這個(gè)反編譯的比較深

一，從附件的圖標(biāo)看是python打包的exe文件，先用pyinstxtractor.py 解包

生成的文件在main.exe_extracted目錄下，在這里邊找到main

二，把main改名為pyc然后加上頭

這個(gè)頭從包里找一個(gè)帶頭的pyc文件（這里用的_boot文件）把E3前邊的16字節(jié)插進(jìn)來

三，用uncompyle6反編譯，生成mai.py

N0WayBack\春節(jié)紅包題\Re_rabbit_Game>uncompyle6 main.pyc > main.py?

四，打開main.py查看流程，這里需要運(yùn)行114514次magic_s()每次會(huì)進(jìn)行一個(gè)LCG處理

                            if self.score < 114514:self.magic_s()self.score += 1

LCG

    def magic_s(self):p = 16045690984230472446a = 114514b = 1919810self.magic = (a * self.magic + b) % p

?

然后會(huì)打印解密的flag

    def print_flag(self):key = str(self.magic)[:16]enc = AES.new(key.encode(), AES.MODE_ECB)flag = enc.decrypt(self.FLAG)print(flag)self.draw_text(flag, 22, WHITE, WIDTH / 2, HEIGHT / 2)self.draw_text('Happy 2023!!!!!', 22, WHITE, WIDTH / 2, HEIGHT / 2 - 40)

五，這里要對(duì)FLAG進(jìn)行AES解密，key在secret里

from secret import flag

問大姥，這個(gè)自己寫導(dǎo)入的secret都在 PYZ-00目錄里，文件是經(jīng)過aes加密和zlib壓縮

PYZ-00.pyz_extracted

?六，用網(wǎng)上的腳本進(jìn)行解密解壓，生成secret.pyc文件

import glob
import zlib
import tinyaes
from pathlib import PathCRYPT_BLOCK_SIZE = 16# key obtained from pyimod00_crypto_key
key = bytes('0000000000r4bb1t', 'utf-8')for p in ['secret.pyc.encrypted']: #Path("PYZ-00.pyz_extracted").glob("**/*.pyc.encrypted"):inf = open(p, 'rb') # encrypted file inputoutf = open('secret.py', 'wb') # output file# Initialization vectoriv = inf.read(CRYPT_BLOCK_SIZE)cipher = tinyaes.AES(key, iv)# Decrypt and decompressplaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))# Write pyc header# The header below is for Python 3.8outf.write(b'\x55\x0d\x0d\x0a\0\0\0\0\0\0\0\0\0\0\0\0')# Write decrypted dataoutf.write(plaintext)inf.close()outf.close()# Delete .pyc.encrypted file#p.unlink()

這里的aes用的key在pyimod00_crypto_key 文件里，這也是個(gè)pyc文件，可以反編譯也可以直接看，拿到key

七，得到flag后對(duì)，編寫代碼利用原用函數(shù)解密

from Crypto.Cipher import AES FLAG = bytes.fromhex('17e8fb647b4b10cc8182f0f76649f08bd2d33eacb5fa4ca865d99062f8d0b4c479d7d2328081121536c26c6a4150efb5')magic = 0
def magic_s():global magic p = 16045690984230472446a = 114514b = 1919810magic = (a * magic + b) % pdef print_flag():key = str(magic)[:16]enc = AES.new(key.encode(), AES.MODE_ECB)flag = enc.decrypt(FLAG)print(flag)for _ in range(114514):magic_s()print_flag()
#