Bugku encrypted python writeup

As soon as I came up, I gave two files, one is the encrypted source code, the other is the encryption process file.

Challenge.py

N1ES.py

There are four functions in N1ES.py, one class contains two functions, except the last encrypt function, all the other functions operate on key, and then encrypt flag through key, so I directly run the program, get the encrypted data of key, and then only reverse the encrypt function.

Decryption script:

Kn= [['~', 'wicked,' yawning, 'kicking,'\ x02years,'\ x05miles,'\ x05'], ['winters,' dwells,'}','\ x14levels,'?,'\ x130s,''\ x04bands,''W'], ['lags,' 6bands,''\ x08bands,''\ x04bands,'\ x04bands,'\ x13bands, '3bands,''\ x19' '\ x10'], ['\ x08, 'Please,' 2','\ x02,'/', 'Wicked,' /','WW'], ['\ x08,'\ x14','?,'@', 'Wicked,' ^','k'], ['\ x1baked,'6','^','(',', 'Mouse,' Yee,'\ x19'' '\ x02'], [' 3', 'foul,' wicked,'(','\ x13','}','\ x08,'u'], ['=','_','\ x13', 'Mouse,' 2','=','@','\ x04'], ['zonal,' _','~','\ x08', 'Lhasa,' foul,'\ x19' 'z'], [' Ifat, 'Yee,'\ x01','}','/','}', 'Log,''o'], ['\ x19','\ x05','3','\ x01','z','w','~',''?], [''Little,' baked,'~','\ x13','@','6','@' '\ x05'], ['\ x08legs, 'dwells,'\ x13ths, 'Lords,' ^','?', 'Lords,' u'], ['\ x05bands,'{', 'Mises,' Packers, 'masks,' 'nails,' zeales,'P'], ['kills,' ~', 'kills,' /', 'oaths,' usies,'\ x19' '\ x04'], [' oasis, 'knight,' (',', '6'], ['','/','}','?','\ x04percent,'}', 'zoning,'\ x19'], ['\ x05miles,'\ nregions,'\ ntrees, 'lags,' 'lags,' ^','l'], ['kills,' 3bands,'}','\ x190s, 'utensils,' Illuits,'' '^'], ['~', 'Bamboo,'\ x02percent,'}', 'kink,'\ x05miles,'\ x05miles,'\ x05bands,'/'], ['\ ntrees,'\ x05bands,'^','^', 'playing,'}','!','{'], ['\ x08bands, 'walls,' utensils, 'oaths,'', 'two','d'' '\ x04'], [' /', 'Wicked,' wicked,'\ x08,''zoned,'\ x19','@','I'], ['\ x14','', 'Please,'!,'6','6','','}'], ['(','!','\ x01,','\ x08, 'dfarmer,'\ x08,'w' '?], [' upright, 'waxed,' @','\ x13','}','~','6','o'], ['3','3','6','o'], ['3','6','d','3','9', 5','2','2','6','6'], ['}','\ x08,'6,'\ x19,'&','\ x04hammer,'k' 'u'], ['\ x13','2','2','(','\ x19','{','/','w'], ['\ x02, 'Yee,', 'Wicked,'\ x08, 'uhere,'\ x01' Import base64s=base64.b64decode ('HRlgC2ReHW1/WRk2DikfNBo1dl1XZBJrRR9qECMNOjNHDktBJSxcI1hZIz07YjVx') flag= [] for i in range (3): flag.append (s [I * 16: (iTun1) * 16]) from z3 import * def fun (a x%d'%i b): X = [BitVec (' x%d'%i) 32) for i in range (8)] solver=Solver () res='' for i in range (len (a)): exec ("solver.add (x [I]-2 * (x [I] & ord (b [I]) = ord (a [I])-ord (b [I])") solver.check () try: exec ("res+=chr (solver.model () [x [I]])] .as _ long () ") except: print solver return resres=''for i in flag: Lathi [: 8] Ripi [8:] L For k in range (32): res+=L+Rprint res (Kn [k]) res+=L+Rprint res