ctf pyc反编译+解密详细分析

52lxw

用EasyPythonDecompiler反编译pyc文件得到：

[Python] 纯文本查看 复制代码

# Embedded file name: secend.py
print "Welcome to Processor's Python Classroom Part 2!\n"
print "Now let's start the origin of Python!\n"
print 'Plz Input Your Flag:\n'
enc = raw_input()
len = len(enc)
enc1 = []
enc2 = ''
aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
for i in range(len):
    if i % 2 == 0:#2
        enc1.append(chr(ord(enc[i]) + 1))
    else:#1
        enc1.append(chr(ord(enc[i]) + 2))

s1 = []
for x in range(3):#encrypt the plain
    for i in range(len):#
        if (i + x) % 3 == 0:#swap the position
            s1.append(enc1[i])

enc2 = enc2.join(s1)
if enc2 in aaa: #another way to judge equal
    print "You 're Right!"
else:
    print "You're Wrong!"
    exit(0)

分析一下代码，先进行移位，偶数移1位，奇数移2位，然后进行了类似交换的加密，我动态调试一下

[Python] 纯文本查看 复制代码

[backcolor=#40332b]aaa[/backcolor] = [color=#a5c261]'ioOavquaDb}x2ha4[~ifqZaujQ#'[/color]
s1 = []
for x in range(3):#encrypt the plain
    for i in range(len(aaa)):
        if (i + x) % 3 == 0:#swap the position
            print str(i)+',',
    print

输出

[Python] 纯文本查看 复制代码

0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,

可以发现原来的下标顺序0,1,2,3,4,5,....变为了0,3,6,9,12....我们写个脚本把顺序还原

[Python] 纯文本查看 复制代码

aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
print len(aaa)
matrix=[0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25
        ]
s1 = []
for x in range(3):#encrypt the plain
    for i in range(len(aaa)):
        if (i + x) % 3 == 0:#swap the position
            print str(i)+',',
    print
plain=['']*27
for i in range(27):
    plain[matrix[i]]=aaa[i]
print ''.join(plain)

输出

[Python] 纯文本查看 复制代码

27
0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,
iibof}OqxaZ2vahquauj4aQ[D#~

解下来解密移位，很简单,把加变成减就行了：

[Python] 纯文本查看 复制代码

enc1=[]
for i in range(27):
    if i % 2 == 0:#2
        enc1.append(chr(ord(plain[i]) - 1))
    else:#1
        enc1.append(chr(ord(plain[i]) - 2))

最后写到一起

[Python] 纯文本查看 复制代码

aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
print len(aaa)
matrix=[0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25
        ]
s1 = []
for x in range(3):#encrypt the plain
    for i in range(len(aaa)):
        if (i + x) % 3 == 0:#swap the position
            print str(i)+',',
    print
plain=['']*27
for i in range(27):
    plain[matrix[i]]=aaa[i]
print ''.join(plain)
enc1=[]
for i in range(27):
    if i % 2 == 0:#2
        enc1.append(chr(ord(plain[i]) - 1))
    else:#1
        enc1.append(chr(ord(plain[i]) - 2))
print "".join(enc1)

[Python] 纯文本查看 复制代码

27
0, 3, 6, 9, 12, 15, 18, 21, 24,
2, 5, 8, 11, 14, 17, 20, 23, 26,
1, 4, 7, 10, 13, 16, 19, 22, 25,
iibof}OqxaZ2vahquauj4aQ[D#~
hgame{Now_Y0u_got_th3_PYC!}

chenjingyes

谢谢楼主分享   很适合入门练习

冥界3大法王

@52lxw
楼主你给我表演下破解Wing IDE 7.0
这个让我搞的无限试用了，如何注册成功不太会弄。

Fris

冥界3大法王 发表于 2019-5-16 08:05
@52lxw
楼主你给我表演下破解Wing IDE 7.0
这个让我搞的无限试用了，如何注册成功不太会弄。

无限试用就行了呗，还追求那么多干啥？
话说你汉化完了没？共享一下呗。

FZW云焕

高手啊，感觉很厉害

ruin1990

谢谢楼主分享，这个过程实践挺实用