（我不懂）密码学系列之异或运算

KEY1 = a6c8b6733c9b22de7bc0253266a3867df55acde8635e19c73313KEY2 ^ KEY1 = 37dcb292030faa90d07eec17e3b1c6d8daf94c35d4c9191a5e1eKEY2 ^ KEY3 = c1545756687e7573db23aa1c3452a098b71a7fbf0fddddde5fc1FLAG ^ KEY1 ^ KEY3 ^ KEY2 = 04ee9855208a2cd59091d04767ae47963170d1660df7f56f5faf

from itertools import *from data import flag,plainkey=flag.strip("de1ctf{").strip("}")assert(len(key<38))salt="WeAreDe1taTeam"ki=cycle(key)si=cycle(salt)cipher = ''.join([hex(ord(p) ^ ord(next(ki)) ^ ord(next(si)))[2:].zfill(2) for p in plain])print cipher# output:# 49380d773440222d1b421b3060380c3f403c3844791b202651306721135b6229294a3c3222357e766b2f15561b35305e3c3b670e49382c295c6c170553577d3a2b791470406318315d753f03637f2b614a4f2e1c4f21027e227a4122757b446037786a7b0e37635024246d60136f7802543e4d36265c3e035a725c6322700d626b345d1d6464283a016f35714d434124281b607d315f66212d671428026a4f4f79657e34153f3467097e4e135f187a21767f02125b375563517a3742597b6c394e78742c4a725069606576777c314429264f6e330d7530453f22537f5e3034560d22146831456b1b72725f30676d0d5c71617d48753e26667e2f7a334c731c22630a242c7140457a42324629064441036c7e646208630e745531436b7c51743a36674c4f352a5575407b767a5c747176016c0676386e403a2b42356a727a04662b4446375f36265f3f124b724c6e346544706277641025063420016629225b43432428036f29341a2338627c47650b264c477c653a67043e6766152a485c7f33617264780656537e5468143f305f4537722352303c3d4379043d69797e6f3922527b24536e310d653d4c33696c635474637d0326516f745e610d773340306621105a7361654e3e392970687c2e335f3015677d4b3a724a4659767c2f5b7c16055a126820306c14315d6b59224a27311f747f336f4d5974321a22507b22705a226c6d446a37375761423a2b5c29247163046d7e47032244377508300751727126326f117f7a38670c2b23203d4f27046a5c5e1532601126292f577776606f0c6d0126474b2a73737a41316362146e581d7c1228717664091c

from Crypto.Util.number import *from Crypto.Util.strxor import strxorfrom string import printablekeytable = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_"ci = "..."s = b"WeAreDe1taTeam"ci = bytes.fromhex(ci)# c = p^k = ci^sc = strxor(ci,(s*((len(ci)//len(s))+1))[:len(ci)])def bruce_printable(s):TMP = set()for each in printable:tmp = chr(ord(each)^s)if tmp in keytable:TMP.add(tmp)return TMPfor k_len in range(1,38):candidates = []for j in range(k_len):block = [c[k_len*i+j] for i in range(len(c)//k_len)]candidate=set()init = Truefor eachbyte in block:tmp_candidate=bruce_printable(eachbyte)if init:candidate = tmp_candidateinit = Falseelse:candidate &= tmp_candidateif candidate:candidates.append(candidate)#print(candidates)if k_len == len(candidates):print("[+]",k_len)

k_len = 30key_candidates=[]for j in range(k_len):block = [c[k_len*i+j] for i in range(len(c)//k_len)]keyi_candidate = []for keyi in keytable:for eachbyte in block:if chr(ord(keyi)^eachbyte) not in plaintable:breakelse:keyi_candidate.append(keyi)if not keyi_candidate:print("[-] error")exit()key_candidates.append(keyi_candidate)print(key_candidates)

plaintable="1234567890qwertyuiopasdfghjklxcvbnmQWERTYUIOPSDFGHJKLZXCVBNM\'` ;,."

from secrets import randbitsfrom Crypto.Util.number import bytes_to_longimport osflag = os.environ.get('FLAG', 'SEE{not_the_real_flag}').encode()# get a one-time-pad in which not exactly half the bits are setdef get_xorpad(bitlength):    xorpad = randbits(bitlength)    return xorpad if bin(xorpad).count('1') != bitlength // 2 else get_xorpad(bitlength)def leak_encrypted_flag():    return bytes_to_long(flag) ^ get_xorpad(len(flag) * 8)# I managed to leak the encrypted flag a lot of timesif __name__ == '__main__':    for _ in range(2**16):        print(leak_encrypted_flag())

>>> from collections import Counter>>> arr = [int(x) for x in open('nn_out.txt').readlines()]>>> print(Counter(bin(x).count('1')%2 for x in arr))Counter({1: 34422, 0: 31114})

arr = [x for x in arr if bin(x).count('1')%2 == 0]arrbits = np.array([[int(a) for a in f'{x:0272b}'] for x in arr])

flag = 'SEE{?????????????????????????????}'flagbits = np.array(bits(flag.encode()))known = np.array([False] * 272)for i, c in enumerate(flag):    if c == '?':        known[8*i] = True    else:        known[8*i:8*i+8] = Trueprint(known)

>>> np.count_nonzero(known * (arrbits[0] != flagbits), -1)35

from collections import Counterfrom pwn import bits, unbitsfrom scipy.special import binomimport numpy as np# determine the parity of our flagarr = [int(x) for x in open('nn_out.txt').readlines()]print(Counter(bin(x).count('1')%2 for x in arr))# Counter({1: 34422, 0: 31114})# This means the flag has an even number of set bits# set up array with our encrypted bitsarr = [x for x in arr if bin(x).count('1')%2 == 0]LEN = max(arr).bit_length()assert LEN == 272arrbits = np.array([[int(a) for a in f'{x:0272b}'] for x in arr])# set up array with our guesses for the flagflag = 'SEE{?????????????????????????????}'flagbits = np.array(bits(flag.encode()))# set up array of which positions are known. it's ASCII so every MSBit is setknown = np.array([False] * 272)for i, c in enumerate(flag):    if c == '?':        known[8*i] = True    else:        known[8*i:8*i+8] = True# this is the same function defined above, but in the log spacedef f(n,x):    return np.log(2.0**(n-1) - binom(n,x))while n := sum(~known):    # calculate our probabilities! this has a scale of -inf to inf rather than the usual 0 to 1    k = 136 - np.count_nonzero(known * (arrbits != flagbits), -1)    probs = (f(n-1, k) - f(n-1, k-1)) @ (2 * arrbits - 1)    # out of all the unknown bits, get the 10 with the best probability    inds = np.nonzero(~known)[0]    inds = inds[np.argsort(-abs(probs[inds]))[:10]]    # set these flag bits to the corresponding sign     flagbits[inds] = probs[inds] > 0    known[inds] = True    # print our best estimate of the flag    print(unbits(np.where(known, flagbits, probs > 0)))