CGVN - Codegate 2024 Finals

吉里吉里Zで実装したプログラムが与えられる

しかしデコンパイル結果は結構間違っているので注意

code:python

# username ?

# final_word ?

# ctfname Codegate

def check(username, final_word, ctfname):

username = _0x20a518(username) # maybe 8 byte

final_word = _0x20a518(final_word)

ctfname = _0x20a518('Codegate') # 8 byte

return _0x269b08(username, final_word, ctfname, 12307354521613678656, 2224992992374123453)

def NOT(v):

return 0xffffffff_ffffffff - v

def _0x9454c1(p3, p4):

return (p3 + p4) & 4294967295;

def _0x1d45e8(p3, p4, p5, p6, p7, p8):

p4 = _0x9454c1(_0x9454c1(p4, p3), _0x9454c1(p6, p8));

return _0x9454c1((p4 << p7) | (p4 >> (32 - p7)), p5);

def _0x1de0e5(p3, p4, p5, p6, p7, p8, p9):

return _0x1d45e8((p4 & p5) | (NOT(p4) & p6), p3, p4, p7, p8, p9);

def _0x3838c1(p3, p4, p5, p6, p7, p8, p9):

return _0x1d45e8((p4 & p6) | (p5 & NOT(p6)), p3, p4, p7, p8, p9);

def _0x192f23(p3, p4, p5, p6, p7, p8, p9):

return _0x1d45e8(p4 ^ p5 ^ p6, p3, p4, p7, p8, p9);

def _0x51b732(p3, p4, p5, p6, p7, p8, p9):

return _0x1d45e8(p5 ^ (p4 | NOT(p6)), p3, p4, p7, p8, p9);

def _0x4a21e0(p3, p4):

v6 = p3 >> 32;

v7 = p3 & 4294967295;

v8 = p4 >> 32;

v9 = p4 & 4294967295;

ret = ((_0x9454c1(v7, p3 & 0xffffffff) ^ _0x9454c1(v9, p4 & 0xffffffff)) << 32) | (_0x9454c1(v6, p3 >> 32) ^ _0x9454c1(v8, p4 >> 32));

return ret

def _0xf394f3(p3):

v5 = p3 & 0xff

v6 = (p3 >> 8) & 0xff

v7 = (p3 >> 16) & 0xff

v8 = (p3 >> 24) & 0xff

v9 = (p3 >> 32) & 0xff

v10 = (p3 >> 40) & 0xff

v11 = (p3 >> 48) & 0xff

v12 = (p3 >> 56) & 0xff

return v13

def rev_0xf394f3(p3):

v5 = v4.index(p3 & 0xff)

v6 = v4.index((p3 >> 8) & 0xff)

v7 = v4.index((p3 >> 16) & 0xff)

v8 = v4.index((p3 >> 24) & 0xff)

v9 = v4.index((p3 >> 32) & 0xff)

v10 = v4.index((p3 >> 40) & 0xff)

v11 = v4.index((p3 >> 48) & 0xff)

v12 = v4.index((p3 >> 56) & 0xff)

v13 = v9 | (v11 << 8) | (v8 << 16) | (v7 << 24) | (v5 << 32) | (v12 << 40) | (v6 << 48) | (v10 << 56)

return v13

def _0x14d338(p3):

v4 = ((p3 & 255) << 56) | (p3 >> 8);

return _0x1b516f(p3, v4) & 0xffffffffffffffff

def _0x1b516f(p3, p4):

v1 = (((p3 ^ p4) * p4) >> 32)

v2 = ((v1 * p3 * p3) & 0xff00ff00ff00ff)

v3 = (((v2 * p4) << 32) ^ p3)

v4 = ((v3 * p4) & 0xff00ff00ff00ff00)

v5 = ((v4 * p4) ^ p3)

return (v5 * p4) ^ p3

def _0x269b08(p3, p4, p5, p6, p7):

v9 = 0

for v10 in range(13100):

p3 = _0xf394f3(p3)

v9 = _0x4a21e0(p3 - p4, p5)

p3 += v9

p4 += v9

p5 = _0x14d338(p5)

p3 = _0xf394f3(p3)

print('p3, p6', p3, p6)

print('p4, p7', p4, p7)

return p3 == p6 or p4 == p7

def rev_0x269b08(p5, p6, p7):

p5s = []

for _ in range(13100):

p5s.append(p5)

p5 = _0x14d338(p5)

p3 = p6

p4 = p7

p3 = rev_0xf394f3(p3)

for v10 in range(13100):

v9 = _0x4a21e0(p3 - p4, p5)

p3 -= v9

p4 -= v9

p3 = rev_0xf394f3(p3)

return p3, p4

def _0x20a518(s):

if len(s) != 8:

return 0

res = 0

for c in s:

res = res * 256

if c not in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789":

res += 0xff

else:

res += "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".index(c)

return res

def rev_0x20a518(x):

res = ''

while x != 0 and x != -1:

x //= 256

return res

ctfname = _0x20a518('Codegate')

username, final_word = rev_0x269b08(ctfname, 12307354521613678656, 2224992992374123453)

print(hex(username), hex(final_word))

print(rev_0x20a518(username), rev_0x20a518(final_word))

print(_0x269b08(username, final_word, ctfname, 12307354521613678656, 2224992992374123453))