1.题目描述比赛萌新使用经典Logistic混沌映射生成密钥流异或加密Flag加密方式简单但他忽略了计算机浮点精度缺陷。已知密文试还原Flag。已知条件密文0x7d,0x2e,0x1f,0x45,0x0a,0x3b,0x28,0x14,0x5c,0x10加密参数 μ3.98初值保留3位小数。2.加密源码原题源码import random flag CTN{xxxx_test_xxxx} mu 3.98 x0 random.uniform(0.1,0.9) def logistic(x): return mu * x * (1 - x) # 生成混沌密钥流 key [] x x0 for _ in range(len(flag)): x logistic(x) key.append(int(x * 256) % 256) # 异或加密 cipher [ord(f)^k for f,k in zip(flag,key)] print(cipher)3.漏洞与考点分析1. CTN经典出题套路初值仅3位小数取值空间极小可全量暴力爆破2. Logistic映射迭代公开、无密钥混淆迭代完全可逆可复现3. 混沌浮点有限精度退化短序列无复杂度适合爆破求解。4.解题思路1. 遍历 0.100~0.900 所有三位小数初值2. 复现混沌迭代生成密钥流3. 异或解密匹配出合法 CTN 格式 Flag。5.完整EXP脚本cipher [0x7d,0x2e,0x1f,0x45,0x0a,0x3b,0x28,0x14,0x5c,0x10] mu 3.98 def logistic(x): return mu * x * (1 - x) # 暴力遍历3位小数初值 for i in range(100,900): x i / 1000 key [] tmp x for _ in range(len(cipher)): tmp logistic(tmp) key.append(int(tmp * 256) % 256) # 解密 res .join([chr(c^k) for c,k in zip(cipher,key)]) if res.startswith(CTN{): print(Flag:,res) break