1
用户输入(8位) → E(input) → 比较结果 → 返回code → 显示对应消息

1
NP = [0, 12, 5, 8, 1, 10, 2, 15, 14, 3, 11, 4, 9, 7, 6, 13]
2
NPinv = [0, 4, 6, 9, 11, 2, 14, 13, 3, 12, 5, 10, 1, 8, 15, 7]

1
rcSeed = [215, 31, 223, 184, 189, 157, 205, 105]

1
FC_HEX = "288EC0208CDB3A3CCC4BF6B5B2731E7E2B66096270417B26D9405A5607ACB471861DD07437A4F46F75600550"

1
for i in range(8):
2
    out[i] = input[i] ^ ((i * 2 + 103) & 0xFF)

1
for i in range(8):
2
    out[i] = ((out[i] << 2) | (out[i] >> 6)) & 0xFF

1
for i in range(8):
2
    temp = (out[i] - i*5 + 11) & 0xFF
3
    out[i] = (temp * 5 - 23) & 0xFF

1
for i in range(8):
2
    k1 = (187 - i) & 0xFF
3
    k2 = (i * 3 + 68) & 0xFF
4
    k3 = (136 - i * 2) & 0xFF
5
    k4 = (i * 4 + 221) & 0xFF
6
    out[i] = out[i] ^ k1 ^ k2 ^ k3 ^ k4

1
for i in range(4):
2
    j = 7 - i  # 对称位置
3

4
    # 分离高低半字节
5
    hiT = (out[i] >> 4) & 0x0F
6
    loT = out[i] & 0x0F
7
    hiA = (out[j] >> 4) & 0x0F
8
    loA = out[j] & 0x0F
9

10
    # 使用NP表置换
11
    hiTp = NP[hiT]
12
    loTp = NP[loT]
13
    hiAp = NP[hiA]
14
    loAp = NP[loA]
15

16
    # 交叉组合
17
    out[i] = (hiTp << 4) | loAp
18
    out[j] = (hiAp << 4) | loTp

1
for i in range(8):
2
    v = ((i + 119) ^ (out[i] - (i*i*2) % 256)) & 0xFF
3
    out[i] = ((v << 4) | (v >> 4)) & 0xFF

1
#!/usr/bin/env python3
2
"""
3
PCTF EzAndroid CTF Challenge Solver
4
逆向工程Android加密算法以获取正确输入
5
"""
6

7
# 置换表
8
NP = [0, 12, 5, 8, 1, 10, 2, 15, 14, 3, 11, 4, 9, 7, 6, 13]
9

10
# 生成NP的逆置换表
11
NPinv = [0] * 16
12
for i in range(16):
13
    NPinv[NP[i]] = i
14

15
# rcSeed用于生成正确答案的目标值
16
rcSeed = [215, 31, 223, 184, 189, 157, 205, 105]
17

18

19
def R():
20
    """
21
    生成正确答案的加密目标值
22
    这是validate函数中code==1的条件
23
    """
24
    result = []
25
    for i in range(8):
26
        result.append(rcSeed[i] ^ ((i * 13 + 90) & 0xFF))
27
    return result
28

29

30
def E(s):
31
    """
32
    正向加密函数E(s) - 用于验证
33
    输入: 8字节字符串
34
    输出: 8字节加密结果
35
    """
36
    if len(s) != 8:
37
        return []
38

39
    out = [ord(c) for c in s]
40

41
    # 第1轮: XOR with position-dependent key
42
    for i in range(8):
43
        v = out[i] & 0xFF
44
        k = ((i * 2) + 103) & 0xFF
45
        out[i] = v ^ k
46

47
    # 第2轮: 循环左移2位
48
    for i in range(8):
49
        v = out[i] & 0xFF
50
        out[i] = ((v << 2) | (v >> 6)) & 0xFF
51

52
    # 第3轮: 仿射变换
53
    for i in range(8):
54
        v = out[i] & 0xFF
55
        out[i] = ((((v - (i * 5) + 11) & 0xFF) * 5) - 23) & 0xFF
56

57
    # 第4轮: 多重XOR
58
    for i in range(8):
59
        v = out[i] & 0xFF
60
        k1 = (187 - i) & 0xFF
61
        k2 = ((i * 3) + 68) & 0xFF
62
        k3 = (136 - (i * 2)) & 0xFF
63
        k4 = ((i * 4) + 221) & 0xFF
64
        out[i] = ((v ^ k1) ^ k2) ^ k3 ^ k4
65

66
    # 第5轮: 半字节置换与交换
67
    for i in range(4):
68
        j = 7 - i
69
        t = out[i] & 0xFF
70
        a = out[j] & 0xFF
71

72
        hiT = (t >> 4) & 0x0F
73
        loT = t & 0x0F
74
        hiA = (a >> 4) & 0x0F
75
        loA = a & 0x0F
76

77
        hiTp = NP[hiT]
78
        loTp = NP[loT]
79
        hiAp = NP[hiA]
80
        loAp = NP[loA]
81

82
        out[i] = (hiTp << 4) | loAp
83
        out[j] = (hiAp << 4) | loTp
84

85
    # 第6轮: 复杂变换和半字节旋转
86
    for i in range(8):
87
        v = (((i + 119) & 0xFF) ^ (((out[i] & 0xFF) - (((i * i) * 2) % 256)) & 0xFF)) & 0xFF
88
        out[i] = ((v << 4) | (v >> 4)) & 0xFF
89

90
    return out
91

92

93
def modinv(a, m):
94
    """计算a在模m下的乘法逆元"""
95
    # 使用扩展欧几里得算法
96
    def extended_gcd(a, b):
97
        if a == 0:
98
            return b, 0, 1
99
        gcd, x1, y1 = extended_gcd(b % a, a)
100
        x = y1 - (b // a) * x1
101
        y = x1
102
        return gcd, x, y
103

104
    gcd, x, _ = extended_gcd(a % m, m)
105
    if gcd != 1:
106
        return None
107
    return (x % m + m) % m
108

109

110
def inverse_E(target):
111
    """
112
    逆向E函数以找到原始输入
113
    输入: 8字节目标加密值
114
    输出: 8字节原始字符串
115
    """
116
    out = list(target)
117

118
    # 逆向第6轮
119
    for i in range(8):
120
        # 反向半字节旋转: 如果原来是 ((v << 4) | (v >> 4))
121
        # 那么逆操作也是 ((v << 4) | (v >> 4)) 因为它是自逆的
122
        out[i] = ((out[i] << 4) | (out[i] >> 4)) & 0xFF
123
        # 反向复杂变换: v = (i+119) ^ (out[i] - i*i*2)
124
        # 所以 out[i] = v ^ (i+119) + i*i*2
125
        out[i] = ((out[i] ^ ((i + 119) & 0xFF)) + (((i * i) * 2) % 256)) & 0xFF
126

127
    # 逆向第5轮: 半字节置换与交换
128
    # 原操作: out[i] = (NP[hiT] << 4) | NP[loA], out[j] = (NP[hiA] << 4) | NP[loT]
129
    # 逆操作需要恢复原始的t和a
130
    for i in range(4):
131
        j = 7 - i
132

133
        # 当前的out[i]和out[j]
134
        current_i = out[i] & 0xFF
135
        current_j = out[j] & 0xFF
136

137
        # 提取半字节
138
        hi_i = (current_i >> 4) & 0x0F
139
        lo_i = current_i & 0x0F
140
        hi_j = (current_j >> 4) & 0x0F
141
        lo_j = current_j & 0x0F
142

143
        # 应用NPinv反向置换
144
        # out[i] = (NP[hiT] << 4) | NP[loA]
145
        # 所以 hi_i = NP[hiT], lo_i = NP[loA]
146
        # 因此 hiT = NPinv[hi_i], loA = NPinv[lo_i]
147
        hiT_orig = NPinv[hi_i]
148
        loA_orig = NPinv[lo_i]
149
        hiA_orig = NPinv[hi_j]
150
        loT_orig = NPinv[lo_j]
151

152
        # 恢复原始的t和a
153
        t_orig = (hiT_orig << 4) | loT_orig
154
        a_orig = (hiA_orig << 4) | loA_orig
155

156
        out[i] = t_orig
157
        out[j] = a_orig
158

159
    # 逆向第4轮: 多重XOR (XOR是自逆的)
160
    for i in range(8):
161
        k1 = (187 - i) & 0xFF
162
        k2 = (i * 3 + 68) & 0xFF
163
        k3 = (136 - i * 2) & 0xFF
164
        k4 = (i * 4 + 221) & 0xFF
165
        out[i] = ((out[i] ^ k1) ^ k2) ^ k3 ^ k4
166

167
    # 逆向第3轮: 仿射变换
168
    # 原: out[i] = ((((v - i*5 + 11) & 0xFF) * 5) - 23) & 0xFF
169
    # 步骤: temp = (v - i*5 + 11) & 0xFF
170
    #       out[i] = (temp * 5 - 23) & 0xFF
171
    # 逆向: temp = (out[i] + 23) * modinv(5, 256) & 0xFF
172
    #       v = (temp + i*5 - 11) & 0xFF
173
    inv5 = modinv(5, 256)  # 计算5在模256下的逆元
174
    if inv5 is None:
175
        raise ValueError("5在模256下没有逆元")
176

177
    for i in range(8):
178
        temp = ((out[i] + 23) * inv5) & 0xFF
179
        out[i] = (temp + i * 5 - 11) & 0xFF
180

181
    # 逆向第2轮: 循环右移2位
182
    for i in range(8):
183
        out[i] = ((out[i] >> 2) | (out[i] << 6)) & 0xFF
184

185
    # 逆向第1轮: XOR (XOR是自逆的)
186
    for i in range(8):
187
        out[i] = out[i] ^ ((i * 2 + 103) & 0xFF)
188

189
    return bytes(out)
190

191

192
def brute_force_check():
193
    """暴力验证可打印ASCII范围"""
194
    target = R()
195
    print("\n[*] 尝试暴力搜索可打印ASCII字符...")
196

197
    # 只检查可打印ASCII (32-126)
198
    import itertools
199
    count = 0
200
    for combo in itertools.product(range(32, 127), repeat=8):
201
        count += 1
202
        if count % 1000000 == 0:
203
            print(f"    已检查: {count:,} 组合...")
204

205
        s = ''.join(chr(c) for c in combo)
206
        if E(s) == target:
207
            print(f"[✓] 找到答案: {s}")
208
            return s
209

210
        if count > 10000000:  # 限制搜索次数
211
            print("    搜索空间太大，停止暴力搜索")
212
            break
213

214
    return None
215

216

217
def main():
218
    print("=" * 60)
219
    print("PCTF EzAndroid CTF Challenge Solver")
220
    print("=" * 60)
221

222
    # 计算目标R()值
223
    target = R()
224
    print(f"\n[*] 目标加密值 R(): {target}")
225
    print(f"    十六进制: {' '.join(f'{b:02X}' for b in target)}")
226

227
    # 检查是否是kNearMiss
228
    kNearMiss = [61, 120, 171, 57, 51, 6, 101, 220]  # 从代码中提取,注意符号位
229
    kNearMiss_unsigned = [(b if b >= 0 else b + 256) for b in [-46, 101, 6, 51, 57, -85, 120, 61]]
230
    print(f"\n[*] kNearMiss值: {kNearMiss}")
231

232
    if target == kNearMiss:
233
        print("\n[!] 注意: R()生成的值等于kNearMiss!")
234
        print("    这意味着正确输入应该非常接近某个特定值")
235

236
    # 逆向求解
237
    print("\n[*] 开始逆向求解...")
238
    try:
239
        result = inverse_E(target)
240

241
        print(f"\n[+] 逆向得到的字节:")
242
        print(f"    字节数组: {list(result)}")
243
        print(f"    十六进制: {result.hex()}")
244

245
        # 检查是否全是可打印ASCII
246
        is_printable = all(32 <= b <= 126 for b in result)
247
        if is_printable:
248
            print(f"    ASCII: {result.decode('ascii')}")
249
        else:
250
            print(f"    [!] 包含不可打印字符: {[b for b in result if not (32 <= b <= 126)]}")
251
            print(f"    尝试解释: {result.decode('latin-1')}")
252

253
        # 验证结果
254
        print("\n[*] 验证结果...")
255
        if is_printable:
256
            encrypted = E(result.decode('ascii'))
257
        else:
258
            encrypted = E(result.decode('latin-1'))
259

260
        if encrypted == target:
261
            print("[✓] 验证成功! 加密结果匹配目标值")
262
            if is_printable:
263
                print(f"\n{'='*60}")
264
                print(f"正确答案: {result.decode('ascii')}")
265
                print(f"{'='*60}")
266
                print("\n[!] 在APP中输入上述答案,即可获得真正的flag!")
267
        else:
268
            print("[✗] 验证失败! 逆向算法存在错误")
269
            print(f"    期望: {target}")
270
            print(f"    得到: {encrypted}")
271
            print(f"    差异: {[target[i] - encrypted[i] for i in range(8)]}")
272

273
    except Exception as e:
274
        print(f"[✗] 逆向过程出错: {e}")
275
        import traceback
276
        traceback.print_exc()
277

278

279
if __name__ == "__main__":
280
    main()

1
import struct
2
import os
3

4
# --- 1. 定义魔改的 TEA 解密核心 ---
5
def decrypt_block(v0, v1, key):
6
    delta = 289739801
7
    rounds = 65
8

9

10
    sum_val = (delta * rounds) & 0xFFFFFFFF
11

12
    for _ in range(rounds):
13

14
        op1 = ((v0 << 4) + key[2]) & 0xFFFFFFFF
15
        op2 = (v0 + sum_val) & 0xFFFFFFFF
16
        op3 = ((v0 >> 5) + key[3]) & 0xFFFFFFFF
17
        v1 = (v1 - (op1 ^ op2 ^ op3)) & 0xFFFFFFFF
18

19

20
        op1 = ((v1 << 4) + key[0]) & 0xFFFFFFFF
21
        op2 = (v1 + sum_val) & 0xFFFFFFFF
22
        op3 = ((v1 >> 5) + key[1]) & 0xFFFFFFFF
23
        v0 = (v0 - (op1 ^ op2 ^ op3)) & 0xFFFFFFFF
24

25
        sum_val = (sum_val - delta) & 0xFFFFFFFF
26

27
    return v0, v1
28

29
# --- 2. 主解密逻辑 ---
30
def solve():
31
    filename = "flag.doc.encrypt"
32
    if not os.path.exists(filename):
33
        print(f"找不到文件: {filename}")
34
        return
35

36
    with open(filename, "rb") as f:
37
        data = f.read()
38

39
    total_len = len(data)
40

41
    # 提取 Key 和 IV
42
    # Key 在倒数 24 字节开始，长 16 字节
43
    key_bytes = data[-24 : -8]
44
    # IV 在倒数 8 字节开始，长 8 字节
45
    iv_bytes = data[-8:]
46

47
    cipher_data = data[: -24]
48

49
    print(f"文件总大小: {total_len}")
50
    print(f"提取 Key: {key_bytes.hex()}")
51
    print(f"提取 IV : {iv_bytes.hex()}")
52

53
    # 将 Key 转换为 4 个 uint32 (Little Endian)
54
    key = struct.unpack("<4I", key_bytes)
55

56
    decrypted_bytes = bytearray()
57

58

59
    current_iv = list(iv_bytes)
60

61
    # 8字节为一个块进行遍历
62
    for i in range(0, len(cipher_data), 8):
63
        block = cipher_data[i : i+8]
64
        if len(block) < 8:
65
            break
66

67
        # 读取当前的密文块 v0, v1
68
        v0, v1 = struct.unpack("<2I", block)
69

70
        # 保存这个密文块，它将作为下一块解密的 IV
71
        next_iv = list(block)
72

73
        # 1. TEA 解密
74
        dec_v0, dec_v1 = decrypt_block(v0, v1, key)
75

76
        # 转回 bytes
77
        dec_block = struct.pack("<2I", dec_v0, dec_v1)
78
        dec_block_list = list(dec_block)
79

80
        # 2. CBC 异或 (与当前的 IV 异或)
81
        final_block = []
82
        for k in range(8):
83
            final_block.append(dec_block_list[k] ^ current_iv[k])
84

85
        decrypted_bytes.extend(final_block)
86

87
        # 更新 IV 为这一轮原本的密文
88
        current_iv = next_iv
89

90
    # 写入解密后的文件
91
    output_filename = "flag_decrypted.bin"
92
    with open(output_filename, "wb") as f:
93
        f.write(decrypted_bytes)
94

95
    print(f"\n解密完成! 保存为: {output_filename}")
96
    print("尝试以文本形式输出(可能包含乱码):")
97
    try:
98
        # 尝试去掉末尾的 padding (00)
99
        print(decrypted_bytes.rstrip(b'\x00').decode('utf-8', errors='ignore'))
100
    except:
101
        pass
102

103
if __name__ == "__main__":
104
    solve()

1
X0R_SECRET_KEY

1
  0x3E, 0x5C, 0x33, 0x38, 0x28, 0x36, 0x2A, 0x3F, 0x35, 0x38,
2
  0x3A, 0x14, 0x3D, 0x36, 0x2A, 0x6F, 0x37, 0x31, 0x30, 0x37,
3
  0x3A, 0x22, 0x31, 0x3D, 0x30, 0x25, 0x1A, 0x30, 0x2B, 0x6F,
4
  0x25, 0x3A, 0x32, 0x2E, 0x3E

1
def decrypt_flag():
2
    ciphertext = [0x3E, 0x5C, 0x33, 0x38, 0x28,
3
                  0x36, 0x2A, 0x3F, 0x35, 0x38,
4
                  0x3A, 0x14, 0x3D, 0x36, 0x2A,
5
                  0x6F, 0x37, 0x31, 0x30, 0x37,
6
                  0x3A, 0x22, 0x31, 0x3D, 0x30,
7
                  0x25, 0x1A, 0x30, 0x2B, 0x6F,
8
                  0x25, 0x3A, 0x32, 0x2E, 0x3E
9
                ]
10
    key = "X0R_SECRET_KEY"
11
    flag = ""
12
    for i in range(len(ciphertext)):
13
        cipher_byte = ciphertext[i]
14
        key_byte = ord(key[i % len(key)])
15
        decoded_char = chr(cipher_byte ^ key_byte)
16
        flag += decoded_char
17
    print(f"Flag: {flag}")
18
if __name__ == "__main__":
19
    decrypt_flag()

1
#include <stdio.h>
2
#include <stdlib.h>
3

4
/* ================= MT19937 源码部分 (标准实现) ================= */
5
#define N 624
6
#define M 397
7
#define MATRIX_A 0x9908b0dfUL
8
#define UPPER_MASK 0x80000000UL
9
#define LOWER_MASK 0x7fffffffUL
10

11
static unsigned long mt[N];
12
static int mti=N+1;
13

14
void init_genrand(unsigned long s) {
15
    mt[0]= s & 0xffffffffUL;
16
    for (mti=1; mti<N; mti++) {
17
        mt[mti] = (1812433253UL * (mt[mti-1] ^ (mt[mti-1] >> 30)) + mti);
18
        mt[mti] &= 0xffffffffUL;
19
    }
20
}
21

22
void init_by_array(unsigned long init_key[], int key_length) {
23
    int i, j, k;
24
    init_genrand(19650218UL);
25
    i=1; j=0;
26
    k = (N>key_length ? N : key_length);
27
    for (; k; k--) {
28
        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1664525UL)) + init_key[j] + j;
29
        mt[i] &= 0xffffffffUL;
30
        i++; j++;
31
        if (i>=N) { mt[0] = mt[N-1]; i=1; }
32
        if (j>=key_length) j=0;
33
    }
34
    for (k=N-1; k; k--) {
35
        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1566083941UL)) - i;
36
        mt[i] &= 0xffffffffUL;
37
        i++;
38
        if (i>=N) { mt[0] = mt[N-1]; i=1; }
39
    }
40
    mt[0] = 0x80000000UL;
41
}
42

43
unsigned long genrand_int32(void) {
44
    unsigned long y;
45
    static unsigned long mag01[2]={0x0UL, MATRIX_A};
46
    if (mti >= N) {
47
        int kk;
48
        if (mti == N+1) init_genrand(5489UL);
49
        for (kk=0;kk<N-M;kk++) {
50
            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
51
            mt[kk] = mt[kk+M] ^ (y >> 1) ^ mag01[y & 0x1UL];
52
        }
53
        for (;kk<N-1;kk++) {
54
            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
55
            mt[kk] = mt[kk+(M-N)] ^ (y >> 1) ^ mag01[y & 0x1UL];
56
        }
57
        y = (mt[N-1]&UPPER_MASK)|(mt[0]&LOWER_MASK);
58
        mt[N-1] = mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1UL];
59
        mti = 0;
60
    }
61
    y = mt[mti++];
62
    y ^= (y >> 11);
63
    y ^= (y << 7) & 0x9d2c5680UL;
64
    y ^= (y << 15) & 0xefc60000UL;
65
    y ^= (y >> 18);
66
    return y;
67
}
68

69
/* ================= 主逻辑部分 ================= */
70

71
int main() {
72
    // 1. 设置种子
73
    unsigned long init_key[] = {291, 564, 837, 1110};
74
    int key_length = 4;
75
    init_by_array(init_key, key_length);
76

77
    // 2. 读取 TMP 文件
78
    FILE *fp_in = fopen("TMP", "rb");
79
    if (!fp_in) {
80
        printf("Error: Cannot open TMP file. Make sure it is in the same directory.\n");
81
        return 1;
82
    }
83

84
    // 获取文件大小
85
    fseek(fp_in, 0, SEEK_END);
86
    long file_size = ftell(fp_in);
87
    fseek(fp_in, 0, SEEK_SET);
88

89
    unsigned char *buffer = (unsigned char *)malloc(file_size);
90
    fread(buffer, 1, file_size, fp_in);
91
    fclose(fp_in);
92

93
    // 3. 解密过程 (XOR)
94
    for (int i = 0; i < file_size; i++) {
95
        // 注意：C代码中 genrand_int32() 产生的是 32位整数
96
        // 这里的 ^ 操作会自动截断取低8位，或者你可以显式写成 (unsigned char)genrand_int32()
97
        buffer[i] = buffer[i] ^ genrand_int32();
98
    }
99

100
    // 4. 写入输出文件 (solved.dex)
101
    FILE *fp_out = fopen("solved.dex", "wb");
102
    fwrite(buffer, 1, file_size, fp_out);
103
    fclose(fp_out);
104
    free(buffer);
105

106
    printf("Done! Decrypted to 'solved.dex'. Now open it in JADX.\n");
107
    return 0;
108
}

1
import struct
2
import base64
3
from Crypto.Cipher import AES
4

5
AES_CIPHER_HEX = "7A5E0F55EAE178BBF5AAF32ED4856936"
6

7
AES_KEY = b"aNdR01d_s0_fUN!!"
8

9
FLAG_CIPHER_B64 = "YYCKLWlSJ9x4lYVm7iqlHt/EXvgahEoKEe2dl0BnRmGhNQ9KhPXYef3Eqbg="
10

11
def decrypt_xxtea_key():
12
    try:
13
        cipher = AES.new(AES_KEY, AES.MODE_ECB)
14
        encrypted_bytes = bytes.fromhex(AES_CIPHER_HEX)
15
        decrypted_bytes = cipher.decrypt(encrypted_bytes)
16

17
        key_str = decrypted_bytes.decode('utf-8', errors='ignore').rstrip('\x00')
18
        print(f"成功解密 XXTEA Key: {key_str}")
19
        return key_str
20
    except Exception as e:
21
        print(f"AES 解密失败: {e}")
22
        return None
23

24
def xxtea_decrypt(data, key_str):
25
    _DELTA = 0x9E3779B9
26

27
    def _long2str(v, w):
28
        n = (len(v) - 1) << 2
29
        if w:
30
            m = v[-1]
31
            if (m < n - 3) or (m > n): return None
32
            n = m
33
        s = struct.pack('<%dI' % len(v), *v)
34
        return s[0:n] if w else s
35

36
    def _str2long(s, w):
37
        n = len(s)
38
        m = (4 - (n & 3)) & 3
39
        s = s + (b'\0' * m)
40
        v = list(struct.unpack('<%dI' % (len(s) // 4), s))
41
        if w: v.append(n)
42
        return v
43

44
    if not data: return data
45
    v = _str2long(data, False)
46
    key_bytes = key_str.encode('utf-8')
47
    k = _str2long(key_bytes.ljust(16, b'\0')[:16], False)
48

49
    n = len(v) - 1
50
    z = v[n]
51
    y = v[0]
52
    q = 6 + 52 // (n + 1)
53
    sum_val = (q * _DELTA) & 0xffffffff
54

55
    while sum_val != 0:
56
        e = (sum_val >> 2) & 3
57
        for p in range(n, 0, -1):
58
            z = v[p - 1]
59
            v[p] = (v[p] - (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum_val ^ y) + (k[(p & 3) ^ e] ^ z)))) & 0xffffffff
60
            y = v[p]
61
        p = 0
62
        z = v[n]
63
        v[0] = (v[0] - (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum_val ^ y) + (k[(p & 3) ^ e] ^ z)))) & 0xffffffff
64
        y = v[0]
65
        sum_val = (sum_val - _DELTA) & 0xffffffff
66

67
    original_len = v[-1]
68
    decrypted_raw = struct.pack('<%dI' % (len(v)-1), *v[:-1])
69
    return decrypted_raw[:original_len]
70

71
if __name__ == "__main__":
72
    real_key = decrypt_xxtea_key()
73
    if real_key:
74
        flag_bytes = xxtea_decrypt(base64.b64decode(FLAG_CIPHER_B64), real_key)
75
        try:
76
            print(f"\nFlag 是: {flag_bytes.decode('utf-8')}\n")
77
        except:
78
            print(f"\n[?] 解密结果 (Hex): {flag_bytes.hex()}")

1
encrypted_bytes = [
2
    0x3E, 0x5C, 0x33, 0x38, 0x28, 0x36, 0x2A, 0x3F, 0x35, 0x38, 0x3A,
3
    0x14, 0x30, 0x29, 0x20, 0x6F, 0x37, 0x31, 0x30, 0x37, 0x3A, 0x22,
4
    0x31, 0x3D, 0x30, 0x25, 0x1A, 0x30, 0x2B, 0x6F, 0x25, 0x3A, 0x32,
5
    0x2E, 0x3E
6
]
7
key_str = "X0R_SECRET_KEY"
8

9
flag = ""
10
key_len = len(key_str)
11

12
for i in range(len(encrypted_bytes)):
13
    k = ord(key_str[i % key_len])
14
    decoded_char = chr(encrypted_bytes[i] ^ k)
15
    flag += decoded_char
16

17
print(f"解密结果: {flag}")

1
import sys
2
def rc4_decrypt_modified(key_str, ciphertext):
3
    key = [ord(c) for c in key_str]
4
    key_len = len(key)
5
    # 1. KSA (完全标准的初始化，对应 sub_401100)
6
    S = list(range(256))
7
    j = 0
8
    for i in range(256):
9
        j = (j + S[i] + key[i % key_len]) % 256
10
        S[i], S[j] = S[j], S[i]
11
    # 2. PRGA (魔改版，对应 sub_401220)
12
    i = 0
13
    j = 0
14
    decrypted = []
15
    for char in ciphertext:
16
        i = (i + 1) % 256
17
        j = (j + S[i]) % 256
18
        S[i], S[j] = S[j], S[i]
19
        # 生成标准 RC4 密钥流 k
20
        k = S[(S[i] + S[j]) % 256]
21

22
        m = char ^ k ^ 0x56
23
        decrypted.append(m)
24

25
    return "".join([chr(x) for x in decrypted])
26

27
key_string = "This_is_a_rc4_key"
28

29
full_signed = [ 62, 3, 40, 40, -127, 90, -7, 103, -117, 117,
30
                74, -94, 125, -32, -24, 36, -113, 62, -86, 109, -47,
31
                107, 53, 48, -1, -124, 90, 56, 117, -53,
32
                -124, 9, -111, 39, 34, -69, -4
33
              ]
34
full_ciphertext = [x & 0xFF for x in (full_signed )]
35
try:
36
    flag = rc4_decrypt_modified(key_string, full_ciphertext)
37
    print(f"[*] Decryption successful!")
38
    print(f"[*] Flag: {flag}")
39
except Exception as e:
40
    print(f"[!] Error: {e}")