# uncompyle6 version 3.7.4# Python bytecode 2.7 (62211)# Decompiled from: Python 3.8.6 (tags/v3.8.6:db45529, Sep 23 2020, 15:52:53) [MSC v.1927 64 bit (AMD64)]# Embedded file name: py.py# Compiled at: 1995-09-28 00:18:56  def encode(s):    str = ''    for i in range(len(s)):        res = ord(s[i]) ^ 32        res += 31        str += chr(res)     return str  m = 'ek`fz13b3c5e047b`bd`0/c268e600e7c5d1`|'strings = ''strings = input('Input:')if encode(strings) == m:    print 'Correct!'else:    print 'Try again!'

m = 'ek`fz13b3c5e047b`bd`0/c268e600e7c5d1`|'str=''for i in m:  str+=chr((ord(i)-31)^32)print(str)#flag{24c4d6f158cacea10d379f711f8d6e2a}

fake_code=[   0xDD, 0x9F, 0x58, 0xB3, 0x72, 0xD0, 0xBC, 0xC4, 0x94, 0x56,  0x6C, 0xA8, 0xCE, 0x54, 0x62, 0xCE, 0x1E, 0xF3, 0xF3, 0x26,  0xB9, 0x19, 0x0F, 0xC6, 0x2D, 0x6E, 0xA3, 0xC0, 0x21, 0xD4,  0x99, 0x13]fake_flag='flag{abcdefghijklmnopqrstuvwxyz}'enc=[0x8C, 0xC4, 0x00, 0xE6, 0x6A, 0x88, 0xB8, 0x90, 0xC2, 0x07,  0x6B, 0xA9, 0xC3, 0x0A, 0x3E, 0xC0, 0x44, 0xA6, 0xFE, 0x7E,  0xF0, 0x59, 0x4C, 0x83, 0x3D, 0x2B, 0xE2, 0xD3, 0x38, 0xCB,  0x82, 0x5B]for i in range(32):  print(chr(ord(fake_flag[i])^fake_code[i]^enc[i]),end='')#7792c9f724afe76e68c79116d07dafa5

#include<stdio.h>void encrypt(unsigned __int64 *code , unsigned __int64 *key){    unsigned __int64 delta=0x9E3779B9;   unsigned __int64 tmp1,tmp2,tmp3,tmp4,key1,key2,key3,key4,d;   int i;     tmp1=code[0];    tmp2=code[1];    tmp3=code[2];    tmp4=code[3];     key1=key[0];    key2=key[1];    key3=key[2];    key4=key[3];     for(i=0;i<32;i++)    {        d+=delta;        tmp1 += (key2 + (tmp2 >> 5)) ^ (d + tmp2) ^ (key1 + 16 * tmp2);        tmp2 += (key4 + (tmp1 >> 5)) ^ (d + tmp1) ^ (key3 + 16 * tmp1);        tmp3 += (key2 + (tmp4 >> 5)) ^ (d + tmp4) ^ (key1 + 16 * tmp4);        tmp4 += (key4 + (tmp3 >> 5)) ^ (d + tmp3) ^ (key3 + 16 * tmp3);    }    code[0]=tmp1;    code[1]=tmp2;    code[2]=tmp3;    code[3]=tmp4;} void decrypt(unsigned __int64 *code , unsigned __int64 *key){    unsigned __int64 delta=0x9E3779B9;   unsigned __int64 sum=delta*32;// sum=0x13C6EF3720   unsigned __int64 tmp1,tmp2,tmp3,tmp4,key1,key2,key3,key4;   int i;     tmp1=code[0];    tmp2=code[1];    tmp3=code[2];    tmp4=code[3];     key1=key[0];    key2=key[1];    key3=key[2];    key4=key[3];     for(i=0;i<32;i++)    {        tmp4 -= (key4 + (tmp3 >> 5)) ^ (sum + tmp3) ^ (key3 + 16 * tmp3);        tmp3 -= (key2 + (tmp4 >> 5)) ^ (sum + tmp4) ^ (key1 + 16 * tmp4);        tmp2 -= (key4 + (tmp1 >> 5)) ^ (sum + tmp1) ^ (key3 + 16 * tmp1);        tmp1 -= (key2 + (tmp2 >> 5)) ^ (sum + tmp2) ^ (key1 + 16 * tmp2);        sum-=delta;    }    code[0]=tmp1;    code[1]=tmp2;    code[2]=tmp3;    code[3]=tmp4;} int main(){    unsigned __int64 code[4]={0x0E990A522BE80F786,0x8B836286B8A5EB59,0x2FDE61CCEFC70FF8,0x56BC19E119C8B07B},key[4]={0x54466076484C5476,0x4550504F765F4344,0x5A796F755F6D6179,0x5F6E6565645F7468};     //encrypt(code,key);    decrypt(code,key);    printf("%016llx%016llx%016llx%016llx",code[0],code[1],code[2],code[3]);}//505a4cc462489e8003aef16b785c7501343057844ff5acb809616159f51713f3

enc = bytearray.fromhex('505a4cc462489e8003aef16b785c7501343057844ff5acb809616159f51713f3')fake_flag='abcdefghijklmnopqrstuvwxyzabcdea'xor=[0x00000005,0x00000059,0x0000001a,0x000000c3,0x00000037,0x00000048,0x000000c8,0x0000008a,0x0000005f,0x000000a7,0x000000f9,0x00000030,0x00000073,0x00000004,0x0000002a,0x00000014,0x0000007c,0x00000073,0x0000001c,0x000000c6,0x0000000b,0x000000b2,0x000000ec,0x000000f2,0x00000041,0x00000078,0x00000038,0x0000000c,0x000000f4,0x00000012,0x00000046,0x000000a5]flag=''for i in range(32):  flag+=chr((ord(fake_flag[i])^xor[i]^enc[i]))flag='flag{'+flag+'}'print(flag)#flag{4a5c0f1b5cc7f60e918611721c87ba07}

# 往期推荐

1. 对使用系统调用进行收发包的frida hook抓包

2. 恶意样本分析——XOR加密与进程注入

3.超级长的IE调试总结：CVE-2013-1347 IE CGenericElement UAF漏洞分析

4. MS17-010 “永恒之蓝”漏洞分析与复现

5. 11个小挑战，Qiling Framework 入门上手跟练

6. VMP导入表修复