<?xml version="1.0" encoding="utf-8" standalone="yes"?><?xml-stylesheet href="/scripts/pretty-feed-v3.xsl" type="text/xsl"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:h="http://www.w3.org/TR/html4/"><channel><title>Hack Your Heart</title><link>https://h4cker.zip/tags/upx/</link><description>临渊羡鱼，不如退而结网</description><generator>Hugo 0.168.0</generator><language>en</language><atom:link href="https://h4cker.zip/tags/upx/rss.xml" rel="self" type="application/rss+xml"/><lastBuildDate>Thu, 09 Oct 2025 10:15:20 +0800</lastBuildDate><item><title>2025 “招商铸盾” 智能网联汽车攻防赛Writeup</title><link>https://h4cker.zip/94d1dd/</link><pubDate>Thu, 09 Oct 2025 10:15:20 +0800</pubDate><guid isPermaLink="true">https://h4cker.zip/94d1dd/</guid><description/><content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>之前的之江铸网有个车联网，没来得及参加，也没流出附件和wp，这次通过狼组的附件做一下，当然还是通过wp学习</p>
<p>不过这个WP为什么都是常规CTF题的啊，iov只有附件没有wp</p>
<blockquote>
<p>2025“招商铸盾”智能网联汽车攻防赛是由招商局检测车辆技术研究院有限公司主办的面向智能网联汽车领域的安全攻防活动。</p>
</blockquote>
<h2 id="misc">MISC<a class="anchor" href="#misc">#</a></h2>
<h3 id="日志审计-8-19">日志审计-8-19<a class="anchor" href="#日志审计-8-19">#</a></h3>
<p>可能是让找哪个恶意IP登录了Admin吧，根据格式，搜索<code>Accepted password for root from</code>就俩IP有这个一个是root，一个是admin用户，那个IP就是恶意，不过狼组居然提取所有IP扔微步里，没想到。微步普通用户好像不能上传ioc判断是否恶意了。</p>
<p>另一个数独题没附件。</p>
<h2 id="crypto">Crypto<a class="anchor" href="#crypto">#</a></h2>
<h3 id="这是古典密码">这是古典密码<a class="anchor" href="#这是古典密码">#</a></h3>
<div class="code-block highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="ln">1</span><span class="cl">YWlweHs4MjNqNTZwMzdhcDkycDkzcGQ0ZzdhZDZhMHAwMXAyMX0=</span></span></code></pre><span class="language ps-1 pe-3 text-sm bg-muted text-muted-foreground">text</span><button class="copy text-muted-foreground p-1 box-content border rounded-lg bg-card" aria-label="Copy code"><div class="ready"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M15 2c.683 0 1.287.343 1.647.866l.085.134H18a2 2 0 0 1 1.995 1.85L20 5v12a5 5 0 0 1-4.783 4.995L15 22H6a2 2 0 0 1-1.995-1.85L4 20V5a2 2 0 0 1 1.85-1.995L6 3h1.268a2 2 0 0 1 1.563-.993L9 2zM7 5H6v15h9a3 3 0 0 0 3-3V5h-1a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2m5 9a1 1 0 0 1 .117 1.993L12 16H9a1 1 0 0 1-.117-1.993L9 14zm3-4a1 1 0 1 1 0 2H9a1 1 0 1 1 0-2zm0-6H9v1h6z"></path></g></svg>
</div><div class="success hidden"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M13.586 2A2 2 0 0 1 15 2.586L19.414 7A2 2 0 0 1 20 8.414V20a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2zM12 4H6v16h12V10h-4.5A1.5 1.5 0 0 1 12 8.5zm1.59 8.657a1 1 0 0 1 1.415 1.414l-3.111 3.112a1.1 1.1 0 0 1-1.556 0l-1.343-1.344a1 1 0 0 1 1.414-1.414l.707.707ZM14 4.414V8h3.586z"></path></g></svg>
</div></button></div>
<p>base64解开是个仿射密码，仿射密码是根据函数加密的：</p>
<span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>E</mi><mo stretchy="false">(</mo><mi>x</mi><mo stretchy="false">)</mo><mo>=</mo><mo stretchy="false">(</mo><mi>a</mi><mi>x</mi><mo>+</mo><mi>b</mi><mo stretchy="false">)</mo><mtext> </mtext><mo lspace="0.22em" rspace="0.22em"><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow></mo><mtext> </mtext><mi>m</mi></mrow><annotation encoding="application/x-tex">
E(x)=(ax+b)\bmod{m}
</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="katex-base"><span class="katex-strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal" style="margin-right:0.0576em;">E</span><span class="mopen">(</span><span class="mord mathnormal">x</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">(</span><span class="mord mathnormal">a</span><span class="mord mathnormal">x</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal">b</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:0.4306em;"></span><span class="mord"><span class="mord mathnormal">m</span></span></span></span></span></span><ul>
<li><em>a</em> 和 <em>m</em> 互质</li>
<li><em>m</em> 是字母的数目</li>
</ul>
<p>解密函数是：</p>
<span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>D</mi><mo stretchy="false">(</mo><mi>x</mi><mo stretchy="false">)</mo><mo>=</mo><msup><mi>a</mi><mrow><mo>−</mo><mn>1</mn></mrow></msup><mo stretchy="false">(</mo><mi>x</mi><mo>−</mo><mi>b</mi><mo stretchy="false">)</mo><mtext> </mtext><mo lspace="0.22em" rspace="0.22em"><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow></mo><mtext> </mtext><mi>m</mi></mrow><annotation encoding="application/x-tex">
D(x)=a^{-1}(x-b)\bmod{m}
</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="katex-base"><span class="katex-strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal" style="margin-right:0.0278em;">D</span><span class="mopen">(</span><span class="mord mathnormal">x</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:1.1141em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="katex-sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">1</span></span></span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">x</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal">b</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="katex-base"><span class="katex-strut" style="height:0.4306em;"></span><span class="mord"><span class="mord mathnormal">m</span></span></span></span></span></span><p><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><msup><mi>a</mi><mrow><mo>−</mo><mn>1</mn></mrow></msup></mrow><annotation encoding="application/x-tex">a^{−1}</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="katex-base"><span class="katex-strut" style="height:0.8141em;"></span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8141em;"><span style="top:-3.063em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="katex-sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">1</span></span></span></span></span></span></span></span></span></span></span></span>是 a 在 <span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><msub><mi mathvariant="double-struck">Z</mi><mi>m</mi></msub></mrow><annotation encoding="application/x-tex">\mathbb{Z}_m</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="katex-base"><span class="katex-strut" style="height:0.8389em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.1514em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="katex-sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">m</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> 群的乘法逆元</p>
<p>注意：<em>x</em> 是字母的次序，以 0 为开始</p>
<p>这里使用爆破，把每种可能都输出，狼组的脚本很好，不用任何库，26位直接遍历逆元，虽然没有验证互质。但是很简洁。</p>
<p>用我的思路，我还是会用库的：</p>
<div class="code-block highlight collapsed"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="ln"> 1</span><span class="cl"><span class="kn">import</span> <span class="nn">gmpy2</span>
</span></span><span class="line"><span class="ln"> 2</span><span class="cl"><span class="c1"># 解密函数</span>
</span></span><span class="line"><span class="ln"> 3</span><span class="cl"><span class="k">def</span> <span class="nf">affine_decrypt</span><span class="p">(</span><span class="n">ciphertext</span><span class="p">,</span><span class="n">a</span><span class="p">,</span><span class="n">b</span><span class="p">):</span>
</span></span><span class="line"><span class="ln"> 4</span><span class="cl">    <span class="n">plaintext</span><span class="o">=</span><span class="s1">&#39;&#39;</span>
</span></span><span class="line"><span class="ln"> 5</span><span class="cl">    <span class="n">inver_a</span><span class="o">=</span><span class="n">gmpy2</span><span class="o">.</span><span class="n">invert</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="mi">26</span><span class="p">)</span>
</span></span><span class="line"><span class="ln"> 6</span><span class="cl">    <span class="k">for</span> <span class="n">char</span> <span class="ow">in</span> <span class="n">ciphertext</span><span class="p">:</span>
</span></span><span class="line"><span class="ln"> 7</span><span class="cl">        <span class="k">if</span> <span class="n">char</span><span class="o">.</span><span class="n">isalpha</span><span class="p">():</span>
</span></span><span class="line"><span class="ln"> 8</span><span class="cl">            <span class="c1"># 获取字母次序</span>
</span></span><span class="line"><span class="ln"> 9</span><span class="cl">            <span class="n">char_num</span> <span class="o">=</span> <span class="nb">ord</span><span class="p">(</span><span class="n">char</span><span class="p">)</span> <span class="o">-</span> <span class="nb">ord</span><span class="p">(</span><span class="s1">&#39;a&#39;</span><span class="p">)</span>
</span></span><span class="line"><span class="ln">10</span><span class="cl">            <span class="n">decrypted_char_num</span> <span class="o">=</span> <span class="p">(</span><span class="n">inver_a</span> <span class="o">*</span> <span class="p">(</span><span class="n">char_num</span> <span class="o">-</span> <span class="n">b</span><span class="p">))</span> <span class="o">%</span> <span class="mi">26</span>
</span></span><span class="line"><span class="ln">11</span><span class="cl">            <span class="c1"># 得到密文字母次序，要加上a的ascii才能得到此密文字母的ascii</span>
</span></span><span class="line"><span class="ln">12</span><span class="cl">            <span class="n">decrypted_char</span> <span class="o">=</span> <span class="nb">chr</span><span class="p">(</span><span class="n">decrypted_char_num</span> <span class="o">+</span> <span class="nb">ord</span><span class="p">(</span><span class="s1">&#39;a&#39;</span><span class="p">))</span>
</span></span><span class="line"><span class="ln">13</span><span class="cl">            <span class="n">plaintext</span> <span class="o">+=</span> <span class="n">decrypted_char</span>
</span></span><span class="line"><span class="ln">14</span><span class="cl">        <span class="k">else</span><span class="p">:</span>
</span></span><span class="line"><span class="ln">15</span><span class="cl">            <span class="n">plaintext</span> <span class="o">+=</span> <span class="n">char</span>
</span></span><span class="line"><span class="ln">16</span><span class="cl">    
</span></span><span class="line"><span class="ln">17</span><span class="cl">    <span class="k">return</span> <span class="n">plaintext</span>
</span></span><span class="line"><span class="ln">18</span><span class="cl">
</span></span><span class="line"><span class="ln">19</span><span class="cl"><span class="k">def</span> <span class="nf">brute_force</span><span class="p">(</span><span class="n">ciphertext</span><span class="p">):</span>
</span></span><span class="line"><span class="ln">20</span><span class="cl">    <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">1</span><span class="p">,</span> <span class="mi">26</span><span class="p">):</span>
</span></span><span class="line"><span class="ln">21</span><span class="cl">        <span class="k">for</span> <span class="n">b</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">26</span><span class="p">):</span>
</span></span><span class="line"><span class="ln">22</span><span class="cl">            <span class="k">if</span> <span class="n">gmpy2</span><span class="o">.</span><span class="n">gcd</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="mi">26</span><span class="p">)</span><span class="o">==</span><span class="mi">1</span><span class="p">:</span>
</span></span><span class="line"><span class="ln">23</span><span class="cl">                <span class="n">plaintext</span> <span class="o">=</span> <span class="n">affine_decrypt</span><span class="p">(</span><span class="n">ciphertext</span><span class="p">,</span> <span class="n">a</span><span class="p">,</span> <span class="n">b</span><span class="p">)</span>
</span></span><span class="line"><span class="ln">24</span><span class="cl">                <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s2">&#34;参数：a=</span><span class="si">{</span><span class="n">a</span><span class="si">}</span><span class="s2">，b=</span><span class="si">{</span><span class="n">b</span><span class="si">}</span><span class="s2"> 解密：</span><span class="si">{</span><span class="n">plaintext</span><span class="si">}</span><span class="s2">&#34;</span><span class="p">)</span>
</span></span><span class="line"><span class="ln">25</span><span class="cl">                <span class="c1"># 输出太多还要搜索，这里设置如果是flag开头直接停止函数</span>
</span></span><span class="line"><span class="ln">26</span><span class="cl">                <span class="k">if</span> <span class="n">plaintext</span><span class="p">[:</span><span class="mi">4</span><span class="p">]</span><span class="o">==</span><span class="s2">&#34;flag&#34;</span><span class="p">:</span>
</span></span><span class="line"><span class="ln">27</span><span class="cl">                    <span class="k">return</span> <span class="mi">0</span>
</span></span><span class="line"><span class="ln">28</span><span class="cl">            <span class="k">else</span><span class="p">:</span>
</span></span><span class="line"><span class="ln">29</span><span class="cl">                <span class="k">continue</span>
</span></span><span class="line"><span class="ln">30</span><span class="cl">
</span></span><span class="line"><span class="ln">31</span><span class="cl"><span class="n">ciphertext</span> <span class="o">=</span> <span class="s1">&#39;aipx</span><span class="si">{823j56p37ap92p93pd4g7ad6a0p01p21}</span><span class="s1">&#39;</span>
</span></span><span class="line"><span class="ln">32</span><span class="cl"><span class="n">brute_force</span><span class="p">(</span><span class="n">ciphertext</span><span class="p">)</span></span></span></code></pre><span class="language ps-1 pe-3 text-sm bg-muted text-muted-foreground">python</span><button class="copy text-muted-foreground p-1 box-content border rounded-lg bg-card" aria-label="Copy code"><div class="ready"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M15 2c.683 0 1.287.343 1.647.866l.085.134H18a2 2 0 0 1 1.995 1.85L20 5v12a5 5 0 0 1-4.783 4.995L15 22H6a2 2 0 0 1-1.995-1.85L4 20V5a2 2 0 0 1 1.85-1.995L6 3h1.268a2 2 0 0 1 1.563-.993L9 2zM7 5H6v15h9a3 3 0 0 0 3-3V5h-1a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2m5 9a1 1 0 0 1 .117 1.993L12 16H9a1 1 0 0 1-.117-1.993L9 14zm3-4a1 1 0 1 1 0 2H9a1 1 0 1 1 0-2zm0-6H9v1h6z"></path></g></svg>
</div><div class="success hidden"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M13.586 2A2 2 0 0 1 15 2.586L19.414 7A2 2 0 0 1 20 8.414V20a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2zM12 4H6v16h12V10h-4.5A1.5 1.5 0 0 1 12 8.5zm1.59 8.657a1 1 0 0 1 1.415 1.414l-3.111 3.112a1.1 1.1 0 0 1-1.556 0l-1.343-1.344a1 1 0 0 1 1.414-1.414l.707.707ZM14 4.414V8h3.586z"></path></g></svg>
</div></button><button class="collapse-toggle bg-card text-muted-foreground rounded-lg m-2" aria-label="Toggle collapse code block"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="M24 0v24H0V0zM12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.019-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="m11 17.243l-3.95-3.95a1 1 0 1 0-1.414 1.414l5.657 5.657a1 1 0 0 0 1.414 0l5.657-5.657a1 1 0 0 0-1.414-1.414L13 17.243V4a1 1 0 1 0-2 0z"></path></g></svg>
<span class="desc"> code</span></button><div class="collapse-fade"></div></div>
<p>不同在于，添加了互质校验，检测到flag开头直接停止，不用再搜索。如果是大小写字母加数字的，m实际上就从26变成了 26+26+10=62</p>
<h2 id="re">Re<a class="anchor" href="#re">#</a></h2>
<h3 id="gogogo">gogogo<a class="anchor" href="#gogogo">#</a></h3>
<p>Go写的，而且UPX标识不全。所以需要补全，然后脱壳。</p>
<p>补全后，可以手动脱壳，也可以用upx脱壳。</p>
<p>这个知识点在 无名侠在看雪的《IDA特训营》课程学过</p>
<p>缺少了字母P，ASCII是80，十六进制是50，补上两个就行，然后upx脱壳：</p>
<div class="code-block highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="ln">1</span><span class="cl">upx -d test.exe</span></span></code></pre><span class="language ps-1 pe-3 text-sm bg-muted text-muted-foreground">cmd</span><button class="copy text-muted-foreground p-1 box-content border rounded-lg bg-card" aria-label="Copy code"><div class="ready"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M15 2c.683 0 1.287.343 1.647.866l.085.134H18a2 2 0 0 1 1.995 1.85L20 5v12a5 5 0 0 1-4.783 4.995L15 22H6a2 2 0 0 1-1.995-1.85L4 20V5a2 2 0 0 1 1.85-1.995L6 3h1.268a2 2 0 0 1 1.563-.993L9 2zM7 5H6v15h9a3 3 0 0 0 3-3V5h-1a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2m5 9a1 1 0 0 1 .117 1.993L12 16H9a1 1 0 0 1-.117-1.993L9 14zm3-4a1 1 0 1 1 0 2H9a1 1 0 1 1 0-2zm0-6H9v1h6z"></path></g></svg>
</div><div class="success hidden"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M13.586 2A2 2 0 0 1 15 2.586L19.414 7A2 2 0 0 1 20 8.414V20a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2zM12 4H6v16h12V10h-4.5A1.5 1.5 0 0 1 12 8.5zm1.59 8.657a1 1 0 0 1 1.415 1.414l-3.111 3.112a1.1 1.1 0 0 1-1.556 0l-1.343-1.344a1 1 0 0 1 1.414-1.414l.707.707ZM14 4.414V8h3.586z"></path></g></svg>
</div></button></div>
<p>IDA打开就是Go的典型入口点：<code>_rt0_amd64_windows</code>，不过没什么用，看main函数：<code>main.main</code>：</p>
<div class="code-block highlight collapsed"><pre tabindex="0" class="chroma"><code class="language-go" data-lang="go"><span class="line"><span class="ln"> 1</span><span class="cl"><span class="c1">// main.main</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 2</span><span class="cl"><span class="nx">void</span><span class="w"> </span><span class="nx">__fastcall</span><span class="w"> </span><span class="nf">main_main</span><span class="p">()</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 3</span><span class="cl"><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 4</span><span class="cl"><span class="w">  </span><span class="kt">string</span><span class="w"> </span><span class="o">*</span><span class="nx">v0</span><span class="p">;</span><span class="w"> </span><span class="c1">// rcx</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 5</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">v1</span><span class="p">;</span><span class="w"> </span><span class="c1">// rax</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 6</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">r1</span><span class="p">;</span><span class="w"> </span><span class="c1">// rdx</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 7</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">r0</span><span class="p">;</span><span class="w"> </span><span class="c1">// rbx</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 8</span><span class="cl"><span class="w">  </span><span class="nx">retval_44A060</span><span class="w"> </span><span class="nx">v4</span><span class="p">;</span><span class="w"> </span><span class="c1">// kr00_16</span><span class="w">
</span></span></span><span class="line"><span class="ln"> 9</span><span class="cl"><span class="w">  </span><span class="nx">retval_449800</span><span class="w"> </span><span class="nx">v5</span><span class="p">;</span><span class="w"> </span><span class="c1">// kr10_16</span><span class="w">
</span></span></span><span class="line"><span class="ln">10</span><span class="cl"><span class="w">  </span><span class="nx">char</span><span class="w"> </span><span class="o">*</span><span class="nx">ptr</span><span class="p">;</span><span class="w"> </span><span class="c1">// rdi</span><span class="w">
</span></span></span><span class="line"><span class="ln">11</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">v7</span><span class="p">;</span><span class="w"> </span><span class="c1">// [rsp+0h] [rbp-68h]</span><span class="w">
</span></span></span><span class="line"><span class="ln">12</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">v8</span><span class="p">;</span><span class="w"> </span><span class="c1">// [rsp+8h] [rbp-60h]</span><span class="w">
</span></span></span><span class="line"><span class="ln">13</span><span class="cl"><span class="w">  </span><span class="nx">__int64</span><span class="w"> </span><span class="nx">v9</span><span class="p">;</span><span class="w"> </span><span class="c1">// [rsp+10h] [rbp-58h]</span><span class="w">
</span></span></span><span class="line"><span class="ln">14</span><span class="cl"><span class="w">  </span><span class="kt">string</span><span class="w"> </span><span class="o">*</span><span class="nx">p_string</span><span class="p">;</span><span class="w"> </span><span class="c1">// [rsp+18h] [rbp-50h]</span><span class="w">
</span></span></span><span class="line"><span class="ln">15</span><span class="cl"><span class="w">  </span><span class="nx">_QWORD</span><span class="w"> </span><span class="nx">v11</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span><span class="w"> </span><span class="c1">// [rsp+20h] [rbp-48h] BYREF</span><span class="w">
</span></span></span><span class="line"><span class="ln">16</span><span class="cl"><span class="w">  </span><span class="nx">_QWORD</span><span class="w"> </span><span class="nx">v12</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span><span class="w"> </span><span class="c1">// [rsp+30h] [rbp-38h] BYREF</span><span class="w">
</span></span></span><span class="line"><span class="ln">17</span><span class="cl"><span class="w">  </span><span class="nx">_QWORD</span><span class="w"> </span><span class="nx">v13</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span><span class="w"> </span><span class="c1">// [rsp+40h] [rbp-28h] BYREF</span><span class="w">
</span></span></span><span class="line"><span class="ln">18</span><span class="cl"><span class="w">  </span><span class="nx">_QWORD</span><span class="w"> </span><span class="nx">v14</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span><span class="w"> </span><span class="c1">// [rsp+50h] [rbp-18h] BYREF</span><span class="w">
</span></span></span><span class="line"><span class="ln">19</span><span class="cl"><span class="w">
</span></span></span><span class="line"><span class="ln">20</span><span class="cl"><span class="w">  </span><span class="nx">p_string</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="p">(</span><span class="kt">string</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="nf">runtime_newobject</span><span class="p">(</span><span class="o">&amp;</span><span class="nx">RTYPE_string</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">21</span><span class="cl"><span class="w">  </span><span class="nx">p_string</span><span class="o">-</span><span class="p">&gt;</span><span class="nx">ptr</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">22</span><span class="cl"><span class="w">  </span><span class="nx">v14</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">RTYPE__ptr_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">23</span><span class="cl"><span class="w">  </span><span class="nx">v14</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">p_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">24</span><span class="cl"><span class="w">  </span><span class="nf">fmt_Fscanf</span><span class="p">(</span><span class="nx">go_itab__os_File_io_Reader</span><span class="p">,</span><span class="w"> </span><span class="nx">os_Stdin</span><span class="p">,</span><span class="w"> </span><span class="s">&#34;%s&#34;</span><span class="p">,</span><span class="w"> </span><span class="mi">2</span><span class="p">,</span><span class="w"> </span><span class="nx">v14</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">25</span><span class="cl"><span class="w">  </span><span class="nx">v0</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">p_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">26</span><span class="cl"><span class="w">  </span><span class="k">if</span><span class="w"> </span><span class="p">(</span><span class="w"> </span><span class="nx">p_string</span><span class="o">-</span><span class="p">&gt;</span><span class="nx">len</span><span class="w"> </span><span class="o">==</span><span class="w"> </span><span class="mi">32</span><span class="w"> </span><span class="p">)</span><span class="w">
</span></span></span><span class="line"><span class="ln">27</span><span class="cl"><span class="w">  </span><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln">28</span><span class="cl"><span class="w">    </span><span class="nx">v1</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">29</span><span class="cl"><span class="w">    </span><span class="nx">r1</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">30</span><span class="cl"><span class="w">    </span><span class="nx">r0</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">31</span><span class="cl"><span class="w">    </span><span class="nf">while</span><span class="w"> </span><span class="p">(</span><span class="w"> </span><span class="nx">v1</span><span class="w"> </span><span class="p">&lt;</span><span class="w"> </span><span class="mi">32</span><span class="w"> </span><span class="p">)</span><span class="w">
</span></span></span><span class="line"><span class="ln">32</span><span class="cl"><span class="w">    </span><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln">33</span><span class="cl"><span class="w">      </span><span class="nx">ptr</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">v0</span><span class="o">-</span><span class="p">&gt;</span><span class="nx">ptr</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">34</span><span class="cl"><span class="w">      </span><span class="k">if</span><span class="w"> </span><span class="p">(</span><span class="w"> </span><span class="nx">v1</span><span class="w"> </span><span class="o">&gt;=</span><span class="w"> </span><span class="nx">v0</span><span class="o">-</span><span class="p">&gt;</span><span class="nx">len</span><span class="w"> </span><span class="p">)</span><span class="w">
</span></span></span><span class="line"><span class="ln">35</span><span class="cl"><span class="w">        </span><span class="nf">runtime_panicIndex</span><span class="p">(</span><span class="nx">v1</span><span class="p">,</span><span class="w"> </span><span class="nx">r0</span><span class="p">,</span><span class="w"> </span><span class="nx">v0</span><span class="o">-</span><span class="p">&gt;</span><span class="nx">len</span><span class="p">,</span><span class="w"> </span><span class="nx">ptr</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">36</span><span class="cl"><span class="w">      </span><span class="nx">v7</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">r1</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">37</span><span class="cl"><span class="w">      </span><span class="nx">v9</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">r0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">38</span><span class="cl"><span class="w">      </span><span class="nx">v8</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">v1</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">39</span><span class="cl"><span class="w">      </span><span class="nx">v4</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nf">runtime_intstring</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="p">(</span><span class="nx">unsigned</span><span class="w"> </span><span class="nx">__int8</span><span class="p">)((</span><span class="nx">v1</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="mi">1</span><span class="p">)</span><span class="w"> </span><span class="p">^</span><span class="w"> </span><span class="nx">ptr</span><span class="p">[</span><span class="nx">v1</span><span class="p">]));</span><span class="w">
</span></span></span><span class="line"><span class="ln">40</span><span class="cl"><span class="w">      </span><span class="nx">v5</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nf">runtime_concatstring2</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="nx">v9</span><span class="p">,</span><span class="w"> </span><span class="nx">v7</span><span class="p">,</span><span class="w"> </span><span class="nx">v4</span><span class="p">.</span><span class="nx">_r0</span><span class="p">,</span><span class="w"> </span><span class="nx">v4</span><span class="p">.</span><span class="nx">_r1</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">41</span><span class="cl"><span class="w">      </span><span class="nx">v0</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">p_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">42</span><span class="cl"><span class="w">      </span><span class="nx">r1</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">v5</span><span class="p">.</span><span class="nx">_r1</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">43</span><span class="cl"><span class="w">      </span><span class="nx">r0</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">v5</span><span class="p">.</span><span class="nx">_r0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">44</span><span class="cl"><span class="w">      </span><span class="nx">v1</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="nx">v8</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">45</span><span class="cl"><span class="w">    </span><span class="p">}</span><span class="w">
</span></span></span><span class="line"><span class="ln">46</span><span class="cl"><span class="w">    </span><span class="k">if</span><span class="w"> </span><span class="p">(</span><span class="w"> </span><span class="nx">r1</span><span class="w"> </span><span class="o">==</span><span class="w"> </span><span class="mi">31</span><span class="w"> </span><span class="o">&amp;&amp;</span><span class="w"> </span><span class="p">(</span><span class="nx">unsigned</span><span class="w"> </span><span class="nx">__int8</span><span class="p">)</span><span class="nf">runtime_memequal</span><span class="p">(</span><span class="nx">r0</span><span class="p">,</span><span class="w"> </span><span class="s">&#34;66a&lt;254?=??&gt;=&gt;k$u! r-&amp;t,/,(x~+z&#34;</span><span class="p">,</span><span class="w"> </span><span class="mi">31</span><span class="p">)</span><span class="w"> </span><span class="p">)</span><span class="w">
</span></span></span><span class="line"><span class="ln">47</span><span class="cl"><span class="w">    </span><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln">48</span><span class="cl"><span class="w">      </span><span class="nx">v12</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">RTYPE_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">49</span><span class="cl"><span class="w">      </span><span class="nx">v12</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">off_4DBE00</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">50</span><span class="cl"><span class="w">      </span><span class="nf">fmt_Fprintln</span><span class="p">(</span><span class="nx">go_itab__os_File_io_Writer</span><span class="p">,</span><span class="w"> </span><span class="nx">os_Stdout</span><span class="p">,</span><span class="w"> </span><span class="nx">v12</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">51</span><span class="cl"><span class="w">    </span><span class="p">}</span><span class="w">
</span></span></span><span class="line"><span class="ln">52</span><span class="cl"><span class="w">    </span><span class="k">else</span><span class="w">
</span></span></span><span class="line"><span class="ln">53</span><span class="cl"><span class="w">    </span><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln">54</span><span class="cl"><span class="w">      </span><span class="nx">v11</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">RTYPE_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">55</span><span class="cl"><span class="w">      </span><span class="nx">v11</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">off_4DBE10</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">56</span><span class="cl"><span class="w">      </span><span class="nf">fmt_Fprintln</span><span class="p">(</span><span class="nx">go_itab__os_File_io_Writer</span><span class="p">,</span><span class="w"> </span><span class="nx">os_Stdout</span><span class="p">,</span><span class="w"> </span><span class="nx">v11</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">57</span><span class="cl"><span class="w">    </span><span class="p">}</span><span class="w">
</span></span></span><span class="line"><span class="ln">58</span><span class="cl"><span class="w">  </span><span class="p">}</span><span class="w">
</span></span></span><span class="line"><span class="ln">59</span><span class="cl"><span class="w">  </span><span class="k">else</span><span class="w">
</span></span></span><span class="line"><span class="ln">60</span><span class="cl"><span class="w">  </span><span class="p">{</span><span class="w">
</span></span></span><span class="line"><span class="ln">61</span><span class="cl"><span class="w">    </span><span class="nx">v13</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">RTYPE_string</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">62</span><span class="cl"><span class="w">    </span><span class="nx">v13</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="w"> </span><span class="p">=</span><span class="w"> </span><span class="o">&amp;</span><span class="nx">off_4DBDF0</span><span class="p">;</span><span class="w">
</span></span></span><span class="line"><span class="ln">63</span><span class="cl"><span class="w">    </span><span class="nf">fmt_Fprintln</span><span class="p">(</span><span class="nx">go_itab__os_File_io_Writer</span><span class="p">,</span><span class="w"> </span><span class="nx">os_Stdout</span><span class="p">,</span><span class="w"> </span><span class="nx">v13</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w">
</span></span></span><span class="line"><span class="ln">64</span><span class="cl"><span class="w">  </span><span class="p">}</span><span class="w">
</span></span></span><span class="line"><span class="ln">65</span><span class="cl"><span class="p">}</span></span></span></code></pre><span class="language ps-1 pe-3 text-sm bg-muted text-muted-foreground">go</span><button class="copy text-muted-foreground p-1 box-content border rounded-lg bg-card" aria-label="Copy code"><div class="ready"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M15 2c.683 0 1.287.343 1.647.866l.085.134H18a2 2 0 0 1 1.995 1.85L20 5v12a5 5 0 0 1-4.783 4.995L15 22H6a2 2 0 0 1-1.995-1.85L4 20V5a2 2 0 0 1 1.85-1.995L6 3h1.268a2 2 0 0 1 1.563-.993L9 2zM7 5H6v15h9a3 3 0 0 0 3-3V5h-1a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2m5 9a1 1 0 0 1 .117 1.993L12 16H9a1 1 0 0 1-.117-1.993L9 14zm3-4a1 1 0 1 1 0 2H9a1 1 0 1 1 0-2zm0-6H9v1h6z"></path></g></svg>
</div><div class="success hidden"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M13.586 2A2 2 0 0 1 15 2.586L19.414 7A2 2 0 0 1 20 8.414V20a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2zM12 4H6v16h12V10h-4.5A1.5 1.5 0 0 1 12 8.5zm1.59 8.657a1 1 0 0 1 1.415 1.414l-3.111 3.112a1.1 1.1 0 0 1-1.556 0l-1.343-1.344a1 1 0 0 1 1.414-1.414l.707.707ZM14 4.414V8h3.586z"></path></g></svg>
</div></button><button class="collapse-toggle bg-card text-muted-foreground rounded-lg m-2" aria-label="Toggle collapse code block"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="M24 0v24H0V0zM12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.019-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="m11 17.243l-3.95-3.95a1 1 0 1 0-1.414 1.414l5.657 5.657a1 1 0 0 0 1.414 0l5.657-5.657a1 1 0 0 0-1.414-1.414L13 17.243V4a1 1 0 1 0-2 0z"></path></g></svg>
<span class="desc"> code</span></button><div class="collapse-fade"></div></div>
<p>逻辑：</p>
<ul>
<li>程序从标准输入读取一个字符串</li>
<li>如果字符串长度为31，则对每个字符进行处理： <code>(i+1) ^ char[i]</code></li>
<li>然后将处理结果与字符串 <code>66a&lt;254?=??&gt;=&gt;k$u! r-&amp;t,/,(x~+z</code> 进行比较</li>
</ul>
<p>反过来就行，代码：</p>
<div class="code-block highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="ln">1</span><span class="cl"><span class="n">s</span> <span class="o">=</span> <span class="s1">&#39;66a&lt;254?=??&gt;=&gt;k$u! r-&amp;t,/,(x~+z&#39;</span>
</span></span><span class="line"><span class="ln">2</span><span class="cl"><span class="n">result</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span>
</span></span><span class="line"><span class="ln">3</span><span class="cl"><span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">s</span><span class="p">)):</span>
</span></span><span class="line"><span class="ln">4</span><span class="cl">    <span class="n">result</span> <span class="o">+=</span> <span class="nb">chr</span><span class="p">((</span><span class="n">i</span><span class="o">+</span><span class="mi">1</span><span class="p">)</span> <span class="o">^</span> <span class="nb">ord</span><span class="p">(</span><span class="n">s</span><span class="p">[</span><span class="n">i</span><span class="p">]))</span>
</span></span><span class="line"><span class="ln">5</span><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">result</span><span class="p">)</span></span></span></code></pre><span class="language ps-1 pe-3 text-sm bg-muted text-muted-foreground">python</span><button class="copy text-muted-foreground p-1 box-content border rounded-lg bg-card" aria-label="Copy code"><div class="ready"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M15 2c.683 0 1.287.343 1.647.866l.085.134H18a2 2 0 0 1 1.995 1.85L20 5v12a5 5 0 0 1-4.783 4.995L15 22H6a2 2 0 0 1-1.995-1.85L4 20V5a2 2 0 0 1 1.85-1.995L6 3h1.268a2 2 0 0 1 1.563-.993L9 2zM7 5H6v15h9a3 3 0 0 0 3-3V5h-1a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2m5 9a1 1 0 0 1 .117 1.993L12 16H9a1 1 0 0 1-.117-1.993L9 14zm3-4a1 1 0 1 1 0 2H9a1 1 0 1 1 0-2zm0-6H9v1h6z"></path></g></svg>
</div><div class="success hidden"><svg
  aria-hidden="true"
  class="pure-icon size-5"
  width="22"
  height="22"
  viewBox="0 0 24 24"
  fill="currentColor"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"></path><path fill="currentColor" d="M13.586 2A2 2 0 0 1 15 2.586L19.414 7A2 2 0 0 1 20 8.414V20a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2zM12 4H6v16h12V10h-4.5A1.5 1.5 0 0 1 12 8.5zm1.59 8.657a1 1 0 0 1 1.415 1.414l-3.111 3.112a1.1 1.1 0 0 1-1.556 0l-1.343-1.344a1 1 0 0 1 1.414-1.414l.707.707ZM14 4.414V8h3.586z"></path></g></svg>
</div></button></div>
<p>输出：74b87337454200d4d33f80c4663dc5e</p>
<p>狼组的做法是，把字符串全部按ASCII转16进制。然后跟索引（01020304 ······）异或，也能得到答案。</p>
<h2 id="iov">IOV<a class="anchor" href="#iov">#</a></h2>
<h3 id="iov-vin交互">iov-vin交互<a class="anchor" href="#iov-vin交互">#</a></h3>
<p>jadx-gui打开，看到了源代码，它通过蓝牙协议发送VIN，首先java去除空格，然后native层的encrypt函数加密发送</p>
<p>流量包里是加密数据，过滤蓝牙协议用<code>btl2cap</code>，往下翻到有条流量带有data：<code>33303137323834663265643930333831343331316336386435313439626635633132</code></p>
<p>所以要去逆向native层的encrypt函数。</p>
<p>IDA看到是好像是RC4的改版，还没学到。</p>
<h3 id="iov-can-re">iov-CAN-RE<a class="anchor" href="#iov-can-re">#</a></h3>
<p>candump的流量，经典</p>
<p>0x733在跟0x73B交互，貌似多帧传输，</p>
<h2 id="小结">小结<a class="anchor" href="#小结">#</a></h2>
<p>web没容器，MISC少附件，Re还行，Pwn不会</p>
<p>给的另外4个附件，三个iov，一个AI对抗样本检测的，没有wp。</p>
<p>不像之前的VSEC或者其他人题目都是车相关的，国内的汽车安全CTF貌似传统CTF还是占了半壁江山。</p>
]]></content:encoded><h:img src="https://h4cker.zip/94d1dd/2025vcuhvudy.webp"/><enclosure url="https://h4cker.zip/94d1dd/2025vcuhvudy.webp"/><category>CAN</category><category>UPX</category><category>仿射密码</category></item></channel></rss>