easy baby

Problem: [羊城杯 2021]BabySmc

[[toc]]

思路

NSSIMAGE

EXP


res="H>oQn6aqLr{DH6odhdm0dMe`MBo?lRglHtGPOdobDlknejmGI|ghDb<"
key=[0xA6,0xA3,0xA9,0xAC]
flag=[]
for i in range(len(res)):
    flag+=[ord(res[i]) ^ key[i%len(key)]]
print(flag)
table=[0xE4, 0xC4, 0xE7, 0xC7, 0xE6, 0xC6, 0xE1, 
0xC1, 0xE0, 0xC0, 0xE3, 0xC3, 0xE2, 0xC2, 0xED, 
0xCD, 0xEC,0xCC, 0xEF, 0xCF, 0xEE, 0xCE, 0xE9, 0xC9, 
0xE8, 0xC8, 0xEB, 0xCB, 0xEA, 0xCA, 0xF5, 0xD5, 0xF4, 
0xD4, 0xF7, 0xD7, 0xF6, 0xD6, 0xF1, 0xD1, 0xF0, 0xD0, 
0xF3, 0xD3, 0xF2, 0xD2, 0xFD, 0xDD, 0xFC, 0xDC, 0xFF, 
0xDF, 0x95, 0x9C, 0x9D, 0x92, 0x93, 0x90, 0x91, 0x96, 
0x97, 0x94, 0x8A, 0x8E]
result=""
#flag根据再table中的索引值全部转化为二进制，放入table中，不够6位的需要补齐
for i in flag:
    result+=('{:0>6}'.format(bin(table.index(i)).replace("0b","")))
for i in range(0,len(result),8):
    print(chr(int(result[i:i+8],2)),end="")

总结

*base64换表加密的认识，比一定是原有的表交换顺序，可以直接换成其他数字
*Smc自加密用动态调试进行破解