[1970-01-01 08:00:00] System boot sequence initiated [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 00000000fe ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 10000000ef ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 20000000e2 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 30000000fb ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 40000000f5 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 50000000da ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 60000000e6 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 70000000e7 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 80000000fd ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 90000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 100000000e7 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 110000000fd ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 120000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 130000000cf ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 140000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 150000000dd ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 160000000ef ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 170000000e3 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 180000000fe ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 190000000e2 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 200000000eb ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 210000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 220000000c8 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 230000000e2 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 240000000ef ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 250000000e9 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 260000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 270000000cd ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 280000000e6 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 290000000ef ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 300000000e0 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 310000000e9 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 320000000eb ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 330000000d1 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 340000000c3 ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 350000000eb ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 360000000af ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 370000000af ns [1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 380000000f3 ns [1970-01-01 08:00:00] System entering chronostasis mode
将每一个十六进制数的末两位提取出来然后xor brute force
img
时空交织的密语
将二进制fromhex以后可以发现每四个字节是一组，而且前28位完全相同因此提取出每组的最低四位
1 2 3 4 5 6
f=open('timestream.bin','rb') s=f.read() x='' for i inrange(3,len(s),4): x+=str(hex(s[i]%16)[2:]) print(x)
from Crypto.Util.number import long_to_bytes data = [] withopen("timeloop.log", "r") as f: for line in f: stripped = line.strip() if stripped: parts = stripped.split("|") data.append(parts) for i inrange(len(data)): for j inrange(i + 1, len(data)): if data[i][0] > data[j][0]: data[i], data[j] = data[j], data[i] res_str = "" for item in data: second_field = item[1] first_char = second_field[0] all_same = True for ch in second_field: if ch != first_char: all_same = False break if all_same: res_str += first_char hex_num = int(res_str, 16) print(long_to_bytes(hex_num)) #b'palu{Time_1s_cycl1c@l_0x}'
Crypto
循环锁链
flag的下一位是前一位xor的密钥
1 2 3 4 5 6 7 8
f=open('flag.enc','rb') s=f.read() tmp=112 flag='' for i inrange(len(s)-1,0,-1): flag+=chr(s[i]^tmp) tmp=s[i]^tmp print('p'+flag[::-1])
import sympy as sp from Crypto.Util.number import long_to_bytes defsolve_p_q(pq, p4_plus_q4): x, y = sp.symbols('x y') eq = (x**2 - 2 * y)**2 - 2 * y**2 - p4_plus_q4 solutions_for_x = sp.solve(eq.subs(y, pq), x) results = [] for x_sol in solutions_for_x: t = sp.symbols('t') quadratic_eq = t**2 - x_sol * t + pq roots = sp.solve(quadratic_eq, t) results.append(roots)
return results n = 125997816345753096048865891139073286898143461169514858050232837657906289840897974068391106608902082960171083817785532702158298589600947834699494234633846206712414663927142998976208173208829799860130354978308649020815886262453865196867390105038666506017720712272359417586671917060323891124382072599746305448903 s = 35935569267272146368441512592153486419244649035623643902985220815940198358146024590300394059909370115858091217597774010493938674472746828352595432824315405933241792789402041405932624651226442192749572918686958461029988244396875361295785103356745756304497466567342796329331150560777052588294638069488836419744297241409127729615544668547101580333420563318486256358906310909703237944327684178950282413703357020770127158209107658407007489563388980582632159120621869165333921661377997970334407786581024278698231418756106787058054355713472306409772260619117725561889350862414726861327985706773512963177174611689685575805282 solutions = solve_p_q(n, s) e = 65537 c = 16076213508704830809521504161524867240789661063230251272973700316524961511842110066547743812160813341691286895800830395413052502516451815705610447484880112548934311914559776633140762863945819054432492392315491109745915225117227073045171062365772401296382778452901831550773993089344837645958797206220200272941 for i, sol inenumerate(solutions): ifint(sol[0])>0andint(sol[1])>0: p = int(sol[0]) q = int(sol[1]) d = pow(e, -1, (p-1)*(q-1)) m = pow(c, d, n) print(long_to_bytes(m)) #b'palu{This_is_a_fake_flag_change_it_for_real_use}'
