DASCTFx0psu3 部分Rev

Record

Posted by Aaron on December 22, 2024

Rev

tryme

密文

9611ab5914fb5271cb0dc32151a3d26d

在base64后进行xor 2

11a7bc332607aef10ec9ffa7f237e888

表为ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/

cf75c89e3d1b5c44b7b91b51ec13ea18

cyperchef一把梭了

edcbe7a62bbff7af847b8cfea720c4ba

DASCTF{454646fa-2462-4392-82ea-5f809ad5ddc2}

黑客不许哭

根据最后对比的值可知数据类型为double

在执行完cudaMemcpy后的v4的值立即变为了对输入加密后的值

于是动调追踪汇编代码,在cudaMemcpy的最后得到值

1a80c337000dda9c14aa15c67cb10af3

ct:70.36839506165201 67.308024691285 85.67024691348701 69.348271604863 ...
data:60.51846366284686 89.4737043286176 24.03104711352393 84.68873702464015 ...
#num:1.020123456789

>>> 70.36839506165201 * 60.51846366284686
4258.58715955144
>>> 67.308024691285 * 89.4737043286176
6022.298300171327
>>> 85.67024691348701 * 24.03104711352393
2058.7457398052343
>>> 69.348271604863 * 84.68873702464015
5873.017537057563

发现ct * data的值为 enc -100

直接使用(enc[i] - 100) // data[i]来获取密文,发现有一些明文但是不完全正确

6105f75ef41489a963101b253f6b9095

之前对输入进行了一个双精度的乘法,将其在后面除以前面的数值,即可得到flag

import numpy as np


data = np.array([
    60.51846366284686,89.4737043286176,24.03104711352393,84.68873702464015,104.6695364464632,83.75627693648984,
    96.41044018110416,75.27071882034213,60.33140727998576,46.10475987767577,56.28563000222285,86.68936481373537,
    80.87786332435297,55.29894355978243,9.261748448423328,20.6272127322797,31.1897419717479,116.1865600512257,
    30.85991826286804,1.063344600421732,10.59144776777723,55.64965261721374,122.950447694522,7.140637105592679,
    55.44977106531295,62.82703886751251,125.3057489450499,45.94487116254584,32.57185367060958,92.37291765689986,
    117.6805078353046,63.42241478603398,84.08593452538155,125.3035418960081,26.50460072585211,15.6085145259943,
    35.68707511621358,37.67352051379848,24.32434117146088,25.69248490815507,116.4638282572803,86.30264794289376,
    79.51984419851664,100.6517460100543
])

enc = np.array([4358.58716,6122.2983,2158.74574,5973.017537,9173.840881,6164.67827,12293.528276,4091.327439,3360.696562,2403.667017,3199.455077,4962.117508,8266.407604,
  2863.062918,1044.626306,1067.530873,3217.476319,6260.942959,3278.952568,160.724197,596.797742,3277.973032,6368.757598,842.858109,5925.142209,3046.937162,
  12752.384458,2442.54747,1827.164764,4903.961921,5619.869598,3851.247916,4472.987644,13135.636855,1640.630636,975.4295509999999,2174.379531,2289.845471,
  2605.707441,1488.586824,12216.019619,4588.270425,4803.36317,13035.30263,])


num = 1.020123456789
for i in range(len(enc)):
    print(chr(int(((enc[i] - 100) // data[i]) // num)&0xff),end='')
#DASCTF{34056b0c-a3d7-71ef-b132-92e8688d4e29}

###