std::ostream::write((std::ostream *)v5, v8, 1024LL);\n            std::ostream::write((std::ostream *)v5, v29, 0x10000LL);\n            std::ofstream::close(v5);\n            free(ptr);\n            free(v29);\n            cudaFree(v7);\n            cudaFree(v6);\n            v3 = 0;\n            std::ofstream::~ofstream(v5);\n          }\n        }\n        else\n        {\n          v3 = -1;\n        }\n      }\n      else\n      {\n        v3 = -1;\n      }\n    }\n    else\n    {\n      v3 = -1;\n    }\n  }\n  std::ifstream::~ifstream(v15);\n  return v3;\n}\n<\/code><\/pre>\n
\u7a0b\u5e8f\u7684\u903b\u8f91\u6bd4\u8f83\u7b80\u5355,\u91cd\u8981\u7684\u662f\u91cc\u9762\u76843\u4e2aLayer\u51fd\u6570,\u4f7f\u7528\u5de5\u5177dump\u51fa\u6c47\u7f16\u4ee3\u7801\u5e76\u8fd8\u539f\u53ef\u4ee5\u5f97\u5230<\/p>\n
#include "cuda_runtime.h"\n#include "device_launch_parameters.h"\n#include <iostream>\n\n__constant__ uint8_t cuda_sbox[256];\n__constant__ uint8_t cuda_tbox[256];\n__constant__ float cuda_motion[256];\n\n__global__ void Layer1(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x;\n    int bid = blockIdx.x;\n    int bdim = blockDim.x;\n    \n    if (tid >= 241 || bid >= 241)\n        return;\n\n    float sum = 0.f;\n    for (int i = 0; i < 16; i++)\n    {\n        for (int j = 0; j < 16; j++)\n        {\n            int Index = (i + bid) * bdim + (tid + j);\n            sum += cuda_motion[240 - (i * 16) + j] * (float)(Input[Index]);\n        }\n    }\n\n    Output[bid * bdim + tid] = (uint8_t)(sum);\n}\n\n__global__ void Layer2(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x;\n    int bid = blockIdx.x;\n    int bdim = 256;\n\n    uint8_t Value = Input[bid * 256 + tid];\n    int Index = 256 * cuda_sbox[tid] + cuda_sbox[bid];\n    Output[Index] = Value;\n}\n\/*\nfor block in range(256):\n    for thread in range(256):\n        output[sbox[thread] * 256 + sbox[block]] = input[block * 256 + thread]\n*\/\n\n__global__ void Layer3(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x; \/\/\u53ef\u4ee5\u7406\u89e3\u4e3a\u5217\u53f7\n    int bid = blockIdx.x; \/\/\u53ef\u4ee5\u7406\u89e3\u4e3a\u884c\u53f7\n    int bdim = blockDim.x; \/\/256\n\n    int CurIndex = bdim * bid + tid; \/\/\u5f53\u524d\u7d22\u5f15\n\n    Input[CurIndex] ^= tid | bid;\n\n    __syncthreads(); \/\/\u7ebf\u7a0b\u540c\u6b65\n\n    if ((CurIndex & 7) == 0) \/\/\u6bcf 8 \u4e2a\u7ebf\u7a0b\u4e2d\u7684\u7b2c\u4e00\u4e2a\u7ebf\u7a0b\u6267\u884c\u8fd9\u6bb5\u4ee3\u7801\uff08\u5373 CurIndex \u662f 8 \u7684\u500d\u6570\u7684\u7ebf\u7a0b\uff09\n    {\n        uint32_t v0 = *(uint32_t*)(Input + CurIndex); \/\/\u56fe\u7247\u5927\u5c0f\u662f256\n        uint32_t sum = 1786956040;\n        for (int i = 0; i < 3238567; i++)\n        {\n            v1 += ((v0 << 4) + 1386807340) ^ ((v0 >> 5) + 2007053320) ^ (v0 + sum);\n            v0 -= ((v1 << 4) + 621668851) ^ ((v1 >> 5) - 862448841) ^ (v1 + sum);\n            sum += -1708609273;\n        }\n        *(uint32_t*)(Input + CurIndex) = v0;\n        *(uint32_t*)(Input + CurIndex + 4) = v1;\n    }\n    __syncthreads();\n\n    Input[CurIndex] ^= bid & tid;\n\n    __syncthreads();\n\n    uint8_t tmp = cuda_sbox[tid]; \/\/char\n    uint16_t v = 0;\n\n    for (int i = 0; i < 256; i++)\n    {\n        v += cuda_tbox[tmp] * Input[bid * bdim + i];\n        tmp = tmp * 5 + 17; \/\/tmp(char)\u4e5f\u5c31\u662f\u5927\u5c0f\u6b63\u597d0-255\uff0ctmp\u1d62\u208a\u2081 = tmp\u1d62 * 5 + 17 mod 256\n    }\n\/*\n    for block in range(256):\n        for thread in range(256):\n            tmp = sbox[thread] #\u4e5f\u5c31\u662f\u4f1a\u6709256\u4e2atmp\u7684\u521d\u59cb\u503c\n            v = 0\n            for i in range(256):\n                v += tbox[tmp] * b_dat[256 * block + i] \n                tmp = (tmp * 5 + 17) & 0xFF\n*\/\n    \n    for (int i = 8; i < 4137823; i++)\n    {\n        uint32_t tmp1 = (v << 3) | ((v & 224) >> 5);\n        int tmp2 = tmp1 * 13 + (tid ^ bid);\n        v = cuda_sbox[(cuda_tbox[i] ^ tmp2)];\n    }\n    \/*\n    for block in range(256):\n    for thread in range(256):\n        sbox = sbox_ori.copy()\n        ttl = 0\n        for rounds in range(256):\n            ttl += tbox[sbox[thread]] * b_dat[256 * block + rounds]\n            sbox[thread] = (sbox[thread] * 5 + 17) & 0xFF\n        for cycle in range(8, 4137823):\n            ttl = sbox[tbox[cycle & 0xFF] ^ ((((ttl & 224) >> 5) | (ttl << 3)) * 13 + (block ^ thread)) & 0xFF]\n        final[block * 256 + thread] = ttl\n    *\/\n\n    Output[CurIndex] = (uint8_t)v;\n}\n<\/code><\/pre>\n
REVERSE<\/h1>\n
Layer3\u90e8\u5206<\/h2>\n
__global__ void Layer3(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x; \/\/\u53ef\u4ee5\u7406\u89e3\u4e3a\u5217\u53f7\n    int bid = blockIdx.x; \/\/\u53ef\u4ee5\u7406\u89e3\u4e3a\u884c\u53f7\n    int bdim = blockDim.x; \/\/256\n\n    int CurIndex = bdim * bid + tid; \/\/\u5f53\u524d\u7d22\u5f15\n\n    Input[CurIndex] ^= tid | bid;\n\n    __syncthreads(); \/\/\u7ebf\u7a0b\u540c\u6b65\n\n    if ((CurIndex & 7) == 0) \/\/\u6bcf 8 \u4e2a\u7ebf\u7a0b\u4e2d\u7684\u7b2c\u4e00\u4e2a\u7ebf\u7a0b\u6267\u884c\u8fd9\u6bb5\u4ee3\u7801\uff08\u5373 CurIndex \u662f 8 \u7684\u500d\u6570\u7684\u7ebf\u7a0b\uff09\n    {\n        uint32_t v0 = *(uint32_t*)(Input + CurIndex); \/\/\u56fe\u7247\u5927\u5c0f\u662f256\n        uint32_t sum = 1786956040;\n        for (int i = 0; i < 3238567; i++)\n        {\n            v1 += ((v0 << 4) + 1386807340) ^ ((v0 >> 5) + 2007053320) ^ (v0 + sum);\n            v0 -= ((v1 << 4) + 621668851) ^ ((v1 >> 5) - 862448841) ^ (v1 + sum);\n            sum += -1708609273;\n        }\n        *(uint32_t*)(Input + CurIndex) = v0;\n        *(uint32_t*)(Input + CurIndex + 4) = v1;\n    }\n    __syncthreads();\n\n    Input[CurIndex] ^= bid & tid;\n\n    __syncthreads();\n\n    uint8_t tmp = cuda_sbox[tid]; \/\/char\n    uint16_t v = 0;\n\n    for (int i = 0; i < 256; i++)\n    {\n        v += cuda_tbox[tmp] * Input[bid * bdim + i];\n        tmp = tmp * 5 + 17; \/\/tmp(char)\u4e5f\u5c31\u662f\u5927\u5c0f\u6b63\u597d0-255\uff0ctmp\u1d62\u208a\u2081 = tmp\u1d62 * 5 + 17 mod 256\n    }\n\/*\n    for block in range(256):\n        for thread in range(256):\n            tmp = sbox[thread] #\u4e5f\u5c31\u662f\u4f1a\u6709256\u4e2atmp\u7684\u521d\u59cb\u503c\n            v = 0\n            for i in range(256):\n                v += tbox[tmp] * b_dat[256 * block + i] \n                tmp = (tmp * 5 + 17) & 0xFF\n*\/\n    \n    for (int i = 8; i < 4137823; i++)\n    {\n        uint32_t tmp1 = (v << 3) | ((v & 224) >> 5);\n        int tmp2 = tmp1 * 13 + (tid ^ bid);\n        v = cuda_sbox[(cuda_tbox[i] ^ tmp2)];\n    }\n    \/*\n    for block in range(256):\n    for thread in range(256):\n        sbox = sbox_ori.copy()\n        ttl = 0\n        for rounds in range(256):\n            ttl += tbox[sbox[thread]] * b_dat[256 * block + rounds]\n            sbox[thread] = (sbox[thread] * 5 + 17) & 0xFF\n        for cycle in range(8, 4137823):\n            ttl = sbox[tbox[cycle & 0xFF] ^ ((((ttl & 224) >> 5) | (ttl << 3)) * 13 + (block ^ thread)) & 0xFF]\n        final[block * 256 + thread] = ttl\n    *\/\n\n    Output[CurIndex] = (uint8_t)v;\n}\n<\/code><\/pre>\n
Layer3_part1\u5206\u6790\uff1a<\/h3>\n
\u6211\u4eec\u8981\u6c42\u7684\u8fc7\u7a0b
\nOutput[CurIndex]–>v–>tmp2–>tmp1–>v \u4e2d\u95f4\u6709\u5f88\u591a\u6b21\u5faa\u73af<\/p>\n
cuda_sbox[a] = v
\n\u90a3\u6211\u4eec\u5bf9v\u6c42\u9006\u7d22\u5f15\u5c31\u662f
\ncuda_invsbox[v] = a<\/p>\n
a = cuda_tbox[i] ^ tmp2<\/p>\n
\u73b0\u5728v = cuda_tbox[i] ^ tmp2
\n\u5f97\u5230tmp2 = v ^ cuda_tbox[i]<\/p>\n
\u73b0\u5728\u6c42tmp1
\n\u6b63\u5411\u4ee3\u7801\uff1atmp2 = tmp1 * 13 + (tid ^ bid);
\n\u9006\u5411\u4ee3\u7801\uff1atmp1 = ( tmp2 – (tid ^ bid) ) * 0xc5
\n\u6ce8\u610f\uff1a
\n\u7531\u4e8e\u8fd9\u91cc\u662f\u4e8c\u8fdb\u5236\u4e58\u9664\u6cd5\uff0c\u4e0d\u80fd\u76f4\u63a5\u4f7f\u7528\u9664\u6cd5\u6765\u6c42tmp1\uff0c\u5fc5\u987b\u4e58\u4e0a13\u7684\u9006\u5143\uff0c\u5e76\u4e14\u4fdd\u7559int\u5927\u5c0f\u624d\u884c
\n\u4f8b\u5982\uff1a
\n0x6b * 0xc5  \t== 0x57
\n0x57 * 13     \t== 0x6b<\/p>\n
\u73b0\u5728\u6c42v
\n\u6b63\u5411\u4ee3\u7801\uff1auint32_t tmp1 = (v << 3) | ((v & 224) >> 5);\u4e5f\u5c31\u662f\u4ea4\u6362\u524d\u4e09\u4e2a\u5b57\u8282\u548c\u540e\u4e94\u4e2a\u5b57\u8282\u7684\u4f4d\u7f6e
\n\u9006\u5411\u4ee3\u7801\uff1av = (tmp1 >> 3) | (tmp1 << 5);\u6211\u4eec\u53d8\u56de\u6765\u5c31\u597d\u4e86<\/p>\n
\u6700\u540e\u6211\u4eec\u80fd\u6c42\u5f97\u4e0a\u4e00\u6b65\u5f97\u51fa\u7684v<\/p>\n
Layer3_part2\u5206\u6790\uff1a<\/h3>\n
\u8fd8\u539f\u7b97\u6cd5,\u901a\u8fc7\u7ea6\u675f\u6c42\u89e3,\u6211\u4eec\u53ef\u4ee5\u7206\u7834\u5f97\u5230\u539f\u6765\u7684input<\/p>\n
\u52a0\u5bc6\u7684\u7b97\u6cd5:<\/p>\n
uint8_t tmp = cuda_sbox[tid]; \/\/char\nuint16_t v = 0;\n\nfor (int i = 0; i < 256; i++)\n    {\n        v += cuda_tbox[tmp] * Input[bid * bdim + i];\n        tmp = tmp * 5 + 17; \/\/tmp(char)\u4e5f\u5c31\u662f\u5927\u5c0f\u6b63\u597d0-255\uff0ctmp\u1d62\u208a\u2081 = tmp\u1d62 * 5 + 17 mod 256\n    }\n\/*\nfor block in range(256):\n    for thread in range(256):\n        tmp = sbox[thread] #\u4e5f\u5c31\u662f\u4f1a\u6709256\u4e2atmp\u7684\u521d\u59cb     \t\t\t\tv = 0\n        for i in range(256):\n            v += tbox[tmp] * b_dat[256 * block + i] \n            tmp = (tmp * 5 + 17) & 0xFF\n*\/\n<\/code><\/pre>\n
\u8fd8\u539f\u7684\u7b97\u6cd5:<\/p>\n
def solve_input(vArray,Size): # vArray \u5c31\u662f\u6211\u4eec\u4e0a\u4e00\u6b65\u6c42\u89e3\u51fa\u6765\u7684256*256\u7684v\u6570\u7ec4\n    s = Solver()\n\n    Input = [[BitVec(f'input_{i}_{j}', 8) for j in range(256)] for i in range(Size)]\n\n    for bid in range(Size):\n        for tid in range(256):\n            tmp = sbox[tid]\n            sum = 0\n            for i in range(256):\n                sum += (tbox[tmp&0xff] * Input[bid][i])&0xffff\n                tmp = (tmp*5+17)&0xff\n\n            s.add(sum == vArray[bid*256+tid])\n\n    if s.check() == sat: # \u6709\u89e3\n        model = s.model()\n        result = [[model.evaluate(Input[i][j]).as_long() \n                  for j in range(256)] \n                  for i in range(Size)] # \u904d\u5386\u6a21\u578b,\u8fd4\u56de\u4e8c\u7ef4input\u6570\u7ec4\n        return result\n    else:\n        return None\n    \nnum = int(sys.argv[1]) # \u8fd9\u91cc\u662f\u4e3a\u4e86\u5c06\u539f\u6765\u7684\u6570\u636e\u5206\u4e3a16\u5757,\u901a\u8fc7\u591a\u7ebf\u7a0b\u7684\u65b9\u5f0f\u52a0\u901f\u6c42\u89e3\n\nwith open(r'Steg2' , 'rb') as f: # \u8bfb\u53d6\u539f\u6587\u4ef6\n    data = f.read(0x10000)\n\nwith open(r'Steg3_part'+str(num),'wb') as out_f: \n    start = num * 16 * 256\n    print('Running...')\n    for i in range(16):\n        block = data[start + i * 256 : start + i * 256 + 256 * 1]\n        In_ = [b for b in block]\n        \n        result = solve_input(In_, 1)\n\n        if result:\n            for row in result:\n                out_f.write(bytes(row))\n        \n        print('Finished ' + str(i) + ' block')\n    print('Finished all.')\n<\/code><\/pre>\n
Layer3_part3\u5206\u6790:<\/h3>\n
\u8fd9\u4e2a\u5c31\u662f\u4e00\u4e2a\u7b80\u5355\u7684TEA\u7b97\u6cd5,\u6211\u4eec\u76f4\u63a5\u9006\u5411\u5c31\u53ef\u4ee5\u5f97\u5230<\/p>\n
Layer2\u90e8\u5206<\/h2>\n
\u52a0\u5bc6\u7b97\u6cd5:<\/p>\n
__global__ void Layer2(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x;\n    int bid = blockIdx.x;\n    int bdim = blockDim.x; \/\/256\n\n    uint8_t Value = Input[bid * bdim + tid];\n    int Index = 256 * cuda_sbox[tid] + cuda_sbox[bid];\n    Output[256 * cuda_sbox[tid] + cuda_sbox[bid]] = Value;\n}\n<\/code><\/pre>\n
cuda_sbox[tid]\u53ef\u4ee5\u89c6\u4f5ctid
\ncuda_sbox[bid]\u53ef\u4ee5\u89c6\u4f5cbid
\n\u4e5f\u5c31\u662f
\ntid = cuda_sbox[tid]
\nbid = cuda_sbox[bid]<\/p>\n
\u53c8\u7531\u4e8ecuda_invsbox[cuda_sbox[tid]] == tid
\n\u5bf9Output\u7684tid\u4e0ebid\u6c42\u9006,\u53ef\u4ee5\u5f97\u5230\u539f\u6765\u7684Input\u7684tid\u548cbid\u7684\u503c
\n\u6211\u4eec\u518d\u628a\u6570\u503c\u653e\u56de\u539f\u6765\u7684\u4f4d\u7f6e\u5c31\u53ef\u4ee5\u4e86<\/p>\n
\u89e3\u5bc6\u7b97\u6cd5:<\/p>\n
__global__ void Re_Layer2(uint8_t* Input, uint8_t* Output)\n{\n    int tid = threadIdx.x;\n    int bid = blockIdx.x;\n    int bdim = blockDim.x;\n\n    int oTid = cuda_invsbox[bid]; \/\/\u8fd9\u91cc\u4f7f\u7528sbox\u9006\u7d22\u5f15\u8868\u6c42\u51fa\u4e86\n    int oBid = cuda_invsbox[tid];\n\n    uint8_t Value = Input[bid * 256 + tid];\n\n    Output[oBid * bdim + oTid] = Value;\n}\n<\/code><\/pre>\n
Layer1\u90e8\u5206<\/h2>\n
\u5230\u8fd9\u4e00\u6b65,\u6211\u4eec\u5df2\u7ecf\u53ef\u4ee5\u590d\u539f\u51fa\u5927\u6982\u6a21\u7cca\u7684\u56fe\u50cf\u4e86,\u63a5\u4e0b\u6765\u5c31\u662f\u53cd\u5377\u79ef\u5904\u7406,\u53ef\u4ee5\u901a\u8fc7\u4ee3\u7801\u91cd\u5efa\u8fd1\u4f3c\u8f93\u5165\u5c31\u53ef\u4ee5\u5f97\u5230\u53ef\u4ee5\u770b\u6e05flag\u7684\u56fe\u50cf\u4e86.<\/p>\n
\u8865\u5145<\/h1>\n
\u4ec0\u4e48\u662f\u5377\u79ef<\/h2>\n
\u5377\u79ef\u5c31\u662f\u628a\u5377\u79ef\u6838<\/a>\u653e\u5728\u8f93\u5165\u4e0a\u8fdb\u884c\u6ed1\u7a97\uff0c\u5c06\u5f53\u524d\u5377\u79ef\u6838\u8986\u76d6\u8303\u56f4\u5185\u7684\u8f93\u5165\u4e0e\u5377\u79ef\u6838\u76f8\u4e58\uff0c\u503c\u8fdb\u884c\u7d2f\u52a0\uff0c\u5f97\u5230\u5f53\u524d\u4f4d\u7f6e\u7684\u8f93\u51fa\uff0c\u5176\u672c\u8d28\u5728\u4e8e\u878d\u5408\u591a\u4e2a\u50cf\u7d20\u503c\u7684\u4fe1\u606f\u8f93\u51fa\u4e00\u4e2a\u50cf\u7d20\u503c\uff0c\u672c\u8d28\u4e0a\u662f\u4e0b\u91c7\u6837\u7684\uff0c\u6240\u4ee5\u8f93\u51fa\u7684\u5927\u5c0f\u5fc5\u7136\u5c0f\u4e8e\u8f93\u5165\u7684\u5927\u5c0f\uff0c\u5982\u4e0b\u56fe\u6240\u793a\uff1a<\/p>\n
\"\"<\/p>\n
\u4ec0\u4e48\u662f\u53cd\u5377\u79ef<\/h2>\n
\u53cd\u5377\u79ef\u548c\u8f6c\u7f6e\u5377\u79ef\u90fd\u662f\u4e00\u4e2a\u610f\u601d\uff0c\u6240\u8c13\u7684\u53cd\u5377\u79ef\uff0c\u5c31\u662f\u5377\u79ef\u7684\u9006\u64cd\u4f5c\uff0c\u6211\u4eec\u5c06\u4e0a\u56fe\u7684\u5377\u79ef\u770b\u6210\u662f\u8f93\u5165\u901a\u8fc7\u5377\u79ef\u6838\u7684\u900f\u89c6\uff0c\u90a3\u4e48\u53cd\u5377\u79ef\u5c31\u53ef\u4ee5\u770b\u6210\u8f93\u51fa\u901a\u8fc7\u5377\u79ef\u6838\u7684\u900f\u89c6\uff0c\u5177\u4f53\u5982\u4e0b\u56fe\u6240\u793a\uff1a
\n\"\"<\/p>\n
\u6bd4\u5982\u5de6\u4e0a\u89d2\u7684\u56fe\uff0c\u5c06\u8f93\u51fa\u768455\u6309\u7167\u7eff\u8272\u7684\u7ebf\u7684\u9006\u65b9\u5411\u6295\u5f71\u56de\u53bb\uff0c\u53ef\u4ee5\u5f97\u5230
\n[[55,110,55],[110,55,110],[55,55,110]]\u7684\u7ed3\u679c\uff1b<\/code>
\n\u6211\u4eec\u5c06\u5f97\u5230\u7684\u56db\u5f20\u7279\u5f81\u56fe\u8fdb\u884c\u53e0\u52a0\uff08\u91cd\u5408\u7684\u5730\u65b9\u5176\u503c\u76f8\u52a0\uff09\uff0c\u53ef\u4ee5\u5f97\u5230\u4e0b\u56fe\uff1a<\/p>\n
\"\"<\/p>\n
\u6700\u7ec8\u6211\u4eec\u5f97\u5230\u7684\u7279\u5f81\u56fe\u4e0e\u5377\u79ef\u8f93\u5165\u7684\u7279\u5f81\u56fe\u503c\u7684\u5927\u5c0f\u5e76\u4e0d\u76f8\u540c\uff0c\u8bf4\u660e\u5377\u79ef\u548c\u53cd\u5377\u79ef\u5e76\u4e0d\u662f\u5b8c\u5168\u5bf9\u7b49\u7684\u53ef\u9006\u64cd\u4f5c\uff08\u56e0\u4e3a\u91c7\u7528\u76f8\u540c\u7684\u5377\u79ef\u6838\uff0c\u5377\u79ef\u548c\u53cd\u5377\u79ef\u5f97\u5230\u7684\u8f93\u5165\u8f93\u51fa\u4e0d\u540c\uff09\uff0c\u4e5f\u5c31\u662f\u53cd\u5377\u79ef\u53ea\u80fd\u6062\u590d\u5c3a\u5bf8\uff0c\u4e0d\u80fd\u6062\u590d\u6570\u503c<\/code>\u6240\u4ee5\u6211\u4eec\u7528\u4ee3\u7801\u6062\u590d\u7684\u53ea\u662f\u4e00\u4e2a\u8f83\u4e3a\u6a21\u7cca\u7684\u56fe\u50cf,\u5e76\u4e0d\u80fd\u5b8c\u5168\u590d\u539f<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
\u65f6\u9694\u8fd9\u4e48\u4e45,\u7ec8\u4e8e\u65ad\u65ad\u7eed\u7eed\u7684\u628a\u8fd9\u9053\u9898\u770b\u5b8c\u4e86. \u4e0d\u5f97\u4e0d\u8bf4\u6d59\u5927\u7684\u270c\u6c34\u5e73\u8fd8\u662f\u592a\u9ad8\u4e86.\u505a\u7684\u90a3\u53eb\u4e00\u4e2a\u75db\u82e6(\u4e5f\u6709\u53ef\u80fd\u662f\u6211\u592a\u83dc […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-40","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/40","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/comments?post=40"}],"version-history":[{"count":1,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/40\/revisions"}],"predecessor-version":[{"id":41,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/40\/revisions\/41"}],"wp:attachment":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/media?parent=40"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/categories?post=40"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/tags?post=40"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}