2025hgameCTF_Re Writeup

#include <stdint.h>  
#include <stdio.h>
#include <stdlib.h>
#include <string.h>  

#define CRC32_POLYNOMIAL 0xEDB88320  

uint32_t crc32_table[256];

void generate_crc32_table() {
    uint32_t crc;
    for (int i = 0; i < 256; i++) {
        crc = i;
        for (int j = 0; j < 8; j++) {
            if (crc & 1) {
                crc = (crc >> 1) ^ CRC32_POLYNOMIAL;
            }
            else {
                crc >>= 1;
            }
        }
        crc32_table[i] = crc;
    }
}

uint32_t crc32(const uint8_t* data, size_t length) {
    uint32_t crc = 0xFFFFFFFF;
    for (size_t i = 0; i < length; i++) {
        crc = (crc >> 8) ^ crc32_table[(crc ^ data[i]) & 0xFF];
    }
    return crc ^ 0xFFFFFFFF;
}

void dec_btea(uint32_t* v, int n, uint32_t const key[4])
{
    uint32_t y, z, sum, delta;
    unsigned p, rounds, e;
    delta = 0;
    rounds = 6 + 52 / n;
    sum = rounds * delta;
    y = v[0];
    do
    {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--)    //注意这里的p是从n-1~0,和上面是反过来的
        {
            z = v[p - 1];
            y = v[p] -= (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z)));
        }
        z = v[n - 1];
        y = v[0] -= (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z)));   //这里的MX中传入的 p=0
        sum -= delta;
    } while (--rounds);
}

int main() {

    /*unsigned char data[65536] = {
    0xE9, 0xFF, 0x57, 0x00,
    0x00, 0xE9, 0x9E, 0x9C, 0x01, 0x00, 0xE9, 0xA9, 0xD7, 0x07, 0x00, 0xE9, 0xD0, 0x9F, 0x00, 0x00,
   ......
    ,0x07, 0xE8, 0x81, 0xEF, 0xFE, 0xFF, 0x48, 0x8B, 0x08, 0x8B, 0x40, 0x08, 0x48, 0x89, 0x4D, 0xC7,
   0x89, 0x45, 0xCF, 0xBA, 0x10, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x29
   };*/
    
    uint32_t input[] = {
    0x3050EA23, 0x47514C00, 0x2B769CEE, 0x1794E6D5, 0xB3E42BED, 0x61D536CB, 0x7CA0C2C0, 0x5ED767FE,
    0xC579E0AF };
    uint32_t key[4] = { 0x97a25fb5,0xe1756dba,0xa143464a,0x5a8f284f };

    //generate_crc32_table();
    //for (int i = 0; i < 4; i++) {
    //    uint32_t result = key[i] = crc32(&data[0x4000 * i], 0x4000);
    //    printf("0x%x,", result);
    //}
    dec_btea(input,9, key);
    printf("hgame{");
    for (int i = 0; i < 36; i++) {
        printf("%c", *((unsigned char*)input + i));
    }
    printf("}");
    return 0;
}