（52）[HGAME 2023 week1]encode

[HGAME 2023 week1]encode

nss：3480

这个题我们进入IDA

我们可以发现这就是一个加密，然后判断的程序。

如果v4！=dword_403000 的话就会报错，因为那个

sub_401160(Format);这个是报错的函数。

所以我们要提取加密后的东西

我们点开发现这个dword_40300这个进去之后应该是100个数据哇，可是IDA呈现好多，这些0我们就需要去掉。

所以我们需要写一个这个程序

v4_new=[x for x in v4 if x!=0]
if len(v4_new)<100:
 v4_new.extend([0]*(100-len(v4_new)))

然后我们得到正确的enc为

[8, 6, 7, 6, 1, 6, 13, 6, 5, 6, 11, 7, 5, 6, 14, 6, 3, 6, 15, 6, 4, 6, 5, 6, 15, 5, 9, 6, 3, 7, 15, 5, 5, 6, 1, 6, 3, 7, 9, 7, 15, 5, 6, 6, 15, 6, 2, 7, 15, 5, 1, 6, 15, 5, 2, 7, 5, 6, 6, 7, 5, 6, 2, 7, 3, 7, 5, 6, 15, 5, 5, 6, 14, 6, 7, 6, 9, 6, 14, 6, 5, 6, 5, 6, 2, 7, 13, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]

以上这个关于正确的enc，有好多帖子他们都没有说怎么求，所以我就写了，他们简直太不负责了嘿嘿嘿。

所以接下来我们分析一下加密部分

这个就是将

flag高位和低位分开了。

第一行是将flag的高四位变为0，留下了第四位

第二行是将flag的高四位变为低四位。

所以我们要做的就是将这两个变换位置。所以我写了两种代码。

网上写的解法跟我不一样，反正能做出来就行了，这个题网上的wp也比较少吧，好像，反正我见了好几个人都写的一样的wp

#v4=[ 8, 6, 7, 6, 1, 6, 13, 6, 5, 6, 11, 7, 5, 6, 14, 6, 3, 6, 15, 6, 4, 6, 5, 6, 15, 5, 9, 6, 3, 7, 15, 5, 5, 6, 1, 6,
#        3, 7, 9, 7, 15, 5, 6, 6, 15, 6, 2, 7, 15, 5, 1, 6, 15, 5, 2, 7, 5, 6, 6, 7, 5, 6, 2, 7, 3, 7, 5, 6, 15, 5, 5, 6,
#        14, 6, 7, 6, 9, 6, 14, 6, 5, 6, 5, 6, 2, 7, 13, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
​
v4=[8, 0, 0, 0, 6, 0, 0, 0, 7, 0,
0, 0, 6, 0, 0, 0, 1, 0, 0, 0,
6, 0, 0, 0, 13, 0, 0, 0, 6, 0,
0, 0, 5, 0, 0, 0, 6, 0, 0, 0,
11, 0, 0, 0, 7, 0, 0, 0, 5, 0,
0, 0, 6, 0, 0, 0, 14, 0, 0, 0,
6, 0, 0, 0, 3, 0, 0, 0, 6, 0,
0, 0, 15, 0, 0, 0, 6, 0, 0, 0,
4, 0, 0, 0, 6, 0, 0, 0, 5, 0,
0, 0, 6, 0, 0, 0, 15, 0, 0, 0,
5, 0, 0, 0, 9, 0, 0, 0, 6, 0,
0, 0, 3, 0, 0, 0, 7, 0, 0, 0,
15, 0, 0, 0, 5, 0, 0, 0, 5, 0,
0, 0, 6, 0, 0, 0, 1, 0, 0, 0,
6, 0, 0, 0, 3, 0, 0, 0, 7, 0,
0, 0, 9, 0, 0, 0, 7, 0, 0, 0,
15, 0, 0, 0, 5, 0, 0, 0, 6, 0,
0, 0, 6, 0, 0, 0, 15, 0, 0, 0,
6, 0, 0, 0, 2, 0, 0, 0, 7, 0,
0, 0, 15, 0, 0, 0, 5, 0, 0, 0,
1, 0, 0, 0, 6, 0, 0, 0, 15, 0,
0, 0, 5, 0, 0, 0, 2, 0, 0, 0,
7, 0, 0, 0, 5, 0, 0, 0, 6, 0,
0, 0, 6, 0, 0, 0, 7, 0, 0, 0,
5, 0, 0, 0, 6, 0, 0, 0, 2, 0,
0, 0, 7, 0, 0, 0, 3, 0, 0, 0,
7, 0, 0, 0, 5, 0, 0, 0, 6, 0,
0, 0, 15, 0, 0, 0, 5, 0, 0, 0,
5, 0, 0, 0, 6, 0, 0, 0, 14, 0,
0, 0, 6, 0, 0, 0, 7, 0, 0, 0,
6, 0, 0, 0, 9, 0, 0, 0, 6, 0,
0, 0, 14, 0, 0, 0, 6, 0, 0, 0,
5, 0, 0, 0, 6, 0, 0, 0, 5, 0,
0, 0, 6, 0, 0, 0, 2, 0, 0, 0,
7, 0, 0, 0, 13, 0, 0, 0, 7, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
#重新排一下序号
​
v4_new=[x for x in v4 if x!=0]
if len(v4_new)<100:
 v4_new.extend([0]*(100-len(v4_new)))
​
​
flag=''
for i in range(50):
 flag_h=(bin(v4_new[2*i+1]<<4))[2:].zfill(8)
 flag_l=(bin(v4_new[2*i]))[2:].zfill(8)
 flag+=chr(int(flag_h,2) | int(flag_l,2))
​
 #flag+=chr(int(flag_h,2)+int(flag_l,2))   这部分可以和上面是一样的作用
print(flag)
​

我们得到flag

hgame{encode_is_easy_for_a_reverse_engineer}