• happy_mota
• Patternlock

happy_mota

先玩遊戲，玩兩局發現魔王很難打，通過npc對話發現flag被分成四段，並且玩到第11層的時候對話中有提示：11-19層的牆壁有點奇怪，發現第一串flag是TSCTF{enj。

有了玩遊戲的基礎，發現flag都隱藏在NPC對話中，用pyinstxtractor.py反編譯main.exe得到main.py，但是main函式中的字串經過decode後發現都是操作相關，並不涉及於NPC的對話，於是先扒檔案，在\happy_mota\main\scripts目錄下找到人物對話原始碼，發現三段可疑程式碼：

s = b''
f2 = self.parameter['2wsxdr5']
for i in range(len(f2)):
	s += bytes([f2[i] ^ i ^ 0xC8])
self.conversation_control.print_word("商人L3m0nade", "爽快！我這兒撿了個字串:\"" + s.decode() + '\"你看有沒有用.',"npc_2")
 

s = b''
f3 = self.parameter['3edcft6']
for i in range(len(f3)):
    s += bytes([f3[i] ^ i ^ 0xB4])
self.parameter['answer3'] = s.decode()

s = b''
f4 = self.parameter['4rfvgy7']
for i in range(len(f4)):
    s += bytes([(f4[i] ^ (len(f4) - i) ^ 0xA9)])
self.parameter['answer4'] = s.decode()

一開始以為f2,f3,f4就是2wsxdr5,3edcft6,4rfvgy7,搞了很久，最後才發現應該只是類似於C++STL庫中的map對映，翻了翻人物對話發現找不到這個對映，於是回到main函式：

'2wsxdr5': b'\xf8\xb0\x95\xfc\x84\x88',
'3edcft6': b'\xeb\xe7\x85\xe1\xd5\xc3\x87\xd6\x85\xdc\xd3\xda\x9e',
'4rfvgy7': b'\xee\x97\xd4\xcc\xe7\x91\xf7\xd4\x92\xdc\xe3\xc5\xcb\xcf\x8a\xd5',
'answer2': '',
'answer3': '',
'answer4': '',

然後寫exp得到後三段flag：

#include<iostream>
using namespace std;
char s2[6];
char s3[13];
char s4[16];
int f2[6] = {0xf8,0xb0,0x95,0xfc,0x84,0x88};
int f3[13] = {0xeb,0xe7,0x85,0xe1,0xd5,0xc3,0x87,0xd6,0x85,0xdc,0xd3,0xda,0x9e};
int f4[16] = {0xee,0x97,0xd4,0xcc,0xe7,0x91,0xf7,0xd4,0x92,0xdc,0xe3,0xc5,0xcb,0xcf,0x8a,0xd5};
int main()
{
	for(int i=0;i<6;i++)s2[i] = f2[i] ^ i ^ 0xC8,cout<<s2[i];
	for(int i=0;i<13;i++)s3[i] = f3[i] ^ i ^ 0xB4,cout<<s3[i];
	for(int i=0;i<16;i++)s4[i] = f4[i] ^ (16 - i) ^ 0xA9,cout<<s4[i];
}
 

最後合併一下得到完整flag：TSCTF{enj0y_7HE_R3Ver5e9ame&W1shB3Tt3rLife!}

Patternlock

#include<bits/stdc++.h>
using namespace std;

char v9[] = "cig`o";
char v11[] = "(Mhbrd)kigm$_y|f~v):N";
char a[] = "\r<6\x12)G^VfIDjDX";
char TSCTF[] = "TSCTF2022!!!!!";
char key[50];
char inputbytes[50];
int cmp[40] = {97, 14, 20, 35, 10, 68, 11, 86, 55, 91, 4, 42, 4, 76, 107, 89, 68, 32, 95, 77, 15, 6, 55, 9, 86, 47, 87, 26, 109, 86, 68, 116, 11, 19, 11, 5, 54, 12, 87, 122};

int main()
{
	int v12[3];
	
	for (int i = 0; i <= 4; ++i)
		v9[i] ^= i;
    	
	for (int j = 0; j <= 20; ++j)
		v11[j] ^= j;
	cout<<v9<<endl<<v11<<endl;
	
	for(int i=0;i<=13;i++) key[i] = TSCTF[i] ^ a[i];
	cout<<key<<endl; 
		
	for(int i=0;i<40;i++) inputbytes[i] = key[i%strlen(key)] ^ cmp[i];
	cout<<inputbytes<<endl;
}