看雪CTF.TSRC 2018 团队赛 第八题 『二向箔』 解题思路
发布者：Editor
发布于：2018-12-23 18:13
第八题《二向箔》在今天（12月17日）中午12：00 结束攻击。本题共有4支团队破解成功！
tekkens 以 64059 s 成为首支攻击成功的团队。本题出题团队Tnppppppp也因此位列防守方第二名。
最新赛况战况一览
第八题之后攻击方最新排名情况如下：
中午放题搬砖狗哭哭 守擂成功，有惊无险。风间仁所在的 tekkens 从第三名晋升到第二名！
作为多界看雪CTF的冠军选手，tekkens与新晋看雪CTF新秀的PK，越发紧张，究竟风间仁能否继续往届的风采？而新晋冠军是否能够笑到最后？亦或者新晋黑马突出重围？
不到最后一切都是悬念，后续还会有怎样的精彩？不加入怎么知道呢？
第八题 点评
crownless：
二向箔此题由两部分组成：第一部分是一个DPRE(基于4f系统的双随机相位编码)算法，难点在于识别算法。第二部分为修改过的AES+XXTEA，需要攻击者熟悉并理解这两种加密算法的原理。
第八题 出题团队简介
出题团队： Tnppppppp
第八题 设计思路
由看雪论坛waiWH 原创
注册成功：Good!
注册码：
76474B2B1926009C452B00627200190268740438FDCC641665D0EA735F2739B3EE7B315A
格式:
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
设计思路：
题目分成两部分
第一部分是一个DPRE(基于4f系统的双随机相位编码)算法。
校验流程为：把B当作原始图像的信号，在经过Cat映射(Arnold映射)，得到的二维信号，与内置的RM1相乘，经过fft2变换，再与RM2相乘，再作ifft2变换。
可表达为： I = Cat(I);
EncryptionIm=ifft2(fft2(((I)).*RM1Im).*RM2Im);//(当进行*RM1时会填充成复数)
将得到的EncryptionIm与内置的一组EncryptionIm对比，如果一样，即第一部分成功。
也就是需要攻击者将内置的一组EncryptionIm进行解密还原
解密流程：
可表达为：
DecryptionIm=ifft2(fft2(double(EncryptionIm)).*conj(double(RM2Im))).*conj(double(RM1Im));
DecryptionIm = invCatMap(DecryptionIm);
难点就是需要攻击者去识别是fft2，ifft2算法，以及知道解密时需要对内置的RM2Im,RM1Im的复数数组进行共轭，之后才进行fft2，ifft2。
当然，逆运算得到的DecryptionIm是一组复数数组，不过复数部分为0，也就是输入B注册码所需要的是整数部分。
第二部分为AES+XXTEA
AES有修改过sbox/invsbox，列混合变换采用8*8矩阵，每轮添加了一个矩阵转置，以及修改行位移。使aes的特征不那么明显。
验证流程为：
将攻击者输入的A段注册码，经过xxtea解密，然后AES256解密。判断最后得到的解密数据是否与内置的一组数据相同。
修改sbox/invsbox为：
采用8*8矩阵进行矩阵转置，需要攻击者对inv_mix矩阵求逆。由于这个8*8矩阵和逆矩阵一样，所以直接贴出逆列混合变换所使用的逆矩阵。
修改行位移
变换中增加mix_transpose进行转置。
另外想展示一下vm引擎，但由于文件限制大小需要控制在1MB，所以就随便v了一下流程。
攻击者有很多方法去还原出该部分算法，比如可以直接去观察state所在的堆栈位置等。
vm引擎还有很多不足之处，一些模块未完成。所以也想借此机会看看攻击者如何去分析该引擎。
那么攻击者需要先使用aes进行加密，然后在使用xxtea算法加密，最后就得到A段注册码。
原文链接：
https://bbs.pediy.com/thread-248058.htm第八题 二向箔 解题思路
本题解析由看雪论坛 风间仁原创。
1. 处理逻辑
BYTE sn[16+20]; check1验证前半部分, check2验证后半部分。
.text:00402811 lea edx, [ebp+sn] .text:00402814 push edx ; buf .text:00402815 lea eax, [ebp+str_sn] .text:0040281B push eax ; a1 .text:0040281C call hex_to_bin .text:00402821 add esp, 20h .text:00402824 cmp eax, 36 .text:00402827 jnz short loc_402849 .text:00402829 lea ecx, [ebp+sn] .text:0040282C push ecx .text:0040282D call x_check1 .text:00402832 add esp, 4 .text:00402835 test eax, eax .text:00402837 jz short loc_402849 .text:00402839 lea edx, [ebp+sn+10h] .text:0040283C push edx .text:0040283D call
2. check1(主要是二元一次浮点运算), 得到sn前半部分：
76474B2B1926009C452B006272001902
test.cpp
typedef struct tagPointF{
double x;
double y;
}PointF, *PPointF;
double get_pi()
{
double pi;
*((DWORD64 *)&pi) = 0x400921FB5442771C;
return pi;
}
string g_str_part1_expected = util::hex2bin("EEB9171C0B535640B08F207B1FCB53C03EDEDAB2D8CD5BC0C2E04F8024B8014028D9AE091D454D40BCBFB0BAA4103D40593D04F9440D494079F8577F3FE845402A3EB76F3D4943C09047A102410318C0FE3CD86E3FD2574074E505B84FEE37409355C67FA98D5F40CC052BFED1914BC048D363E2EE4244404009C744AB39354050B7F31ADCAB0F4054CC0B4B2BA02B40309FBBE1D42C504018CF21801F7026C00A5D83EA8655514094B7E265F3E24240B1215C0315E74840C001F6C35AAEF03F34EE29D023421F4084016925DD933D4058E4B88B3C46204038F87B858407274070161F32582318C0B8D55808C32F20C0546B434AF2893940D89E2FD10FA4FA3F");
PPointF g_part1_expected = (PPointF)g_str_part1_expected.c_str();
string g_str_pts_const1 = util::hex2bin("EE1926ACE715E43FC9F8493847E9E8BF36075F9A6DD5EEBFA81D8421FE1ED13F000000000000F03F075C143326A6B1BC000000000000F03F000000000000000036075F9A6DD5EEBFA81D8421FE1ED13F000000000000F03F0000000000000000AB8604B97D69E73F141BA89A86D0E5BF41B13E0865DAEF3F151D92D94880B8BF000000000000F03F075C143326A6B1BCAB8604B97D69E73F141BA89A86D0E5BF2F58C368100FEE3FEAC193588EF3D53F1869F1C5E9FAEF3F508B6EE7560AA23F000000000000F03F000000000000000041B13E0865DAEF3F151D92D94880B8BF1869F1C5E9FAEF3F508B6EE7560AA23F138D486D01E2ED3FC402F17478E4D6BF");
PPointF g_pts_const1 = (PPointF)g_str_pts_const1.c_str();
string g_str_pts_const2 = util::hex2bin("26B18B5A4F64EC3F19D8B235EB85DD3F000000000000F03F075C143326A6B1BC000000000000F03F00000000000000006F5AAE0BC8B7EB3F7A016B8D7DFBDF3F000000000000F03F075C143326A6B1BC6F5AAE0BC8B7EB3F7A016B8D7DFBDF3F96A95B1782F4EF3F258E251B341CAB3FCDE70F56B7D9EF3FC76F400E7CB8B8BF000000000000F03F000000000000000096A95B1782F4EF3F258E251B341CAB3FBC732036F7D2EF3F2C266CAF5ECEBA3FD4702B0AD39CEF3F8605EF9065DBC33F6F5AAE0BC8B7EB3F7A016B8D7DFBDF3FCDE70F56B7D9EF3FC76F400E7CB8B8BFD4702B0AD39CEF3F8605EF9065DBC33FB4ADFBFF5EC3E83FD93C046A9144E43F");
PPointF g_pts_const2 = (PPointF)g_str_pts_const2.c_str();
PointF g_pi_const1[2] = {
{ cos((0) * get_pi() / 2), sin((0) * get_pi() / 2) },
{ cos((-1) * get_pi() / 2), sin((-1) * get_pi() / 2) },
};
PointF g_pi_const2[2] = {
{ cos((0) * get_pi() / 2), sin((0) * get_pi() / 2) },
{ cos((1) * get_pi() / 2), sin((1) * get_pi() / 2) },
};
void x_p0(PPointF pts, PPointF pts_const, int count)
{
for (int i = 0; i < count; i++)
{
double x = pts[i].x;
double y = pts[i].y;
double m = pts_const[i].x;
double n = pts_const[i].y;
pts[i].x = x * m - y * n;
pts[i].y = x * n + y * m;
}
}
void x_p0_r(PPointF pts, PPointF pts_const, int count)
{
for (int i = 0; i < count; i++)
{
double x = pts[i].x;
double y = pts[i].y;
double m = pts_const[i].x;
double n = pts_const[i].y;
pts[i].x = (y * n + x * m) / (m * m + n * n);
pts[i].y = (y * m - x * n) / (m * m + n * n);
}
}
void x_p1_raw(PPointF pts, PPointF pts_const)
{
PointF p0;
PointF p1;
PointF p2;
PointF p3;
PointF c0 = pts_const[0];
PointF c1 = pts_const[1];
p0 = pts[0];
p1 = pts[1];
p2 = pts[2];
p3 = pts[3];
pts[0].x = p0.x + p2.x;
pts[0].y = p0.y + p2.y;
pts[1].x = p1.x + p3.x;
pts[1].y = p1.y + p3.y;
pts[2].x = p0.x - p2.x;
pts[2].y = p0.y - p2.y;
pts[3].x = p1.x - p3.x;
pts[3].y = p1.y - p3.y;
x_p0(pts + 2, &c0, 1);
x_p0(pts + 3, &c1, 1);
p0 = pts[0];
p1 = pts[1];
p2 = pts[2];
p3 = pts[3];
pts[0].x = p0.x + p1.x;
pts[0].y = p0.y + p1.y;
pts[1].x = p0.x - p1.x;
pts[1].y = p0.y - p1.y;
pts[2].x = p2.x + p3.x;
pts[2].y = p2.y + p3.y;
pts[3].x = p2.x - p3.x;
pts[3].y = p2.y - p3.y;
x_p0(pts + 1, &c0, 1);
x_p0(pts + 3, &c0, 1);
PointF tmp = pts[1];
pts[1] = pts[2];
pts[2] = tmp;
}
void x_p1_raw_r(PPointF pts, PPointF pts_const)
{
PointF tmp = pts[1];
pts[1] = pts[2];
pts[2] = tmp;
PointF p0;
PointF p1;
PointF p2;
PointF p3;
PointF c0 = pts_const[0];
PointF c1 = pts_const[1];
x_p0_r(pts + 1, &c0, 1);
x_p0_r(pts + 3, &c0, 1);
p0 = pts[0];
p1 = pts[1];
p2 = pts[2];
p3 = pts[3];
pts[0].x = (p0.x + p1.x) / 2;
pts[1].x = (p0.x - p1.x) / 2;
pts[0].y = (p0.y + p1.y) / 2;
pts[1].y = (p0.y - p1.y) / 2;
pts[2].x = (p2.x + p3.x) / 2;
pts[3].x = (p2.x - p3.x) / 2;
pts[2].y = (p2.y + p3.y) / 2;
pts[3].y = (p2.y - p3.y) / 2;
x_p0_r(pts + 2, &c0, 1);
x_p0_r(pts + 3, &c1, 1);
p0 = pts[0];
p1 = pts[1];
p2 = pts[2];
p3 = pts[3];
pts[0].x = (p0.x + p2.x) / 2;
pts[2].x = (p0.x - p2.x) / 2;
pts[0].y = (p0.y + p2.y) / 2;
pts[2].y = (p0.y - p2.y) / 2;
pts[1].x = (p1.x + p3.x) / 2;
pts[3].x = (p1.x - p3.x) / 2;
pts[1].y = (p1.y + p3.y) / 2;
pts[3].y = (p1.y - p3.y) / 2;
}
void x_p1(PPointF pts)
{
size_t i;
PointF tmp[4][4];
for (i = 0; i < 4; i++)
{
tmp[0][i] = pts[4 * i + 0];
tmp[1][i] = pts[4 * i + 1];
tmp[2][i] = pts[4 * i + 2];
tmp[3][i] = pts[4 * i + 3];
}
for (i = 0; i < 4; i++)
{
x_p1_raw(&tmp[i][0], g_pi_const1);
}
for (i = 0; i < 4; i++)
{
pts[4 * i + 0] = tmp[0][i];
pts[4 * i + 1] = tmp[1][i];
pts[4 * i + 2] = tmp[2][i];
pts[4 * i + 3] = tmp[3][i];
}
for (i = 0; i < 4; i++)
{
x_p1_raw(pts + 4 * i, g_pi_const1);
}
}
void x_p1_r(PPointF pts)
{
size_t i;
PointF tmp[4][4];
for (i = 0; i < 4; i++)
{
x_p1_raw_r(pts + 4 * i, g_pi_const1);
}
for (i = 0; i < 4; i++)
{
tmp[0][i] = pts[4 * i + 0];
tmp[1][i] = pts[4 * i + 1];
tmp[2][i] = pts[4 * i + 2];
tmp[3][i] = pts[4 * i + 3];
}
for (i = 0; i < 4; i++)
{
x_p1_raw_r(&tmp[i][0], g_pi_const1);
}
for (i = 0; i < 4; i++)
{
pts[4 * i + 0] = tmp[0][i];
pts[4 * i + 1] = tmp[1][i];
pts[4 * i + 2] = tmp[2][i];
pts[4 * i + 3] = tmp[3][i];
}
}
void x_p2_raw(PPointF pts, PPointF pts_const)
{
x_p1_raw(pts, pts_const);
for (size_t i = 0; i < 4; i++)
{
pts[i].x /= 4;
pts[i].y /= 4;
}
}
void x_p2_raw_r(PPointF pts, PPointF pts_const)
{
for (size_t i = 0; i < 4; i++)
{
pts[i].x *= 4;
pts[i].y *= 4;
}
x_p1_raw_r(pts, pts_const);
}
void x_p2(PPointF pts)
{
size_t i;
PointF tmp[4][4];
for (i = 0; i < 4; i++)
{
x_p2_raw(pts + 4 * i, g_pi_const2);
}
for (i = 0; i < 4; i++)
{
tmp[0][i] = pts[4 * i + 0];
tmp[1][i] = pts[4 * i + 1];
tmp[2][i] = pts[4 * i + 2];
tmp[3][i] = pts[4 * i + 3];
}
for (i = 0; i < 4; i++)
{
x_p2_raw(&tmp[i][0], g_pi_const2);
}
for (i = 0; i < 4; i++)
{
pts[4 * i + 0] = tmp[0][i];
pts[4 * i + 1] = tmp[1][i];
pts[4 * i + 2] = tmp[2][i];
pts[4 * i + 3] = tmp[3][i];
}
}
void x_p2_r(PPointF pts)
{
size_t i;
PointF tmp[4][4];
for (i = 0; i < 4; i++)
{
tmp[0][i] = pts[4 * i + 0];
tmp[1][i] = pts[4 * i + 1];
tmp[2][i] = pts[4 * i + 2];
tmp[3][i] = pts[4 * i + 3];
}
for (i = 0; i < 4; i++)
{
x_p2_raw_r(&tmp[i][0], g_pi_const2);
}
for (i = 0; i < 4; i++)
{
pts[4 * i + 0] = tmp[0][i];
pts[4 * i + 1] = tmp[1][i];
pts[4 * i + 2] = tmp[2][i];
pts[4 * i + 3] = tmp[3][i];
}
for (i = 0; i < 4; i++)
{
x_p2_raw_r(pts + 4 * i, g_pi_const2);
}
}
void test_part1()
{
BYTE sn[16] = {
0x11, 0x11, 0x11, 0x11, 0x22, 0x22, 0x22, 0x22, 0x33, 0x33, 0x33, 0x33, 0x44, 0x44, 0x44, 0x44,
};
BYTE map[16] = {
0x00, 0x09, 0x02, 0x0B, 0x0F, 0x04, 0x0D, 0x06, 0x0A, 0x03, 0x08, 0x01, 0x05, 0x0E, 0x07, 0x0C,
};
size_t i;
BYTE buf[16] = {0};
for (i = 0; i < 16; i++)
{
buf[map[i]] = sn[i];
}
PointF pts[16] = {0};
for (i = 0; i < 16; i++)
{
pts[i].x = buf[i];
}
x_p0(pts, g_pts_const1, 16);
x_p1(pts);
x_p0(pts, g_pts_const2, 16);
x_p2(pts);
}
BYTE double_to_byte(double v)
{
BYTE ch = 0;
char buf[256] = {0};
sprintf(buf, "%f", v);
char *dot = strchr(buf, '.');
if (dot != NULL)
{
*dot = 0;
ch = (BYTE)atoi(buf);
}
return ch;
}
string x_get_sn_part1()
{
int i;
PPointF pts = g_part1_expected;
x_p2_r(pts);
x_p0_r(pts, g_pts_const2, 16);
x_p1_r(pts);
x_p0_r(pts, g_pts_const1, 16);
BYTE r_map[16] = {0};
for (i = 0; i < 16; i++)
{
BYTE row = (7 * (i / 4) + 2 * (i % 4)) % 4;
BYTE col = (i / 4 + i % 4 + 2 * (i / 4)) % 4;
r_map[4 * row + col] = i;
}
BYTE sn[16] = {0};
for (i = 0; i < 16; i++)
{
//printf("%f\n", pts[i].x);
sn[r_map[i]] = double_to_byte(pts[i].x);
}
return util::bin2hex(sn, 16);
}
3. check2(主要是AES256[修改过]解密和xxtea解密), 得到sn后半部分：
68740438FDCC641665D0EA735F2739B3EE7B315A
AES代码参见：
_https://github.com/kokke/tiny-AES-c/blob/master/aes.c原始xxtea代码参见：
_https://github.com/xxtea/xxtea-c (没改动, 就不贴了)
AES改动的部分
(1) sbox及rsbox；
(2) AddRoundKey之前/之后多了转置矩阵操作；
(3) ShiftRows移位略做改动；
(4) MixColumns中的矩阵改成了8*8, 其逆矩阵是其自身。
AES解密的循环部分代码被VM了, 不过不需要跟进去, 下个硬件断点跟踪输入/输出数据, 就知道在干嘛了。
aes.cpp
#include "stdafx.h"
#include <string.h>
#include "aes.h"
#define Nb 4
#define Nk 8
#define Nr 14
typedef uint8_t state_t[4][4];
static const uint8_t sbox[256] = {
0x03, 0x10, 0xD1, 0xD5, 0xC9, 0x27, 0xC8, 0x68, 0xB3, 0xEF, 0x30, 0xFA, 0x33, 0xB0, 0xCA, 0x51,
0x7E, 0x37, 0x74, 0xF6, 0xC7, 0x4B, 0xE3, 0x0A, 0x36, 0x98, 0x9B, 0xB6, 0xD3, 0x9E, 0x1D, 0x77,
0x9D, 0x46, 0xED, 0x8C, 0xEC, 0xE6, 0xA7, 0x12, 0x92, 0xF4, 0x76, 0xDC, 0xA0, 0x14, 0x24, 0xD9,
0x20, 0x79, 0x59, 0x08, 0x4E, 0xB1, 0x07, 0x90, 0xAA, 0x2E, 0xD7, 0x4F, 0x11, 0xCD, 0xC5, 0x8A,
0xA5, 0x1C, 0x6A, 0x19, 0xC2, 0x66, 0xB4, 0xBC, 0x94, 0xC0, 0x9C, 0x2D, 0xE1, 0x29, 0xE2, 0x15,
0x55, 0x2A, 0x97, 0x81, 0xCF, 0x1A, 0x5A, 0xF5, 0x2C, 0xF3, 0xDD, 0x93, 0xB5, 0x4A, 0xE0, 0x39,
0x57, 0x6F, 0x6E, 0xD6, 0x0C, 0x61, 0xAE, 0x31, 0xFF, 0xBD, 0xCE, 0x35, 0xD2, 0x5C, 0x40, 0x82,
0x17, 0x89, 0x75, 0xE7, 0x7C, 0xA6, 0x32, 0x01, 0x22, 0x78, 0x18, 0x3A, 0x5D, 0x44, 0xAD, 0x84,
0x45, 0x6B, 0xDB, 0xC3, 0x25, 0x5F, 0x06, 0x7F, 0xF0, 0xAB, 0xFD, 0x60, 0x2F, 0x3B, 0x00, 0x48,
0x2B, 0xFB, 0x96, 0x9F, 0x05, 0xE5, 0x91, 0x1E, 0x8F, 0x0F, 0x50, 0xA9, 0x0D, 0xF9, 0x3D, 0x21,
0xFE, 0xEE, 0x1B, 0x04, 0x13, 0x95, 0xB7, 0x42, 0xBF, 0x7A, 0x3E, 0x49, 0xB2, 0xAF, 0xCC, 0x28,
0xCB, 0x8D, 0x70, 0x54, 0xDE, 0x99, 0x3C, 0x26, 0xF7, 0x83, 0x85, 0x7D, 0x34, 0xE9, 0xBA, 0x3F,
0x9A, 0xDF, 0x02, 0x69, 0x5E, 0x7B, 0x43, 0x38, 0x67, 0xD8, 0xA4, 0xC4, 0xEA, 0x88, 0xE4, 0xD4,
0xBB, 0xB8, 0x47, 0xA2, 0xE8, 0x23, 0xA8, 0xF8, 0x73, 0x58, 0xF1, 0x6D, 0x1F, 0xAC, 0x65, 0x86,
0x8E, 0x09, 0x0E, 0x0B, 0xDA, 0xEB, 0x41, 0x62, 0xD0, 0x5B, 0x6C, 0x87, 0x4C, 0xFC, 0x71, 0x8B,
0x56, 0x4D, 0x64, 0xC1, 0x52, 0xA1, 0xBE, 0xB9, 0xC6, 0x53, 0x80, 0xF2, 0x16, 0x72, 0xA3, 0x63
};
static const uint8_t rsbox[256] = {
0x8E, 0x77, 0xC2, 0x00, 0xA3, 0x94, 0x86, 0x36, 0x33, 0xE1, 0x17, 0xE3, 0x64, 0x9C, 0xE2, 0x99,
0x01, 0x3C, 0x27, 0xA4, 0x2D, 0x4F, 0xFC, 0x70, 0x7A, 0x43, 0x55, 0xA2, 0x41, 0x1E, 0x97, 0xDC,
0x30, 0x9F, 0x78, 0xD5, 0x2E, 0x84, 0xB7, 0x05, 0xAF, 0x4D, 0x51, 0x90, 0x58, 0x4B, 0x39, 0x8C,
0x0A, 0x67, 0x76, 0x0C, 0xBC, 0x6B, 0x18, 0x11, 0xC7, 0x5F, 0x7B, 0x8D, 0xB6, 0x9E, 0xAA, 0xBF,
0x6E, 0xE6, 0xA7, 0xC6, 0x7D, 0x80, 0x21, 0xD2, 0x8F, 0xAB, 0x5D, 0x15, 0xEC, 0xF1, 0x34, 0x3B,
0x9A, 0x0F, 0xF4, 0xF9, 0xB3, 0x50, 0xF0, 0x60, 0xD9, 0x32, 0x56, 0xE9, 0x6D, 0x7C, 0xC4, 0x85,
0x8B, 0x65, 0xE7, 0xFF, 0xF2, 0xDE, 0x45, 0xC8, 0x07, 0xC3, 0x42, 0x81, 0xEA, 0xDB, 0x62, 0x61,
0xB2, 0xEE, 0xFD, 0xD8, 0x12, 0x72, 0x2A, 0x1F, 0x79, 0x31, 0xA9, 0xC5, 0x74, 0xBB, 0x10, 0x87,
0xFA, 0x53, 0x6F, 0xB9, 0x7F, 0xBA, 0xDF, 0xEB, 0xCD, 0x71, 0x3F, 0xEF, 0x23, 0xB1, 0xE0, 0x98,
0x37, 0x96, 0x28, 0x5B, 0x48, 0xA5, 0x92, 0x52, 0x19, 0xB5, 0xC0, 0x1A, 0x4A, 0x20, 0x1D, 0x93,
0x2C, 0xF5, 0xD3, 0xFE, 0xCA, 0x40, 0x75, 0x26, 0xD6, 0x9B, 0x38, 0x89, 0xDD, 0x7E, 0x66, 0xAD,
0x0D, 0x35, 0xAC, 0x08, 0x46, 0x5C, 0x1B, 0xA6, 0xD1, 0xF7, 0xBE, 0xD0, 0x47, 0x69, 0xF6, 0xA8,
0x49, 0xF3, 0x44, 0x83, 0xCB, 0x3E, 0xF8, 0x14, 0x06, 0x04, 0x0E, 0xB0, 0xAE, 0x3D, 0x6A, 0x54,
0xE8, 0x02, 0x6C, 0x1C, 0xCF, 0x03, 0x63, 0x3A, 0xC9, 0x2F, 0xE4, 0x82, 0x2B, 0x5A, 0xB4, 0xC1,
0x5E, 0x4C, 0x4E, 0x16, 0xCE, 0x95, 0x25, 0x73, 0xD4, 0xBD, 0xCC, 0xE5, 0x24, 0x22, 0xA1, 0x09,
0x88, 0xDA, 0xFB, 0x59, 0x29, 0x57, 0x13, 0xB8, 0xD7, 0x9D, 0x0B, 0x91, 0xED, 0x8A, 0xA0, 0x68
};
static const uint8_t Rcon[11] = {
0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
};
#define getSBoxValue(num) (sbox[(num)])
#define getSBoxInvert(num) (rsbox[(num)])
static void KeyExpansion(uint8_t* RoundKey, const uint8_t* Key)
{
unsigned i, j, k;
uint8_t tempa[4];
for (i = 0; i < Nk; ++i)
{
RoundKey[(i * 4) + 0] = Key[(i * 4) + 0];
RoundKey[(i * 4) + 1] = Key[(i * 4) + 1];
RoundKey[(i * 4) + 2] = Key[(i * 4) + 2];
RoundKey[(i * 4) + 3] = Key[(i * 4) + 3];
}
for (i = Nk; i < Nb * (Nr + 1); ++i)
{
{
k = (i - 1) * 4;
tempa[0]=RoundKey[k + 0];
tempa[1]=RoundKey[k + 1];
tempa[2]=RoundKey[k + 2];
tempa[3]=RoundKey[k + 3];
}
if (i % Nk == 0)
{
// This function shifts the 4 bytes in a word to the left once.
// [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
// Function RotWord()
{
const uint8_t u8tmp = tempa[0];
tempa[0] = tempa[1];
tempa[1] = tempa[2];
tempa[2] = tempa[3];
tempa[3] = u8tmp;
}
// SubWord() is a function that takes a four-byte input word and
// applies the S-box to each of the four bytes to produce an output word.
// Function Subword()
{
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
}
tempa[0] = tempa[0] ^ Rcon[i/Nk];
}
if (i % Nk == 4)
{
// Function Subword()
{
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
}
}
j = i * 4; k=(i - Nk) * 4;
RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0];
RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1];
RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2];
RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3];
}
}
void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key)
{
KeyExpansion(ctx->RoundKey, key);
}
static void AddRoundKey(uint8_t round,state_t* state,uint8_t* RoundKey)
{
uint8_t i,j;
for (i = 0; i < 4; ++i)
{
for (j = 0; j < 4; ++j)
{
(*state)[i][j] ^= RoundKey[(round * Nb * 4) + (i * Nb) + j];
}
}
}
static void Transpose(state_t* state)
{
int row, col;
state_t tmp;
for (row = 0; row < 4; row++)
{
for (col = 0; col < 4; col++)
{
tmp[row][col] = (*state)[col][row];
}
}
memcpy(state, tmp, 16);
}
static void SubBytes(state_t* state)
{
uint8_t i, j;
for (i = 0; i < 4; ++i)
{
for (j = 0; j < 4; ++j)
{
(*state)[j][i] = getSBoxValue((*state)[j][i]);
}
}
}
static void InvSubBytes(state_t* state)
{
uint8_t i, j;
for (i = 0; i < 4; ++i)
{
for (j = 0; j < 4; ++j)
{
(*state)[j][i] = getSBoxInvert((*state)[j][i]);
}
}
}
static void ShiftRows(state_t* state)
{
uint8_t temp1;
uint8_t temp2;
// col1: down 2
temp1 = (*state)[2][1];
temp2 = (*state)[3][1];
(*state)[2][1] = (*state)[0][1];
(*state)[3][1] = (*state)[1][1];
(*state)[0][1] = temp1;
(*state)[1][1] = temp2;
// col2: down 2
temp1 = (*state)[2][2];
temp2 = (*state)[3][2];
(*state)[2][2] = (*state)[0][2];
(*state)[3][2] = (*state)[1][2];
(*state)[0][2] = temp1;
(*state)[1][2] = temp2;
// col3: down 1
temp1 = (*state)[3][3];
(*state)[3][3] = (*state)[2][3];
(*state)[2][3] = (*state)[1][3];
(*state)[1][3] = (*state)[0][3];
(*state)[0][3] = temp1;
}
static void InvShiftRows(state_t* state)
{
uint8_t temp1;
uint8_t temp2;
// col1: up 2
temp1 = (*state)[0][1];
temp2 = (*state)[1][1];
(*state)[0][1] = (*state)[2][1];
(*state)[1][1] = (*state)[3][1];
(*state)[2][1] = temp1;
(*state)[3][1] = temp2;
// col2: up 2
temp1 = (*state)[0][2];
temp2 = (*state)[1][2];
(*state)[0][2] = (*state)[2][2];
(*state)[1][2] = (*state)[3][2];
(*state)[2][2] = temp1;
(*state)[3][2] = temp2;
// col3: up 1
temp1 = (*state)[0][3];
(*state)[0][3] = (*state)[1][3];
(*state)[1][3] = (*state)[2][3];
(*state)[2][3] = (*state)[3][3];
(*state)[3][3] = temp1;
}
static uint8_t xtime(uint8_t x)
{
return ((x<<1) ^ (((x>>7) & 1) * 0x1b));
}
static uint8_t Multiply(uint8_t x, uint8_t y)
{
uint8_t v = 0;
v ^= (y & 1) * x;
v ^= (y>>1 & 1) * xtime(x);
v ^= (y>>2 & 1) * xtime(xtime(x));
v ^= (y>>3 & 1) * xtime(xtime(xtime(x)));
v ^= (y>>4 & 1) * xtime(xtime(xtime(xtime(x))));
return v;
}
static void MixColumns(state_t* state)
{
int i;
uint8_t a, b, c, d;
uint8_t e, f, g, h;
uint8_t tmp[4][4] = {0};
for (i = 0; i < 2; i++)
{
a = (*state)[0][i+0];
b = (*state)[1][i+0];
c = (*state)[2][i+0];
d = (*state)[3][i+0];
e = (*state)[0][i+2];
f = (*state)[1][i+2];
g = (*state)[2][i+2];
h = (*state)[3][i+2];
tmp[0][i+0] = Multiply(a, 0x0B) ^ Multiply(b, 0x08) ^ Multiply(c, 0x06) ^ Multiply(d, 0x05) ^ Multiply(e, 0x04) ^ Multiply(f, 0x03) ^ Multiply(g, 0x01) ^ Multiply(h, 0x07);
tmp[1][i+0] = Multiply(a, 0x08) ^ Multiply(b, 0x0B) ^ Multiply(c, 0x05) ^ Multiply(d, 0x06) ^ Multiply(e, 0x03) ^ Multiply(f, 0x04) ^ Multiply(g, 0x07) ^ Multiply(h, 0x01);
tmp[2][i+0] = Multiply(a, 0x06) ^ Multiply(b, 0x05) ^ Multiply(c, 0x0B) ^ Multiply(d, 0x08) ^ Multiply(e, 0x01) ^ Multiply(f, 0x07) ^ Multiply(g, 0x04) ^ Multiply(h, 0x03);
tmp[3][i+0] = Multiply(a, 0x05) ^ Multiply(b, 0x06) ^ Multiply(c, 0x08) ^ Multiply(d, 0x0B) ^ Multiply(e, 0x07) ^ Multiply(f, 0x01) ^ Multiply(g, 0x03) ^ Multiply(h, 0x04);
tmp[0][i+2] = Multiply(a, 0x04) ^ Multiply(b, 0x03) ^ Multiply(c, 0x01) ^ Multiply(d, 0x07) ^ Multiply(e, 0x0B) ^ Multiply(f, 0x08) ^ Multiply(g, 0x06) ^ Multiply(h, 0x05);
tmp[1][i+2] = Multiply(a, 0x03) ^ Multiply(b, 0x04) ^ Multiply(c, 0x07) ^ Multiply(d, 0x01) ^ Multiply(e, 0x08) ^ Multiply(f, 0x0B) ^ Multiply(g, 0x05) ^ Multiply(h, 0x06);
tmp[2][i+2] = Multiply(a, 0x01) ^ Multiply(b, 0x07) ^ Multiply(c, 0x04) ^ Multiply(d, 0x03) ^ Multiply(e, 0x06) ^ Multiply(f, 0x05) ^ Multiply(g, 0x0B) ^ Multiply(h, 0x08);
tmp[3][i+2] = Multiply(a, 0x07) ^ Multiply(b, 0x01) ^ Multiply(c, 0x03) ^ Multiply(d, 0x04) ^ Multiply(e, 0x05) ^ Multiply(f, 0x06) ^ Multiply(g, 0x08) ^ Multiply(h, 0x0B);
}
memcpy(state, tmp, 16);
}
static void Cipher(state_t* state, uint8_t* RoundKey)
{
uint8_t round = 0;
AddRoundKey(0, state, RoundKey);
Transpose(state);
for (round = 1; round < Nr; ++round)
{
SubBytes(state);
ShiftRows(state);
MixColumns(state);
Transpose(state);
AddRoundKey(round, state, RoundKey);
}
SubBytes(state);
ShiftRows(state);
Transpose(state);
AddRoundKey(Nr, state, RoundKey);
}
static void InvCipher(state_t* state,uint8_t* RoundKey)
{
uint8_t round = 0;
AddRoundKey(Nr, state, RoundKey);
Transpose(state);
for (round = (Nr - 1); round > 0; --round)
{
InvShiftRows(state);
InvSubBytes(state);
AddRoundKey(round, state, RoundKey);
Transpose(state);
MixColumns(state);
}
InvShiftRows(state);
InvSubBytes(state);
Transpose(state);
AddRoundKey(0, state, RoundKey);
}
void AES_ECB_encrypt(struct AES_ctx *ctx, uint8_t* buf)
{
Cipher((state_t*)buf, ctx->RoundKey);
}
void AES_ECB_decrypt(struct AES_ctx* ctx, uint8_t* buf)
{
InvCipher((state_t*)buf, ctx->RoundKey);
}
test.cpp
string x_get_sn_part2()
{
BYTE key[32] = {
0x7E, 0x6E, 0xCF, 0xD4, 0x92, 0xBC, 0x4B, 0x27, 0xC0, 0xCF, 0xF2, 0x65, 0x6D, 0x3C, 0x49, 0xD1,
0xAA, 0xB1, 0x45, 0xA8, 0x6D, 0x75, 0x9B, 0xC1, 0xDF, 0x75, 0x60, 0xDD, 0x8D, 0xDD, 0x13, 0xDA,
};
// expected
BYTE buf_part2[16] = {
0xA5, 0x4B, 0x4A, 0x9A, 0xC5, 0x49, 0x8A, 0xA2, 0x62, 0xA4, 0xC5, 0x56, 0x2D, 0x52, 0x5A, 0xA6
};
AES_ctx ctx;
AES_init_ctx(&ctx, key);
AES_ECB_encrypt(&ctx, buf_part2);
size_t tmp_len = 0;
void *tmp = xxtea_encrypt(buf_part2, 16, "goodLuck7777777", &tmp_len);
return util::bin2hex(tmp, tmp_len);
}
原文链接：
合作伙伴
腾讯安全应急响应中心
TSRC，腾讯安全的先头兵，肩负腾讯公司安全漏洞、黑客入侵的发现和处理工作。这是个没有硝烟的战场，我们与两万多名安全专家并肩而行，捍卫全球亿万用户的信息、财产安全。一直以来，我们怀揣感恩之心，努力构建开放的TSRC交流平台，回馈安全社区。未来，我们将继续携手安全行业精英，探索互联网安全新方向，建设互联网生态安全，共铸“互联网+”新时代。
转载请注明：转自看雪学院
看雪CTF.TSRC 2018 团队赛 解题思路汇总：
声明：该文观点仅代表作者本人，转载请注明来自看雪