import base64 list=['e','3','n','i','f','I','H','9','b','_','C','@','n','@','d','H','0'] for i in range(len(list)): list[i]=chr(ord(list[i])-i) a=''.join(list) print( base64.b64decode(a).decode('utf-8'))
#include<stdio.h> intmain() { char key[] = "adsfkndcls"; char text[] = "killshadow"; int i; int v3=10;/ for (int i = 0; i < 10; i++) { for (int j = 0; j < 128; j++) { if (j < 'A' || j > 'z' || j > 'Z' && j < 'a') { continue; } if ((j - 39 - key[v3 % 10] + 97) % 26 + 97 == text[i]) { printf("%c",j); v3++; break; } } } }
1 2 3 4 5 6 7 8 9 10
text='killshadow'
key= 'ADSFKNDCLS'.lower()
for x inrange(0,10): for j inrange (0,128): if (j<=96and j>122or j>64and j<=90 ): if (((j - 39 - ord(key[x]) + 97) % 26 + 97 )== ord(text[x])): print(chr(j),end='')
Java逆向解密
jadx打开即可
1 2 3 4 5
KEY = [180, 136, 137, 147, 191, 137, 147, 191, 148, 136, 133, 191, 134, 140, 129, 135, 191, 65] for i inrange(len(KEY)): for x inrange (0,127): if (x+64)^32==KEY[i]: print(chr(x),end='')
[GXYCTF2019]luck_guy1
因为switch里是随机数，所以得出flag靠运气23333
执行顺序case4->case5->case1
解题脚本
1 2 3 4 5 6 7 8 9
f2=[0x7F,0x66,0x6F,0x60,0x67,0x75,0x63,0x69][::-1] flag = 'GXY{do_not_' for x inrange(0,8): if x%2==1: f2[x]-=2 else: f2[x]-=1 flag+=chr(f2[x]) print(flag)
#include<stdio.h> intsub_4010F0(char *a1, int a2, int a3) // sub_4010F0((int)v7, 0, 10); { int result; // eax int i; // esi int v5; // ecx int v6; // edx
result = a3; for ( i = a2; i <= a3; a2 = i ) { v5 = i; v6 = a1[i]; if ( a2 < result && i < result ) { do { if ( v6 > a1[result] ) { if ( i >= result ) break; ++i; a1[v5] = a1[result]; if ( i >= result ) break; while ( a1[i] <= v6 ) { if ( ++i >= result ) goto LABEL_13; } if ( i >= result ) break; v5 = i; a1[result] = a1[i]; } --result; } while ( i < result ); } LABEL_13: a1[result] = v6; sub_4010F0(a1, a2, i - 1); result = a3; ++i; } return result; } intmain() { char v7[]="ZJSECaNH3ng"; sub_4010F0(v7, 0, 10); printf("%s",v7); }
for i inrange(len(code)-2,-1,-1): code[i] = chr(ord(code[i]) ^ ord(code[(i + 1)]))
for i inrange(len(code)): num = chr((ord(code[i])-i)%128) print(num,end='')
[ACTF新生赛2020]easyre1
upx脱壳
wp
1 2 3 4 5 6 7 8 9
v4 = [42,70,39,34,78,44,34,40,73,63,43,64] data_start__ = chr(0x7E)+"}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)(" + chr(0x27) + '&%$# !"' flag = "" for i in v4: for j inrange(len(data_start__)): if i==ord(data_start__[j]): flag+=chr(j+1) print(flag)
[ACTF新生赛2020]rome1
1 2 3 4 5 6 7 8 9 10 11 12 13
v12='Qsw3sj_lz4_Ujw@l'
for i inrange(16): for j inrange(0,128): key=j if j > 64and j <= 90: j=(j-51)%26+65 if j>96and j<=122: j= (j-79)%26 +97 if j == ord(v12[i]): print(chr(key),end='')
model = "abcdefghijklmnopqrstuvwxyz" str1 = "pvkq{m164675262033l4m49lnp7p9mnk28k75}" for i inrange(1,27): print("key=%d"%i) for s in str1: if s.isalpha(): n = model.find(s) s = model[n-i] print(s, end='') print('\n')
<!DOCTYPE Html /> <html> <head> <title>FLARE On 2017</title> </head> <body> <inputtype="text"name="flag"id="flag"value="Enter the flag" /> <inputtype="button"id="prompt"value="Click to check the flag" /> <scripttype="text/javascript"> document.getElementById("prompt").onclick = function () { var flag = document.getElementById("flag").value; var rotFlag = flag.replace(/[a-zA-Z]/g, function(c){returnString.fromCharCode((c <= "Z" ? 90 : 122) >= (c = c.charCodeAt(0) + 13) ? c : c - 26);}); if ("PyvragFvqrYbtvafNerRnfl@syner-ba.pbz" == rotFlag) { alert("Correct flag!"); } else { alert("Incorrect flag, rot again"); } } </script> </body> </html>
ROT13
(c <= "Z" ? 90 : 122) >= 确保加密后的字母仍在字母表范围内.
1 2 3 4 5 6 7 8 9 10 11
str1='PyvragFvqrYbtvafNerRnfl@syner-ba.pbz' result='' for x in str1: if'a' <= x <= 'z': result += chr((ord(x) - ord('a') - 13) % 26 + ord('a')) elif'A' <= x <= 'Z': result += chr((ord(x) - ord('A') - 13) % 26 + ord('A')) else: result += x
print(result)
[WUSTCTF2020]level11
1 2 3 4 5 6 7 8 9 10 11 12 13 14
f = open("output.txt",'r') i=1 whileTrue: tmp = f.readline() ifnot tmp: break tmp=int(tmp) if i & 1!= 0 : tmp=tmp>>i else: tmp=tmp/i i=i+1 print(chr(int(tmp)),end='')
print(len(key)) print(len(result)) flag=[0]*33 tmp='' for x inrange(0,33): tmp+=chr(key[x]^result[x]) for x inrange(33): flag[key[x]]=tmp[x] print("".join(flag))
[MRCTF2020]Xor
找到地址为401095的call调用的函数，将其反汇编为c代码，然后就可以将main函数反汇编。无法直接F5的原因：1.反编译器无法确定调用约定（the decompiler could not determine the calling convention） 2. 反编译器无法确定参数个数和类型
很简单的异或
1 2 3 4 5
key='MSAWB~FXZ:J:`tQJ"N@ bpdd}8g' flag='' for i inrange(0,27): flag+=chr(i^ord(key[i])) print(flag)
[ACTF新生赛2020]usualCrypt1
换表
1 2 3 4 5 6 7 8 9 10 11
key='zMXHz3TIgnxLxJhFAdtZn2fFk3lYCrtPC2l9' key=key.swapcase() print(key) base='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/' base=list(base) for i inrange (6,15): tmp=base[i] base[i]=base[i+10] base[i+10]=tmp print("".join(base))
