BUUCTF-[羊城杯 2020]Bytecode
题目下载：下载
这道题是一个关于python字节码的。
补充一下相关知识：https://shliang.blog.csdn.net/article/details/119676978dis --- Python 字节码反汇编器 — Python 3.7.13 文档
手工还原参考:[原创]死磕python字节码-手工还原python源码-软件逆向-看雪论坛-安全社区|安全招聘|bbs.pediy.com
刚开始看别人的wp，我以为有什么工具可以还原python源码，原来他们可能都是自己看出来的。
根据上面的手工还原链接，连看再猜应该比较容易一些。
Python 代码先被编译为字节码后，再由Python虚拟机来执行字节码， Python的字节码是一种类似汇编指令的中间语言， 一个Python语句会对应若干字节码指令，虚拟机一条一条执行字节码指令， 从而完成程序执行。
Python dis 模块支持对Python代码进行反汇编， 生成字节码指令。
看一下题目字节码：
4 0 LOAD_CONST 0 (3)3 LOAD_CONST 1 (37)6 LOAD_CONST 2 (72)9 LOAD_CONST 3 (9)12 LOAD_CONST 4 (6)15 LOAD_CONST 5 (132)18 BUILD_LIST 6 # 列表21 STORE_NAME 0 (en)5 24 LOAD_CONST 6 (101)27 LOAD_CONST 7 (96)30 LOAD_CONST 8 (23)33 LOAD_CONST 9 (68)36 LOAD_CONST 10 (112)39 LOAD_CONST 11 (42)42 LOAD_CONST 12 (107)45 LOAD_CONST 13 (62)48 LOAD_CONST 7 (96)51 LOAD_CONST 14 (53)54 LOAD_CONST 15 (176)57 LOAD_CONST 16 (179)60 LOAD_CONST 17 (98)63 LOAD_CONST 14 (53)66 LOAD_CONST 18 (67)69 LOAD_CONST 19 (29)72 LOAD_CONST 20 (41)75 LOAD_CONST 21 (120)78 LOAD_CONST 22 (60)81 LOAD_CONST 23 (106)84 LOAD_CONST 24 (51)87 LOAD_CONST 6 (101)90 LOAD_CONST 25 (178)93 LOAD_CONST 26 (189)96 LOAD_CONST 6 (101)99 LOAD_CONST 27 (48)102 BUILD_LIST 26 #列表105 STORE_NAME 1 (output)7 108 LOAD_CONST 28 ('welcome to GWHT2020')111 PRINT_ITEM 112 PRINT_NEWLINE 9 113 LOAD_NAME 2 (raw_input)116 LOAD_CONST 29 ('please input your flag:')119 CALL_FUNCTION 1122 STORE_NAME 3 (flag)10 125 LOAD_NAME 3 (flag)128 STORE_NAME 4 (str)12 131 LOAD_NAME 5 (len)134 LOAD_NAME 4 (str)137 CALL_FUNCTION 1140 STORE_NAME 6 (a)13 143 LOAD_NAME 6 (a)146 LOAD_CONST 30 (38)149 COMPARE_OP 0 (<) #if判断152 POP_JUMP_IF_FALSE 173 #失败跳转到偏移173处14 155 LOAD_CONST 31 ('lenth wrong!')158 PRINT_ITEM 159 PRINT_NEWLINE 15 160 LOAD_NAME 7 (exit)163 LOAD_CONST 32 (0) 166 CALL_FUNCTION 1169 POP_TOP 170 JUMP_FORWARD 0 (to 173)17 >> 173 LOAD_NAME 8 (ord)176 LOAD_NAME 4 (str)179 LOAD_CONST 32 (0)182 BINARY_SUBSCR #访问元素183 CALL_FUNCTION 1186 LOAD_CONST 33 (2020)189 BINARY_MULTIPLY 190 LOAD_NAME 8 (ord)193 LOAD_NAME 4 (str)196 LOAD_CONST 34 (1)199 BINARY_SUBSCR 200 CALL_FUNCTION 1203 BINARY_ADD 204 LOAD_CONST 33 (2020)207 BINARY_MULTIPLY #乘运算208 LOAD_NAME 8 (ord)211 LOAD_NAME 4 (str)214 LOAD_CONST 35 (2)217 BINARY_SUBSCR 218 CALL_FUNCTION 1221 BINARY_ADD #加运算222 LOAD_CONST 33 (2020)225 BINARY_MULTIPLY 226 LOAD_NAME 8 (ord)229 LOAD_NAME 4 (str)232 LOAD_CONST 0 (3)235 BINARY_SUBSCR 236 CALL_FUNCTION 1239 BINARY_ADD 240 LOAD_CONST 33 (2020)243 BINARY_MULTIPLY 244 LOAD_NAME 8 (ord)247 LOAD_NAME 4 (str)250 LOAD_CONST 36 (4)253 BINARY_SUBSCR 254 CALL_FUNCTION 1257 BINARY_ADD 258 LOAD_CONST 37 (1182843538814603)261 COMPARE_OP 2 (==) #if判断264 POP_JUMP_IF_FALSE 27518 267 LOAD_CONST 38 ('good!continue\xe2\x80\xa6\xe2\x80\xa6')270 PRINT_ITEM 271 PRINT_NEWLINE 272 JUMP_FORWARD 15 (to 290)20 >> 275 LOAD_CONST 39 ('bye~')278 PRINT_ITEM 279 PRINT_NEWLINE 21 280 LOAD_NAME 7 (exit)283 LOAD_CONST 32 (0)286 CALL_FUNCTION 1289 POP_TOP 23 >> 290 BUILD_LIST 0293 STORE_NAME 9 (x)24 296 LOAD_CONST 40 (5)299 STORE_NAME 10 (k)25 302 SETUP_LOOP 128 (to 433) #循环305 LOAD_NAME 11 (range)308 LOAD_CONST 41 (13)311 CALL_FUNCTION 1314 GET_ITER >> 315 FOR_ITER 114 (to 432)318 STORE_NAME 12 (i)26 321 LOAD_NAME 8 (ord)324 LOAD_NAME 4 (str)327 LOAD_NAME 10 (k)330 BINARY_SUBSCR 331 CALL_FUNCTION 1334 STORE_NAME 13 (b)27 337 LOAD_NAME 8 (ord)340 LOAD_NAME 4 (str)343 LOAD_NAME 10 (k)346 LOAD_CONST 34 (1)349 BINARY_ADD 350 BINARY_SUBSCR 351 CALL_FUNCTION 1354 STORE_NAME 14 (c)28 357 LOAD_NAME 14 (c)360 LOAD_NAME 0 (en)363 LOAD_NAME 12 (i)366 LOAD_CONST 4 (6)369 BINARY_MODULO 370 BINARY_SUBSCR 371 BINARY_XOR 372 STORE_NAME 15 (a11)29 375 LOAD_NAME 13 (b)378 LOAD_NAME 0 (en)381 LOAD_NAME 12 (i)384 LOAD_CONST 4 (6)387 BINARY_MODULO 388 BINARY_SUBSCR 389 BINARY_XOR 390 STORE_NAME 16 (a22)30 393 LOAD_NAME 9 (x)396 LOAD_ATTR 17 (append)399 LOAD_NAME 15 (a11)402 CALL_FUNCTION 1405 POP_TOP 31 406 LOAD_NAME 9 (x)409 LOAD_ATTR 17 (append)412 LOAD_NAME 16 (a22)415 CALL_FUNCTION 1418 POP_TOP 32 419 LOAD_NAME 10 (k)422 LOAD_CONST 35 (2)425 INPLACE_ADD 426 STORE_NAME 10 (k)429 JUMP_ABSOLUTE 315>> 432 POP_BLOCK 33 >> 433 LOAD_NAME 9 (x)436 LOAD_NAME 1 (output)439 COMPARE_OP 2 (==)442 POP_JUMP_IF_FALSE 45334 445 LOAD_CONST 38 ('good!continue\xe2\x80\xa6\xe2\x80\xa6')448 PRINT_ITEM 449 PRINT_NEWLINE 450 JUMP_FORWARD 15 (to 468)36 >> 453 LOAD_CONST 42 ('oh,you are wrong!')456 PRINT_ITEM 457 PRINT_NEWLINE 37 458 LOAD_NAME 7 (exit)461 LOAD_CONST 32 (0)464 CALL_FUNCTION 1467 POP_TOP 39 >> 468 LOAD_NAME 5 (len)471 LOAD_NAME 4 (str)474 CALL_FUNCTION 1477 STORE_NAME 18 (l)40 480 LOAD_NAME 8 (ord)483 LOAD_NAME 4 (str)486 LOAD_NAME 18 (l)489 LOAD_CONST 43 (7)492 BINARY_SUBTRACT 493 BINARY_SUBSCR 494 CALL_FUNCTION 1497 STORE_NAME 19 (a1)41 500 LOAD_NAME 8 (ord)503 LOAD_NAME 4 (str)506 LOAD_NAME 18 (l)509 LOAD_CONST 4 (6)512 BINARY_SUBTRACT 513 BINARY_SUBSCR 514 CALL_FUNCTION 1517 STORE_NAME 20 (a2)42 520 LOAD_NAME 8 (ord)523 LOAD_NAME 4 (str)526 LOAD_NAME 18 (l)529 LOAD_CONST 40 (5)532 BINARY_SUBTRACT 533 BINARY_SUBSCR 534 CALL_FUNCTION 1537 STORE_NAME 21 (a3)43 540 LOAD_NAME 8 (ord)543 LOAD_NAME 4 (str)546 LOAD_NAME 18 (l)549 LOAD_CONST 36 (4)552 BINARY_SUBTRACT 553 BINARY_SUBSCR 554 CALL_FUNCTION 1557 STORE_NAME 22 (a4)44 560 LOAD_NAME 8 (ord)563 LOAD_NAME 4 (str)566 LOAD_NAME 18 (l)569 LOAD_CONST 0 (3)572 BINARY_SUBTRACT 573 BINARY_SUBSCR 574 CALL_FUNCTION 1577 STORE_NAME 23 (a5)45 580 LOAD_NAME 8 (ord)583 LOAD_NAME 4 (str)586 LOAD_NAME 18 (l)589 LOAD_CONST 35 (2)592 BINARY_SUBTRACT 593 BINARY_SUBSCR 594 CALL_FUNCTION 1597 STORE_NAME 24 (a6)46 600 LOAD_NAME 19 (a1)603 LOAD_CONST 0 (3)606 BINARY_MULTIPLY 607 LOAD_NAME 20 (a2)610 LOAD_CONST 35 (2)613 BINARY_MULTIPLY 614 BINARY_ADD 615 LOAD_NAME 21 (a3)618 LOAD_CONST 40 (5)621 BINARY_MULTIPLY 622 BINARY_ADD 623 LOAD_CONST 44 (1003)626 COMPARE_OP 2 (==)629 POP_JUMP_IF_FALSE 80747 632 LOAD_NAME 19 (a1)635 LOAD_CONST 36 (4)638 BINARY_MULTIPLY 639 LOAD_NAME 20 (a2)642 LOAD_CONST 43 (7)645 BINARY_MULTIPLY 646 BINARY_ADD 647 LOAD_NAME 21 (a3)650 LOAD_CONST 3 (9)653 BINARY_MULTIPLY 654 BINARY_ADD 655 LOAD_CONST 45 (2013)658 COMPARE_OP 2 (==)661 POP_JUMP_IF_FALSE 80748 664 LOAD_NAME 19 (a1)667 LOAD_NAME 20 (a2)670 LOAD_CONST 46 (8)673 BINARY_MULTIPLY 674 BINARY_ADD 675 LOAD_NAME 21 (a3)678 LOAD_CONST 35 (2)681 BINARY_MULTIPLY 682 BINARY_ADD 683 LOAD_CONST 47 (1109)686 COMPARE_OP 2 (==)689 POP_JUMP_IF_FALSE 80449 692 LOAD_NAME 22 (a4)695 LOAD_CONST 0 (3)698 BINARY_MULTIPLY 699 LOAD_NAME 23 (a5)702 LOAD_CONST 35 (2)705 BINARY_MULTIPLY 706 BINARY_ADD 707 LOAD_NAME 24 (a6)710 LOAD_CONST 40 (5)713 BINARY_MULTIPLY 714 BINARY_ADD 715 LOAD_CONST 48 (671)718 COMPARE_OP 2 (==)721 POP_JUMP_IF_FALSE 80150 724 LOAD_NAME 22 (a4)727 LOAD_CONST 36 (4)730 BINARY_MULTIPLY 731 LOAD_NAME 23 (a5)734 LOAD_CONST 43 (7)737 BINARY_MULTIPLY 738 BINARY_ADD 739 LOAD_NAME 24 (a6)742 LOAD_CONST 3 (9)745 BINARY_MULTIPLY 746 BINARY_ADD 747 LOAD_CONST 49 (1252)750 COMPARE_OP 2 (==)753 POP_JUMP_IF_FALSE 79851 756 LOAD_NAME 22 (a4)759 LOAD_NAME 23 (a5)762 LOAD_CONST 46 (8)765 BINARY_MULTIPLY 766 BINARY_ADD 767 LOAD_NAME 24 (a6)770 LOAD_CONST 35 (2)773 BINARY_MULTIPLY 774 BINARY_ADD #加运算775 LOAD_CONST 50 (644)778 COMPARE_OP 2 (==) #if判断781 POP_JUMP_IF_FALSE 79552 784 LOAD_CONST 51 ('congraduation!you get the right flag!')787 PRINT_ITEM 788 PRINT_NEWLINE 789 JUMP_ABSOLUTE 795792 JUMP_ABSOLUTE 798>> 795 JUMP_ABSOLUTE 801>> 798 JUMP_ABSOLUTE 804>> 801 JUMP_ABSOLUTE 807>> 804 JUMP_FORWARD 0 (to 807)>> 807 LOAD_CONST 52 (None)810 RETURN_VALUE 还原后(这道题盯了快1h...)：
en = [3,37,72,9,6,132]
output = [101,96,23,68,112,42,107,62,96,53,176,179,98,53,67,29,41,120,60,106,51,101,178,189,101,48]
print('welcome to GWHT2020')
flag = raw_input('please input your flag:')
str = flag
a = len(str)
if a<38:print('lenth wrong!')exit(0)
if((((ord(str[1])+2020*ord(str[0]))*2020+ord(str[2]))*2020+ord(str[3]))*2020+ord(str[4])!=1182843538814603):print('bye~')exit(0)
x=[]
k=5
for i in range(13):b=ord(str[k])c=ord(str[k+1])a11=c^en[i%6]a22=b^en[i%6]x.append(a11)x.append(a22)k+=2
if x!=output:print('oh,you are wrong!')exit(0)
l=len(str)
a1=ord(str[l-7])
a2=ord(str[l-6])
a3=ord(str[l-5])
a4=ord(str[l-4])
a5=ord(str[l-3])
a6=ord(str[l-2])
if(a1*3+a2*2+a3*5==1003):if(a1*4+a2*7+a3*9==2013):if(a1+a2*8+a3*2==1109):if(a4*3+a5*2+a6*5==671):if(a4*4+a5*7+a6*9==1252):if(a4+a5*8+a6*2==644):print('congraduation!you get the right flag!')
因为这题有很多未知解，所以很容易想到用z3约束器。
代码如下
from z3 import *
en = [3,37,72,9,6,132]
output = [101,96,23,68,112,42,107,62,96,53,176,179,98,53,67,29,41,120,60,106,51,101,178,189,101,48]
flag=''
s=Solver()
a1=Int('a1')
a2=Int('a2')
a3=Int('a3')
a4=Int('a4')
a5=Int('a5')
a6=Int('a6')
s.add(a1*3+a2*2+a3*5==1003)
s.add(a1*4+a2*7+a3*9==2013)
s.add(a1+a2*8+a3*2==1109)
s.add(a4*3+a5*2+a6*5==671)
s.add(a4*4+a5*7+a6*9==1252)
s.add(a4+a5*8+a6*2==644)
if s.check()==sat:print(s.model())
k=0
for i in range(13):flag+=chr(output[k+1]^en[i%6])flag+=chr(output[k]^en[i%6])k=k+2
s = [97,101,102,102,55,51]
for i in range(6):flag+=chr(s[i])
print(flag)#cfa2b87b3f746a8f0ac5c5963faeff73