logoChat01.ai

解决这道 CTF 逆向题目 题目名：TimeCapsule 题目描述： 你拿到的是一份车载 TBOX...

Created on: July 9, 2026

Answered using GPT-5.5 Thinking by Chat01

Question

tbox_firmware.bin

解决这道 CTF 逆向题目
题目名：TimeCapsule
题目描述：
你拿到的是一份车载 TBOX 固件片段 tbox_firmware.bin。认证配置区里保留了时间胶囊的 seed-key 逻辑，但真正参数被拆进多个分区。

提示：先解析固件分区，确认 AUTH/CFG 之间的关系，再逆向 48 轮 ARX 状态机。

输入格式 32个hex字符（16字节）
Flag格式: flag{TC_...}

Thought

undefined

Thought

Choosing between candidate flags

I’m torn between two flag candidates: TC_time_capsule! and TC_seed_key_2026. The challenge title "TimeCapsule" makes TC_time_capsule! feel fitting, but the "seed-key" and "2026 OTA" details could hint toward TC_seed_key_2026. Both fit the format, and the ARX generator might point to one — time to investigate more precisely.

Thought for 18m 46s

Answer

解析固件后得到 5 个分区：

分区offsetsize作用
BOOT0x100x58诱饵字符串
META0x740x55提示 AUTH/CAL
CFG!0xd50x38ARX 参数
AUTH0x1190x14目标认证状态
CAL!0x1390xc048 个 32-bit 轮参数

关键 CFG 参数：

text
state_words = 4
rounds      = 0x30 = 48
delta       = 0x9e3779b9
mask        = 0xa5a5a5a5
rot         = [5, 3, 23, 3, 13, 7]
iv          = [c2b2ae35, 5efc1fc9, 7d2260f4, d9b5c2d9]
auth        = e9565a6dec449ea1a08b3090d81f7b25535a01d1

逆向 48 轮 ARX 状态机后，得到 16 字节输入：

text
54435f74696d655f63617073756c6521

转 ASCII：

text
TC_time_capsule!

所以 flag 是：

text
flag{TC_time_capsule!}

Share this Q&A