姚小宝 发表于 2020-1-3 22:17

深圳某讯面试题两种注册方式详解

本帖最后由 yechen123 于 2020-1-3 22:29 编辑



考完试了看见论坛一师傅(@cyhcuichao )去年发过一个面试题，第一关有人解出来了，第二关好像还没人发解题思路，写一下解题思路。
原题目连接:https://www.52pojie.cn/thread-834380-1-1.html


mfc写的程序，可以通过mfcspy找到两个注册功能的主要函数。


第一关
位于.text:00401620
第一关比较简单

void __thiscall sub_401620(CWnd *this)
{
CWnd *v1; // esi
int v2; // edi
char *v3; // eax
char *v4; // eax
int password; //
int username; //
int v7; //
int v8; //
int *v9; //
char v10; //
char *v11; //
int v12; //
unsigned int v13; //
void *v14; //
int v15; //
unsigned int v16; //
char v17; //
char *v18; //
int v19; //
unsigned int v20; //
int v21; //

v1 = this;
v20 = 15;
v19 = 0;
LOBYTE(v18) = 0;
v21 = 0;
v16 = 15;
v15 = 0;
LOBYTE(v14) = 0;
v13 = 15;
v12 = 0;
LOBYTE(v11) = 0;
LOBYTE(v21) = 2;
CWnd::UpdateData(this, 1);
v8 = 0;
v7 = 0;
v9 = 0;
string_to_hex("1937", (int)&v8);
string_to_hex("5", (int)&v7);
password = 0;
username = 0;
sub_402D10(&v17);
v2 = *((_DWORD *)v1 + 31);
if ( *(_DWORD *)(v2 - 12) && *(_DWORD *)(*((_DWORD *)v1 + 30) - 12) )
{
    copy_value((int)&v17, *((_DWORD *)v1 + 31) + 1, *((void **)v1 + 31), strlen(*((const char **)v1 + 31)));// password
    copy_value((int)&v10, *((_DWORD *)v1 + 30) + 1, *((void **)v1 + 30), strlen(*((const char **)v1 + 30)));// username
    v3 = v18;
    if ( v20 < 0x10 )
      v3 = (char *)&v18;
    string_to_hex(v3, (int)&password);
    v4 = v11;
    if ( v13 < 0x10 )
      v4 = (char *)&v11;
    string_to_hex(v4, (int)&username);
    sub_411980(password, (_DWORD *)v7, v8, (int *)&v9);
    if ( cmp((int *)username, v9) )
      SendMessageA(*((HWND *)v1 + 8), 0x591u, 1u, 0);
    else
      SendMessageA(*((HWND *)v1 + 8), 0x591u, 1u, 1);
}
if ( v13 >= 0x10 )
    operator delete(v11);
LOBYTE(v11) = 0;
v12 = 0;
v13 = 15;
if ( v16 >= 0x10 )
    operator delete(v14);
LOBYTE(v14) = 0;
v15 = 0;
v16 = 15;
if ( v20 >= 0x10 )
    operator delete(v18);
}

通过调试确定一些函数的功能。
获取账号密码加密密码然后和账号比较。
一开始赋值了1937 和 5这两个数值，经过sub_411980函数加密。
sub_411980(password, (_DWORD *)v7, v8, (int *)&v9);

题目界面说用户名为0-1937，再通过这个函数的传参，可以很快反应这应该是RSA加密，
即username=password^5mod1937





第二关

这一关比较恶心，弄了挺久的。
void __thiscall sub_401840(CWnd *this)
{
CWnd *v1; // esi
int v2; // edi
int v3; // edx
void *v4; // eax
char v5; //
char password_value; //
int v7; //
int password; //
int v9; //
int v10; //
int v11; //
int *v12; //
int *key; //
int v14; //
char *v15; //
char v16; //
void *v17; //
unsigned int v18; //
unsigned int v19; //
int v20; //
void *v21; //
unsigned int v22; //
unsigned int v23; //
char v24; //
void *v25; //
int v26; //
unsigned int v27; //
int v28; //
char v29; //
char v30; //
char v31; //
char v32; //
int v33; //

v1 = this;
v27 = 15;
v26 = 0;
LOBYTE(v25) = 0;
v33 = 0;
v23 = 15;
v22 = 0;
LOBYTE(v21) = 0;
v19 = 15;
v18 = 0;
LOBYTE(v17) = 0;
LOBYTE(v33) = 2;
v28 = '0166';                                 // 6610394
v29 = '3';
v30 = '9';
v31 = '4';
v32 = 0;
CWnd::UpdateData(this, 1);
sub_402D10(&v16);
v2 = *((_DWORD *)v1 + 32);
if ( *(_DWORD *)(v2 - 12) && *(_DWORD *)(*((_DWORD *)v1 + 33) - 12) )
{
    copy_value((int)&v16, *((_DWORD *)v1 + 32) + 1, *((void **)v1 + 32), strlen(*((const char **)v1 + 32)));// username
    sub_402D10(&v24);
    copy_value((int)&v24, v3, *((void **)v1 + 33), strlen(*((const char **)v1 + 33)));// password
    sub_402D10(&v20);
    v14 = 0;
    key = &v28;
    v12 = &v20;
    v15 = &v5;
    v11 = 15;
    v10 = 0;
    password_value = 0;
    sub_4028D0((int)&v5, &v24, 0, (char *)0xFFFFFFFF);
    sub_4179D0(v5, *(void **)&password_value, v7, password, v9, v10, v11, (int)v12, (int)key, v14);
    v4 = v17;
    if ( v19 < 0x10 )
      v4 = &v17;
    if ( sub_402100(&v20, 0, v22, (int)v4, v18) )
      SendMessageA(*((HWND *)v1 + 8), 0x591u, 2u, 0);
    else
      SendMessageA(*((HWND *)v1 + 8), 0x591u, 2u, 1);
}
if ( v19 >= 0x10 )
    operator delete(v17);
LOBYTE(v17) = 0;
v18 = 0;
v19 = 15;
if ( v23 >= 0x10 )
    operator delete(v21);
LOBYTE(v21) = 0;
v22 = 0;
v23 = 15;
if ( v27 >= 0x10 )
    operator delete(v25);
}

先获取账号密码
赋值"6610394" 估摸着可能是密钥

经过变种DES加密，然后和用户名对比。
sub_4179D0 为主要加密函数
void __cdecl sub_4179D0(char a1, void *password_value, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int a10)
{
int v10; // ebx
int v11; // ebp
size_t v12; // edi
void *v13; // esi
void *v14; // eax
unsigned int v15; // edi
unsigned int v16; // esi
_DWORD *v17; // eax
int v18; //
int v19; //
char v20; //
char v21; //
unsigned __int8 v22; //
int v23; //
__int16 v24; //
unsigned __int8 v25; //
char input; //
__int16 v27; //
char v28; //
char Src; //
int v30; //

v10 = a9;
v18 = a8;
*(_DWORD *)&input = 0;
v27 = 0;
v28 = 0;
v22 = 0;
v23 = 0;
v24 = 0;
v25 = 0;
v30 = 0;
input = 0;
v19 = 0;
memset(&v20, 0, 124u);
memset(&v21, 0, 128u);
sub_402D10((_DWORD *)a8);
if ( !a10 )
{
    v11 = a6;
    if ( a6 & 1 )
      goto LABEL_15;
    v12 = a6 + 1;
    v13 = operator new[](a6 + 1);
    memset(v13, 0, v12);
    v14 = password_value;
    if ( (unsigned int)a7 < 16 )
      v14 = &password_value;
    string_set_int((int)v14, (int)v13, v11);
    copy_value((int)&a1, (int)v13 + 1, v13, strlen((const char *)v13));
    operator delete(v13);
}
sub_417870(v10, (int)&v22);
sub_403450((int)&v19, (int)&v22);             // 处理密钥
v15 = (unsigned int)a6 >> 3;
if ( a6 & 7 )
{
    ++v15;
    sub_417D60((int)&a1, 7 - (a6 & 7), 0);
}
v16 = 0;
if ( v15 )
{
    do
    {
      *(_DWORD *)input = 0;
      *(_DWORD *)&input = 0;
      v17 = password_value;
      if ( (unsigned int)a7 < 0x10 )
      v17 = &password_value;
      *(_DWORD *)input = v17;
      *(_DWORD *)&input = v17;
      if ( a10 == 1 )
      {
      sub_4034A0(&v19, (unsigned __int8 *)input, &v22);
      sprintf(
          &Src,
          "%02X%02X%02X%02X%02X%02X%02X%02X",
          v22,
          (unsigned __int8)v23,
          BYTE1(v23),
          BYTE2(v23),
          HIBYTE(v23),
          (unsigned __int8)v24,
          HIBYTE(v24),
          v25);
      }
      else                                    // 这里
      {
      sub_4034A0(&v21, (unsigned __int8 *)input, &v22);
      sprintf(
          &Src,
          "%C%C%C%C%C%C%C%C",
          v22,
          (unsigned __int8)v23,
          BYTE1(v23),
          BYTE2(v23),
          HIBYTE(v23),
          (unsigned __int8)v24,
          HIBYTE(v24),
          v25);
      }
      sub_417F10(v18, &Src, strlen(&Src));
      ++v16;
    }
    while ( v16 < v15 );
}
LABEL_15:
if ( (unsigned int)a7 >= 0x10 )
    operator delete(password_value);
}

里边有个函数 被我改名为string_set_int
主要功能就是把16进制字符串改为内存存储形式，比如"9ABC"内存中储存为 " 39 41 42 43"，函数让内存变为"9A BC"存储形式

int __cdecl string_set_int(int a1, int a2, unsigned int a3)
{
char *v3; // esi
unsigned int v4; // edi
char v5; // cl
char v6; // cl
char v7; // dl
char v8; // dl
int v10; //

v10 = 0;
if ( a3 > 2 && a3 != 1 )
{
    v3 = (char *)(a1 + 1);
    v4 = ((a3 - 2) >> 1) + 1;
    do
    {
      v5 = *(v3 - 1);
      if ( (unsigned __int8)(*(v3 - 1) - 48) > 9u )
      {
      if ( (unsigned __int8)(v5 - 65) > 5u )
          v6 = 0;
      else
          v6 = v5 - 55;
      }
      else
      {
      v6 = v5 - 48;
      }
      v7 = *v3;
      if ( (unsigned __int8)(*v3 - 48) > 9u )
      {
      if ( (unsigned __int8)(v7 - 65) > 5u )
          v8 = 0;
      else
          v8 = v7 - 55;
      }
      else
      {
      v8 = v7 - 48;
      }
      *(_BYTE *)(a2 + v10++) = v8 + 16 * v6;
      v3 += 2;
      --v4;
    }
    while ( v4 );
}
return v10;
}


sub_417870 和 sub_403450 函数应该就是处理密钥用的当输入的密钥为空时 默认存为"abcdef"

int __cdecl sub_417870(int a1, int a2)
{
unsigned int v2; // edx
_BYTE *v3; // eax
char v4; // cl
int result; // eax
int v6; //
char v7; //
char v8; //
char v9; //
__int16 v10; //
char v11; //

*(_DWORD *)&v9 = 0;
v10 = 0;
v11 = 0;
v6 = 0;
v9 = 0;
memset(&v7, 0, 124u);
memset(&v8, 0, 128u);
*(_DWORD *)a2 = dword_45E188;
*(_DWORD *)(a2 + 4) = dword_45E18C;
if ( !strlen((const char *)a1) )            // 如果没有密码 默认为abcdef 设的密码为6610394
{
    *(_DWORD *)a1 = 'dcba';
    *(_WORD *)(a1 + 4) = 'fe';
    *(_BYTE *)(a1 + 6) = 0;
}
v2 = 0;
v3 = (_BYTE *)a2;
do
{
    v4 = v3;
    if ( !v4 )
      break;
    *v3 ^= v4 % 128;
    ++v2;
    ++v3;
}
while ( v2 < 8 );                           // 密钥异或
sub_403450((int)&v6, (int)&dword_45E188);
sub_4034A0(&v6, (unsigned __int8 *)a2, v9);
sub_403450((int)&v6, (int)&byte_45E180);
sub_4034A0(&v8, (unsigned __int8 *)v9, (_BYTE *)a2);
sub_403450((int)&v6, (int)&dword_45E188);
sub_4034A0(&v6, (unsigned __int8 *)a2, v9);
result = *(_DWORD *)&v9;
*(_DWORD *)a2 = *(_DWORD *)v9;
*(_DWORD *)(a2 + 4) = result;
return result;
}

此时已经可以得知，密钥时固定的，经过密钥处理函数才会进入真正的加密函数。
下边的sub_4034A0函数为主要加密函数
unsigned int __cdecl sub_4034A0(_DWORD *a1, unsigned __int8 *a2, _BYTE *a3)
{
int password_right; // edx
unsigned int v4; // ecx
int v5; // edx
unsigned int v6; // eax
int v7; // ecx
unsigned int v8; // edx
int v9; // eax
int v10; // ecx
int v11; // eax
unsigned int v12; // edx
int v13; // ecx
int v14; // eax
int v15; // ecx
unsigned int v16; // edx
int v17; // ecx
int v18; // edx
int v19; // ecx
int v20; // edx
int v21; // ecx
int v22; // edx
int v23; // ecx
int v24; // edx
int v25; // ecx
int v26; // edx
int v27; // ecx
int v28; // edx
int v29; // ecx
int v30; // edx
int v31; // ecx
int v32; // edx
unsigned int v33; // ebx
unsigned int v34; // edi
int v35; // eax
unsigned int v36; // ecx
int v37; // eax
unsigned int v38; // ecx
int v39; // edx
int v40; // eax
unsigned int v41; // ecx
int v42; // edx
int v43; // eax
int v44; // ecx
int v45; // edx
int v46; // ecx
unsigned int v47; // eax
int v48; // edx
unsigned int v49; // ecx
int v50; // eax
unsigned int result; // eax

password_right = a2 | ((a2 | ((a2 | (a2 << 8)) << 8)) << 8);
v4 = (password_right ^ ((a2 | ((a2 | ((a2 | ((unsigned int)*a2 << 8)) << 8)) << 8)) >> 4)) & 0xF0F0F0F;// 前4^后4 &0xf0f0f0f0
v5 = v4 ^ password_right;
v6 = 16 * v4 ^ (a2 | ((a2 | ((a2 | (*a2 << 8)) << 8)) << 8));
v7 = (unsigned __int16)(v5 ^ (v6 >> 16));
v8 = v7 ^ v5;
v9 = (v7 << 16) ^ v6;
v10 = (v9 ^ (v8 >> 2)) & 0x33333333;
v11 = v10 ^ v9;
v12 = 4 * v10 ^ v8;
v13 = (v11 ^ (v12 >> 8)) & 0xFF00FF;
v14 = v13 ^ v11;
v15 = __ROL4__(v12 ^ (v13 << 8), 1);          // 循环左移
v16 = (v14 ^ v15) & 0xAAAAAAAA;
v17 = v16 ^ v15;
v18 = dword_45C708[(a1 ^ __ROR4__(v17, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 24) & 0x3F] ^ dword_45C808[(v17 ^ *a1) & 0x3F] ^ dword_45C608[(((unsigned int)v17 ^ *a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v17 ^ *a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v17 ^ *a1) >> 24) & 0x3F] ^ __ROL4__(v14 ^ v16, 1);
v19 = dword_45C708[(a1 ^ __ROR4__(v18, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 24) & 0x3F] ^ dword_45C808[(v18 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v18 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v18 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v18 ^ a1) >> 24) & 0x3F] ^ v17;
v20 = dword_45C708[(a1 ^ __ROR4__(v19, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 24) & 0x3F] ^ dword_45C808[(v19 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v19 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v19 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v19 ^ a1) >> 24) & 0x3F] ^ v18;
v21 = dword_45C708[(a1 ^ __ROR4__(v20, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 24) & 0x3F] ^ dword_45C808[(v20 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v20 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v20 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v20 ^ a1) >> 24) & 0x3F] ^ v19;
v22 = dword_45C708[(a1 ^ __ROR4__(v21, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 24) & 0x3F] ^ dword_45C808[(v21 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v21 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v21 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v21 ^ a1) >> 24) & 0x3F] ^ v20;
v23 = dword_45C708[(a1 ^ __ROR4__(v22, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 24) & 0x3F] ^ dword_45C808[(v22 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v22 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v22 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v22 ^ a1) >> 24) & 0x3F] ^ v21;
v24 = dword_45C708[(a1 ^ __ROR4__(v23, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 24) & 0x3F] ^ dword_45C808[(v23 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v23 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v23 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v23 ^ a1) >> 24) & 0x3F] ^ v22;
v25 = dword_45C708[(a1 ^ __ROR4__(v24, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 24) & 0x3F] ^ dword_45C808[(v24 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v24 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v24 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v24 ^ a1) >> 24) & 0x3F] ^ v23;
v26 = dword_45C708[(a1 ^ __ROR4__(v25, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 24) & 0x3F] ^ dword_45C808[(v25 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v25 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v25 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v25 ^ a1) >> 24) & 0x3F] ^ v24;
v27 = dword_45C708[(a1 ^ __ROR4__(v26, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 24) & 0x3F] ^ dword_45C808[(v26 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v26 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v26 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v26 ^ a1) >> 24) & 0x3F] ^ v25;
v28 = dword_45C708[(a1 ^ __ROR4__(v27, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 24) & 0x3F] ^ dword_45C808[(v27 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v27 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v27 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v27 ^ a1) >> 24) & 0x3F] ^ v26;
v29 = dword_45C708[(a1 ^ __ROR4__(v28, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 24) & 0x3F] ^ dword_45C808[(v28 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v28 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v28 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v28 ^ a1) >> 24) & 0x3F] ^ v27;
v30 = dword_45C708[(a1 ^ __ROR4__(v29, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 24) & 0x3F] ^ dword_45C808[(v29 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v29 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v29 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v29 ^ a1) >> 24) & 0x3F] ^ v28;
v31 = dword_45C708[(a1 ^ __ROR4__(v30, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 24) & 0x3F] ^ dword_45C808[(v30 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v30 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v30 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v30 ^ a1) >> 24) & 0x3F] ^ v29;
v32 = dword_45C708[(a1 ^ __ROR4__(v31, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 24) & 0x3F] ^ dword_45C808[(v31 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v31 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v31 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v31 ^ a1) >> 24) & 0x3F] ^ v30;
v33 = (((unsigned int)v32 ^ a1) >> 8) & 0x3F;
v34 = ((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 8) & 0x3F;
v35 = __ROR4__(
          dword_45C808[(v32 ^ a1) & 0x3F] ^ dword_45C608 ^ dword_45C408[(((unsigned int)v32 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v32 ^ a1) >> 24) & 0x3F] ^ v31 ^ dword_45C708[(a1 ^ __ROR4__(v32, 4)) & 0x3F] ^ dword_45C508 ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 24) & 0x3F],
          1);
v36 = (v32 ^ v35) & 0xAAAAAAAA;
v37 = v36 ^ v35;
v38 = __ROR4__(v32 ^ v36, 1);
v39 = (v37 ^ (v38 >> 8)) & 0xFF00FF;
v40 = v39 ^ v37;
v41 = (v39 << 8) ^ v38;
v42 = (v40 ^ (v41 >> 2)) & 0x33333333;
v43 = v42 ^ v40;
v44 = 4 * v42 ^ v41;
v45 = (unsigned __int16)(v44 ^ HIWORD(v43));
v46 = v45 ^ v44;
v47 = (v45 << 16) ^ v43;
v48 = (v46 ^ (v47 >> 4)) & 0xF0F0F0F;
v49 = v48 ^ v46;
v50 = 16 * v48 ^ v47;
*a3 = HIBYTE(v50);
a3 = BYTE2(v50);
a3 = v50;
a3 = BYTE1(v50);
a3 = HIBYTE(v49);
result = v49 >> 8;
a3 = BYTE2(v49);
a3 = BYTE1(v49);
a3 = v49;
return result;
}

该函数传入用户密码，还有生成的子密钥。
由于是变种的des加密，不是很想逆密钥处理函数，反正都是生成固定的子密钥。可以先用python还原一下sub_4034A0

#!/usr/bin/python
#coding:utf-8

table_45C708=
table_45C508 =
table_45C308 =
table_45C108 =
table_45C808 =
table_45C608 =
table_45C408 =
table_45C208 =
a1 =


def circular_shift_left(int_value,k,bit = 32):

    bit_string = '{:0%db}' % bit

    bin_value = bit_string.format(int_value) # 8 bit binary

    bin_value = bin_value + bin_value[:k]

    int_value = int(bin_value,2)

    return int_value

def circular_shift_right (int_value,k,bit = 32):

    bit_string = '{:0%db}' % bit

    bin_value = bit_string.format(int_value) # 8 bit binary

    bin_value = bin_value[-k:] + bin_value[:-k]

    int_value = int(bin_value,2)

    return int_value



password_temp = "494C4F5645594F55"#输入必须为偶数

password_temp = password_temp.ljust(16,'0')

password_left = int(password_temp,16)

password_right = int(password_temp,16)

v4 = (password_right^(password_left)>>4)&0xf0f0f0f
v5 = v4^password_right
v6 = 16*v4^(password_left)
v7 = (v5^(v6>>16))&0x0ffff
v8 = (v7^v5)&0xffffffff
v9 = ((v7<<16)^v6)&0xffffffff
v10 = ((v9 ^ (v8 >> 2)) & 0x33333333)&0xffffffff
v11 = (v10 ^ v9)&0xffffffff
v12 = (4 * v10 ^ v8)&0xffffffff
v13 = ((v11 ^ (v12 >> 8)) & 0xFF00FF)&0xffffffff
v14 = (v13 ^ v11)&0xffffffff
v13_temp = (v13<<8)&0xffffffff
v12_temp = (v12^v13_temp)&0xffffffff
v15 = (v12_temp>>31)&0xffffffff+(v12_temp<<1)&0xffffffff
v15 = circular_shift_left(v12_temp,1)#循环左移
v16 = (v14 ^ v15) & 0xAAAAAAAA
v17 = (v16 ^ v15)&0xffffffff

# print table_45C208[((v17 ^ a1) >> 24) & 0x3F]
# print table_45C108[((a1 ^ circular_shift_right(v17, 4)) >> 24) & 0x3F]^circular_shift_left(v14 ^ v16, 1)^table_45C808[(v17 ^ a1) & 0x3F]^table_45C408[((v17 ^ a1) >> 16) & 0x3F]^table_45C208[((v17 ^ a1) >> 24) & 0x3F]^table_45C608[((v17 ^ a1) >> 8) & 0x3F]
v18 = (table_45C708[(a1 ^ circular_shift_right(v17, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v17, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v17, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v17, 4)) >> 24) & 0x3F] ^ table_45C808[(v17 ^ a1) & 0x3F] ^ table_45C608[((v17 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v17 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v17 ^ a1) >> 24) & 0x3F] ^ circular_shift_left(v14 ^ v16, 1))&0xffffffff;
v19 = (table_45C708[(a1 ^ circular_shift_right(v18, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v18, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v18, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v18, 4)) >> 24) & 0x3F] ^ table_45C808[(v18 ^ a1) & 0x3F] ^ table_45C608[((v18 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v18 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v18 ^ a1) >> 24) & 0x3F] ^ v17)&0xffffffff;
v20 = (table_45C708[(a1 ^ circular_shift_right(v19, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v19, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v19, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v19, 4)) >> 24) & 0x3F] ^ table_45C808[(v19 ^ a1) & 0x3F] ^ table_45C608[((v19 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v19 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v19 ^ a1) >> 24) & 0x3F] ^ v18)&0xffffffff;
v21 = (table_45C708[(a1 ^ circular_shift_right(v20, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v20, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v20, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v20, 4)) >> 24) & 0x3F] ^ table_45C808[(v20 ^ a1) & 0x3F] ^ table_45C608[((v20 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v20 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v20 ^ a1) >> 24) & 0x3F] ^ v19)&0xffffffff;
v22 = (table_45C708[(a1 ^ circular_shift_right(v21, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v21, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v21, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v21, 4)) >> 24) & 0x3F] ^ table_45C808[(v21 ^ a1) & 0x3F] ^ table_45C608[((v21 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v21 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v21 ^ a1) >> 24) & 0x3F] ^ v20)&0xffffffff;
v23 = (table_45C708[(a1 ^ circular_shift_right(v22, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v22, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v22, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v22, 4)) >> 24) & 0x3F] ^ table_45C808[(v22 ^ a1) & 0x3F] ^ table_45C608[((v22 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v22 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v22 ^ a1) >> 24) & 0x3F] ^ v21)&0xffffffff;
v24 = (table_45C708[(a1 ^ circular_shift_right(v23, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v23, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v23, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v23, 4)) >> 24) & 0x3F] ^ table_45C808[(v23 ^ a1) & 0x3F] ^ table_45C608[((v23 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v23 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v23 ^ a1) >> 24) & 0x3F] ^ v22)&0xffffffff;
v25 = (table_45C708[(a1 ^ circular_shift_right(v24, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v24, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v24, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v24, 4)) >> 24) & 0x3F] ^ table_45C808[(v24 ^ a1) & 0x3F] ^ table_45C608[((v24 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v24 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v24 ^ a1) >> 24) & 0x3F] ^ v23)&0xffffffff;
v26 = (table_45C708[(a1 ^ circular_shift_right(v25, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v25, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v25, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v25, 4)) >> 24) & 0x3F] ^ table_45C808[(v25 ^ a1) & 0x3F] ^ table_45C608[((v25 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v25 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v25 ^ a1) >> 24) & 0x3F] ^ v24)&0xffffffff;
v27 = (table_45C708[(a1 ^ circular_shift_right(v26, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v26, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v26, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v26, 4)) >> 24) & 0x3F] ^ table_45C808[(v26 ^ a1) & 0x3F] ^ table_45C608[((v26 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v26 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v26 ^ a1) >> 24) & 0x3F] ^ v25)&0xffffffff;
v28 = (table_45C708[(a1 ^ circular_shift_right(v27, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v27, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v27, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v27, 4)) >> 24) & 0x3F] ^ table_45C808[(v27 ^ a1) & 0x3F] ^ table_45C608[((v27 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v27 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v27 ^ a1) >> 24) & 0x3F] ^ v26)&0xffffffff;
v29 = (table_45C708[(a1 ^ circular_shift_right(v28, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v28, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v28, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v28, 4)) >> 24) & 0x3F] ^ table_45C808[(v28 ^ a1) & 0x3F] ^ table_45C608[((v28 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v28 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v28 ^ a1) >> 24) & 0x3F] ^ v27)&0xffffffff;
v30 = (table_45C708[(a1 ^ circular_shift_right(v29, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v29, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v29, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v29, 4)) >> 24) & 0x3F] ^ table_45C808[(v29 ^ a1) & 0x3F] ^ table_45C608[((v29 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v29 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v29 ^ a1) >> 24) & 0x3F] ^ v28)&0xffffffff;
v31 = (table_45C708[(a1 ^ circular_shift_right(v30, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v30, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v30, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v30, 4)) >> 24) & 0x3F] ^ table_45C808[(v30 ^ a1) & 0x3F] ^ table_45C608[((v30 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v30 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v30 ^ a1) >> 24) & 0x3F] ^ v29)&0xffffffff;
v32 = (table_45C708[(a1 ^ circular_shift_right(v31, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v31, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v31, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v31, 4)) >> 24) & 0x3F] ^ table_45C808[(v31 ^ a1) & 0x3F] ^ table_45C608[((v31 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v31 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v31 ^ a1) >> 24) & 0x3F] ^ v30)&0xffffffff;
v35 = (table_45C708[(a1 ^ circular_shift_right(v32, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v32, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v32, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v32, 4)) >> 24) & 0x3F] ^ table_45C808[(v32 ^ a1) & 0x3F] ^ table_45C608[((v32 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v32 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v32 ^ a1) >> 24) & 0x3F] ^ v31)&0xffffffff;
   
v35 = circular_shift_right(v35,1)


v36 = ((v32 ^ v35) & 0xAAAAAAAA)&0xffffffff
v37 = (v36 ^ v35)&0xffffffff
v38 = (circular_shift_right(v32 ^ v36, 1))&0xffffffff
v39 = ((v37 ^ (v38 >> 8)) & 0xFF00FF)&0xffffffff
v40 = (v39 ^ v37)&0xffffffff
v41 = ((v39 << 8) ^ v38)&0xffffffff
v42 = ((v40 ^ (v41 >> 2)) & 0x33333333)&0xffffffff
v43 = (v42 ^ v40)&0xffffffff
v44 = (4 * v42 ^ v41)&0xffffffff
v45 = ((v44 ^ (v43>>16)))&0xffff
v46 = (v45 ^ v44)&0xffffffff
v47 = ((v45 << 16) ^ v43)&0xffffffff
v48 = ((v46 ^ (v47 >> 4)) & 0xF0F0F0F)&0xffffffff
out_right = (v48 ^ v46)&0xffffffff
out_left = (16 * v48 ^ v47)&0xffffffff

print hex(out_left).rjust(8,'0')+hex(out_right).rjust(8,'0')
# 0xE108379B
# 0x6661BB00

这个函数用password加密得到的密文就是username，后边会和输入的username对比。
此时已经可以从password逆推回来username，但我想题目要求应该还是从username到password。
现在可以换种思路，现在我们得到子密钥，其实改变一下子密钥的的顺序就可以把加密函数改为解密函数。
看下边的图，就是明文加密的过程。

明文进入之后先进行初始置换，分为两部分 和子密钥进行16轮交替加密。

再看回sub_4034A0函数
password_right = a2 | ((a2 | ((a2 | (a2 << 8)) << 8)) << 8);
v4 = (password_right ^ ((a2 | ((a2 | ((a2 | ((unsigned int)*a2 << 8)) << 8)) << 8)) >> 4)) & 0xF0F0F0F;// 前4^后4 &0xf0f0f0f0
v5 = v4 ^ password_right;
v6 = 16 * v4 ^ (a2 | ((a2 | ((a2 | (*a2 << 8)) << 8)) << 8));
v7 = (unsigned __int16)(v5 ^ (v6 >> 16));
v8 = v7 ^ v5;
v9 = (v7 << 16) ^ v6;
v10 = (v9 ^ (v8 >> 2)) & 0x33333333;
v11 = v10 ^ v9;
v12 = 4 * v10 ^ v8;
v13 = (v11 ^ (v12 >> 8)) & 0xFF00FF;
v14 = v13 ^ v11;
v15 = __ROL4__(v12 ^ (v13 << 8), 1);          // 循环左移
v16 = (v14 ^ v15) & 0xAAAAAAAA;
v17 = v16 ^ v15;
这部分可以理解为初始置换


这部分可以理解为16轮交替加密。

v18 = dword_45C708[(a1 ^ __ROR4__(v17, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v17, 4)) >> 24) & 0x3F] ^ dword_45C808[(v17 ^ *a1) & 0x3F] ^ dword_45C608[(((unsigned int)v17 ^ *a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v17 ^ *a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v17 ^ *a1) >> 24) & 0x3F] ^ __ROL4__(v14 ^ v16, 1);
v19 = dword_45C708[(a1 ^ __ROR4__(v18, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v18, 4)) >> 24) & 0x3F] ^ dword_45C808[(v18 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v18 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v18 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v18 ^ a1) >> 24) & 0x3F] ^ v17;
v20 = dword_45C708[(a1 ^ __ROR4__(v19, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v19, 4)) >> 24) & 0x3F] ^ dword_45C808[(v19 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v19 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v19 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v19 ^ a1) >> 24) & 0x3F] ^ v18;
v21 = dword_45C708[(a1 ^ __ROR4__(v20, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v20, 4)) >> 24) & 0x3F] ^ dword_45C808[(v20 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v20 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v20 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v20 ^ a1) >> 24) & 0x3F] ^ v19;
v22 = dword_45C708[(a1 ^ __ROR4__(v21, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v21, 4)) >> 24) & 0x3F] ^ dword_45C808[(v21 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v21 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v21 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v21 ^ a1) >> 24) & 0x3F] ^ v20;
v23 = dword_45C708[(a1 ^ __ROR4__(v22, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v22, 4)) >> 24) & 0x3F] ^ dword_45C808[(v22 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v22 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v22 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v22 ^ a1) >> 24) & 0x3F] ^ v21;
v24 = dword_45C708[(a1 ^ __ROR4__(v23, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v23, 4)) >> 24) & 0x3F] ^ dword_45C808[(v23 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v23 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v23 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v23 ^ a1) >> 24) & 0x3F] ^ v22;
v25 = dword_45C708[(a1 ^ __ROR4__(v24, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v24, 4)) >> 24) & 0x3F] ^ dword_45C808[(v24 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v24 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v24 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v24 ^ a1) >> 24) & 0x3F] ^ v23;
v26 = dword_45C708[(a1 ^ __ROR4__(v25, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v25, 4)) >> 24) & 0x3F] ^ dword_45C808[(v25 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v25 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v25 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v25 ^ a1) >> 24) & 0x3F] ^ v24;
v27 = dword_45C708[(a1 ^ __ROR4__(v26, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v26, 4)) >> 24) & 0x3F] ^ dword_45C808[(v26 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v26 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v26 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v26 ^ a1) >> 24) & 0x3F] ^ v25;
v28 = dword_45C708[(a1 ^ __ROR4__(v27, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v27, 4)) >> 24) & 0x3F] ^ dword_45C808[(v27 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v27 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v27 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v27 ^ a1) >> 24) & 0x3F] ^ v26;
v29 = dword_45C708[(a1 ^ __ROR4__(v28, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v28, 4)) >> 24) & 0x3F] ^ dword_45C808[(v28 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v28 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v28 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v28 ^ a1) >> 24) & 0x3F] ^ v27;
v30 = dword_45C708[(a1 ^ __ROR4__(v29, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v29, 4)) >> 24) & 0x3F] ^ dword_45C808[(v29 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v29 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v29 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v29 ^ a1) >> 24) & 0x3F] ^ v28;
v31 = dword_45C708[(a1 ^ __ROR4__(v30, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v30, 4)) >> 24) & 0x3F] ^ dword_45C808[(v30 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v30 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v30 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v30 ^ a1) >> 24) & 0x3F] ^ v29;
v32 = dword_45C708[(a1 ^ __ROR4__(v31, 4)) & 0x3F] ^ dword_45C508[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 8) & 0x3F] ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v31, 4)) >> 24) & 0x3F] ^ dword_45C808[(v31 ^ a1) & 0x3F] ^ dword_45C608[(((unsigned int)v31 ^ a1) >> 8) & 0x3F] ^ dword_45C408[(((unsigned int)v31 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v31 ^ a1) >> 24) & 0x3F] ^ v30;
v33 = (((unsigned int)v32 ^ a1) >> 8) & 0x3F;
v34 = ((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 8) & 0x3F;
v35 = __ROR4__(
          dword_45C808[(v32 ^ a1) & 0x3F] ^ dword_45C608 ^ dword_45C408[(((unsigned int)v32 ^ a1) >> 16) & 0x3F] ^ dword_45C208[(((unsigned int)v32 ^ a1) >> 24) & 0x3F] ^ v31 ^ dword_45C708[(a1 ^ __ROR4__(v32, 4)) & 0x3F] ^ dword_45C508 ^ dword_45C308[((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 16) & 0x3F] ^ dword_45C108[((unsigned int)(a1 ^ __ROR4__(v32, 4)) >> 24) & 0x3F],
          1);

上边已经还原过这个函数，已经得知子密钥，那么把子密钥的顺序取反就可以得到解密函数。
可以写脚本
#!/usr/bin/python
#coding:utf-8

table_45C708=
table_45C508 =
table_45C308 =
table_45C108 =
table_45C808 =
table_45C608 =
table_45C408 =
table_45C208 =
a1 =


def circular_shift_left(int_value,k,bit = 32):

    bit_string = '{:0%db}' % bit

    bin_value = bit_string.format(int_value) # 8 bit binary

    bin_value = bin_value + bin_value[:k]

    int_value = int(bin_value,2)

    return int_value

def circular_shift_right (int_value,k,bit = 32):

    bit_string = '{:0%db}' % bit

    bin_value = bit_string.format(int_value) # 8 bit binary

    bin_value = bin_value[-k:] + bin_value[:-k]

    int_value = int(bin_value,2)

    return int_value



password_temp = "3532506F6A696521"#52Pojie!

password_temp = password_temp.ljust(16,'0')

password_left = int(password_temp,16)

password_right = int(password_temp,16)

v4 = (password_right^(password_left)>>4)&0xf0f0f0f
v5 = v4^password_right
v6 = 16*v4^(password_left)
v7 = (v5^(v6>>16))&0x0ffff
v8 = (v7^v5)&0xffffffff
v9 = ((v7<<16)^v6)&0xffffffff
v10 = ((v9 ^ (v8 >> 2)) & 0x33333333)&0xffffffff
v11 = (v10 ^ v9)&0xffffffff
v12 = (4 * v10 ^ v8)&0xffffffff
v13 = ((v11 ^ (v12 >> 8)) & 0xFF00FF)&0xffffffff
v14 = (v13 ^ v11)&0xffffffff
v13_temp = (v13<<8)&0xffffffff
v12_temp = (v12^v13_temp)&0xffffffff
v15 = (v12_temp>>31)&0xffffffff+(v12_temp<<1)&0xffffffff
v15 = circular_shift_left(v12_temp,1)#循环左移
v16 = (v14 ^ v15) & 0xAAAAAAAA
v17 = (v16 ^ v15)&0xffffffff

v18 = (table_45C708[(a1 ^ circular_shift_right(v17, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v17, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v17, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v17, 4)) >> 24) & 0x3F] ^ table_45C808[(v17 ^ a1) & 0x3F] ^ table_45C608[((v17 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v17 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v17 ^ a1) >> 24) & 0x3F] ^ circular_shift_left(v14 ^ v16, 1))&0xffffffff;
v19 = (table_45C708[(a1 ^ circular_shift_right(v18, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v18, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v18, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v18, 4)) >> 24) & 0x3F] ^ table_45C808[(v18 ^ a1) & 0x3F] ^ table_45C608[((v18 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v18 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v18 ^ a1) >> 24) & 0x3F] ^ v17)&0xffffffff;
v20 = (table_45C708[(a1 ^ circular_shift_right(v19, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v19, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v19, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v19, 4)) >> 24) & 0x3F] ^ table_45C808[(v19 ^ a1) & 0x3F] ^ table_45C608[((v19 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v19 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v19 ^ a1) >> 24) & 0x3F] ^ v18)&0xffffffff;
v21 = (table_45C708[(a1 ^ circular_shift_right(v20, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v20, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v20, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v20, 4)) >> 24) & 0x3F] ^ table_45C808[(v20 ^ a1) & 0x3F] ^ table_45C608[((v20 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v20 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v20 ^ a1) >> 24) & 0x3F] ^ v19)&0xffffffff;
v22 = (table_45C708[(a1 ^ circular_shift_right(v21, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v21, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v21, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v21, 4)) >> 24) & 0x3F] ^ table_45C808[(v21 ^ a1) & 0x3F] ^ table_45C608[((v21 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v21 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v21 ^ a1) >> 24) & 0x3F] ^ v20)&0xffffffff;
v23 = (table_45C708[(a1 ^ circular_shift_right(v22, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v22, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v22, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v22, 4)) >> 24) & 0x3F] ^ table_45C808[(v22 ^ a1) & 0x3F] ^ table_45C608[((v22 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v22 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v22 ^ a1) >> 24) & 0x3F] ^ v21)&0xffffffff;
v24 = (table_45C708[(a1 ^ circular_shift_right(v23, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v23, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v23, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v23, 4)) >> 24) & 0x3F] ^ table_45C808[(v23 ^ a1) & 0x3F] ^ table_45C608[((v23 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v23 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v23 ^ a1) >> 24) & 0x3F] ^ v22)&0xffffffff;
v25 = (table_45C708[(a1 ^ circular_shift_right(v24, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v24, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v24, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v24, 4)) >> 24) & 0x3F] ^ table_45C808[(v24 ^ a1) & 0x3F] ^ table_45C608[((v24 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v24 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v24 ^ a1) >> 24) & 0x3F] ^ v23)&0xffffffff;
v26 = (table_45C708[(a1 ^ circular_shift_right(v25, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v25, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v25, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v25, 4)) >> 24) & 0x3F] ^ table_45C808[(v25 ^ a1) & 0x3F] ^ table_45C608[((v25 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v25 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v25 ^ a1) >> 24) & 0x3F] ^ v24)&0xffffffff;
v27 = (table_45C708[(a1 ^ circular_shift_right(v26, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v26, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v26, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v26, 4)) >> 24) & 0x3F] ^ table_45C808[(v26 ^ a1) & 0x3F] ^ table_45C608[((v26 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v26 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v26 ^ a1) >> 24) & 0x3F] ^ v25)&0xffffffff;
v28 = (table_45C708[(a1 ^ circular_shift_right(v27, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v27, 4)) >> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v27, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v27, 4)) >> 24) & 0x3F] ^ table_45C808[(v27 ^ a1) & 0x3F] ^ table_45C608[((v27 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v27 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v27 ^ a1) >> 24) & 0x3F] ^ v26)&0xffffffff;
v29 = (table_45C708[(a1 ^ circular_shift_right(v28, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v28, 4))>> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v28, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v28, 4)) >> 24) & 0x3F] ^ table_45C808[(v28 ^ a1) & 0x3F] ^ table_45C608[((v28 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v28 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v28 ^ a1) >> 24) & 0x3F] ^ v27)&0xffffffff;
v30 = (table_45C708[(a1 ^ circular_shift_right(v29, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v29, 4))>> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v29, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v29, 4)) >> 24) & 0x3F] ^ table_45C808[(v29 ^ a1) & 0x3F] ^ table_45C608[((v29 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v29 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v29 ^ a1) >> 24) & 0x3F] ^ v28)&0xffffffff;
v31 = (table_45C708[(a1 ^ circular_shift_right(v30, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v30, 4))>> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v30, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v30, 4)) >> 24) & 0x3F] ^ table_45C808[(v30 ^ a1) & 0x3F] ^ table_45C608[((v30 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v30 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v30 ^ a1) >> 24) & 0x3F] ^ v29)&0xffffffff;
v32 = (table_45C708[(a1 ^ circular_shift_right(v31, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v31, 4))>> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v31, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v31, 4)) >> 24) & 0x3F] ^ table_45C808[(v31 ^ a1) & 0x3F] ^ table_45C608[((v31 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v31 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v31 ^ a1) >> 24) & 0x3F] ^ v30)&0xffffffff;
v35 = (table_45C708[(a1 ^ circular_shift_right(v32, 4)) & 0x3F] ^ table_45C508[((a1 ^ circular_shift_right(v32, 4))>> 8) & 0x3F] ^ table_45C308[((a1 ^ circular_shift_right(v32, 4)) >> 16) & 0x3F] ^ table_45C108[((a1 ^ circular_shift_right(v32, 4)) >> 24) & 0x3F] ^ table_45C808[(v32 ^ a1) & 0x3F] ^ table_45C608[((v32 ^ a1) >> 8) & 0x3F] ^ table_45C408[((v32 ^ a1) >> 16) & 0x3F] ^ table_45C208[((v32 ^ a1) >> 24) & 0x3F] ^ v31)&0xffffffff;

v35 = circular_shift_right(v35,1)


v36 = ((v32 ^ v35) & 0xAAAAAAAA)&0xffffffff
v37 = (v36 ^ v35)&0xffffffff
v38 = (circular_shift_right(v32 ^ v36, 1))&0xffffffff
v39 = ((v37 ^ (v38 >> 8)) & 0xFF00FF)&0xffffffff
v40 = (v39 ^ v37)&0xffffffff
v41 = ((v39 << 8) ^ v38)&0xffffffff
v42 = ((v40 ^ (v41 >> 2)) & 0x33333333)&0xffffffff
v43 = (v42 ^ v40)&0xffffffff
v44 = (4 * v42 ^ v41)&0xffffffff
v45 = ((v44 ^ (v43>>16)))&0xffff
v46 = (v45 ^ v44)&0xffffffff
v47 = ((v45 << 16) ^ v43)&0xffffffff
v48 = ((v46 ^ (v47 >> 4)) & 0xF0F0F0F)&0xffffffff
out_right = (v48 ^ v46)&0xffffffff
out_left = (16 * v48 ^ v47)&0xffffffff

temp = (hex(out_left).rjust(8,'0')+hex(out_right).rjust(8,'0')).upper()
print temp





kenwapj 发表于 2020-1-4 00:34

我是面试官，明天开始取消泄漏的题目

evea 发表于 2020-1-4 11:04

;www;www 随便给一组{:1_911:}

xiao智可以不帅 发表于 2020-1-3 23:01

我觉得肯定会火

virt123 发表于 2020-1-3 23:29

感觉很厉害的样子 ，小白看不懂先标记有空学习一下

红红的太阳 发表于 2020-1-3 23:40

能下载使用就好了。

周游世界 发表于 2020-1-4 00:04

原谅我无知，只有一句牛Bi

cherrypi 发表于 2020-1-4 00:18

先收藏，明天慢慢来看看。

唐子啊 发表于 2020-1-4 00:44

原谅我无知，只有一句牛Bi

smallte 发表于 2020-1-4 01:15

楼主学数学的？或是密码学？膜拜大佬

2Burhero 发表于 2020-1-4 01:18

要去期望
页: [1] 2 3 4 5 6
查看完整版本: 深圳某讯面试题两种注册方式详解


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn