首先查壳
upx,用upx -d notsudoku.exe脱掉
然后是个python的exe,用python pyinstxtractor.py notsudoku.exe拆开(pyinstxtractor.py随便下一个)
其中的2是pyc文件,但是缺少文件头,把struct文件里的头和2文件的全部复制到一个新文件里(不能直接修改)
然后用uncompyle6 -o new.py new.pyc转成py文件
# uncompyle6 version 3.7.4
# Python bytecode 3.7 (3394)
# Decompiled from: Python 3.8.2 (tags/v3.8.2:7b3ab59, Feb 25 2020, 23:03:10) [MSC v.1916 64 bit (AMD64)]
# Embedded file name: 2.py
# Compiled at: 1995-09-28 00:18:56
# Size of source mod 2**32: 272 bytes
import time, sys, hashlib
class あ:
def __init__(self):
self.う = {}
self.な = []
self.に = ''
self.ぬ = []
self.ね = 65
def え(self, えひ):
def の(f):
self.う[えひ] = f
return f
return の
def お(self, は):
return self.う.get(は)
def か(self):
き = 0
while True:
く = self.な[き][0]
け = self.な[き][1]
こ = self.な[き][2]
さ = self.お(く)
さ(け, こ)
き += 1
い = あ()
@い.え('し')
def f(a, b):
if a == 1:
い.ぬ += b
@い.え('す')
def f(a, b):
if a == 1:
print(い.に)
else:
if a == 2:
print(い.ぬ)
else:
if a == 3:
print((い.flag), end='')
else:
print(a, end='')
@い.え('せ')
def f(a, b):
sys.exit()
@い.え('そ')
def f(a, b):
い.に = input()
@い.え('た')
def f(a, b):
time.sleep(a)
@い.え('ち')
def f(a, b):
if len(い.に) % 2 != 0:
sys.exit()
for i in い.に:
if ord(i) > 52 or ord(i) < 48:
sys.exit()
x = str(hashlib.new('md5', bytes((い.に), encoding='utf8')).hexdigest())
if x[:6] != 'e3a912':
sys.exit()
い.flag = x
@い.え('と')
def f(a, b):
ふ = 0
for i in range(0, len(い.に), 2):
ふ += 1
a = int(い.に[i])
b = int(い.に[(i + 1)])
い.ぬ[a][b] = ふ
@い.え('つ')
def f(a, b):
if い.ぬ[0][1] != 24 or い.ぬ[4][3] != 2:
sys.exit()
if い.ぬ[0][2] != 1 or い.ぬ[2][3] != 20:
sys.exit()
if い.ぬ[1][0] != 23 or い.ぬ[3][4] != 3:
sys.exit()
@い.え('て')
def f(a, b):
ね = 0
if b == -1:
for i in range(5):
ね += い.ぬ[a][i]
if ね != い.ね:
sys.exit()
else:
for i in range(5):
ね += い.ぬ[i][b]
if ね != い.ね:
sys.exit()
い.な = [
[
'す', 'welcome baby~ ', 0],
[
'す', 'input your flag~:', 0],
[
'そ', 0, 0],
[
'す', 'your input is:', 0],
[
'す', 1, 0],
[
'す', "let's check......", 0],
[
'た', 0.5, 0],
[
'し', 1, [[0 for i in range(5)]]],
[
'し', 1, [[0 for i in range(5)]]],
[
'し', 1, [[0 for i in range(5)]]],
[
'し', 1, [[0 for i in range(5)]]],
[
'し', 1, [[0 for i in range(5)]]],
[
'ち', 0, 0],
[
'と', 0, 0],
[
'つ', 0, 0],
[
'て', 0, -1],
[
'て', 1, -1],
[
'て', 2, -1],
[
'て', 3, -1],
[
'て', 4, -1],
[
'て', 0, 0],
[
'て', 0, 1],
[
'て', 0, 2],
[
'て', 0, 3],
[
'て', 0, 4],
[
'す', 'Goodjob!', 0],
[
'す', 'The flag is vnctf{', 0],
[
'す', 3, 0],
[
'す', '}', 0],
[
'せ', 0, 0]]
い.か()
是五维幻方,和为65
#include<cstdio>
#include<iostream>
using namespace std;
int main()
{
int a[5][7]={{17,24,1,8,15},{23,5,7,14,16},{4,6,13,20,22},{10,12,19,21,3},{11,18,25,2,9}};
int k = 1;
while (k <= 25)
{
for (int i = 0; i <= 4; i++)
{
for (int j = 0; j <= 4; j++)
{
if (a[i][j] == k)
{
cout << i << j;
k++;
}
}
}
}
return 0;
}
flag:vnctf{e3a912c1e911ad82544af0c3d753f44f}