Matrix on PseudorandomDog's Blog

Two Perspectives of Why Column Rank Equals Row Rank and Their Connections

Thu, 16 Apr 2026 00:00:00 +0000

Frankly speaking, there’s no need to write a blog explaining this corollary since it has been taught on undergraduate classes for decades. But when I was reviewing my Algebra book, I found myself pondering a deeper question: what is the intrinsic connection between these two perspectives? At least I need an explanation other than Mathematic proof.

Review: Fundamental Theorem of Linear Maps #

Matrices are essentially representations of linear maps. I’ll begin by recalling the fundamental theorem of linear maps.

DASCTF2023年7月赛留档

Mon, 31 Jul 2023 00:00:00 +0000

controlflow #

这个程序的控制流好像有点奇怪

可以通过识别 push ebp 来确定真实的函数的位置

设置函数起始处跳过这些插入的代码块并勾选 BP-Based Frame 可以成功 F5

每个小函数上下断点可以找到执行的顺序如下

main -> func3 -> func5 -> func6 -> func2b -> func1 -> func4

main 函数中最后一段还有一部分加密代码

main: a[i]^=0x401
func3: a[i]+=i**2
func5: a[j]^=j*(j+1) for j in range(10,30)
func6: a[i]-=i
func2b: a[i]*=3
func4: swap(a[k+1],a[k]) for k in range(10,30,2)

解密并不难

s = [
    3279, 3264, 3324, 3288, 3363, 3345, 3528, 3453, 3498, 3627, 3708,
    3675, 3753, 3786, 3930, 3930, 4017, 4173, 4245, 4476, 4989, 4851,
    5166, 5148, 4659, 4743, 4596, 5976, 5217, 4650, 6018, 6135, 6417,
    6477, 6672, 6891, 7056, 7398, 7650, 7890
]

# func4
for i in range(10, 30, 2):
    s[i + 1], s[i] = s[i], s[i + 1]

# func2b
for i in range(40):
    assert s[i] % 3 == 0
    s[i] //= 3

# func6
for i in range(40):
    s[i] += i

# func5
for i in range(20):
    s[10 + i] ^= i * (i + 1)

# func3
for i in range(40):
    s[i] -= i * i

# main
for i in range(40):
    s[i] ^= 0x401

flag = "".join(chr(b) for b in s)
print(flag)
#DASCTF{TWpnemRuSTRkVzVsWVhOMmJqZzNOREoy}

感觉这题其实是可以 angr 一把梭的，没试

GDGAlgiersCTF2022

Wed, 12 Oct 2022 00:00:00 +0000

Traditions #

假随机，种子 0x7E6

import ctypes
libc = ctypes.CDLL("libc.so.6")
libc.srand(0x7E6)
stream = [libc.rand() for i in range(47)]

Oldschool #

You'll probably recognize this format just by looking at the size of the binary file.

512 字节的 MBR 块

BIOS 会将 MBR 装载到 0x10000 的地址空间中，起始地址为 0x7C00

MBR 部分以程序指针被置零结束

这里使用 unicorn 加载并调试

from unicorn import *
from unicorn.x86_const import *
from capstone import *

base_addr = 0x7C00
entry_point = base_addr
mem_size = 0x10000

with open("oldschool", "rb") as fp:
    mbr = fp.read()

def emu(flag):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    md = Cs(CS_ARCH_X86, CS_MODE_16)

    mu.mem_map(0, mem_size)
    mu.mem_write(base_addr, mbr[:512])

    mu_stdin = flag
    mu_stdout = []

    def hook_code(mu, address, size, user_data):
        nonlocal md

        code = mu.mem_read(address, size)
        insns = list(md.disasm(bytes(code), address, count=1))

        if len(insns) == 0:
            raise Exception(f"cant disasm insn at {address}")

        insn = insns[0]
        address = insn.address
        size = insn.size
        mnemonic = insn.mnemonic
        op_str = insn.op_str

        print("%.8x:\t%s\t%s" % (address, mnemonic, op_str))

        if address == 0x7c6a:
            ax = mu.reg_read(UC_X86_REG_AX)
            bx = mu.reg_read(UC_X86_REG_BX)
            dx = mu.reg_read(UC_X86_REG_DX)
            di = mu.reg_read(UC_X86_REG_DI)
            print("ax: %.4x\tbx: %.4x\tdx: %.4x\tdi: %.4x" % (ax, bx, dx, di))


    def hook_intr(mu, intno, user_data):
        nonlocal mu_stdin
        nonlocal mu_stdout

        ah = mu.reg_read(UC_X86_REG_AH)
        al = mu.reg_read(UC_X86_REG_AL)
        di = mu.reg_read(UC_X86_REG_DI)

        if intno == 0x10:
            if ah == 0x0E:  # print char
                mu_stdout.append(al)
        elif intno == 0x16:
            mu.reg_write(UC_X86_REG_AL, mu_stdin[di - 0x7D80])
        else:
            raise Exception("unk intr no: %xh" % intno)


    try:
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_INTR, hook_intr)
        mu.emu_start(begin=entry_point, until=0)
    except Exception as e:
        print(e)
        mu.emu_stop()

    return bytes(mu_stdout)

out=emu(b"0123456789ABCDEF")
print(bytes(out).decode())

上述模板将打印程序执行流，部分执行流如下