ctf pyc反编译+解密详细分析

52lxw 发表于 2019-5-15 21:16

用EasyPythonDecompiler反编译pyc文件得到：

# Embedded file name: secend.py
print "Welcome to Processor's Python Classroom Part 2!\n"
print "Now let's start the origin of Python!\n"
print 'Plz Input Your Flag:\n'
enc = raw_input()
len = len(enc)
enc1 = []
enc2 = ''
aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
for i in range(len):
if i % 2 == 0:#2
   enc1.append(chr(ord(enc) + 1))
else:#1
   enc1.append(chr(ord(enc) + 2))

s1 = []
for x in range(3):#encrypt the plain
for i in range(len):#
   if (i + x) % 3 == 0:#swap the position
         s1.append(enc1)

enc2 = enc2.join(s1)
if enc2 in aaa: #another way to judge equal
print "You 're Right!"
else:
print "You're Wrong!"
exit(0)
分析一下代码，先进行移位，偶数移1位，奇数移2位，然后进行了类似交换的加密，我动态调试一下
aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
s1 = []
for x in range(3):#encrypt the plain
for i in range(len(aaa)):
   if (i + x) % 3 == 0:#swap the position
         print str(i)+',',
print
输出0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,
可以发现原来的下标顺序0,1,2,3,4,5,....变为了0,3,6,9,12....我们写个脚本把顺序还原aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
print len(aaa)
matrix=[0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25
   ]
s1 = []
for x in range(3):#encrypt the plain
for i in range(len(aaa)):
   if (i + x) % 3 == 0:#swap the position
         print str(i)+',',
print
plain=['']*27
for i in range(27):
plain]=aaa
print ''.join(plain)
输出27
0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,
iibof}OqxaZ2vahquauj4aQ
解下来解密移位，很简单,把加变成减就行了：enc1=[]
for i in range(27):
if i % 2 == 0:#2
   enc1.append(chr(ord(plain) - 1))
else:#1
   enc1.append(chr(ord(plain) - 2))
最后写到一起aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
print len(aaa)
matrix=[0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25
   ]
s1 = []
for x in range(3):#encrypt the plain
for i in range(len(aaa)):
   if (i + x) % 3 == 0:#swap the position
         print str(i)+',',
print
plain=['']*27
for i in range(27):
plain]=aaa
print ''.join(plain)
enc1=[]
for i in range(27):
if i % 2 == 0:#2
   enc1.append(chr(ord(plain) - 1))
else:#1
   enc1.append(chr(ord(plain) - 2))
print "".join(enc1)

27
0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,
iibof}OqxaZ2vahquauj4aQ[D#~
hgame{Now_Y0u_got_th3_PYC!}

chenjingyes 发表于 2019-5-16 00:41

谢谢楼主分享很适合入门练习:lol

冥界3大法王 发表于 2019-5-16 08:05

@52lxw
楼主你给我表演下破解Wing IDE 7.0
这个让我搞的无限试用了，如何注册成功不太会弄。

Fris 发表于 2019-5-16 19:35

冥界3大法王发表于 2019-5-16 08:05
@52lxw
楼主你给我表演下破解Wing IDE 7.0
这个让我搞的无限试用了，如何注册成功不太会弄。

无限试用就行了呗，还追求那么多干啥？
话说你汉化完了没？共享一下呗。

FZW云焕 发表于 2019-5-26 09:47

高手啊，感觉很厉害

ruin1990 发表于 2019-6-12 18:08

谢谢楼主分享，这个过程实践挺实用

页: [1]

吾爱破解 - 52pojie.cn's Archiver

ctf pyc反编译+解密详细分析