# 第二届BMZCTF公开赛-easymisc

### 文章目录

``````题目附件请自取：

``````

# 题目设计

• 考察知识点：`数据处理``wav文件头``高低振幅转换``LSB隐写`
• 题目思路：`逆序字节流数据->wav文件->高低振幅转换->LSB隐写->异或测试`

`文件转换二进制01数据`

``````from binascii import *

with open('1.png', 'rb') as f:#需要转换的文件
with open('bin.txt', 'w') as f1:
for i in range(0, len(hex_data), 2):
data = '{:08b}'.format(int(hex_data[i:i+2], 16))
f1.write(data)
``````

`二进制数据转换wav高低振幅`

``````import wave,struct,random

sampleRate = 44100.0
obj = wave.open('sound.wav','w')
obj.setnchannels(1)
obj.setsampwidth(2)
obj.setframerate(sampleRate)

with open('bin.txt', 'r') as f:
for i in bin_data:
if i == '1':
if random.randint(0,1) == 1:
obj.writeframesraw(struct.pack('<h', random.randint(30000, 32000)))
else:
obj.writeframesraw(struct.pack('<h', random.randint(-32000, -30000)))
elif i == '0':
if random.randint(0,1) == 1:
obj.writeframesraw(struct.pack('<h', random.randint(18000, 20000)))
else:
obj.writeframesraw(struct.pack('<h', random.randint(-20000, -18000)))
else:
break
obj.close()
``````

`逆序文件字节流`

``````from binascii import *

with open('sound.wav', 'rb') as f:
with open('sound', 'wb') as f1:
for i in range(0, len(hex_data), 2):
data = hex_data[i:i+2][::-1]
f1.write(unhexlify(data))
``````

`对文件整体进行异或`

``````from binascii import *

with open('qrcode.png', 'rb') as f:
with open('data', 'wb') as f1:
for i in range(len(all_data)):
f.seek(i)
xor_data = '{:02x}'.format(data ^ 0x7f)
f1.write(unhexlify(xor_data))
``````

# 解题步骤(Writeup)

`what`文件开头并不是什么类型的文件头

``````from binascii import *

with open('what', 'rb') as f:
with open('data.wav', 'wb') as f1:
for i in range(0, len(hex_data), 2):
data = hex_data[i:i+2][::-1]
f1.write(unhexlify(data))
``````

``````import wave

obj = wave.open('data.wav', 'r')
frames = obj.getnframes()
print("All Frames: {}".format(frames))
for i in range(0, len(frames_data), 4):
data = frames_data[i:i+4]
real_data = int(data[2:] + data[:2], 16)
data1 = data[2:] + data[:2]
print("第{:<2}帧: {} => {}  真实数据值: {}".format(int((i+4)/4), data,data1 , real_data))
``````

PS：分析高低振幅取值范围可以提升提取出来的帧数来进行更精确的判断

``````>>> import math
>>> math.pow(2,15)-(45650-math.pow(2,15))
19886.0#第二帧
>>> math.pow(2,15)-(47417-math.pow(2,15))
18119.0#第三帧
>>> math.pow(2,15)-(33915-math.pow(2,15))
31621.0#第五帧
>>> math.pow(2,15)-(35258-math.pow(2,15))
30278.0#第十二帧
``````

OK，这样就解决了负振幅数据转换的问题

``````import wave, math, struct
from binascii import *

obj = wave.open('data.wav', 'r')
frames = obj.getnframes()

bin_data = ''
for idx in range(0, len(frames_data), 4):
data = frames_data[idx:idx+4]
data = data[2:] + data[:2]
if int(data, 16) <= 20000:
bin_data += '0'
elif int(data, 16) > 20000 and int(data, 16) <= 32000:
bin_data += '1'
elif int(data, 16) > math.pow(2, 15):
overflow_data = math.pow(2, 15) - (int(data, 16) - math.pow(2, 15))
if overflow_data > 20000 and overflow_data <= 32000:
bin_data += '1'
elif overflow_data <= 20000:
bin_data += '0'

hex_data = ''
for idx in range(0, len(bin_data), 8):
hex_data += '{:02x}'.format(int(bin_data[idx:idx+8], 2))

with open('data', 'wb') as f1:
f1.write(unhexlify(hex_data))
``````

``````hint: xor [00-ff] which one?
``````

``````head_bytes = 'F6 2F 31 38'
for n in range(0xff):
xor_data = ''
for data in hex_data:
data = int(data, 16) ^ n
xor_data += ' {:02x}'.format(data)
print("XOR {:02x}: {}".format(n, xor_data))
``````

``````BMZCTF{755f3d5c-4817-4610-a377-68743f09e60a}
``````

THE END

)">