EzFlag 逆向分析：密码门 + Fibonacci 周期坑，以及怎么自己出这道题#

1
int main() {
2
    std::string input;
3
    std::cout << "Enter password: ";
4
    std::getline(std::cin, input);
5

6
    if (input != "V3ryStr0ngp@ssw0rd") {          // 明文密码比较
7
        std::cout << "Wrong password!" << std::endl;
8
    } else {
9
        std::cout << "flag{";
10
        std::cout.flush();
11
        unsigned long long key = 1;
12
        for (int i = 0; i < 0x20; i++) {          // 32 个字符
13
            std::cout << f(key);                  // 查表得一个字符
14
            std::cout.flush();
15
            if (i == 7 || i == 12 || i == 17 || i == 22)
16
                std::cout << "-";                 // 分组 8-5-5-5-9（伪 UUID 样式）
17
            key = key * 8 + (i + 0x40);           // key 指数增长 ← 坑的根源
18
            std::this_thread::sleep_for(std::chrono::seconds(1));  // 打字机延迟
19
        }
20
        std::cout << "}" << std::endl;
21
    }
22
    return 0;
23
}

1
; f(unsigned long long n)
2
;   prev = 0, cur = 1, i = 0
3
; loop: tmp = cur; cur = (cur + prev) & 0xf; prev = tmp; i++   ; while i < n
4
;   return K[prev]      ; 查全局字符串 K（std::string::operator[]）

1
// 全局 K：静态初始化时 K = "012ab9c3478d56ef"
2
std::string K;
3

4
char f(unsigned long long n) {
5
    unsigned long long prev = 0, cur = 1;   // F(0), F(1)
6
    for (unsigned long long i = 0; i < n; i++) {
7
        unsigned long long tmp = cur;
8
        cur = (cur + prev) & 0xf;           // 斐波那契，mod 16
9
        prev = tmp;
10
    }
11
    return K[prev];                          // K[F(n) mod 16]
12
}

1
// __static_initialization_and_destruction_0 (0x1482)
2
void __static_init(void) {
3
    K = "012ab9c3478d56ef";   // std::string 构造
4
    atexit(dtor);             // 注册析构
5
}

1
F(key) mod 16 = F(key mod 24) mod 16

1
K = "012ab9c3478d56ef"
2

3
def fib_mod16(n):
4
    n %= 24                      # Pisano period of 16
5
    a, b = 0, 1                  # F(0), F(1)
6
    for _ in range(n):
7
        a, b = b, (a + b) & 0xf
8
    return a
9

10
key = 1
11
chars = []
12
for i in range(32):
13
    chars.append(K[fib_mod16(key)])
14
    key = key * 8 + (i + 0x40)
15

16
s = "".join(chars)
17
out = ""
18
for i, ch in enumerate(s):
19
    out += ch
20
    if i in (7, 12, 17, 22):
21
        out += "-"
22
print(f"flag{{{out}}}")
23
# flag{10632674-1d219-09f29-147a2-760632674}

1
选手流程：识别(ELF/C++) → strings/符号 → 还原 main 和 f → 发现"跑不完" → 找周期 → 离线算 flag
2
出题流程：写 flag 生成器 → 包密码门 → 埋"运行不可行"的坑 → 验证可解且不可白嫖

1
// game.cpp —— 出题模板
2
#include <iostream>
3
#include <string>
4
#include <thread>
5
#include <chrono>
6

7
static std::string K;  // 静态初始化赋值，见第 3 步
8

9
static char f(unsigned long long n) {
10
    unsigned long long prev = 0, cur = 1;
11
    for (unsigned long long i = 0; i < n; i++) {
12
        unsigned long long tmp = cur;
13
        cur = (cur + prev) & 0xf;   // 斐波那契 mod 16
14
        prev = tmp;
15
    }
16
    return K[prev];                 // 查表
17
}
18

19
int main() {
20
    std::string input;
21
    std::cout << "Enter password: ";
22
    std::getline(std::cin, input);
23
    if (input != "V3ryStr0ngp@ssw0rd") {
24
        std::cout << "Wrong password!" << std::endl;
25
        return 0;
26
    }
27
    std::cout << "flag{";
28
    unsigned long long key = 1;
29
    for (int i = 0; i < 32; i++) {
30
        std::cout << f(key);
31
        if (i == 7 || i == 12 || i == 17 || i == 22) std::cout << "-";
32
        key = key * 8 + (i + 0x40);
33
        std::this_thread::sleep_for(std::chrono::seconds(1));  // 可选打字机效果
34
    }
35
    std::cout << "}" << std::endl;
36
    return 0;
37
}

1
#!/usr/bin/env python3
2
"""gen.py —— 出题辅助：给定 K 表推导 flag，并做闭环校验。
3
换 K 表（16 个互异字符的排列）= 换一道题。
4
"""
5
import sys
6

7
def fib_mod16(n: int) -> int:
8
    n %= 24                      # Fibonacci mod 16 的 Pisano 周期
9
    a, b = 0, 1
10
    for _ in range(n):
11
        a, b = b, (a + b) & 0xf
12
    return a
13

14
def gen_flag(K: str) -> str:
15
    assert len(K) == 16 and len(set(K)) == 16, "K 必须是 16 个互异字符"
16
    key = 1
17
    s = []
18
    for i in range(32):
19
        s.append(K[fib_mod16(key)])
20
        key = key * 8 + (i + 0x40)
21
    s = "".join(s)
22
    return f"flag{{{s[:8]}-{s[8:13]}-{s[13:18]}-{s[18:23]}-{s[23:]}}}"
23

24
if __name__ == "__main__":
25
    K = sys.argv[1] if len(sys.argv) > 1 else "012ab9c3478d56ef"
26
    print(gen_flag(K))