文章目錄

• • • 去花后
    • keys(key)
    • init(key, v9, (int)key);
    • 腳本
    • 總結(jié)：

去花后

只需要管是三個函數(shù)keys(key) init(key, v9, (int)key); encry(key, (int)key, (int)input, (int)ciphertext);，其它都不重要，反正不要點開轟炸函數(shù)就行。

keys(key)

j_memset(this, 0, 0x100u);this[64] = "THISISAFAKEFLAG";return this;

init(key, v9, (int)key);

v6 = j_strlen(Str);v5 = 0;result = 0;for ( i = 0; i < 256; ++i ){*(_BYTE *)(i + a3) = 0xFF - i;v5 = (Str[i % v6] + v5 + *(unsigned __int8 *)(i + a3)) % 256;sub_5D42BC(this, i + a3, v5 + a3);result = i + 1;}return result;

這里的話，只需要注意一點（改版的RC4），初始化函數(shù)中的賦值：

s[i] = 0xff-i;

腳本

#include <iostream> using namespace std; void rc4_init(unsigned char* s, unsigned char* key, unsigned long Len) {int i = 0, j = 0;unsigned char tmp = 0;for (i = 0; i < 256; ++i){s[i] = 0xff-i;j = (j + s[i] + key[i%15]) % 256;tmp = s[i];s[i] = s[j];//交換s[i]和s[j]s[j] = tmp;} }void rc4_crypt(unsigned char* s, unsigned char* Data, unsigned long Len) {int i = 0, j = 0, t = 0;unsigned long k = 0;unsigned char tmp;for (k = 0; k < Len; k++){i = (i + 1) % 256;j = (j + s[i]) % 256;tmp = s[i];s[i] = s[j];//交換s[x]和s[y]s[j] = tmp;t = (s[i] + s[j]) % 256;Data[k] ^= s[t];} }int main() {unsigned char ida_chars[] ={0x44, 0x3F, 0x53, 0x2F, 0x73, 0x86, 0x3E, 0xAE, 0x55, 0xBE,0x18, 0x5F, 0x74, 0x68, 0x33, 0x5F, 0xF2, 0x06, 0x6D, 0x62};char key[] = { 0x54, 0x48, 0x49, 0x53, 0x49, 0x53, 0x41, 0x46, 0x41, 0x4B,0x45, 0x46, 0x4C, 0x41, 0x47 };unsigned char s[256] = { 0 }, s2[256] = { 0 };rc4_init(s, (unsigned char*)key, strlen(key));for (int i = 0; i < 256; i++)//用s2[i]暫時保留經(jīng)過初始化的s[i]，很重要的！！！{s2[i] = s[i];}rc4_crypt(s2, (unsigned char*)ida_chars, 20);for (int i = 0; i < 20; i++) {cout << char(ida_chars[i]);} }

D1S4ss3mbl3_th3_b0mb

總結(jié)：

RC4

去花

總結(jié)

以上是生活随笔為你收集整理的MoeCTF 2021Re部分------RedC4Bomb的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。