抱歉,您的浏览器无法访问本站
本页面需要浏览器支持(启用)JavaScript
了解详情 >

EVMEnc

1. question

源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
pragma solidity ^0.5.10;

contract EVMEnc {

uint public result;
string public key;

uint private delta;
uint public output;

uint32 public sum;
uint224 private tmp_sum=0;

uint32 private key0;
uint224 private t0=0;
uint32 private key1;
uint224 private t1=0;
uint32 private key2;
uint224 private t2=0;
uint32 private key3;
uint224 private t3=0;

constructor() public {
delta = 0xb3c6ef3720;
}

function Convert(string memory source) public pure returns (uint result) {
bytes32 tmp;
assembly {
tmp := mload(add(source, 32))
}
result = uint(tmp) / 0x10000000000000000;
}

function set_key(string memory tmp) public {
key = tmp;
}

function cal_(uint x) public {
uint tmp = Convert(key) / 0x10000000000000000;
result = tmp % x;
}

function Encrypt(string memory flag) public {
uint tmp = Convert(flag);
uint key_tmp = Convert(key) / 0x10000000000000000;
assembly {
let first,second
sstore(5, and(shr(96, key_tmp), 0xffffffff))
sstore(6, and(shr(64, key_tmp), 0xffffffff))
sstore(7, and(shr(32, key_tmp), 0xffffffff))
sstore(8, and(key_tmp, 0xffffffff))

let step := 1
for { let i := 1 } lt(i, 4) { i := add(i, 1) } {

first := and(shr(mul(add(sub(24, mul(i, 8)), 4), 8), tmp), 0xffffffff)
second := and(shr(mul(sub(24, mul(i, 8)), 8), tmp), 0xffffffff)

sstore(4, 0)

for {let j := 0 } lt(j, 32) { j := add(j, 1) } {

sstore(4, and(add(and(sload(4), 0xffffffff), shr(5, sload(2))), 0xffffffff))

let tmp11 := and(add(and(mul(second, 16), 0xffffffff), and(sload(5), 0xffffffff)), 0xffffffff)
let tmp12 := and(add(second, and(sload(4),0xffffffff)), 0xffffffff)
let tmp13 := and(add(div(second, 32), and(sload(6),0xffffffff)), 0xffffffff)

first := and(add(first, xor(xor(tmp11, tmp12), tmp13)), 0xffffffff)

let tmp21 := and(add(and(mul(first, 16), 0xffffffff), and(sload(7),0xffffffff)), 0xffffffff)
let tmp22 := and(add(first, and(sload(4),0xffffffff)), 0xffffffff)
let tmp23 := and(add(div(first, 32), and(sload(8),0xffffffff)), 0xffffffff)
second := and(add(second, xor(xor(tmp21, tmp22), tmp23)), 0xffffffff)

}

sstore(3, add(sload(3), add(shl(sub(192, mul(step, 32)), first), shl(sub(192, mul(i, 64)), second))))
step := add(step, 2)
}

}
}
}

2. analysis

3. solve

EasyFJump

1. question

源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
pragma solidity ^0.4.23;

contract EasyFJump {
uint private Variable_a;
uint private Variable_b;
uint private Variable_m;
uint private Variable_s;

event ForFlag(address addr);

struct Func {
function() internal f;
}

constructor() public payable {
Variable_s = 693784268739743906201;
}

function Set(uint tmp_a, uint tmp_b, uint tmp_m) public {
Variable_a = tmp_a;
Variable_b = tmp_b;
Variable_m = tmp_m;
}

function Output() private returns(uint) {
Variable_s = (Variable_s * Variable_a + Variable_b) % Variable_m;
return Variable_s;
}

function GetFlag() public payable {
require(Output() == 2344158256393068019755829);
require(Output() == 3260253069509692480800725);
require(Output() == 2504603638892536865405480);
require(Output() == 1887687973911110649647086);

Func memory func;
func.f = payforflag;
uint offset = (Variable_a - Variable_b - Variable_m) & 0xffff;
assembly {
mstore(func, sub(add(mload(func), callvalue), offset))
}
func.f();
}

function payforflag() public {
require(keccak256(abi.encode(msg.sender))==0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff);
emit ForFlag(msg.sender);
}
}

2. analysis

3. solve

EthEnc

1. question

源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
pragma solidity ^0.6.12;

contract EthEnc {
address private owner; //0

uint private key; //1

uint private delta; //2

uint public output; //3

uint32 private sum;
uint224 private tmp_sum=0; //4

uint32 private key0;
uint224 private t0=0; //5
uint32 private key1;
uint224 private t1=0; //6
uint32 private key2;
uint224 private t2=0; //7
uint32 private key3;
uint224 private t3=0; //8
uint randomNumber = 0;
string private s;

event OhSendFlag(address addr);

constructor() public payable {
// key = 0x74686974 5f69735e 5f746573 746b6579
key = 0x746869745f69735e5f746573746b6579;
delta = 0xb3c6ef3720;
}

modifier auth {
require(msg.sender == owner || msg.sender == address(this), "EthEnc: not authorized");
_;
}

function payforflag() public auth {
require(output == 2282910687825444608285583946662268071674116917685196567156);
emit OhSendFlag(msg.sender);
selfdestruct(msg.sender);
}

function Convert(string memory source) internal pure returns (uint result) {
bytes32 tmp;
assembly {
tmp := mload(add(source, 32))
}
result = uint(tmp) / 0x10000000000000000;
}

// 正 0x 5f5f6f68 5f66616e 74616e73 69746963 5f626162 795f5f5f __oh_fantansitic_baby___

function set_s(string memory _s) public {
s = _s;
}

function Encrypt() public {
uint tmp = Convert(s);
assembly {
let first,second
sstore(5, and(shr(96, sload(1)), 0xffffffff))
sstore(6, and(shr(64, sload(1)), 0xffffffff))
sstore(7, and(shr(32, sload(1)), 0xffffffff))
sstore(8, and(sload(1), 0xffffffff))

let step := 1
for { let i := 1 } lt(i, 4) { i := add(i, 1) } {

first := and(shr(mul(add(sub(24, mul(i, 8)), 4), 8), tmp), 0xffffffff)
second := and(shr(mul(sub(24, mul(i, 8)), 8), tmp), 0xffffffff)

sstore(4, 0)

for {let j := 0 } lt(j, 32) { j := add(j, 1) } {

let tmp11,tmp12
let tmp21,tmp22

tmp11 := and(add(xor(and(mul(second, 16), 0xffffffff), and(div(second, 32), 0xffffffff)), second), 0xffffffff)
switch and(and(sload(4),0xffffffff), 3)
case 0 {
tmp12 := and(add(and(sload(4),0xffffffff), and(sload(5),0xffffffff)), 0xffffffff)
}
case 1 {
tmp12 := and(add(and(sload(4),0xffffffff), and(sload(6),0xffffffff)), 0xffffffff)
}
case 2 {
tmp12 := and(add(and(sload(4),0xffffffff), and(sload(7),0xffffffff)), 0xffffffff)
}
default {
tmp12 := and(add(and(sload(4),0xffffffff), and(sload(8),0xffffffff)), 0xffffffff)
}
first := and(add(first, xor(tmp11, tmp12)), 0xffffffff)

sstore(4, and(add(and(sload(4), 0xffffffff), shr(5, sload(2))), 0xffffffff))

tmp21 := and(add(xor(and(mul(first, 16), 0xffffffff), and(div(first, 32), 0xffffffff)), first), 0xffffffff)
switch and(and(shr(11, and(sload(4),0xffffffff)), 0xffffffff), 3)
case 0 {
tmp22 := and(add(and(sload(4),0xffffffff), and(sload(5),0xffffffff)), 0xffffffff)
}
case 1 {
tmp22 := and(add(and(sload(4),0xffffffff), and(sload(6),0xffffffff)), 0xffffffff)
}
case 2 {
tmp22 := and(add(and(sload(4),0xffffffff), and(sload(7),0xffffffff)), 0xffffffff)
}
default {
tmp22 := and(add(and(sload(4),0xffffffff), and(sload(8),0xffffffff)), 0xffffffff)
}
second := and(add(second, xor(tmp21, tmp22)), 0xffffffff)

}

sstore(3, add(sload(3), add(shl(sub(192, mul(step, 32)), first), shl(sub(192, mul(i, 64)), second))))
step := add(step, 2)
}
}
}

receive() external payable {
if(msg.value == 0) {
this.payforflag();
} else {
this.Encrypt();
}
}
}

2. analysis

3. solve

评论



政策 · 统计 | 本站使用 Volantis 主题设计