前两天在做hctf的时候遇到一个题目，前年的400分，通过IDA分析可以看出就是一个有22个未知数的方程组的求解。
看了前年的writeup加上一位大牛的指点，通过numpy这个包写了python脚本，终于得到了flag。
import sys
import numpy
verify=[
0x83CD50,
0x706048,
0xA9AC74,
0x9A4AF2,
0x9F79A0,
0x7F51A2,
0x7E4CD8,
0x7038B0,
0x7B3708,
0x687078,
0x806066,
0x8F2F2E,
0x928B34,
0x7FEDDC,
0x825768,
0xACB91E,
0x90402E,
0x6F7386,
0xA01C72,
0x7C7250,
0x7AB115,
0x893C38
]//这一个数组里包含的是方程组的结果
matrix=[[8923, 659, 1303, 1949, 4447, 3527, 757, 367, 5507, 7907, 691, 9629, 5303, 8117, 9103, 9391, 89, 3361, 751, 9067, 5417, 6829],
[9067, 1259, 107, 8597, 4229, 1213, 8831, 3259, 269, 5323, 769, 1237, 5501, 6763, 8053, 67, 3163, 3863, 4447, 5569, 4357, 5503],
[9533, 23, 1973, 8269, 6961, 8929, 6301, 2791, 4861, 8053, 1609, 8219, 911, 7583, 6143, 2953, 7247, 6131, 7853, 4451, 7187, 8629],
[1039, 389, 1487, 5987, 937, 239, 3583, 2897, 8893, 3307, 7459, 8521, 9769, 9689, 6959, 7949, 9137, 3461, 4229, 9059, 7177, 7643],
[7853, 6271, 9371, 1613, 73, 8243, 9013, 919, 5387, 2207, 6211, 139, 5077, 7211, 2053, 8443, 4421, 5717, 8779, 8971, 6337, 7159],
[3019, 8377, 1613, 1973, 3923, 8821, 797, 4969, 7643, 7297, 2381, 4679, 5869, 647, 7411, 3329, 6199, 7349, 4969, 8731, 877, 1039],
[3089, 9859, 7159, 227, 271, 8161, 1051, 5701, 1259, 1361, 3673, 8311, 4679, 7877, 2621, 991, 9949, 683, 743, 6079, 2473, 4519],
[1259, 4651, 5479, 4951, 4657, 4591, 509, 3821, 6661, 4127, 2011, 4547, 7621, 5261, 5261, 2003, 4871, 457, 2083, 4561, 6947, 1187],
[4703, 9629, 3769, 2003, 1297, 4283, 2381, 8429, 7057, 9371, 4483, 4099, 1873, 499, 7583, 5897, 937, 727, 241, 4799, 6361, 5531],
[283, 5591, 151, 2113, 7229, 307, 3851, 8963, 2777, 7757, 8831, 17, 8563, 1543, 8243, 3529, 3833, 2411, 2897, 19, 3559, 853],
[9467, 2207, 2269, 2083, 7741, 5801, 2633, 349, 9257, 479, 331, 7649, 5393, 887, 6329, 4243, 3329, 7121, 4001, 6043, 8263, 3253],
[4993, 7577, 6833, 661, 4129, 67, 2791, 3121, 4597, 8053, 8147, 1619, 5801, 6173, 127, 8179, 8093, 9319, 1063, 9157, 7817, 2341],
[1493, 9137,9787, 617, 5557, 8387, 4219, 3301, 251, 3203, 8443, 2521, 2887, 2437, 7883, 5653, 3907, 4457, 9091, 523, 887, 8101],
[9467, 2251, 9067, 4153,557, 4999, 5669, 9343, 7949, 7019, 113, 1801, 1867, 1187, 3541, 5527, 2347, 4813, 3019, 683, 6869, 5051],
[7333, 8677, 3557, 4099, 5279, 449, 2099, 8929, 5393, 1933,9157, 6827, 467, 3299, 443, 3739, 823, 7499, 691, 2467, 281, 4049],
[7489,739, 9769, 7963, 5651, 7691, 947, 8537, 4943, 1187, 4651, 9011, 6359, 1063, 7541, 9187, 2551, 7649, 4001, 3187, 6199, 7433],
[5653, 9349, 9419, 2459, 2423, 1823, 1291,2423, 3671, 4673, 1033, 8389, 2777, 8629, 6203, 6673, 1877, 7583, 5077, 9227, 6037, 2339],
[1663, 3529, 9631, 6833,17, 3697, 4327, 6053, 7639, 6679, 797, 3209, 3191, 3259, 5563, 5717, 3181, 1571, 751, 1163, 211, 4421],
[2273, 9341, 8081, 9311, 41, 4241, 1279, 4483, 6581, 6863, 7583, 4129, 1543, 5651, 4357,9521, 5557, 11, 7723, 2441, 6733, 6521],
[1171, 241,9851, 3583, 1609, 43, 9281, 5867, 2819, 5659, 4493, 223, 2767, 3221, 6173, 6947, 5897, 6113, 6737, 3989, 9733, 3467],
[173, 2099, 2953, 7243, 4987, 1723, 2657, 1213, 2731, 7507, 9721, 4637, 9203, 5407, 3169, 5003, 8681,2, 3329, 5843, 8017, 83],
[5119, 3109, 8369, 7993, 2927, 127, 5233, 4783, 5171, 3907, 1613, 4567, 3343, 2617, 5387, 8713, 7829, 3559, 419, 9931, 6067, 4481]
]//这一个数组里包含的是方程组的系数
print len(matrix)
for i in matrix:
if len(i)==21:
print i
result = [104,99,116,102,123,83,48,95,84,51,114,114,49,98,49,101,95,73,99,49,49,125]
if __name__ == '__main__' :
#gen_matrix()
verify = numpy.array(verify )
matrix = numpy.array(matrix )
print numpy.linalg.solve(matrix,verify)//解方程组
#print result
for x in xrange(len(result)):
sys.stdout.write(chr(result[x]))
