[SWPUCTF 2021 新生赛]fakebase pbidle的WriteUp

题目代码

flag = 'xxxxxxxxxxxxxxxxxxx'

s_box = 'qwertyuiopasdfghjkzxcvb123456#$'
tmp = ''
for i in flag:
    tmp += str(bin(ord(i)))[2:].zfill(8)
b1 = int(tmp,2)
s = ''
while b1//31 != 0:
    s += s_box[b1%31]
    b1 = b1//31

print(s)

# s = u#k4ggia61egegzjuqz12jhfspfkay
​
            
AI代码解释
            
                
            
        

将flag中每个字符影射为字符集的code point, 转换为二进制, 再转换为十进制, 再转换为最低位在前的31进制,
31进制使用自定义的字符集s_box, 即q表示0, w表示1等

把s_box转换为标准31进制字符集:

table = '0123456789abcdefghijklmnopqrstuvwxyz'[:31]
trans = str.maketrans(s_box, table)
​

再将输出的s转换为标准写法的31进制数, 转化为10进制后再恢复为字符串

s2 = this_s.translate(trans)
n = int(s2[::-1], 31)
print(libnum.n2s(n))
​

但是输出不正确, 仔细阅读源码, 发现终止条件是while b1//31 != 0, 会把最高位丢掉, 所以要穷举最高位
总结代码:

s_box = 'qwertyuiopasdfghjkzxcvb123456#$'
s = 'u#k4ggia61egegzjuqz12jhfspfkay'

import libnum
for ch in s_box:
    this_s = s + ch
    table = '0123456789abcdefghijklmnopqrstuvwxyz'[:31]

    trans = str.maketrans(s_box, table)
    s2 = this_s.translate(trans)

    n = int(s2[::-1], 31)
    print(libnum.n2s(n))
​
            
AI代码解释
            
                
            
        

得到flag