XOR-Extract.cpp

(Updated: )
Pwn

# XOR-Extract.cpp

# Background (Fake)

༼ つ ◕_◕ ༽つ：众所周知，异或是一种神奇的运算规则，据不完全统计，目前已有 0xffffffffffffffff 人因为手搓 XOR 导致死亡，其中一半为脑死亡，另一半就是因为搓 XOR 搓的太猛导致手直接断了... ...
(っ °Д °;) っ： 啊？那我不是要趋势了？？？save 我啊风水大狮！！！
༼ つ ◕_◕ ༽つ：还好我有神器！送嗯你啦
༼ つ ◕_◕ ༽つ：哦对了，这里面 DLC 就是.cpp 文件，你肯定想全文背诵他的 (✿◕‿◕✿)

# Background (Real)

没啥，就是打 Pwn 的 shellcode 的时候涉及到固定范围结果的异或分解。
没啥好说的，读读源代码就知道啥意思了。
先看一下输入说明：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
akyoi@akyoi-virtual-machine:~/cac/NEUQCSA11/shellcode$ ./change
( ༼ つ ◕_◕ ༽つ ): God Wang and God Liang can Splitting a Number into Multiple Numbers XOR form WITH ONLT ONE HAND!!!But I'm so weak.
Input the number of ranges :1   //这里输入设置结果范围的个数
Input lower & upper of range 0 :3 7    //这里是每个范围的起始与结束，均是闭区间
You lower: 3 Upper: 7                  //输出一下而已

What's the max number of TEARS you want to get:4       //设定最大由几个数字异或成结果

Input number (input Decimal number,later I will output hex.):1      //输入你要拆分的数字
number: 0x1 can be teared as:  0x3 ^ 0x4 ^ 0x6    ---- equals to : 0x1     //最后输出的0x1是为了检验一下。
number: 0x1 can be teared as:  0x3 ^ 0x5 ^ 0x7    ---- equals to : 0x1
number: 0x1 can be teared as:  0x4 ^ 0x5    ---- equals to : 0x1
number: 0x1 can be teared as:  0x6 ^ 0x7    ---- equals to : 0x1

0x4 result found!!!

Input number (input Decimal,later I will output hex.): //这里接着输入就行了，这里没有退出的选项，直接Ctrl+C就退出了呗

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
#include<bits/stdc++.h>
using namespace std;
// hints,I'm serious.
#define a void
#define aa int
#define aaa bool
#define aaaa for
#define aaaaa while
#define aaaaaa cout
#define aaaaaaa cin
#define aaaaaaaa tear
#define aaaaaaaaa rang
#define aaaaaaaaaa endl
#define aaaaaaaaaaa i
#define aaaaaaaaaaaa arr
#define aaaaaaaaaaaaa return
#define aaaaaaaaaaaaaa main
#define aaaaaaaaaaaaaaa init
#define aaaaaaaaaaaaaaaa num
#define aaaaaaaaaaaaaaaaa k
#define aaaaaaaaaaaaaaaaaa low
#define aaaaaaaaaaaaaaaaaaa upp
#define aaaaaaaaaaaaaaaaaaaa floor
#define aaaaaaaaaaaaaaaaaaaaa cs
#define aaaaaaaaaaaaaaaaaaaaaa cnt
#define aaaaaaaaaaaaaaaaaaaaaaa std
#define aaaaaaaaaaaaaaaaaaaaaaaa ios
#define aaaaaaaaaaaaaaaaaaaaaaaaa sync_with_stdio
#define aaaaaaaaaaaaaaaaaaaaaaaaaa it
#define aaaaaaaaaaaaaaaaaaaaaaaaaaa cur
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaa gtj
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaa fst
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa gi
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa cac
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa hex
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa tj
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa j
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa n
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 100
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1000
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 2
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa memset
#define aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa sizeof
// #define true 0
// #define false 1

// using namespace aaaaaaaaaaaaaaaaaaaaaaa;

aa aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
aa aaaaaaaaaaaaaaaaaaaaa;
aa aaaaaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
aa aaaaaaaaaaaaaaaaa;
aa aaaaaaaaaaaaaaaa;
aa aaaaaaaaaaaaaaaaaaaaaa;
aaa _a=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;

a aaaaaaaa(aa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aa aaaaaaaaaaaaaaaaaaaa,aa aaaaaaaaaaaaaaaaaaaaaaaaaa,aa aaaaaaaaaaaaaaaaaaaaaaaaaaa,aa aaaaaaaaaaaaaaaaaaaaaaaaaaaa,aa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaa){
    if(aaaaaaaaaaaaaaaaaaaa>=aaaaaaaaaaaaaaaaaaaaa)aaaaaaaaaaaaa;
    _a=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
    aaaa(aa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa = aaaaaaaaaaaaaaaaaaaaaaaaaaaa;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa < aaaaaaaaaaaaaaaaa;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa++){
        aa aaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaa;
        if(_a){
            aaaaaaaaaaaaaaaaaa=aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa],aaaaaaaaaaaaaaaaaaa=aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
        }
        else if (aaaaaaaaaaaaaaaaaaaaaaaaaaaaa){
            aaaaaaaaaaaaaaaaaa = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ,aaaaaaaaaaaaaaaaaaa = aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
        }
        else{
            aaaaaaaaaaaaaaaaaa = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ,aaaaaaaaaaaaaaaaaaa = aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
        }
        _a=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
        // aaaaaa<<"aaaaaaaaae:"<<aaaaaaaaaaaaaaaaaa<<" "<<aaaaaaaaaaaaaaaaaaa<<aaaaaaaaaa;
        aaaa(aa aaaaaaaaaaa = aaaaaaaaaaaaaaaaaa;aaaaaaaaaaa <= aaaaaaaaaaaaaaaaaaa;aaaaaaaaaaa++){
            // aaaaaa<<aaaaaaaaaaaaaaaaaa<<" "<<aaaaaaaaaaaaaaaaaaa<<" \n";
            aaaaaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaa]=aaaaaaaaaaa;
            aaaaaaaa(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaa+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaa+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaa^aaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaa,false);
            if((aaaaaaaaaaaaaaaaaaaaaaaaaaa^aaaaaaaaaaa) == aaaaaaaaaaaaaaaa){
                // aaaaaa<<"\naaaaaaaaae "<<tj;
                aa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
                
                aaaaaa<<"number: 0x"<<aaaaaaaaaaaaaaaa<<" can be teared as:  ";
                aaaa(aa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<aaaaaaaaaaaaaaaaaaaaaaaaaa;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa++){
                    aaaaaa<<aaaaaaaaaaaaaaaaaaaaaaa::aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<<"0x"<<aaaaaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]<<" ^ ";
                    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa^=aaaaaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
                }
                aaaaaa<<aaaaaaaaaaaaaaaaaaaaaaa::aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<<"0x"<<aaaaaaaaaaa;
                aaaaaa<<"    ---- equals to : 0x"<<(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa^aaaaaaaaaaa);
                aaaaaa<<aaaaaaaaaa;
                aaaaaaaaaaaaaaaaaaaaaa++;
                if(aaaaaaaaaaaaaaaaaaaa!=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)aaaaaaaaaaaaa ;
            }
        }
    }
}
a aaaaaaaaaaaaaaa(){
    aaaaaa<<"( ༼ つ ◕_◕ ༽つ ): God Wang and God Liang can Splitting a Number into Multiple Numbers XOR form WITH ONLT ONE HAND!!!But I'm so weak.\n";
}
aa aaaaaaaaaaaaaa(){
    aaaaaaaaaaaaaaaaaaaaaaaa::aaaaaaaaaaaaaaaaaaaaaaaaa(false);
    aaaaaaaaaaaaaaa();
    aaaaaa<<"Input the number of ranges :";
    aaaaaaa>>aaaaaaaaaaaaaaaaa;
    aaaa(aa aaaaaaaaaaa=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;aaaaaaaaaaa<aaaaaaaaaaaaaaaaa;aaaaaaaaaaa++){
        aaaaaa<<"Input lower & upper of range "<<aaaaaaaaaaa<<" :";
        aaaaaaa>>aaaaaaaaa[aaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]>>aaaaaaaaa[aaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa];
        aaaaaa<<"You lower: "<<aaaaaaaaa[aaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]<<" Upper: "<<aaaaaaaaa[aaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]<<aaaaaaaaaa;
    }
    aaaaaa<<"\nWhat's the max number of TEARS you want to get:";
    aaaaaaa>>aaaaaaaaaaaaaaaaaaaaa;
    aaaaa(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa){
        _a=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
        aaaaaaaaaaaaaaaaaaaaaa=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
        aaaaaa<<"\nImput number (input Decimal,later I will output hex.):";
        aaaaaaa>>aaaaaaaaaaaaaaaa;
        aaaaaaaa(aaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaa[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa],aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa);
        aaaaaa<<"\n0x"<<aaaaaaaaaaaaaaaaaaaaaa<<" result found!!!";
        aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa(aaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa(aaaaaaaaaaaa));
    }
    aaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
}

好吧，上面的容易把脑组织累坏死༼ つ ◕_◕ ༽つ，还是看下面的吧

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#include<bits/stdc++.h>

using namespace std;

int rang[100][2];
int cs;
int arr[1000];
int k;
int num;
int cnt;
bool a=false;

void tear(int n,int floor,int it,int cur,int gtj,int gi,bool fst){
    if(floor>=cs)return;
    a=false;
    for(int tj = gtj;tj < k;tj++){
        int low,upp;
        if(a){
            low=rang[tj][0],upp=rang[tj][1];
        }
        else if (fst){
            low = gi ,upp = rang[tj][1];
        }
        else{
            low = gi+1 ,upp = rang[tj][1];
        }
        a=true;
        // cout<<"range:"<<low<<" "<<upp<<endl;
        for(int i = low;i <= upp;i++){
            // cout<<low<<" "<<upp<<" \n";
            arr[it]=i;
            tear(n,floor+1,it+1,cur^i,tj,i,false);
            if((cur^i) == num){
                // cout<<"\nrange "<<tj;
                int cac=0;
                
                cout<<"num: 0x"<<num<<" can be tear as:  ";
                for(int j=0;j<it;j++){
                    cout<<std::hex<<"0x"<<arr[j]<<" ^ ";
                    cac^=arr[j];
                }
                cout<<std::hex<<"0x"<<i;
                cout<<"    ---- equal to : 0x"<<(cac^i);
                cout<<endl;
                cnt++;
                if(floor!=0)return ;
            }
        }
    }
}

int main(){
    ios::sync_with_stdio(false);
    cout<<"Input num of ranges :";
    cin>>k;
    for(int i=0;i<k;i++){
        cout<<"Input lower & upper of range "<<i<<" :";
        cin>>rang[i][0]>>rang[i][1];
        cout<<"You lower: "<<rang[i][0]<<" Upper: "<<rang[i][1]<<endl;
    }
    cout<<"\nHow many max number of tears you want to get:";
    cin>>cs;
    while(1){
        a=false;
        cnt=0;
        cout<<"\nImput num (input Decimal,later i will output hex.):";
        cin>>num;
        tear(num,0,0,0,0,rang[0][0],true);
        cout<<"\n0x"<<cnt<<" result found!!!";
        memset(arr,0,sizeof(arr));
    }
    return 0;
}