惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

F
Fortinet All Blogs
博客园 - 三生石上(FineUI控件)
小众软件
小众软件
人人都是产品经理
人人都是产品经理
V
Visual Studio Blog
Last Week in AI
Last Week in AI
V
V2EX
博客园_首页
IT之家
IT之家
Jina AI
Jina AI
博客园 - 叶小钗
The Cloudflare Blog
T
Tailwind CSS Blog
腾讯CDC
B
Blog
D
Docker
L
LangChain Blog
博客园 - 司徒正美
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
美团技术团队
Apple Machine Learning Research
Apple Machine Learning Research
爱范儿
爱范儿
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
GbyAI
GbyAI

Yesterday17's Blog

2026 新年解密红包 / Melody Flag | Yesterday17's Blog 谈谈 Iori 的设计思路(二):如何实现一个 Showroom 录制工具? | Yesterday17's Blog 谈谈 Iori 的设计思路(一):从 Nico Timeshift 说起 | Yesterday17's Blog Iori Minyami 0.1.0 发布 | Yesterday17's Blog 2025 新年解密红包 / Melody Flag | Yesterday17's Blog 使用 Cloudflare Warp 解决罗森票务的海外登录问题 | Yesterday17's Blog How To Blog 04: The Astro v5 Era | Yesterday17's Blog 谈谈 tokio::select! 的公平性 | Yesterday17's Blog Learning Pingora 05 - Connect with TLS | Yesterday17's Blog Leaving Bytedance | Yesterday17's Blog 大橋彩香 AsiaTour「Reflection」上海公演 个人向记录 & Repo | Yesterday17's Blog Recoving from burnout - What happened? | Yesterday17 Yubikey 重建手册 | Yesterday17's Blog How To Blog 03: Heimus | Yesterday17's Blog 🪧 Blog Migration Accouncement | Yesterday17's Blog Learn Your IDE - VSCode 是如何仅重启插件的? | Yesterday17's Blog How To Blog 02: Astro❤️Password | Yesterday17's Blog How To Blog 01: Why, How, and the Future | Yesterday17's Blog Learning Pingora 04 - Establish L4 Connection | Yesterday17's Blog Learning Pingora 03 - Upstreams and Peers | Yesterday17's Blog Learning Pingora 02 - A Simple HTTP Server | Yesterday17's Blog Learning Pingora 01 - Getting Started | Yesterday17's Blog 2024 新年解密红包 / Melody Flag | Yesterday17's Blog 向新的一年飞驰——记录 2023 | Yesterday17's Blog 「サクラノ刻」对话选摘(2) | Yesterday17's Blog PGP Key Revocation 注销声明 | Yesterday17's Blog 「サクラノ刻」对话选摘(1) | Yesterday17's Blog 2023 新年解密红包 / Melody Flag | Yesterday17's Blog 『蒼の彼方のフォーリズム』通关感想 | Yesterday17's Blog 单显卡直通教程 | Yesterday17's Blog
[Google CTF 2021] CPP WriteUp | Yesterday17's Blog
Yesterday17 · 2021-07-19 · via Yesterday17's Blog

clang-format --style='{IndentPPDirectives: AfterHash}' cpp.c

#if __INCLUDE_LEVEL__ > 12 一行开始,接下来就是大段的 #if S == xx。在每个 #if 之后紧跟的又是 #unset S#defineS,对应的是 S++。每个 S 对应一条不同的指令。

简单观察一条指令,不难发现其每次都会对 0-7 进行 define。比如上面截图里就 defineR0-R7。因此不难想到一个 R 其实是由 8 位构成的,即一个字节。因此之后的整理也就基本基于这个思路了。

#if __INCLUDE_LEVEL__ > 12

# if S == 0

# define S 24

# endif

# if S == 1

//# S++

//# R = !R

# endif

# if S == 2

//# S++

//# Z = 0b00000001

# endif

# if S == 3

//# S++

//# R = R + Z

# endif

# if S == 4

//# S++

//# R = R + Z

# endif

# if S == 5

//# S++

//# if R == 0 {

//# S = 38

//# }

# endif

# if S == 6

//# S++

//# R = R + Z

# endif

# if S == 7

//# S++

//# if R == 0 {

//# S = 59

//# }

# endif

# if S == 8

//# S++

//# R = R + Z

# endif

# if S == 9

//# S++

//# if R == 0 {

//# S = 59

//# }

# endif

# if S == 10

//# S++

# error "BUG"

# endif

# if S == 11

//# S = -1

# endif

# if S == 12

//# S++

//# X = 0b00000001

# endif

# if S == 13

//# S++

//# Y = 0

# endif

# if S == 14

//# S++

//# if X == 0 {

//# S = 22

//# }

# endif

# if S == 15

//# S++

//# Z = X

# endif

# if S == 16

//# S++

//# Z = Z & B

# endif

# if S == 17

//# S++

//# if Z == 0 {

//# S = 19

//# }

# endif

# if S == 18

//# S++

//# Y = Y + A

# endif

# if S == 19

//# S++

//# X = X + X

# endif

# if S == 20

//# S++

//# A = A + A

# endif

# if S == 21

//# S = 14

# endif

# if S == 22

//# S++

//# A = Y

# endif

# if S == 23

//# S = 1

# endif

# if S == 24

//# S++

//# I = 0

# endif

# if S == 25

//# S++

//# M = 0

# endif

# if S == 26

//# S++

//# N = 0b00000001

# endif

# if S == 27

//# S++

//# P = 0

# endif

# if S == 28

//# S++

//# Q = 0

# endif

# if S == 29

//# S++

//# B = 0b11100101

# endif

# if S == 30

//# S++

//# B = B + I

# endif

# if S == 31

//# S++

//# if B == 0 {

//# S = 56

//# }

# endif

# if S == 32

//# S++

//# B = 0b10000000

# endif

# if S == 33

//# S++

//# B = B + I

# endif

# if S == 34

//# S++

//# l = B

//# A = [l]

# endif

# if S == 35

//# S++

//# l = I

//# B = [l]

# endif

# if S == 36

//# S++

//# R = 0b00000001

# endif

# if S == 37

//# S = 12

# endif

# if S == 38

//# S++

//# O = M

# endif

# if S == 39

//# S++

//# O = O + N

# endif

# if S == 40

//# S++

//# M = N

# endif

# if S == 41

//# S++

//# N = O

# endif

# if S == 42

//# S++

//# A = A + M

# endif

# if S == 43

//# S++

//# B = 0b00100000

# endif

# if S == 44

//# S++

//# B = B + I

# endif

# if S == 45

//# S++

//# l = B

//# C = [l]

# endif

# if S == 46

//# S++

//# A = A ^ C

# endif

# if S == 47

//# S++

//# P = P + A

# endif

# if S == 48

//# S++

//# B = 0b01000000

# endif

# if S == 49

//# S++

//# B = B + I

# endif

# if S == 50

//# S++

//# l = B

//# A = [l]

# endif

# if S == 51

//# S++

//# A = P ^ A

# endif

# if S == 52

//# S++

//# Q = Q | A

# endif

# if S == 53

//# S++

//# A = 0b00000001

# endif

# if S == 54

//# S++

//# I = A + I

# endif

# if S == 55

//# S = 29

# endif

# if S == 56

//# S++

//# if Q == 0 {

//# S = 58

//# }

# endif

# if S == 57

//# S++

# error "INVALID_FLAG"

# endif

# if S == 58

//# S = -1

# endif

#else

# if S != -1

# include "cpp.c"

# endif

# if S != -1

# include "cpp.c"

# endif

#endif

_1:

if (R == 1)

R = !R

RET

}

if (R == 2)

R = !R

JMP _59 (return)

}

if (R == 3)

R = !R

JMP _59 (return)

}

unreachable!()

_11:

return

############################################

// for (X = 1, Y = 0; X != 0; X *= 2, A *= 2)

_12:

X = 1

Y = 0

while(X != 0) {

Z = X & B

if (Z != 0) {

Y = Y + A

}

X *= 2 // 8 times

A *= 2

}

//for (X = 1; X <= 8; X++) {

// if (B & (1 << X)) {

// Y += A * (1 << X)

// }

//}

############################################

_22:

A = Y

JMP _1

_main:

I = 0

M = 0

N = 1

P = 0

Q = 0

_29:

B = 229 + I

if (B == 0) {

if (Q == 0) {

return

} else {

invalid flag

}

}

########################

A = FLAG[I]

B = [I]

R = 1

CALL _12

// A = A * [I]

########################

O = M + N

M = N

N = O

// M: 1 1 2 3 5 8 13 21 34 55 89 144 233 121 98 219 61 24 85 109 194 47 241 32 17 49 66

// A += fib(I)

A = A + M

B = I + 32

C = [B]

A = A ^ C

// P += (FLAG[I]*[I] + fib(I)) ^ [32+I]

P = P + A

B = I + 64

A = [B]

// P == [64+I]

A = A ^ P

Q = Q | A

I++

JMP _29

function to_byte(n) {

return n & 0xff;

}

const first = [

0b10111011, 0b01010101, 0b10101011, 0b11000101, 0b10111001, 0b10011101,

0b11001001, 0b01101001, 0b10111011, 0b00110111, 0b11011001, 0b11001101,

0b00100001, 0b10110011, 0b11001111, 0b11001111, 0b10011111, 0b00001001,

0b10110101, 0b00111101, 0b11101011, 0b01111111, 0b01010111, 0b10100001,

0b11101011, 0b10000111, 0b01100111,

];

const second = [

0b00001000, 0b01100100, 0b01100100, 0b00110101, 0b10010001, 0b01100100,

0b11100111, 0b10100000, 0b00000110, 0b10101010, 0b11011101, 0b01110101,

0b00010111, 0b10011101, 0b01101101, 0b01011100, 0b01011110, 0b00011001,

0b11111101, 0b11101001, 0b00001100, 0b11111001, 0b10110100, 0b10000011,

0b10000110, 0b00100010, 0b01000010,

];

const third = [

0b11111010, 0b01111011, 0b00011011, 0b10111010, 0b00011110, 0b10110100,

0b10110011, 0b01011000, 0b11000110, 0b11110011, 0b10001100, 0b10010000,

0b00111011, 0b10111010, 0b00011001, 0b01101110, 0b11001110, 0b11011111,

0b11110001, 0b00100101, 0b10001101, 0b01000000, 0b10000000, 0b01110000,

0b11100000, 0b01001101, 0b00011100,

];

const possible =

"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_"

.split("")

.map(c => c.charCodeAt(0));

const fib = [

1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144, 233, 377, 610, 987, 1597, 2584,

4181, 6765, 10946, 17711, 28657, 46368, 75025, 121393, 196418,

].map(to_byte);

function guess(i) {

return possible

.filter(c => {

let P = i === 0 ? 0 : third[i - 1];

P += (to_byte(c * first[i]) + fib[i]) ^ second[i];

P = to_byte(P);

return P === third[i];

})

.map(c => String.fromCharCode(c));

}

[...Array(27).keys()]

.map(i => guess(i))

.map(a => a[0])

.join("");