惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Cisco Talos Blog
Cisco Talos Blog
Martin Fowler
Martin Fowler
A
About on SuperTechFans
H
Help Net Security
F
Full Disclosure
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
IT之家
IT之家
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
阮一峰的网络日志
阮一峰的网络日志
WordPress大学
WordPress大学
H
Heimdal Security Blog
博客园_首页
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
T
Tailwind CSS Blog
Recent Announcements
Recent Announcements
B
Blog RSS Feed
Last Week in AI
Last Week in AI
V2EX - 技术
V2EX - 技术
The Register - Security
The Register - Security
Security Archives - TechRepublic
Security Archives - TechRepublic
G
GRAHAM CLULEY
美团技术团队
S
Securelist
MyScale Blog
MyScale Blog
Vercel News
Vercel News
L
LINUX DO - 最新话题
Hacker News: Ask HN
Hacker News: Ask HN
W
WeLiveSecurity
M
MIT News - Artificial intelligence
宝玉的分享
宝玉的分享
月光博客
月光博客
Attack and Defense Labs
Attack and Defense Labs
大猫的无限游戏
大猫的无限游戏
博客园 - Franky
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
Microsoft Security Blog
Microsoft Security Blog
I
InfoQ
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
Forbes - Security
Forbes - Security
罗磊的独立博客
O
OpenAI News
AI
AI
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
雷峰网
雷峰网
S
Security @ Cisco Blogs
MongoDB | Blog
MongoDB | Blog
Schneier on Security
Schneier on Security
P
Proofpoint News Feed
Webroot Blog
Webroot Blog
V
Visual Studio Blog

Yesterday17's Blog

2026 新年解密红包 / Melody Flag | Yesterday17's Blog 谈谈 Iori 的设计思路(二):如何实现一个 Showroom 录制工具? | Yesterday17's Blog 谈谈 Iori 的设计思路(一):从 Nico Timeshift 说起 | Yesterday17's Blog Iori Minyami 0.1.0 发布 | Yesterday17's Blog 2025 新年解密红包 / Melody Flag | Yesterday17's Blog 使用 Cloudflare Warp 解决罗森票务的海外登录问题 | Yesterday17's Blog How To Blog 04: The Astro v5 Era | Yesterday17's Blog 谈谈 tokio::select! 的公平性 | Yesterday17's Blog Learning Pingora 05 - Connect with TLS | Yesterday17's Blog Leaving Bytedance | Yesterday17's Blog 大橋彩香 AsiaTour「Reflection」上海公演 个人向记录 & Repo | Yesterday17's Blog Recoving from burnout - What happened? | Yesterday17 Yubikey 重建手册 | Yesterday17's Blog How To Blog 03: Heimus | Yesterday17's Blog 🪧 Blog Migration Accouncement | Yesterday17's Blog Learn Your IDE - VSCode 是如何仅重启插件的? | Yesterday17's Blog How To Blog 02: Astro❤️Password | Yesterday17's Blog How To Blog 01: Why, How, and the Future | Yesterday17's Blog Learning Pingora 04 - Establish L4 Connection | Yesterday17's Blog Learning Pingora 03 - Upstreams and Peers | Yesterday17's Blog Learning Pingora 02 - A Simple HTTP Server | Yesterday17's Blog Learning Pingora 01 - Getting Started | Yesterday17's Blog 2024 新年解密红包 / Melody Flag | Yesterday17's Blog 向新的一年飞驰——记录 2023 | Yesterday17's Blog 「サクラノ刻」对话选摘(2) | Yesterday17's Blog PGP Key Revocation 注销声明 | Yesterday17's Blog 「サクラノ刻」对话选摘(1) | Yesterday17's Blog 2023 新年解密红包 / Melody Flag | Yesterday17's Blog 『蒼の彼方のフォーリズム』通关感想 | Yesterday17's Blog 单显卡直通教程 | Yesterday17's Blog 对博客与笔记的思考 | Yesterday17's Blog Project Anni 之旅(3)自动化 Flutter 应用 CI/CD 上架流程 | Yesterday17's Blog AsobiStage 直接播放链接 | Yesterday17 如何在后分P时代进行投稿——sswa使用详解 | Yesterday17's Blog JSON RPC 与 LSP 协议基础 | Yesterday17's Blog Grajapa Shueisha / BookEnd 加密方式调查 | Yesterday17's Blog 【2022篇+WriteUp】如何再收一个新年红包? | Yesterday17's Blog 如何将良心云的良心功能清理干净 | Yesterday17's Blog 【油猴脚本】bilibili 投稿页面返回旧版+旧版页面强制允许分P上传 | Yesterday17's Blog Cloudr1v1 授权方式分析 | Yesterday17 Typora 1.0.2 逆向实录 | Yesterday17's Blog Project Anni 之旅(2)ValueAfterTable——toml-rs的实现与限制 | Yesterday17's Blog IPv4透明代理+IPv6 Passthrough——树莓派单臂软路由折腾记 | Yesterday17's Blog Chaos; Child 汉化补丁 神秘编码探索 | Yesterday17's Blog 镣铐与舞蹈——个性与共性之迷思 | Yesterday17's Blog Go 学习笔记 02 - 找准 io 之道 | Yesterday17's Blog NAT Slipstreaming v1 原理浅析 | Yesterday17's Blog 绕过「9-nine-」的 CDKEY 验证——KrkrPlugin 正(?)向实录 | Yesterday17's Blog 静流的青春纪念册——「サクラノ刻 -櫻の森の下を歩む-」体验版感言 | Yesterday17's Blog Project Anni 之旅 01 - 从 clap-builder 到 derive | Yesterday17's Blog 获取 アソビステージ 的实际播放链接 | Yesterday17's Blog 90 行 Rust 代码实现 AsyncTeeReader | Yesterday17's Blog 或许还算有价值一读的文章列表 | Yesterday17's Blog 从零开始的 Seedbox 之旅 | Yesterday17's Blog [随笔]技术型博客行文迷思(1) | Yesterday17's Blog 浅谈 git fetch 的工作方式 | Yesterday17's Blog 『ソーサレス*アライヴ! ~the World's End Fallen Star~』通关感想" | Yesterday17's Blog Rust std::fmt 格式语法简述 | Yesterday17's Blog 日亚修改居住国的解决方案 | Yesterday17's Blog [Windows/Linux] GC553 的 Switch 完美采集之路 | Yesterday17's Blog 【翻译】Subtyping and Variance / 子类型与变型 | Yesterday17's Blog Berd's Red Envelope 2021 WriteUp | Yesterday17's Blog 【中英对照】ALSA 音频 API 使用教程/A Tutorial on Using the ALSA Audio API | Yesterday17's Blog 从 cue_scanner.l 看 CUE Sheet 的词法单元 | Yesterday17's Blog Postman 历史记录导出的解决方案 | Yesterday17's Blog 《恋爱绮谭 不存在的夏天》通关感想 | Yesterday17's Blog [微机实验/TD-PITE] 微机接口综合实验 | Yesterday17's Blog [微机实验/TD-PITE] 键盘扫描及数码管显示实验 | Yesterday17's Blog [微机实验/TD-PITE] 数码管显示实验 | Yesterday17's Blog Airsonic Advanced+Google Drive+Caddy 部署纪实 | Yesterday17's Blog X-NUCA 2020 - hellowasm 题解 | Yesterday17's Blog [微机实验/TD-PITE] 8251 串行接口实验 | Yesterday17's Blog Node.js child_process.fork 与 env 污染 RCE | Yesterday17's Blog EP.01 「夜の向日葵」 | Yesterday17's Blog [微机实验/TD-PITE] 8254 定时/计数器实验+选做实验 | Yesterday17's Blog [JLU CTF/2020] babywasm WriteUp | Yesterday17's Blog PHP 反序列化与经典利用 | Yesterday17's Blog WebAssembly 逆向简述 | Yesterday17's Blog 『彼女、お借りします』一期完结点评 | Yesterday17's Blog [微机实验/TD-PITE] D/A 转换实验+选做实验 | Yesterday17's Blog [微机实验/TD-PITE] A/D 转换实验+选做实验 | Yesterday17's Blog 开源项目申请 JetBrains Open Source License 简单流程 | Yesterday17's Blog 微软拼音与 JetBrains 搜索快捷键冲突的解决方案 | Yesterday17's Blog [微机实验/TD-PITE] 8259 中断优先级实验+选做实验 | Yesterday17's Blog IFTTT 测试(续) | Yesterday17 IFTTT 测试 | Yesterday17's Blog [微机实验/TD-PITE] 存储器扩展实验+选做实验 | Yesterday17's Blog 新版 GCC 针对 -fdump-translation-unit 的替代方案 | Yesterday17's Blog 一次 HSTS 策略配置的排错之旅 | Yesterday17's Blog YukiNative 踩坑记——Windows 的消息队列 | Yesterday17's Blog 我是我自己——论获取 HTTPS 证书时的验证步骤 | Yesterday17's Blog 【设计文档】对 PUG 的大规模设计修订(1.1) | Yesterday17's Blog GS65 折腾记(2)加装固态,分区,Grub2 引导 Manjaro LiveCD | Yesterday17's Blog 「さくら、もゆ。」的空白字体列表——一次逆向问题定位过程实录 | Yesterday17's Blog GSuite 探索篇(1)使用 Service Account 向 Google Drive 传输文件 | Yesterday17's Blog 『サクラノ詩 -櫻の森の上を舞う-』通关感想 | Yesterday17's Blog 《ATRI -My Dear Moments-》通关感想 | Yesterday17's Blog [工具][VSCode 扩展] AegiKit——方便 Aegisub 使用的工具箱 | Yesterday17's Blog 贝塞尔曲线、字体矢量化与曲线运算 | Yesterday17's Blog NAT 类型初探 | Yesterday17's Blog
[Google CTF 2021] CPP WriteUp | Yesterday17's Blog
Yesterday17 · 2021-07-19 · via Yesterday17's Blog

clang-format --style='{IndentPPDirectives: AfterHash}' cpp.c

#if __INCLUDE_LEVEL__ > 12 一行开始,接下来就是大段的 #if S == xx。在每个 #if 之后紧跟的又是 #unset S#defineS,对应的是 S++。每个 S 对应一条不同的指令。

简单观察一条指令,不难发现其每次都会对 0-7 进行 define。比如上面截图里就 defineR0-R7。因此不难想到一个 R 其实是由 8 位构成的,即一个字节。因此之后的整理也就基本基于这个思路了。

#if __INCLUDE_LEVEL__ > 12

# if S == 0

# define S 24

# endif

# if S == 1

//# S++

//# R = !R

# endif

# if S == 2

//# S++

//# Z = 0b00000001

# endif

# if S == 3

//# S++

//# R = R + Z

# endif

# if S == 4

//# S++

//# R = R + Z

# endif

# if S == 5

//# S++

//# if R == 0 {

//# S = 38

//# }

# endif

# if S == 6

//# S++

//# R = R + Z

# endif

# if S == 7

//# S++

//# if R == 0 {

//# S = 59

//# }

# endif

# if S == 8

//# S++

//# R = R + Z

# endif

# if S == 9

//# S++

//# if R == 0 {

//# S = 59

//# }

# endif

# if S == 10

//# S++

# error "BUG"

# endif

# if S == 11

//# S = -1

# endif

# if S == 12

//# S++

//# X = 0b00000001

# endif

# if S == 13

//# S++

//# Y = 0

# endif

# if S == 14

//# S++

//# if X == 0 {

//# S = 22

//# }

# endif

# if S == 15

//# S++

//# Z = X

# endif

# if S == 16

//# S++

//# Z = Z & B

# endif

# if S == 17

//# S++

//# if Z == 0 {

//# S = 19

//# }

# endif

# if S == 18

//# S++

//# Y = Y + A

# endif

# if S == 19

//# S++

//# X = X + X

# endif

# if S == 20

//# S++

//# A = A + A

# endif

# if S == 21

//# S = 14

# endif

# if S == 22

//# S++

//# A = Y

# endif

# if S == 23

//# S = 1

# endif

# if S == 24

//# S++

//# I = 0

# endif

# if S == 25

//# S++

//# M = 0

# endif

# if S == 26

//# S++

//# N = 0b00000001

# endif

# if S == 27

//# S++

//# P = 0

# endif

# if S == 28

//# S++

//# Q = 0

# endif

# if S == 29

//# S++

//# B = 0b11100101

# endif

# if S == 30

//# S++

//# B = B + I

# endif

# if S == 31

//# S++

//# if B == 0 {

//# S = 56

//# }

# endif

# if S == 32

//# S++

//# B = 0b10000000

# endif

# if S == 33

//# S++

//# B = B + I

# endif

# if S == 34

//# S++

//# l = B

//# A = [l]

# endif

# if S == 35

//# S++

//# l = I

//# B = [l]

# endif

# if S == 36

//# S++

//# R = 0b00000001

# endif

# if S == 37

//# S = 12

# endif

# if S == 38

//# S++

//# O = M

# endif

# if S == 39

//# S++

//# O = O + N

# endif

# if S == 40

//# S++

//# M = N

# endif

# if S == 41

//# S++

//# N = O

# endif

# if S == 42

//# S++

//# A = A + M

# endif

# if S == 43

//# S++

//# B = 0b00100000

# endif

# if S == 44

//# S++

//# B = B + I

# endif

# if S == 45

//# S++

//# l = B

//# C = [l]

# endif

# if S == 46

//# S++

//# A = A ^ C

# endif

# if S == 47

//# S++

//# P = P + A

# endif

# if S == 48

//# S++

//# B = 0b01000000

# endif

# if S == 49

//# S++

//# B = B + I

# endif

# if S == 50

//# S++

//# l = B

//# A = [l]

# endif

# if S == 51

//# S++

//# A = P ^ A

# endif

# if S == 52

//# S++

//# Q = Q | A

# endif

# if S == 53

//# S++

//# A = 0b00000001

# endif

# if S == 54

//# S++

//# I = A + I

# endif

# if S == 55

//# S = 29

# endif

# if S == 56

//# S++

//# if Q == 0 {

//# S = 58

//# }

# endif

# if S == 57

//# S++

# error "INVALID_FLAG"

# endif

# if S == 58

//# S = -1

# endif

#else

# if S != -1

# include "cpp.c"

# endif

# if S != -1

# include "cpp.c"

# endif

#endif

_1:

if (R == 1)

R = !R

RET

}

if (R == 2)

R = !R

JMP _59 (return)

}

if (R == 3)

R = !R

JMP _59 (return)

}

unreachable!()

_11:

return

############################################

// for (X = 1, Y = 0; X != 0; X *= 2, A *= 2)

_12:

X = 1

Y = 0

while(X != 0) {

Z = X & B

if (Z != 0) {

Y = Y + A

}

X *= 2 // 8 times

A *= 2

}

//for (X = 1; X <= 8; X++) {

// if (B & (1 << X)) {

// Y += A * (1 << X)

// }

//}

############################################

_22:

A = Y

JMP _1

_main:

I = 0

M = 0

N = 1

P = 0

Q = 0

_29:

B = 229 + I

if (B == 0) {

if (Q == 0) {

return

} else {

invalid flag

}

}

########################

A = FLAG[I]

B = [I]

R = 1

CALL _12

// A = A * [I]

########################

O = M + N

M = N

N = O

// M: 1 1 2 3 5 8 13 21 34 55 89 144 233 121 98 219 61 24 85 109 194 47 241 32 17 49 66

// A += fib(I)

A = A + M

B = I + 32

C = [B]

A = A ^ C

// P += (FLAG[I]*[I] + fib(I)) ^ [32+I]

P = P + A

B = I + 64

A = [B]

// P == [64+I]

A = A ^ P

Q = Q | A

I++

JMP _29

function to_byte(n) {

return n & 0xff;

}

const first = [

0b10111011, 0b01010101, 0b10101011, 0b11000101, 0b10111001, 0b10011101,

0b11001001, 0b01101001, 0b10111011, 0b00110111, 0b11011001, 0b11001101,

0b00100001, 0b10110011, 0b11001111, 0b11001111, 0b10011111, 0b00001001,

0b10110101, 0b00111101, 0b11101011, 0b01111111, 0b01010111, 0b10100001,

0b11101011, 0b10000111, 0b01100111,

];

const second = [

0b00001000, 0b01100100, 0b01100100, 0b00110101, 0b10010001, 0b01100100,

0b11100111, 0b10100000, 0b00000110, 0b10101010, 0b11011101, 0b01110101,

0b00010111, 0b10011101, 0b01101101, 0b01011100, 0b01011110, 0b00011001,

0b11111101, 0b11101001, 0b00001100, 0b11111001, 0b10110100, 0b10000011,

0b10000110, 0b00100010, 0b01000010,

];

const third = [

0b11111010, 0b01111011, 0b00011011, 0b10111010, 0b00011110, 0b10110100,

0b10110011, 0b01011000, 0b11000110, 0b11110011, 0b10001100, 0b10010000,

0b00111011, 0b10111010, 0b00011001, 0b01101110, 0b11001110, 0b11011111,

0b11110001, 0b00100101, 0b10001101, 0b01000000, 0b10000000, 0b01110000,

0b11100000, 0b01001101, 0b00011100,

];

const possible =

"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_"

.split("")

.map(c => c.charCodeAt(0));

const fib = [

1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144, 233, 377, 610, 987, 1597, 2584,

4181, 6765, 10946, 17711, 28657, 46368, 75025, 121393, 196418,

].map(to_byte);

function guess(i) {

return possible

.filter(c => {

let P = i === 0 ? 0 : third[i - 1];

P += (to_byte(c * first[i]) + fib[i]) ^ second[i];

P = to_byte(P);

return P === third[i];

})

.map(c => String.fromCharCode(c));

}

[...Array(27).keys()]

.map(i => guess(i))

.map(a => a[0])

.join("");