[Reverse]picturelock-mingo
题目是一个apk，功能是对图片进行加密，而在这题中要做的就是对加密(lock）的图片进行解密。
打开发现主要的加密部分在libnative.so里，
函数为enc()，参数有输入文件名，输出文件名以及密钥key，key为签名md5值，动态调试得到“f8c49056e4ccf9a11e090eaf471f418d”；
跟踪发现enc函数用了AES的s_box，猜测与aes有关，但仔细查看发现有区别。关键函数有如下几个：
主要需要对以上几个函数逆向，bytexor（）直接再次加密就可以逆回去，singletable（）与aes的单表置换有关，使用aes的inv_s_box表逆回去，
substitution()也是置换，反置换回去。做的时候遇到些问题主要卡在sub_162c上了，但是之后发现对这个函数逆向只要再加密3次就还原了（1+3
共4次加密回到原输入）。
所以对这几个函数逆向有：
解密lock图片有：
贴上代码如下：
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "cdefs.h"
BYTE byte_36E4[] = { 0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B
,0xFE,0xD7,0xAB,0x76,0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF
,0x9C,0xA4,0x72,0xC0,0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1
,0x71,0xD8,0x31,0x15,0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2
,0xEB,0x27,0xB2,0x75,0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3
,0x29,0xE3,0x2F,0x84,0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39
,0x4A,0x4C,0x58,0xCF,0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F
,0x50,0x3C,0x9F,0xA8,0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21
,0x10,0xFF,0xF3,0xD2,0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D
,0x64,0x5D,0x19,0x73,0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14
,0xDE,0x5E,0x0B,0xDB,0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62
,0x91,0x95,0xE4,0x79,0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA
,0x65,0x7A,0xAE,0x08,0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F
,0x4B,0xBD,0x8B,0x8A,0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9
,0x86,0xC1,0x1D,0x9E,0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9
,0xCE,0x55,0x28,0xDF,0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F
,0xB0,0x54,0xBB,0x16 };
BYTE byte_3920[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x09, 0x0B, 0x0D, 0x0E, 0x04, 0x06, 0x12, 0x16,
0x1A, 0x1C, 0x06, 0x05, 0x1B, 0x1D, 0x17, 0x12, 0x08, 0x0C, 0x24, 0x2C, 0x34, 0x38, 0x0A, 0x0F,
0x2D, 0x27, 0x39, 0x36, 0x0C, 0x0A, 0x36, 0x3A, 0x2E, 0x24, 0x0E, 0x09, 0x3F, 0x31, 0x23, 0x2A,
0x10, 0x18, 0x48, 0x58, 0x68, 0x70, 0x12, 0x1B, 0x41, 0x53, 0x65, 0x7E, 0x14, 0x1E, 0x5A, 0x4E,
0x72, 0x6C, 0x16, 0x1D, 0x53, 0x45, 0x7F, 0x62, 0x18, 0x14, 0x6C, 0x74, 0x5C, 0x48, 0x1A, 0x17,
0x65, 0x7F, 0x51, 0x46, 0x1C, 0x12, 0x7E, 0x62, 0x46, 0x54, 0x1E, 0x11, 0x77, 0x69, 0x4B, 0x5A,
0x20, 0x30, 0x90, 0xB0, 0xD0, 0xE0, 0x22, 0x33, 0x99, 0xBB, 0xDD, 0xEE, 0x24, 0x36, 0x82, 0xA6,
0xCA, 0xFC, 0x26, 0x35, 0x8B, 0xAD, 0xC7, 0xF2, 0x28, 0x3C, 0xB4, 0x9C, 0xE4, 0xD8, 0x2A, 0x3F,
0xBD, 0x97, 0xE9, 0xD6, 0x2C, 0x3A, 0xA6, 0x8A, 0xFE, 0xC4, 0x2E, 0x39, 0xAF, 0x81, 0xF3, 0xCA,
0x30, 0x28, 0xD8, 0xE8, 0xB8, 0x90, 0x32, 0x2B, 0xD1, 0xE3, 0xB5, 0x9E, 0x34, 0x2E, 0xCA, 0xFE,
0xA2, 0x8C, 0x36, 0x2D, 0xC3, 0xF5, 0xAF, 0x82, 0x38, 0x24, 0xFC, 0xC4, 0x8C, 0xA8, 0x3A, 0x27,
0xF5, 0xCF, 0x81, 0xA6, 0x3C, 0x22, 0xEE, 0xD2, 0x96, 0xB4, 0x3E, 0x21, 0xE7, 0xD9, 0x9B, 0xBA,
0x40, 0x60, 0x3B, 0x7B, 0xBB, 0xDB, 0x42, 0x63, 0x32, 0x70, 0xB6, 0xD5, 0x44, 0x66, 0x29, 0x6D,
0xA1, 0xC7, 0x46, 0x65, 0x20, 0x66, 0xAC, 0xC9, 0x48, 0x6C, 0x1F, 0x57, 0x8F, 0xE3, 0x4A, 0x6F,
0x16, 0x5C, 0x82, 0xED, 0x4C, 0x6A, 0x0D, 0x41, 0x95, 0xFF, 0x4E, 0x69, 0x04, 0x4A, 0x98, 0xF1,
0x50, 0x78, 0x73, 0x23, 0xD3, 0xAB, 0x52, 0x7B, 0x7A, 0x28, 0xDE, 0xA5, 0x54, 0x7E, 0x61, 0x35,
0xC9, 0xB7, 0x56, 0x7D, 0x68, 0x3E, 0xC4, 0xB9, 0x58, 0x74, 0x57, 0x0F, 0xE7, 0x93, 0x5A, 0x77,
0x5E, 0x04, 0xEA, 0x9D, 0x5C, 0x72, 0x45, 0x19, 0xFD, 0x8F, 0x5E, 0x71, 0x4C, 0x12, 0xF0, 0x81,
0x60, 0x50, 0xAB, 0xCB, 0x6B, 0x3B, 0x62, 0x53, 0xA2, 0xC0, 0x66, 0x35, 0x64, 0x56, 0xB9, 0xDD,
0x71, 0x27, 0x66, 0x55, 0xB0, 0xD6, 0x7C, 0x29, 0x68, 0x5C, 0x8F, 0xE7, 0x5F, 0x03, 0x6A, 0x5F,
0x86, 0xEC, 0x52, 0x0D, 0x6C, 0x5A, 0x9D, 0xF1, 0x45, 0x1F, 0x6E, 0x59, 0x94, 0xFA, 0x48, 0x11,
0x70, 0x48, 0xE3, 0x93, 0x03, 0x4B, 0x72, 0x4B, 0xEA, 0x98, 0x0E, 0x45, 0x74, 0x4E, 0xF1, 0x85,
0x19, 0x57, 0x76, 0x4D, 0xF8, 0x8E, 0x14, 0x59, 0x78, 0x44, 0xC7, 0xBF, 0x37, 0x73, 0x7A, 0x47,
0xCE, 0xB4, 0x3A, 0x7D, 0x7C, 0x42, 0xD5, 0xA9, 0x2D, 0x6F, 0x7E, 0x41, 0xDC, 0xA2, 0x20, 0x61,
0x80, 0xC0, 0x76, 0xF6, 0x6D, 0xAD, 0x82, 0xC3, 0x7F, 0xFD, 0x60, 0xA3, 0x84, 0xC6, 0x64, 0xE0,
0x77, 0xB1, 0x86, 0xC5, 0x6D, 0xEB, 0x7A, 0xBF, 0x88, 0xCC, 0x52, 0xDA, 0x59, 0x95, 0x8A, 0xCF,
0x5B, 0xD1, 0x54, 0x9B, 0x8C, 0xCA, 0x40, 0xCC, 0x43, 0x89, 0x8E, 0xC9, 0x49, 0xC7, 0x4E, 0x87,
0x90, 0xD8, 0x3E, 0xAE, 0x05, 0xDD, 0x92, 0xDB, 0x37, 0xA5, 0x08, 0xD3, 0x94, 0xDE, 0x2C, 0xB8,
0x1F, 0xC1, 0x96, 0xDD, 0x25, 0xB3, 0x12, 0xCF, 0x98, 0xD4, 0x1A, 0x82, 0x31, 0xE5, 0x9A, 0xD7,
0x13, 0x89, 0x3C, 0xEB, 0x9C, 0xD2, 0x08, 0x94, 0x2B, 0xF9, 0x9E, 0xD1, 0x01, 0x9F, 0x26, 0xF7,
0xA0, 0xF0, 0xE6, 0x46, 0xBD, 0x4D, 0xA2, 0xF3, 0xEF, 0x4D, 0xB0, 0x43, 0xA4, 0xF6, 0xF4, 0x50,
0xA7, 0x51, 0xA6, 0xF5, 0xFD, 0x5B, 0xAA, 0x5F, 0xA8, 0xFC, 0xC2, 0x6A, 0x89, 0x75, 0xAA, 0xFF,
0xCB, 0x61, 0x84, 0x7B, 0xAC, 0xFA, 0xD0, 0x7C, 0x93, 0x69, 0xAE, 0xF9, 0xD9, 0x77, 0x9E, 0x67,
0xB0, 0xE8, 0xAE, 0x1E, 0xD5, 0x3D, 0xB2, 0xEB, 0xA7, 0x15, 0xD8, 0x33, 0xB4, 0xEE, 0xBC, 0x08,
0xCF, 0x21, 0xB6, 0xED, 0xB5, 0x03, 0xC2, 0x2F, 0xB8, 0xE4, 0x8A, 0x32, 0xE1, 0x05, 0xBA, 0xE7,
0x83, 0x39, 0xEC, 0x0B, 0xBC, 0xE2, 0x98, 0x24, 0xFB, 0x19, 0xBE, 0xE1, 0x91, 0x2F, 0xF6, 0x17,
0xC0, 0xA0, 0x4D, 0x8D, 0xD6, 0x76, 0xC2, 0xA3, 0x44, 0x86, 0xDB, 0x78, 0xC4, 0xA6, 0x5F, 0x9B,
0xCC, 0x6A, 0xC6, 0xA5, 0x56, 0x90, 0xC1, 0x64, 0xC8, 0xAC, 0x69, 0xA1, 0xE2, 0x4E, 0xCA, 0xAF,
0x60, 0xAA, 0xEF, 0x40, 0xCC, 0xAA, 0x7B, 0xB7, 0xF8, 0x52, 0xCE, 0xA9, 0x72, 0xBC, 0xF5, 0x5C,
0xD0, 0xB8, 0x05, 0xD5, 0xBE, 0x06, 0xD2, 0xBB, 0x0C, 0xDE, 0xB3, 0x08, 0xD4, 0xBE, 0x17, 0xC3,
0xA4, 0x1A, 0xD6, 0xBD, 0x1E, 0xC8, 0xA9, 0x14, 0xD8, 0xB4, 0x21, 0xF9, 0x8A, 0x3E, 0xDA, 0xB7,
0x28, 0xF2, 0x87, 0x30, 0xDC, 0xB2, 0x33, 0xEF, 0x90, 0x22, 0xDE, 0xB1, 0x3A, 0xE4, 0x9D, 0x2C,
0xE0, 0x90, 0xDD, 0x3D, 0x06, 0x96, 0xE2, 0x93, 0xD4, 0x36, 0x0B, 0x98, 0xE4, 0x96, 0xCF, 0x2B,
0x1C, 0x8A, 0xE6, 0x95, 0xC6, 0x20, 0x11, 0x84, 0xE8, 0x9C, 0xF9, 0x11, 0x32, 0xAE, 0xEA, 0x9F,
0xF0, 0x1A, 0x3F, 0xA0, 0xEC, 0x9A, 0xEB, 0x07, 0x28, 0xB2, 0xEE, 0x99, 0xE2, 0x0C, 0x25, 0xBC,
0xF0, 0x88, 0x95, 0x65, 0x6E, 0xE6, 0xF2, 0x8B, 0x9C, 0x6E, 0x63, 0xE8, 0xF4, 0x8E, 0x87, 0x73,
0x74, 0xFA, 0xF6, 0x8D, 0x8E, 0x78, 0x79, 0xF4, 0xF8, 0x84, 0xB1, 0x49, 0x5A, 0xDE, 0xFA, 0x87,
0xB8, 0x42, 0x57, 0xD0, 0xFC, 0x82, 0xA3, 0x5F, 0x40, 0xC2, 0xFE, 0x81, 0xAA, 0x54, 0x4D, 0xCC,
0x1B, 0x9B, 0xEC, 0xF7, 0xDA, 0x41, 0x19, 0x98, 0xE5, 0xFC, 0xD7, 0x4F, 0x1F, 0x9D, 0xFE, 0xE1,
0xC0, 0x5D, 0x1D, 0x9E, 0xF7, 0xEA, 0xCD, 0x53, 0x13, 0x97, 0xC8, 0xDB, 0xEE, 0x79, 0x11, 0x94,
0xC1, 0xD0, 0xE3, 0x77, 0x17, 0x91, 0xDA, 0xCD, 0xF4, 0x65, 0x15, 0x92, 0xD3, 0xC6, 0xF9, 0x6B,
0x0B, 0x83, 0xA4, 0xAF, 0xB2, 0x31, 0x09, 0x80, 0xAD, 0xA4, 0xBF, 0x3F, 0x0F, 0x85, 0xB6, 0xB9,
0xA8, 0x2D, 0x0D, 0x86, 0xBF, 0xB2, 0xA5, 0x23, 0x03, 0x8F, 0x80, 0x83, 0x86, 0x09, 0x01, 0x8C,
0x89, 0x88, 0x8B, 0x07, 0x07, 0x89, 0x92, 0x95, 0x9C, 0x15, 0x05, 0x8A, 0x9B, 0x9E, 0x91, 0x1B,
0x3B, 0xAB, 0x7C, 0x47, 0x0A, 0xA1, 0x39, 0xA8, 0x75, 0x4C, 0x07, 0xAF, 0x3F, 0xAD, 0x6E, 0x51,
0x10, 0xBD, 0x3D, 0xAE, 0x67, 0x5A, 0x1D, 0xB3, 0x33, 0xA7, 0x58, 0x6B, 0x3E, 0x99, 0x31, 0xA4,
0x51, 0x60, 0x33, 0x97, 0x37, 0xA1, 0x4A, 0x7D, 0x24, 0x85, 0x35, 0xA2, 0x43, 0x76, 0x29, 0x8B,
0x2B, 0xB3, 0x34, 0x1F, 0x62, 0xD1, 0x29, 0xB0, 0x3D, 0x14, 0x6F, 0xDF, 0x2F, 0xB5, 0x26, 0x09,
0x78, 0xCD, 0x2D, 0xB6, 0x2F, 0x02, 0x75, 0xC3, 0x23, 0xBF, 0x10, 0x33, 0x56, 0xE9, 0x21, 0xBC,
0x19, 0x38, 0x5B, 0xE7, 0x27, 0xB9, 0x02, 0x25, 0x4C, 0xF5, 0x25, 0xBA, 0x0B, 0x2E, 0x41, 0xFB,
0x5B, 0xFB, 0xD7, 0x8C, 0x61, 0x9A, 0x59, 0xF8, 0xDE, 0x87, 0x6C, 0x94, 0x5F, 0xFD, 0xC5, 0x9A,
0x7B, 0x86, 0x5D, 0xFE, 0xCC, 0x91, 0x76, 0x88, 0x53, 0xF7, 0xF3, 0xA0, 0x55, 0xA2, 0x51, 0xF4,
0xFA, 0xAB, 0x58, 0xAC, 0x57, 0xF1, 0xE1, 0xB6, 0x4F, 0xBE, 0x55, 0xF2, 0xE8, 0xBD, 0x42, 0xB0,
0x4B, 0xE3, 0x9F, 0xD4, 0x09, 0xEA, 0x49, 0xE0, 0x96, 0xDF, 0x04, 0xE4, 0x4F, 0xE5, 0x8D, 0xC2,
0x13, 0xF6, 0x4D, 0xE6, 0x84, 0xC9, 0x1E, 0xF8, 0x43, 0xEF, 0xBB, 0xF8, 0x3D, 0xD2, 0x41, 0xEC,
0xB2, 0xF3, 0x30, 0xDC, 0x47, 0xE9, 0xA9, 0xEE, 0x27, 0xCE, 0x45, 0xEA, 0xA0, 0xE5, 0x2A, 0xC0,
0x7B, 0xCB, 0x47, 0x3C, 0xB1, 0x7A, 0x79, 0xC8, 0x4E, 0x37, 0xBC, 0x74, 0x7F, 0xCD, 0x55, 0x2A,
0xAB, 0x66, 0x7D, 0xCE, 0x5C, 0x21, 0xA6, 0x68, 0x73, 0xC7, 0x63, 0x10, 0x85, 0x42, 0x71, 0xC4,
0x6A, 0x1B, 0x88, 0x4C, 0x77, 0xC1, 0x71, 0x06, 0x9F, 0x5E, 0x75, 0xC2, 0x78, 0x0D, 0x92, 0x50,
0x6B, 0xD3, 0x0F, 0x64, 0xD9, 0x0A, 0x69, 0xD0, 0x06, 0x6F, 0xD4, 0x04, 0x6F, 0xD5, 0x1D, 0x72,
0xC3, 0x16, 0x6D, 0xD6, 0x14, 0x79, 0xCE, 0x18, 0x63, 0xDF, 0x2B, 0x48, 0xED, 0x32, 0x61, 0xDC,
0x22, 0x43, 0xE0, 0x3C, 0x67, 0xD9, 0x39, 0x5E, 0xF7, 0x2E, 0x65, 0xDA, 0x30, 0x55, 0xFA, 0x20,
0x9B, 0x5B, 0x9A, 0x01, 0xB7, 0xEC, 0x99, 0x58, 0x93, 0x0A, 0xBA, 0xE2, 0x9F, 0x5D, 0x88, 0x17,
0xAD, 0xF0, 0x9D, 0x5E, 0x81, 0x1C, 0xA0, 0xFE, 0x93, 0x57, 0xBE, 0x2D, 0x83, 0xD4, 0x91, 0x54,
0xB7, 0x26, 0x8E, 0xDA, 0x97, 0x51, 0xAC, 0x3B, 0x99, 0xC8, 0x95, 0x52, 0xA5, 0x30, 0x94, 0xC6,
0x8B, 0x43, 0xD2, 0x59, 0xDF, 0x9C, 0x89, 0x40, 0xDB, 0x52, 0xD2, 0x92, 0x8F, 0x45, 0xC0, 0x4F,
0xC5, 0x80, 0x8D, 0x46, 0xC9, 0x44, 0xC8, 0x8E, 0x83, 0x4F, 0xF6, 0x75, 0xEB, 0xA4, 0x81, 0x4C,
0xFF, 0x7E, 0xE6, 0xAA, 0x87, 0x49, 0xE4, 0x63, 0xF1, 0xB8, 0x85, 0x4A, 0xED, 0x68, 0xFC, 0xB6,
0xBB, 0x6B, 0x0A, 0xB1, 0x67, 0x0C, 0xB9, 0x68, 0x03, 0xBA, 0x6A, 0x02, 0xBF, 0x6D, 0x18, 0xA7,
0x7D, 0x10, 0xBD, 0x6E, 0x11, 0xAC, 0x70, 0x1E, 0xB3, 0x67, 0x2E, 0x9D, 0x53, 0x34, 0xB1, 0x64,
0x27, 0x96, 0x5E, 0x3A, 0xB7, 0x61, 0x3C, 0x8B, 0x49, 0x28, 0xB5, 0x62, 0x35, 0x80, 0x44, 0x26,
0xAB, 0x73, 0x42, 0xE9, 0x0F, 0x7C, 0xA9, 0x70, 0x4B, 0xE2, 0x02, 0x72, 0xAF, 0x75, 0x50, 0xFF,
0x15, 0x60, 0xAD, 0x76, 0x59, 0xF4, 0x18, 0x6E, 0xA3, 0x7F, 0x66, 0xC5, 0x3B, 0x44, 0xA1, 0x7C,
0x6F, 0xCE, 0x36, 0x4A, 0xA7, 0x79, 0x74, 0xD3, 0x21, 0x58, 0xA5, 0x7A, 0x7D, 0xD8, 0x2C, 0x56,
0xDB, 0x3B, 0xA1, 0x7A, 0x0C, 0x37, 0xD9, 0x38, 0xA8, 0x71, 0x01, 0x39, 0xDF, 0x3D, 0xB3, 0x6C,
0x16, 0x2B, 0xDD, 0x3E, 0xBA, 0x67, 0x1B, 0x25, 0xD3, 0x37, 0x85, 0x56, 0x38, 0x0F, 0xD1, 0x34,
0x8C, 0x5D, 0x35, 0x01, 0xD7, 0x31, 0x97, 0x40, 0x22, 0x13, 0xD5, 0x32, 0x9E, 0x4B, 0x2F, 0x1D,
0xCB, 0x23, 0xE9, 0x22, 0x64, 0x47, 0xC9, 0x20, 0xE0, 0x29, 0x69, 0x49, 0xCF, 0x25, 0xFB, 0x34,
0x7E, 0x5B, 0xCD, 0x26, 0xF2, 0x3F, 0x73, 0x55, 0xC3, 0x2F, 0xCD, 0x0E, 0x50, 0x7F, 0xC1, 0x2C,
0xC4, 0x05, 0x5D, 0x71, 0xC7, 0x29, 0xDF, 0x18, 0x4A, 0x63, 0xC5, 0x2A, 0xD6, 0x13, 0x47, 0x6D,
0xFB, 0x0B, 0x31, 0xCA, 0xDC, 0xD7, 0xF9, 0x08, 0x38, 0xC1, 0xD1, 0xD9, 0xFF, 0x0D, 0x23, 0xDC,
0xC6, 0xCB, 0xFD, 0x0E, 0x2A, 0xD7, 0xCB, 0xC5, 0xF3, 0x07, 0x15, 0xE6, 0xE8, 0xEF, 0xF1, 0x04,
0x1C, 0xED, 0xE5, 0xE1, 0xF7, 0x01, 0x07, 0xF0, 0xF2, 0xF3, 0xF5, 0x02, 0x0E, 0xFB, 0xFF, 0xFD,
0xEB, 0x13, 0x79, 0x92, 0xB4, 0xA7, 0xE9, 0x10, 0x70, 0x99, 0xB9, 0xA9, 0xEF, 0x15, 0x6B, 0x84,
0xAE, 0xBB, 0xED, 0x16, 0x62, 0x8F, 0xA3, 0xB5, 0xE3, 0x1F, 0x5D, 0xBE, 0x80, 0x9F, 0xE1, 0x1C,
0x54, 0xB5, 0x8D, 0x91, 0xE7, 0x19, 0x4F, 0xA8, 0x9A, 0x83, 0xE5, 0x1A, 0x46, 0xA3, 0x97, 0x8D,
0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x08,
0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x80,
0x00, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x6C, 0x00, 0x00, 0x00, 0xD8,
0x00, 0x00, 0x00, 0xAB, 0x00, 0x00, 0x00, 0x4D, 0x00, 0x00, 0x00, 0x9A, 0x72, 0x62, 0x00, 0x77 };
char g_inv_sbox[256] = {
/* 0 1 2 3 4 5 6 7 8 9 A B C D E F */
0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
};
BYTE * bytexor(BYTE *result, int *a2)
{
int v2; // r2
int v3; // r2
int v4; // r2
int v5; // r1
v2 = *a2;
*result ^= (unsigned int)*a2 >> 24;
result[4] ^= BYTE2(v2);
result[8] ^= BYTE1(v2);
result[12] ^= v2;
v3 = a2[1];
result[1] ^= (unsigned int)v3 >> 24;//HIBYTE(v3);
result[5] ^= BYTE2(v3);
result[9] ^= BYTE1(v3);
result[13] ^= v3;
v4 = a2[2];
result[2] ^= (unsigned int)v4 >> 24;
result[6] ^= BYTE2(v4);
result[10] ^= BYTE1(v4);
result[14] ^= v4;
v5 = a2[3];
result[3] ^= (unsigned int)v5 >> 24;;
result[7] ^= BYTE2(v5);
result[11] ^= BYTE1(v5);
result[15] ^= v5;
return result;
}
_BYTE *__fastcall singletable(_BYTE *result)
{
*result = byte_36E4[(*result & 0xF0) + (*result & 0xF)]; //*result = byte_36E4[*result]
result[1] = byte_36E4[(result[1] & 0xF0) + (result[1] & 0xF)];
result[2] = byte_36E4[(result[2] & 0xF0) + (result[2] & 0xF)];
result[3] = byte_36E4[(result[3] & 0xF0) + (result[3] & 0xF)];
result[4] = byte_36E4[(result[4] & 0xF0) + (result[4] & 0xF)];
result[5] = byte_36E4[(result[5] & 0xF0) + (result[5] & 0xF)];
result[6] = byte_36E4[(result[6] & 0xF0) + (result[6] & 0xF)];
result[7] = byte_36E4[(result[7] & 0xF0) + (result[7] & 0xF)];
result[8] = byte_36E4[(result[8] & 0xF0) + (result[8] & 0xF)];
result[9] = byte_36E4[(result[9] & 0xF0) + (result[9] & 0xF)];
result[10] = byte_36E4[(result[10] & 0xF0) + (result[10] & 0xF)];
result[11] = byte_36E4[(result[11] & 0xF0) + (result[11] & 0xF)];
result[12] = byte_36E4[(result[12] & 0xF0) + (result[12] & 0xF)];
result[13] = byte_36E4[(result[13] & 0xF0) + (result[13] & 0xF)];
result[14] = byte_36E4[(result[14] & 0xF0) + (result[14] & 0xF)];
result[15] = byte_36E4[(result[15] & 0xF0) + (result[15] & 0xF)];
return result;
}
_BYTE *__fastcall inv_singletable(_BYTE *result)
{
for (int i = 0; i < 16; i++)
{
result[i] = g_inv_sbox[result[i]];
}
return result;
}
_BYTE *__fastcall substitution(_BYTE *result)
{
char v1; // r1
char v2; // r1
char v3; // r1
char v4; // r1
v1 = result[4];
result[4] = result[5];
result[5] = result[6];
result[6] = result[7];
result[7] = v1;
v2 = result[8];
result[8] = result[10];
result[10] = v2;
v3 = result[9];
result[9] = result[11];
result[11] = v3;
v4 = result[12];
result[12] = result[15];
result[15] = result[14];
result[14] = result[13];
result[13] = v4;
return result;
}
_BYTE *__fastcall inv_substitution(_BYTE *result)
{
char v1; // r1
char v2; // r1
char v3; // r1
char v4; // r1
v1 = result[4];
result[4] = result[7];
result[7] = result[6];
result[6] = result[5];
result[5] = v1;
v2 = result[8];
result[8] = result[10];
result[10] = v2;
v3 = result[9];
result[9] = result[11];
result[11] = v3;
v4 = result[12];
result[12] = result[13];
result[13] = result[14];
result[14] = result[15];
result[15] = v4;
return result;
}
unsigned __int8 *__fastcall sub_162C(unsigned __int8 *result)
{
int v1; // r2
int v2; // r3
int v3; // lr
int v4; // r12
char v5; // r10
char v6; // r9
char v7; // r6
char v8; // r4
char v9; // r5
int v10; // r6
int v11; // r7
int v12; // r8
int v13; // r3
char v14; // r9
char v15; // r11
char v16; // r10
int v17; // r6
int v18; // r7
int v19; // r8
int v20; // r3
char v21; // r9
char v22; // r11
char v23; // r10
int v24; // r6
int v25; // r7
int v26; // r2
int v27; // r3
char v28; // r9
char v29; // r10
v1 = *result;
v2 = result[12];
v3 = result[8];
v4 = result[4];
v5 = byte_3920[6 * v1 + 1];
v6 = byte_3920[6 * v2];
v7 = v2 ^ v3 ^ byte_3920[6 * v1];
v8 = byte_3920[6 * v3 + 1];
v9 = byte_3920[6 * v4] ^ v1;
LOBYTE(v1) = v1 ^ v4 ^ byte_3920[6 * v3] ^ byte_3920[6 * v2 + 1];
*result = v7 ^ byte_3920[6 * v4 + 1];
result[4] = v2 ^ v9 ^ v8;
result[8] = v1;
result[12] = v3 ^ v4 ^ v5 ^ v6;
v10 = result[13];
v11 = result[1];
v12 = result[5];
v13 = result[9];
v14 = byte_3920[6 * v10];
v15 = byte_3920[6 * v10 + 1];
v16 = byte_3920[6 * v11 + 1];
LOBYTE(v3) = byte_3920[6 * v12];
LOBYTE(v4) = byte_3920[6 * v13];
result[1] = byte_3920[6 * v12 + 1] ^ v10 ^ v13 ^ byte_3920[6 * v11];
result[5] = v3 ^ v11 ^ v10 ^ byte_3920[6 * v13 + 1];
result[9] = v12 ^ v11 ^ v4 ^ v15;
result[13] = v13 ^ v12 ^ v16 ^ v14;
v17 = result[14];
v18 = result[2];
v19 = result[6];
v20 = result[10];
v21 = byte_3920[6 * v17];
v22 = byte_3920[6 * v17 + 1];
v23 = byte_3920[6 * v18 + 1];
LOBYTE(v3) = byte_3920[6 * v19];
LOBYTE(v4) = byte_3920[6 * v20];
result[2] = byte_3920[6 * v19 + 1] ^ v17 ^ v20 ^ byte_3920[6 * v18];
result[6] = v3 ^ v18 ^ v17 ^ byte_3920[6 * v20 + 1];
result[10] = v19 ^ v18 ^ v4 ^ v22;
result[14] = v20 ^ v19 ^ v23 ^ v21;
v24 = result[15];
v25 = result[3];
v26 = result[7];
v27 = result[11];
LOBYTE(v3) = byte_3920[6 * v24];
v28 = byte_3920[6 * v24 + 1];
LOBYTE(v19) = byte_3920[6 * v25 + 1];
result[3] = byte_3920[6 * v25] ^ v24 ^ v27 ^ byte_3920[6 * v26 + 1];
v29 = byte_3920[6 * v27];
result[7] = byte_3920[6 * v26] ^ v25 ^ v24 ^ byte_3920[6 * v27 + 1];
result[11] = v26 ^ v25 ^ v29 ^ v28;
result[15] = v27 ^ v26 ^ v19 ^ v3;
return result;
}
unsigned __int8 *__fastcall inv_sub_162C(unsigned __int8 *result)
{
for (int i = 0; i < 3; i++)
{
sub_162C(result);
}
return result;
}
int main()
{
BYTE v24, *v2, *v3, v25;
char *v27; // r0
int v28; // r8
char str1[] = { 0x34, 0x63, 0x38, 0x66, 0x36, 0x35, 0x30, 0x39, 0x63, 0x63, 0x34, 0x65, 0x31, 0x61, 0x39, 0x66,
0x07, 0xA4, 0xD7, 0x75, 0x31, 0x91, 0xE7, 0x4C, 0x52, 0xF2, 0xD3, 0x29, 0x63, 0x93, 0xEA, 0x4F,
0x83, 0x5F, 0x0B, 0xF0, 0xB2, 0xCE, 0xEC, 0xBC, 0xE0, 0x3C, 0x3F, 0x95, 0x83, 0xAF, 0xD5, 0xDA,
0xD4, 0xB3, 0x72, 0xF7, 0x66, 0x7D, 0x9E, 0x4B, 0x86, 0x41, 0xA1, 0xDE, 0x05, 0xEE, 0x74, 0x04,
0x26, 0xD8, 0x5A, 0x6D, 0x40, 0xA5, 0xC4, 0x26, 0xC6, 0xE4, 0x65, 0xF8, 0xC3, 0x0A, 0x11, 0xFC,
0x96, 0xF6, 0x3D, 0xFF, 0xD6, 0x53, 0xF9, 0xD9, 0x10, 0xB7, 0x9C, 0x21, 0xD3, 0xBD, 0x8D, 0xDD,
0x57, 0x90, 0x47, 0x82, 0x81, 0xC3, 0xBE, 0x5B, 0x91, 0x74, 0x22, 0x7A, 0x42, 0xC9, 0xAF, 0xA7,
0x0B, 0xBC, 0x9A, 0xBB, 0x8A, 0x7F, 0x24, 0xE0, 0x1B, 0x0B, 0x06, 0x9A, 0x59, 0xC2, 0xA9, 0x3D,
0x2C, 0x77, 0xBF, 0xE8, 0xA6, 0x08, 0x9B, 0x08, 0xBD, 0x03, 0x9D, 0x92, 0xE4, 0xC1, 0x34, 0xAF,
0x55, 0x1E, 0xC7, 0xEB, 0xF3, 0x16, 0x5C, 0xE3, 0x4E, 0x15, 0xC1, 0x71, 0xAA, 0xD4, 0xF5, 0xDE,
0x48, 0xB2, 0x8F, 0x3B, 0xBB, 0xA4, 0xD3, 0xD8, 0xF5, 0xB1, 0x12, 0xA9, 0x5F, 0x65, 0xE7, 0x77,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x39, 0x30, 0x65, 0x31, 0x66, 0x61, 0x65, 0x30, 0x66, 0x31, 0x37, 0x34, 0x64, 0x38, 0x31, 0x34,
0x21, 0x73, 0x62, 0xF7, 0x47, 0x12, 0x07, 0xC7, 0x21, 0x23, 0x30, 0xF3, 0x45, 0x1B, 0x01, 0xC7,
0xE7, 0x1D, 0xCD, 0x89, 0xA0, 0x0F, 0xCA, 0x4E, 0x81, 0x2C, 0xFA, 0xBD, 0xC4, 0x37, 0xFB, 0x7A,
0x3D, 0x01, 0x57, 0x82, 0x9D, 0x0E, 0x9D, 0xCC, 0x1C, 0x22, 0x67, 0x71, 0xD8, 0x15, 0x9C, 0x0B,
0x16, 0x60, 0x0E, 0x54, 0x8B, 0x6E, 0x93, 0x98, 0x97, 0x4C, 0xF4, 0xE9, 0x4F, 0x59, 0x68, 0xE2,
0x8E, 0xE4, 0xC5, 0x01, 0x05, 0x8A, 0x56, 0x99, 0x92, 0xC6, 0xA2, 0x70, 0xDD, 0x9F, 0xCA, 0x92,
0xC1, 0x25, 0x1E, 0x55, 0xC4, 0xAF, 0x48, 0xCC, 0x56, 0x69, 0xEA, 0xBC, 0x8B, 0xF6, 0x20, 0x2E,
0xF0, 0x18, 0x5C, 0xA2, 0x34, 0xB7, 0x14, 0x6E, 0x62, 0xDE, 0xFE, 0xD2, 0xE9, 0x28, 0xDE, 0xFC,
0x40, 0x06, 0x68, 0x3F, 0x74, 0xB1, 0x7C, 0x51, 0x16, 0x6F, 0x82, 0x83, 0xFF, 0x47, 0x5C, 0x7F,
0x92, 0x10, 0xC8, 0x6E, 0xE6, 0xA1, 0xB4, 0x3F, 0xF0, 0xCE, 0x36, 0xBC, 0x0F, 0x89, 0x6A, 0xC3,
0xBC, 0x66, 0x6F, 0x5A, 0x5A, 0xC7, 0xDB, 0x65, 0xAA, 0x09, 0xED, 0xD9, 0xA5, 0x80, 0x87, 0x1A };
char *str2 = &str1[0xc0];
char *pstr1 = str1;
char **v29;
int *v30;
int v31;
char *v32;
FILE *input = fopen("flag.jpg.lock", "rb");
FILE *output = fopen("flag.jpg", "wb");
char pmd5key[] = "f8c49056e4ccf9a11e090eaf471f418d";
if (input&&output)
{
v3 = (char *)malloc(0x100u);
memset(v3, 0, 0x100);
v2 = (char *)malloc(0x100u);
for (int i = 0; ; ++i)
{
v24 = *(_BYTE *)(pmd5key + (i & 0x1F));
v25 = fread(v3, 1u, *(unsigned __int8 *)(pmd5key + (i & 0x1F)), input);
if (!v25)
{
fclose(input);
fclose(output);
return 0;
}
if (v25 <= 0xF)
{
v27 = &v3[v25];
v28 = 16 - (v25 & 0xF);
if ((v25 & 0xF) != 16)
{
memset(v27, 16 - (v25 & 0xF), (unsigned __int8)v28);
v27 = &v3[v28 + v25];
}
v25 = 16;
*v27 = 0;
}
v29 = &str2;
if (!(v24 & 1))
v29 = &pstr1;
v30 = (int *)*v29;
v2[0] = v3[0];
v2[4] = v3[1];
v2[8] = v3[2];
v2[12] = v3[3];
v2[1] = v3[4];
v2[5] = v3[5];
v2[9] = v3[6];
v2[13] = v3[7];
v2[2] = v3[8];
v2[6] = v3[9];
v2[10] = v3[10];
v2[14] = v3[11];
v2[3] = v3[12];
v2[7] = v3[13];
v2[11] = v3[14];
v2[15] = v3[15];
bytexor(v2, v30 + 40);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 36);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 32);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 28);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 24);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 20);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 16);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 12);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 8);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 4);
inv_sub_162C((unsigned __int8 *)v2);
inv_substitution((uint8 *)v2);
inv_singletable((uint8 *)v2);
bytexor(v2, v30 + 0);
*v3 = v2[0];
v3[1] = v2[4];
v3[2] = v2[8];
v3[3] = v2[12];
v3[4] = v2[1];
v3[5] = v2[5];
v3[6] = v2[9];
v3[7] = v2[13];
v3[8] = v2[2];
v3[9] = v2[6];
v3[10] = v2[10];
v3[11] = v2[14];
v3[12] = v2[3];
v3[13] = v2[7];
v3[14] = v2[11];
v3[15] = v2[15];
if (v25 >= 0x11)
{
v31 = 16;
v32 = pmd5key;
do
{
v3[v31] = v3[v31] ^ *(_BYTE *)(v32 + v31 % 32);
++v31;
} while (v31 < v25);
}
if (fwrite(v3, 1u, v25, output) != v25)
break;
}
}
return 0;
}
打赏还是打残，这是个问题
没有帐号? 立即注册