人よ、幸福に生きよ

1
__int64 sub_4155F0()
2
{
3
  FILE *v0; // eax
4
  __int64 v1; // rax
5
  __int64 v3; // [esp-8h] [ebp-1B8h]
6
  char v4; // [esp+0h] [ebp-1B0h]
7
  char v5; // [esp+0h] [ebp-1B0h]
8
  int m; // [esp+D0h] [ebp-E0h]
9
  int k; // [esp+DCh] [ebp-D4h]
10
  int j; // [esp+E8h] [ebp-C8h]
11
  int i; // [esp+F4h] [ebp-BCh]
12
  char Buffer[72]; // [esp+100h] [ebp-B0h] BYREF
13
  char Buf1[40]; // [esp+148h] [ebp-68h] BYREF
14
  int v12[6]; // [esp+170h] [ebp-40h] BYREF
15
  int v13[9]; // [esp+188h] [ebp-28h] BYREF
16
  int savedregs; // [esp+1B0h] [ebp+0h] BYREF
17

18
  sub_41132F(&unk_41C00F);
19
  v12[0] = 69;
20
  v12[1] = 86;
21
  v12[2] = 327;
22
  v12[3] = 69;
23
  sub_4110D7("welcome to POFP CTF\n", v4);
24
  sub_4110D7("input your flag:", v5);
25
  _acrt_iob_func(0);
26
  v0 = (FILE *)sub_411253();
27
  fgets(Buffer, 64, v0);
28
  if ( sub_411253() )
29
  {
30
    if ( j_strlen(Buffer) == 32 )
31
    {
32
      j_memset(v13, 0, 0x20u);
33
      for ( i = 0; i <= 7; ++i )
34
        v13[i] = Buffer[4 * i] | (Buffer[4 * i + 1] << 8) | (Buffer[4 * i + 2] << 16) | (Buffer[4 * i + 3] << 24);
35
      for ( j = 0; j <= 7; j += 2 )
36
        sub_4113CA(&v13[j], v12);
37
      for ( k = 0; k <= 7; ++k )
38
      {
39
        for ( m = 0; m <= 3; ++m )
40
          Buf1[4 * k + m] = (unsigned int)v13[k] >> (8 * m);
41
      }
42
      if ( !j_memcmp(Buf1, &byte_41A0EC, 0x20u) )
43
        puts("success");
44
      else
45
        puts("fake");
46
      sub_411253();
47
      LODWORD(v1) = 0;
48
    }
49
    else
50
    {
51
      puts("fake");
52
      sub_411253();
53
      LODWORD(v1) = 0;
54
    }
55
  }
56
  else
57
  {
58
    LODWORD(v1) = 1;
59
  }
60
  v3 = v1;
61
  sub_4111EF(&savedregs, &dword_415880);
62
  return v3;
63
}

1
39 c1 97 e8 dc a1 ec c6 6f 2e 29 d8 26 76 ab 9f
2
9e 6d 79 20 12 db 0c 93 46 34 8f 34 ab 29 df e8

1
int __cdecl sub_414D30(unsigned int *a1, int a2)
2
{
3
  int result; // eax
4
  unsigned int i; // [esp+D0h] [ebp-2Ch]
5
  unsigned int v4; // [esp+DCh] [ebp-20h]
6
  unsigned int v5; // [esp+E8h] [ebp-14h]
7
  unsigned int v6; // [esp+F4h] [ebp-8h]
8

9
  sub_41132F(&unk_41C00F);
10
  v4 = *a1;
11
  v5 = a1[1];
12
  v6 = 0;
13
  for ( i = 0; i <= 0x23; ++i )
14
  {
15
    v4 += (v6 + *(_DWORD *)(a2 + 4 * (v6 & 3))) ^ (v5 + ((16 * v5) ^ (v5 >> 5)));
16
    v6 += 1640531783;
17
    v5 += (v6 + *(_DWORD *)(a2 + 4 * ((v6 >> 11) & 3))) ^ (v4 + ((16 * v4) ^ (v4 >> 5)));
18
  }
19
  *a1 = v4;
20
  result = 4;
21
  a1[1] = v5;
22
  return result;
23
}

1
import struct
2

3
ENC_RAW = bytes([
4
    0x0b,0xf3,0xa5,0xda,0xec,0x93,0xde,0xf4,
5
    0x5d,0x1c,0x1b,0xea,0x14,0x44,0x99,0xad,
6
    0xac,0x5f,0x4b,0x12,0x20,0xe9,0x3e,0xa1,
7
    0x74,0x06,0xbd,0x06,0x99,0x1b,0xed,0xda
8
])
9

10
KEY   = [0x45, 0x56, 0x147, 0x45]
11
DELTA = 0x61C88747
12
ROUNDS = 36  # i <= 0x23
13

14
def tea_decrypt_block(v0: int, v1: int):
15
    s = (DELTA * ROUNDS) & 0xFFFFFFFF
16
    for _ in range(ROUNDS):
17
        v1 = (v1 - (((v0 << 4 ^ v0 >> 5) + v0) ^ (s + KEY[(s >> 11) & 3]))) & 0xFFFFFFFF
18
        s  = (s - DELTA) & 0xFFFFFFFF
19
        v0 = (v0 - (((v1 << 4 ^ v1 >> 5) + v1) ^ (s + KEY[s & 3]))) & 0xFFFFFFFF
20
    return v0, v1
21

22
def solve():
23
    data = bytes([b ^ 0x32 for b in ENC_RAW])
24
    ints = [struct.unpack("<I", data[i:i+4])[0] for i in range(0, len(data), 4)]
25
    out = bytearray()
26
    for i in range(0, len(ints), 2):
27
        v0, v1 = tea_decrypt_block(ints[i], ints[i+1])
28
        out.extend(struct.pack("<I", v0))
29
        out.extend(struct.pack("<I", v1))
30
    print("raw bytes:", out)
31
    print("flag:", out.decode().strip())
32

33
if __name__ == "__main__":
34
    solve()

1
POFP{yAstZwntQ5ufUWOjYabaQaBI6}