1import re
 2
 3file="challenge4_RDID_dump.log"
 4
 5
 6# 解析每行的CAN ID和数据域
 7def parse_candump_log(line):
 8    m=re.match(r".*can0\s+(\w+)#([0-9A-Fa-f]+)", line)
 9    if not m:
10        return None, None
11    can_id = int(m.group(1), 16)
12    data = bytes.fromhex(m.group(2))
13    return can_id, data
14
15# 把每个DID的数据都以DID为键名存到字典里
16def extract_data(file):
17    # 初始化存放结果和连续帧的字典
18    result={}
19    multi_frame={}
20    with open(file) as f:
21        for line in f:
22            # 提取每行的CAN ID，数据域
23            can_id,data=parse_candump_log(line)
24            if data is None or len(data)==0:
25                continue
26            # 提取第一个字节的高4位为PCI
27            pci=data[0] >> 4
28            if pci == 0:
29                # 提取应用数据长度
30                length=data[0] & 0x0F
31                # 这里验证的是ISO-TP层长度，如果实际总长小于写的长度，说明CAN帧残缺
32                if len(data)<1+length:
33                    continue 
34                # 把ISO-TP层的载荷提取出来，UDS报文就是这个载荷
35                payload=data[1:length+1]
36                # 有效UDS回复帧，必定包含SID、DID，至少三个字节,少于3个字节，说明ISO-TP层写的长度短了，此帧有误，不管它
37                # 要求必须是0x22的肯定响应
38                if len(payload)>=3 and payload[0]==0x62:
39                    did=payload[1:3]
40                    result[did]=payload[3:]
41            
42            elif pci == 1:
43                # 首帧至少要有 PCI + 长度 + 0x62 + DID，5个字节
44                # 而且首帧肯定带满数据，长度一定是8，如果总长小于8，说明此帧残缺
45                if len(data) < 8:  
46                    continue
47                #传输的数据总长度
48                total_len=((data[0]&0x0F)<<8)|data[1] 
49                # 首帧的UDS响应
50                payload=data[2:]
51                if len(payload)>=3 and payload[0]==0x62:
52                    did = payload[1:3].hex().upper()
53                    multi_frame[did]={
54                        "total_len":total_len,
55                        "data":payload[3:]
56                    }
57
58
59            elif pci == 2:
60                #连续帧必须有PCI和1个数据，所以最少2个字节
61                if len(data) < 2: 
62                    continue
63                payload = data[1:]
64                for did, mf in multi_frame.items():
65                    # 减3是因为首帧提取的总长度包括了SID，DID的三个字节
66                    if len(mf["data"]) < mf["total_len"] - 3: 
67                        mf["data"] += payload
68                        if len(mf["data"]) >= mf["total_len"] - 3:
69                            result[did] = mf["data"]
70
71    return result
72
73for did,value in extract_data(file).items():
74    try:
75        text = value.decode("ascii")
76        print(f"DID 0x{did}: {text}")
77    except:
78        print(f"DID 0x{did}: {value.hex()}")

  1#!/usr/bin/env python3
  2# -*- coding: utf-8 -*-
  3"""
  4ECDSA私钥恢复工具
  5通过两个使用相同nonce的签名来恢复私钥
  6无需公钥
  7"""
  8
  9import hashlib
 10import binascii
 11
 12def main():
 13    # 文件名配置
 14    sig_file1 = "challenge_signed_firmware_files\ECUB.hex.sig"
 15    sig_file2 = "challenge_signed_firmware_files\ECUC.hex.sig"
 16    msg_file1 = "challenge_signed_firmware_files\ECUB.hex"
 17    msg_file2 = "challenge_signed_firmware_files\ECUC.hex"
 18    
 19    # secp256k1曲线参数
 20    n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141  # 阶数
 21    
 22    print("=== ECDSA私钥恢复工具 ===")
 23    print(f"签名文件1: {sig_file1}")
 24    print(f"签名文件2: {sig_file2}")
 25    print(f"消息文件1: {msg_file1}")
 26    print(f"消息文件2: {msg_file2}")
 27    print(f"曲线阶数 n = 0x{n:064x}")
 28    print()
 29    
 30    try:
 31        # 读取签名文件
 32        print("=== 读取签名数据 ===")
 33        r1, s1 = read_sig_file(sig_file1)
 34        r2, s2 = read_sig_file(sig_file2)
 35        
 36        # 计算消息哈希
 37        print("\n=== 计算消息哈希 ===")
 38        z1 = get_file_hash(msg_file1)
 39        z2 = get_file_hash(msg_file2)
 40        
 41        # 恢复私钥
 42        k, private_key = recover_private_key(r1, s1, r2, s2, z1, z2, n)
 43        
 44        # 输出结果
 45        print("\n=== 最终结果 ===")
 46        print(f"使用的Nonce (十六进制): 0x{k:064x}")
 47        print(f"使用的Nonce (十进制): {k}")
 48        print(f"恢复的私钥 (十六进制): 0x{private_key:064x}")
 49        print(f"恢复的私钥 (十进制): {private_key}")
 50        
 51    except FileNotFoundError as e:
 52        print(f"错误: 找不到文件 - {e}")
 53        print("请确保以下文件存在:")
 54        print(f"  - {sig_file1}")
 55        print(f"  - {sig_file2}")
 56        print(f"  - {msg_file1}")
 57        print(f"  - {msg_file2}")
 58    except Exception as e:
 59        print(f"错误: {e}")
 60
 61def read_sig_file(filename):
 62    """读取sig文件并解析ECDSA签名"""
 63    try:
 64        with open(filename, 'rb') as f:
 65            data = f.read()
 66            hex_data = data.hex()
 67            print(f"文件 {filename} 内容: {hex_data}")
 68    except FileNotFoundError:
 69        # 如果文件不存在，直接使用文件名作为hex字符串
 70        with open(filename.replace('.sig', ''), 'rb') as f:
 71            data = f.read()
 72            hex_data = data.hex()
 73    
 74    # 解析签名数据
 75    if len(hex_data) >= 128:  # 至少64字节
 76        # 假设前64字节是r和s
 77        r_hex = hex_data[:64]
 78        s_hex = hex_data[64:128]
 79        r = int(r_hex, 16)
 80        s = int(s_hex, 16)
 81        print(f"  r = 0x{r:064x}")
 82        print(f"  s = 0x{s:064x}")
 83        return r, s
 84    else:
 85        raise ValueError(f"签名文件 {filename} 数据不足")
 86
 87def get_file_hash(filename):
 88    """计算文件的SHA-256哈希值"""
 89    with open(filename, 'rb') as f:
 90        content = f.read()
 91        hash_value = hashlib.sha256(content).digest()
 92        hash_int = int.from_bytes(hash_value, 'big')
 93        print(f"文件 {filename} SHA256: {hash_int:064x}")
 94        return hash_int
 95
 96def recover_private_key(r1, s1, r2, s2, z1, z2, n):
 97    """通过两个签名恢复私钥"""
 98    print("\n=== 私钥恢复计算 ===")
 99    
100    # 检查是否使用了相同的r值（nonce重用）
101    if r1 != r2:
102        print("警告: 两个签名的r值不同，可能不适用nonce重用攻击")
103        print(f"r1 = 0x{r1:064x}")
104        print(f"r2 = 0x{r2:064x}")
105    
106    r = r1  # 使用第一个签名的r值
107    
108    # 计算 nonce k = (z1 - z2) / (s1 - s2) mod n
109    s_diff = (s1 - s2) % n
110    z_diff = (z1 - z2) % n
111    
112    # 处理负数
113    if s_diff == 0:
114        raise ValueError("s1 == s2，无法计算，请检查数据")
115    
116    if s_diff < 0:
117        s_diff = (s_diff + n) % n
118    if z_diff < 0:
119        z_diff = (z_diff + n) % n
120    
121    # 计算k
122    k = (z_diff * pow(s_diff, -1, n)) % n
123    print(f"Nonce (k) = 0x{k:064x}")
124    
125    # 计算私钥 d = (s1 * k - z1) / r mod n
126    temp = (s1 * k - z1) % n
127    if temp < 0:
128        temp = (temp + n) % n
129    
130    d = (temp * pow(r, -1, n)) % n
131    print(f"Private key (d) = 0x{d:064x}")
132    
133    # 验证计算
134    d_verify = ((s2 * k - z2) * pow(r, -1, n)) % n
135    print(f"Verification key = 0x{d_verify:064x}")
136    print(f"Keys match: {d == d_verify}")
137    
138    return k, d
139
140
141if __name__ == "__main__":
142    main()

 1int __fastcall sub_8006828(int a1, _BYTE *a2, unsigned __int16 a3, int a4, _WORD *a5)
 2{
 3  int result; // r0
 4  int v6; // r3
 5
 6  dword_20032B04 = a4;
 7  dword_20032B08 = (int)a5;
 8  *a5 = 0;
 9  dword_20032B10 = a1;
10  if ( !a3 )
11  {
12    *a2 = 0;
13    return sub_80042BC(a2, 19);
14  }
15  if ( (unsigned __int8)*a2 <= 0xFu )
16    return sub_8003A28(a2, a3, a4, a5);
17  v6 = (unsigned __int8)*a2;
18  if ( v6 == 135 )
19    return sub_8006150(a2, a3);
20  if ( (unsigned __int8)*a2 > 0x87u )
21    return sub_80042BC(a2, 17);
22  if ( v6 == 133 )
23    return sub_8006078(a2, a3);
24  if ( (unsigned __int8)*a2 > 0x85u )
25    return sub_80042BC(a2, 17);
26  if ( (unsigned __int8)*a2 > 0x27u )
27  {
28    if ( v6 == 62 )
29      return sub_8005FF4(a2, a3);
30    return sub_80042BC(a2, 17);
31  }
32  if ( (unsigned __int8)*a2 < 0x10u )
33    return sub_80042BC(a2, 17);
34  switch ( *a2 )
35  {
36    case 0x10:
37      result = sub_8004428(a2, a3);
38      break;
39    case 0x11:
40      result = sub_8004544(a2, a3);
41      break;
42    case 0x14:
43      result = sub_80045B4(a2, a3);
44      break;
45    case 0x27:
46      result = sub_8004DB8(a2, a3);
47      break;
48    default:
49      return sub_80042BC(a2, 17);
50  }
51  return result;
52}

 1int __fastcall sub_8004CD4(int result)
 2{
 3  _BYTE v1[4]; // [sp+Ch] [bp+Ch] BYREF
 4  int i; // [sp+10h] [bp+10h]
 5  char v3; // [sp+17h] [bp+17h]
 6
 7  v1[0] = 103;
 8  v1[1] = *(_BYTE *)(result + 1) & 0x7F;
 9  if ( (unsigned int)dword_20032B3C > 4 )
10    return sub_80042BC(result, 54);
11  if ( (unsigned int)(dword_20032B10 - dword_20032B38) <= 9 )
12    return sub_80042BC(result, 55);
13  if ( byte_20032B40 != 1 )
14    return sub_80042BC(result, 36);
15  v3 = 1;
16  for ( i = 0; i <= 15; ++i )
17  {
18    if ( *(unsigned __int8 *)(i + 2 + result) != (unsigned __int8)byte_20032B0C[i + 28] )
19      v3 = 0;
20  }
21  if ( v3 )
22  {
23    byte_20032B40 = 2;
24    if ( *(char *)(result + 1) >= 0 )
25      return sub_8004268(v1, 2);
26  }
27  else
28  {
29    byte_20032B40 = 0;
30    ++dword_20032B3C;
31    dword_20032B38 = dword_20032B10;
32    return sub_80042BC(result, 53);
33  }
34  return result;
35}

 1import can
 2import time
 3import binascii
 4
 5bus = can.Bus(interface="socketcan",channel="vcan0")
 6recv = "[DATA]:"
 7# 开始地址已有，结束地址选大点
 8startAddr=0xC3F80000
 9endAddr=0xC3F88000
10
11#循环读取内存数据
12for readAddr in range(startAddr,endAddr,0xFF):
13    #分割地址
14    byte1=(readAddr >>24)& 0xFF
15    byte2=(readAddr >>16)& 0xFF
16    byte3=(readAddr >>8)& 0xFF
17    byte4=readAddr& 0xFF
18    # 构造数据
19    candata = [0x07, 0x23, 0x14, byte1, byte2, byte3, byte4, 0xFF]
20    #构造读取内存can帧
21    readMem = can.Message(arbitration_id=0x7DF, is_extended_id=False, dlc=8, data=candata)
22    bus.send(readMem,timeout=0.2)
23    frameCount=0
24    # 一帧7字节数据，36帧252，基本能覆盖完了
25    while frameCount<36:
26        msg=bus.recv(timeout=0.1)
27        if msg is not None:
28            # 判断是否是首帧
29            if frameCount==0:
30                # 首帧要去掉前3个字节，也就是前6个字母
31                recv+=binascii.hexlify(msg.data).decode('utf-8')[6:]
32                # 收到首帧立马发流控帧
33                FC=can.Message(arbitration_id=0x7E0,is_extended_id=False,dlc=8,data=[0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
34                bus.send(FC,timeout=0.2)
35            else:
36                recv+=binascii.hexlify(msg.data).decode('utf-8')[2:]
37            frameCount+=1
38        else:
39            break
40bus.shutdown()
41print(recv)

 1#读取整个日志文件内容，并去除每行末尾的换行符，保存到 data 列表中
 2with open('./chall-log.txt','r') as fd:
 3
 4        data = [x.strip() for x in fd.readlines()]
 5
 6#从一行日志中提取出时间戳的小数部分（毫秒/微秒级），并转换为整数返回
 7def convert_line_to_ts(line):
 8
 9        ts = line.split(' ')[0][1:-1].split('.')[1]
10
11        return int(ts)
12#获取第一行的时间戳小数部分作为初始值
13last = convert_line_to_ts(data[0])
14#遍历其余每一行，计算当前行和上一行时间戳差值，并将其视为 ASCII 码输出对应的字符。
15for line in data[1:]:
16
17        ts = convert_line_to_ts(line)
18
19        print(chr(ts - last),end='' )
20
21        last = ts
22
23print()

 1#define MAX_SIZE 32
 2
 3const uint32_t a = 1103515245;
 4const uint32_t c = 12345;
 5const uint32_t m = 2147483647;
 6uint32_t seed = 1337;
 7
 8unsigned char user_input[MAX_SIZE];
 9const uint32_t STATE[4] = {0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116};
10
11uint32_t start[] = {0x0, 0x0, 0x0, 0x0};
12
13uint32_t gen_random(void) {
14  seed = (uint32_t)(((uint32_t)a * (uint32_t)seed + (uint32_t)c) % m);
15  return (uint32_t)seed;
16}
17
18void setup() {
19  Serial.begin(115200);
20  Serial.println("==================================================");
21  Serial.println("=               SECURE LOCK - v0.5               =");
22  Serial.println("==================================================");
23}
24
25int check_pass(uint32_t start[]) {
26    Serial.println("checking\n");
27    uint32_t temp = 0;
28    for (int i = 0; i < 4; ++i) {
29      temp = start[i];
30      temp *= (uint32_t)0xcafebeef;
31      temp += (uint32_t)gen_random();
32      temp *= (uint32_t)0xfacefeed;
33      temp ^= (uint32_t)gen_random();
34
35      if ((uint32_t)temp != (uint32_t)STATE[i]) {
36        return 0;
37      }
38    }
39    return 1;
40}
41
42void loop() {
43  
44  memset(user_input,0,MAX_SIZE);
45  memset(start, 0, 16);
46
47  Serial.println("Enter your password: ");
48
49  while (Serial.available() == 0) {
50    delay(100);
51  }
52
53  Serial.readBytes(user_input, MAX_SIZE);
54  
55  Serial.println();
56  for (int i = 0; i < 4; i++) {
57    
58    start[i] |= ((uint32_t)user_input[(i * 4)]   << 24);
59    start[i] |= ((uint32_t)user_input[(i * 4)+1] << 16);
60    start[i] |= ((uint32_t)user_input[(i * 4)+2] << 8);
61    start[i] |= ((uint32_t)user_input[(i * 4)+3] << 0);
62
63    Serial.println(start[i],HEX);
64  }
65
66  if (check_pass(start) == 1) {
67    Serial.print("Thats it!\r\nSubmit in the format FLAG{");
68    for (int i = 0; i < 4; i++) {
69          Serial.print(start[i],HEX);
70    }
71    Serial.println("}");
72    while (true) { delay(1000); }
73  }
74
75  // Failed, just spin
76  Serial.println("Incorrect password!");
77  while (true) {delay(1000); }
78}

 1#define MAX_SIZE 32
 2
 3a = 1103515245;
 4c = 12345;
 5m = 2147483647;
 6seed = 1337;
 7
 8STATE = [0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116]
 9
10MOD = 2**32
11
12def inv(x):
13    # 计算模 2^32 下的乘法逆元
14    return pow(x, -1, MOD)
15
16inv_CAFE = inv(0xcafebeef)
17inv_FACE = inv(0xfacefeed)
18
19
20def gen_random():
21    global seed
22    seed = ((a * seed + c)% MOD) % m
23    print(hex(seed))
24    return seed
25
26# 每组两次随机，总共8组，所以循环八次
27rands = []
28for _ in range(8):
29    rands.append(gen_random())
30
31# 然后每段特征码和密钥，随机数反解密码
32start=[]
33for i in range(4):
34    r1 = rands[i * 2]
35    r2 = rands[i * 2 + 1]
36    temp = STATE[i] ^ r2
37    temp = (temp * inv_FACE) % MOD
38    temp = (temp-r1) % MOD
39    start_i=(temp * inv_CAFE) % MOD
40    start.append(start_i)
41
42# 转换成字节
43flag_bytes = b""
44for val in start:
45    flag_bytes += val.to_bytes(4, byteorder='big')
46
47
48print("Recovered input:", flag_bytes.hex())
49print("flag{", end="")
50for val in start:
51    print(f"{val:08x}", end="")
52print("}")

 1from z3 import *
 2a = 1103515245
 3c = 12345
 4m = 2147483647
 5seed = 1337
 6MOD=1 << 32
 7STATE = [0x1e48add6, 0xaaa7550c, 0x18df53bf, 0xe6af1116]
 8flag = [BitVec(f'start_{i}', 32) for i in range(4)]
 9CAFE = 0xcafebeef
10FACE = 0xfacefeed
11
12s = Solver()
13def gen_random():
14    global seed
15    seed = ((a * seed + c)% MOD) % m
16    return seed
17
18seeds=[]
19for _ in range(8):
20    seeds.append(gen_random())
21
22for i in range(4):
23    temp=flag[i]
24    temp = (temp * CAFE)% MOD
25    temp = (temp + seeds[i * 2]) % MOD
26    temp = (temp * FACE) % MOD
27    temp = (temp ^ seeds[i * 2 + 1]) % MOD
28    s.add(temp==STATE[i])
29
30# Check for solution
31if s.check() == sat:
32    model = s.model()
33    result_start = [model.eval(flag[i]).as_long() for i in range(4)]
34    user_input = bytearray()
35    for value in result_start:
36        user_input.extend(value.to_bytes(4, 'big'))
37    print("Correct input (in hex):", user_input.hex().upper())
38else:
39    print("No solution found")

 1import gmpy2
 2import rsa
 3
 4e = 65537
 5n = 86934482296048119190666062003494800588905656017203025617216654058378322103517
 6p = 285960468890451637935629440372639283459
 7q = 304008741604601924494328155975272418463
 8
 9phin = (q - 1) * (p - 1)
10d = gmpy2.invert(e, phin)
11
12key = rsa.PrivateKey(n, e, int(d), p, q)
13
14with open("C:\\Users\\Mr.Wu\\Desktop\\rsa1\\flag.enc", "rb+") as f:
15    f = f.read()
16    print(rsa.decrypt(f, key))