#include<stdio.h>
#include<string.h>
#define _DWORD int
int main()
{
	int result;
	char a1[100];
	scanf("%s",a1);
	char a2[100];
	char byte_202010[]={0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x61,0x62, 0x63, 0x64, 0x65, 0x66};
  int v3; // [rsp+18h] [rbp-18h]
  int i; // [rsp+1Ch] [rbp-14h]

  v3 = 0;
  for ( i = 0; ; i += 2 )
  {
    result = strlen(a1);
    if ( v3 >= result )
      break;
    a2[i] = byte_202010[a1[v3] >> 4];
    a2[i+1]= byte_202010[a1[v3++] & 0xF];
  }   
  printf("%s",a2);
}

__gmpz_init_set_str(v7, "ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35", 16LL);//用来与运算结果比较，应该是密文C
 __gmpz_init_set_str(v6, v9, 16LL);//明文M
 __gmpz_init_set_str(v4, "103461035900816914121390101299049044413950405173712170434161686539878160984549", 10LL);//公共模数N
 __gmpz_init_set_str(v5, "65537", 10LL);//公钥E
 __gmpz_powm(v6, v6, v5, v4);//M^E%N

import  gmpy2
c=0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35
n=103461035900816914121390101299049044413950405173712170434161686539878160984549
p=282164587459512124844245113950593348271
q=366669102002966856876605669837014229419
e=65537
d=gmpy2.invert(e,(p-1)*(q-1))
m = gmpy2.powmod(c,d,n)
print(m)
#185534734614696481020381637136165435809958101675798337848243069

state=p.factory.blank_state(addr=0x4007E8)

p = angr.Project("r100",auto_load_libs=False)

p.hook_symbol('printf',angr.SIM_PROCEDURES['stubs']['ReturnUnconstrained'](),replace=True)

class my_fgets(angr.SimProcedure):
    def run(self,s,num,f):
        simfd=self.state.posix.get_fd(0)
        data,real_size=simfd.read_data(12)
        self.state.memory.store(s,data)
        return 12
p.hook_symbol('fgets',my_fgets(),replace=True)

import angr
p=angr.Project("baby-re")
s=p.factory.simulation_manager(p.factory.full_init_state())
s.one_active.options.add(angr.options.LAZY_SOLVES)
s.explore(find=0x40292C,avoid=0x402941)
print(s.found[0].posix.dumps(0))

#!/usr/bin/env python2
from __future__ import print_function

# Authors: David Manouchehri <manouchehri@protonmail.com>
#          P1kachu <p1kachu@lse.epita.fr>
#          Audrey Dutcher <audrey@rhelmot.io>
# DEFCON CTF Qualifier 2016
# Challenge: baby-re
# Write-up: http://hack.carleton.team/2016/05/21/defcon-ctf-qualifier-2016-baby-re/
# Runtime: ~15 seconds (thanks lazy solves!)

import angr
import claripy

def main():
    proj = angr.Project('./baby-re', auto_load_libs=False)

    # let's provide the exact variables received through the scanf so we don't have to worry about parsing stdin into a bunch of ints.
    flag_chars = [claripy.BVS('flag_%d' % i, 32) for i in range(13)]
    class my_scanf(angr.SimProcedure):
        def run(self, fmt, ptr): # pylint: disable=arguments-differ,unused-argument
            self.state.mem[ptr].dword = flag_chars[self.state.globals['scanf_count']]
            self.state.globals['scanf_count'] += 1

    proj.hook_symbol('__isoc99_scanf', my_scanf(), replace=True)

    sm = proj.factory.simulation_manager()
    sm.one_active.options.add(angr.options.LAZY_SOLVES)
    sm.one_active.globals['scanf_count'] = 0

    # search for just before the printf("%c%c...")
    # If we get to 0x402941, "Wrong" is going to be printed out, so definitely avoid that.
    sm.explore(find=0x4028E9, avoid=0x402941)

    # evaluate each of the flag chars against the constraints on the found state to construct the flag
    flag = ''.join(chr(sm.one_found.solver.eval(c)) for c in flag_chars)
    return flag

def test():
    assert main() == 'Math is hard!'

if __name__ == '__main__':
    print(main())

import angr

def main():
    p = angr.Project("r100")
    simgr = p.factory.simulation_manager(p.factory.full_init_state())
    simgr.explore(find=0x400844, avoid=0x400855)

    return simgr.found[0].posix.dumps(0).strip(b'\0\n')

def test():
    assert main().startswith(b'Code_Talkers')

if __name__ == '__main__':
    print(main())

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
   } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; 

    WORD    Machine; //运行平台
    WORD    NumberOfSections; //文件区块数
    DWORD   TimeDateStamp; //创建的日期时间
    DWORD   PointerToSymbolTable; //指向符号表
    DWORD   NumberOfSymbols; //符号表中符号个数
    WORD    SizeOfOptionalHeader; //紧随其后的可选头的大小
    WORD    Characteristics; //文件属性
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

typedef struct _IMAGE_OPTIONAL_HEADER {
    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint; //文件被执行时入口RVA地址
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    DWORD   ImageBase; //文件优先装入地址
    DWORD   SectionAlignment; //节在内存中对齐单位
    DWORD   FileAlignment; //节存储在磁盘文件中对齐单位
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem; //子系统 
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; //数据目录表
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]
#define IMAGE_DIRECTORY_ENTRY_EXPORT      0    //导出表
#define IMAGE_DIRECTORY_ENTRY_IMPORT      1    //导入表
#define IMAGE_DIRECTORY_ENTRY_RESOURCE    2    //资源
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION   3    //异常
#define IMAGE_DIRECTORY_ENTRY_SECURITY    4    //安全
#define IMAGE_DIRECTORY_ENTRY_BASERELOC   5    //重定位表
#define IMAGE_DIRECTORY_ENTRY_DEBUG       6    //调试信息
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7   //版权信息
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR   8  //RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS         9  //TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_IMPORT 10 //Lood Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 //Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT          12  //导入函数地址表
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT  13  //Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 //COM Runtime descriptor

  typedef struct _IMAGE_SECTION_HEADER {
  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME]; //节表名称
  union {
    DWORD PhysicalAddress; //物理地址
    DWORD VirtualSize; //区块的大小(没对齐的实际大小)
  } Misc;
  DWORD VirtualAddress; //装载到内存中的RVA，是SectionAlignment的整数倍
  DWORD SizeOfRawData; //在磁盘中占的大小
  DWORD PointerToRawData; //在磁盘中的偏移地址(从文件头开始)
  DWORD PointerToRelocations;
  DWORD PointerToLinenumbers;
  WORD  NumberOfRelocations;
  WORD  NumberOfLinenumbers;
  DWORD Characteristics; //区块的属性
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

void rc4_init(unsigned char *s, unsigned char *key, unsigned long Len) //初始化函数
{
    int i =0, j = 0;
    char k[256] = {0};
    unsigned char tmp = 0;
    for (i=0;i<256;i++) {
        s[i] = i;
        k[i] = key[i%Len];
    }
    for (i=0; i<256; i++) {
        j=(j+s[i]+k[i])%256;
        tmp = s[i];
        s[i] = s[j]; //交换s[i]和s[j]
        s[j] = tmp;
    }
 } //密钥调度算法，用0-255初始化数组S，然后用密钥进行替换

void rc4_crypt(unsigned char *s, unsigned char *Data, unsigned long Len) //加解密
{
    int i = 0, j = 0, t = 0;
    unsigned long k = 0;
    unsigned char tmp;
    for(k=0;k<Len;k++) {
        i=(i+1)%256;
        j=(j+s[i])%256;
        tmp = s[i];
        s[i] = s[j]; //交换s[x]和s[y]
        s[j] = tmp;
        t=(s[i]+s[j])%256; 
        Data[k] ^= s[t];
     } //对每个S[i]根据当前的值与S中的另一元素替换，得到的密钥流与明文进行异或操作
}

from Crypto.Cipher import ARC4
from binascii import b2a_hex, a2b_hex
def myRC4(data,key):
 rc41 = ARC4.new(key)
 encrypted = rc41.encrypt(data)
 return encrypted.encode('hex')
def rc4_decrpt_hex(data,key):
  rc41=ARC4.new(key)S
  return rc41.decrypt(a2b_hex(data))
key=''
data=r''
print myRC4(data,key)
print rc4_decrpt_hex('e79aaf7a42d9a1',key)

from hashlib import md5
from Crypto.Cipher import AES
from binascii import b2a_hex

name=b'tipsy'
md5_digest=md5(name).digest()
aes=AES.new(key=b'\x2B\x7E\x15\x16\x28\xAE\xD2\xA6\xAB\xF7\x15\x88\x09\xCF\x4F\x3C',mode=AES.MODE_ECB)
decrypt=aes.decrypt(md5_digest)
print(b2a_hex(decrypt).decode().upper())