ISCC 2012 破解关第四题小弟我已经不蛋疼啦

2012-06-28

ISCC 2012 破解关第四题我已经不蛋疼啦~前一阵突然出现推出了这个破解关第四题，看了看没啥思路，题意大概

ISCC 2012 破解关第四题我已经不蛋疼啦~

前一阵突然出现推出了这个破解关第四题，看了看没啥思路，题意大概就是让你反编译一个小程序，然后具体分析达到功能的方法，最后再仿写一个。

分析程序这一步不多说了，大概就是查端口，抓包，做些特殊数据的测试。端口我用的是冰刃，或者命令行netstat自己找也行，抓包我用的WSExporer可以进程抓包，比较方便

，可以在我的资源里下载。

通过端口和抓包大致可以知道，软件运行的过程是这样的。

现在2012端口建立socket连接，然后通过4次通信交换数据，最后开始阻塞模式下的聊天。

// client.cpp : Defines the entry point for the console application.//#include "stdafx.h"#include <WINSOCK2.H>#include <stdio.h>#include <stdlib.h>#include <string.h>#pragma comment(lib,"ws2_32.lib")typedef unsigned __int64 UINT64;typedef unsigned charUCHAR;SOCKET clientSocket;UINT64 clientP_n,clientP_e,clientS_d,clientS_n;UINT64 serviceP_n,serviceP_e;inline void MUL(UINT64 &a, UINT64 b,UINT64 mod){a = (UINT64)a * b % mod;}inline UINT64 pow(UINT64 a, UINT64 b,UINT64 mod){    UINT64 c = 1;    while (b) {        if (b&1) MUL(c, a ,mod);        MUL(a, a ,mod), b >>= 1;    }    return c;}UINT64 RSADecode(char* x,UINT64 t,UINT64 n){char ret_str[20];UINT64 ret=0;UINT64m=1;for(int i=0;i<4;i++){ret+=m*(UCHAR)x[i];m*=256;}/*sprintf(ret_str,"%x%x%x%x",(UCHAR)x[3],(UCHAR)x[2],(UCHAR)x[1],(UCHAR)x[0]);ret = strtoul(ret_str,NULL,16);*///printf("x in decode %d\n",ret);return pow(ret,t,n);}void RSACode(UINT64 x,UINT64 t,UINT64 n,char* ret_str){//char* ret_str = new char[8] ;UINT64 ret=0;ret = pow(x,t,n);//printf("x in code %d\n",ret);UINT64 m=256;int i;for(i=0;i<3;i++){ret_str[i]=ret%m;ret/=m;}ret_str[3]=ret;//sprintf(ret_str,"%x%x%x%x",num[0],num[1],num[2],num[3]);for(i=4;i<8;i++)ret_str[i]=0;return;}void initServicePublicKey(char* publicKey){serviceP_n=0;serviceP_e=0;char serviceP_n_str[20];char serviceP_e_str[20];UINT64 m=1;/*sprintf(serviceP_e_str,"%x%x",(UCHAR)publicKey[1],(UCHAR)publicKey[0]);sprintf(serviceP_n_str,"%x%x%x%x",(UCHAR)publicKey[11],(UCHAR)publicKey[10],(UCHAR)publicKey[9],(UCHAR)publicKey[8]);serviceP_n = strtoul(serviceP_n_str,NULL,16);serviceP_e = strtoul(serviceP_e_str,NULL,16);*/serviceP_e = (UCHAR)publicKey[0] + (UCHAR)publicKey[1]*256;for(int i=8;i<12;i++){serviceP_n+=(UCHAR)publicKey[i]*m;m*=256;}printf("%lu\n",serviceP_n);printf("%lu\n",serviceP_e);}void initClientRSAKey(){clientS_d=3137;clientS_n=1393427557;clientP_n=1393427557;clientP_e=690679973;}void initRSA(){char receiveBuf[1000];char sendBuf[1000];printf("----------------recive1----------------------\n");recv(clientSocket,receiveBuf,1000,0);for(int i=0;i<4;i++)printf("0x%x\n",receiveBuf[i]);printf("----------------recive2----------------------\n");sendBuf[0]=0x41;sendBuf[1]=0x0c;sendBuf[2]=0x00;sendBuf[3]=0x00;sendBuf[4]=0x00;sendBuf[5]=0x00;sendBuf[6]=0x00;sendBuf[7]=0x00;sendBuf[8]=0x65;sendBuf[9]=0x04;sendBuf[10]=0x0e;sendBuf[11]=0x53; sendBuf[12]=0x00;sendBuf[13]=0x00;sendBuf[14]=0x00;sendBuf[15]=0x00;send(clientSocket,sendBuf,sizeof(char)*16,0);recv(clientSocket,receiveBuf,1000,0);for(int j=0;j<16;j++)printf("0x%x\n",(UCHAR)receiveBuf[j]);initServicePublicKey(receiveBuf);printf("--------------------------------------\n");sendBuf[0]=0x0b;sendBuf[1]=0x0a;sendBuf[2]=0x45;sendBuf[3]=0x54;send(clientSocket,sendBuf,sizeof(char)*4,0);initClientRSAKey();initServicePublicKey(receiveBuf);}void startCommunication(){char receiveBuf[1000];int recvLen;char sendBuf[1000];char codeBuf[1000];char* codeBufCat = new char[8];int i,j;while(true){recvLen=recv(clientSocket,receiveBuf,1000,0);printf("\n[Command] @Police : ");int t=0;while (t<recvLen){char str[8];strncpy(str,receiveBuf+t,8);printf("%c",RSADecode(str,clientP_e,clientP_n));t+=8;}//===============================================================printf("\n[Answer] @Thief : ");scanf("%s",sendBuf);printf("%d\n",strlen(sendBuf));for(i=0;i<strlen(sendBuf);i++){RSACode((UCHAR)sendBuf[i],serviceP_e,serviceP_n,codeBufCat);for(j=i*8;j<(i+1)*8;j++)codeBuf[j]=codeBufCat[j-i*8];}//RSACode('a',serviceP_e,serviceP_n,codeBufCat);for(i=0;i<8*strlen(sendBuf);i++)printf("%x",(UCHAR)codeBuf[i]);printf("\n");send(clientSocket,codeBuf,8*strlen(sendBuf),0);}}void initSocket(){int err;WORD versionRequired;WSADATA wsaData;versionRequired=MAKEWORD(1,1);err=WSAStartup(versionRequired,&wsaData);//协议库的版本信息if (!err){printf("客户端嵌套字已经打开!\n");}else{printf("客户端的嵌套字打开失败!\n");return;//结束}clientSocket=socket(AF_INET,SOCK_STREAM,0);SOCKADDR_IN clientsock_in;clientsock_in.sin_addr.S_un.S_addr=inet_addr("127.0.0.1");clientsock_in.sin_family=AF_INET;clientsock_in.sin_port=htons(2012);connect(clientSocket,(SOCKADDR*)&clientsock_in,sizeof(SOCKADDR));//开始连接initRSA();startCommunication();closesocket(clientSocket);WSACleanup();}void main(){initSocket();/*initClientRSAKey();char x='a';char* str = new char[8];RSACode(x,clientS_d,clientS_n,str);for(int i=0;i<8;i++)printf("%x\n",(unsigned char)str[i]);printf("%c\n",RSADecode(str,clientP_e,clientP_n));printf("%I64u %I64u\n",pow(x,clientS_d,clientS_n),pow(pow(x,clientS_d,clientS_n),clientP_e,clientS_n));*/}

热点排行

互联网

ISCC 2012 破解关第四题 小弟我已经不蛋疼啦

ISCC 2012 破解关第四题小弟我已经不蛋疼啦