seed = 33477128523140105764301644224721378964069 a = 216636540518719887613942270143367229109002078444183475587474655399326769391 b = 186914533399403414430047931765983818420963789311681346652500920904075344361 n = 155908129777160236018105193822448288416284495517789603884888599242193844951 c = 209481865531297761516458182436122824479565806914713408748457524641378381493
for i in range(10): seed = (a*seed+b)%n plaintext=seed^c print(long_to_bytes(plaintext))
# a = 59398519837969938359106832224056187683937568250770488082448642852427682484407513407602969 # b = 32787000674666987602016858366912565306237308217749461581158833948068732710645816477126137 # n = 43520375935212094874930431059580037292338304730539718469760580887565958566208139467751467 # c = 8594514452808046357337682911504074858048299513743867887936794439125949418153561841842276
from Crypto.Util.number import * import gmpy2 a = 59398519837969938359106832224056187683937568250770488082448642852427682484407513407602969 b = 32787000674666987602016858366912565306237308217749461581158833948068732710645816477126137 n = 43520375935212094874930431059580037292338304730539718469760580887565958566208139467751467 c = 8594514452808046357337682911504074858048299513743867887936794439125949418153561841842276
ani=gmpy2.invert(a,n) seed=c for i in range(10): seed = (ani*(seed-b))%n print(long_to_bytes(seed))
from Crypto.Util.number import * def gcd(a,b): if(b==0): return a else: return gcd(b,a%b) s = [9997297986272510947766344959498975323136012075787120721424325775003840341552673589487134830298427997676238039214108, 4943092972488023184271739094993470430272327679424224016751930100362045115374960494124801675393555642497051610643836, 6774612894247319645272578624765063875876643849415903973872536662648051668240882405640569448229188596797636795502471, 9334780454901460926052785252362305555845335155501888087843525321238695716687151256717815518958670595053951084051571, 2615136943375677027346821049033296095071476608523371102901038444464314877549948107134114941301290458464611872942706, 11755491858586722647182265446253701221615594136571038555321378377363341368427070357031882725576677912630050307145062, 7752070270905673490804344757589080653234375679657568428025599872155387643476306575613147681330227562712490805492345, 8402957532602451691327737154745340793606649602871190615837661809359377788072256203797817090151599031273142680590748, 2802440081918604590502596146113670094262600952020687184659605307695151120589816943051322503094363578916773414004662, 5627226318035765837286789021891141596394835871645925685252241680021740265826179768429792645576780380635014113687982] t = [] for i in range(9): t.append(s[i]-s[i-1]) all_n = [] for i in range(7): all_n.append(gcd((t[i+1]*t[i-1]-t[i]*t[i]), (t[i+2]*t[i]-t[i+1]*t[i+1])))
MMI = lambda A, n,s=1,t=0,N=0: (n < 2 and t%N or MMI(n, A%n, t, s-A//n*t, N or n),-1)[n<1] #逆元计算 for n in all_n: n=abs(n) if n==1: continue a=(s[2]-s[1])*MMI((s[1]-s[0]),n)%n ani=MMI(a,n) b=(s[1]-a*s[0])%n seed = (ani*(s[0]-b))%n plaintext=seed print(long_to_bytes(plaintext))
lcg = LCG() lcg.output() c = b''.join([long_to_bytes(ord(flag[i]) ^ (lcg.next() % 10)) for i in range(len(flag))]) print(bytes_to_long(c)) ''' a = 3939333498 b = 3662432446 m = 2271373817 state1 = 17362 state2 = 20624 600017039001091357643174067454938198067935635401496485588306838343558125283178792619821966678282131419050878 '''
base = pow(2,32) i = pow(2,31) while i <= base: print(i) if ((alpha*i+beta)%n)>>16 == res1 and ((((alpha*i+beta)%n)*alpha+beta)%n)>>16 == res2: print('find it',i) break i+=1 #seed=2250883318
这样爆破出i
1 2 3 4 5 6 7 8
symbol = Symbol() symbol.output() flag = long_to_bytes(628427670713408045832213770914678202267468957347245535228951062583137095137644250375583786099578).decode() c = b''.join([long_to_bytes(ord(flag[i]) ^ (Symbol.next() % 10)) for i in range(len(flag))]) print(c) #NSSCTF{378f571491e6559d41ffa02e7a76653e}