变异的SM2

原题连接：https://ctf.njupt.edu.cn/545.html
直接上脚本，反正原理也不懂

from pwn import *
from Crypto.Util.number import *
from gmssl import func, sm2
import server
r = remote("129.211.59.129", 20001)
# context.log_level = 'debug'
pk = int(r.recvline().split(b":")[1].decode(), 16)
pks = int(r.recvline().split(b":")[1].decode(), 16)
log.info(f"pk: {pk}")
log.info(f"pks: {pks}")
backdoor = b'0'*128 + b'1'
r.sendlineafter(b"op: ", b"sign")
r.sendlineafter(b"backdoor:", backdoor)
sks = int(r.recvline(), 16)
n = 115792089210356248756420345214020892766061623724957744567843809356293439045923
# pks = (sk + 1) * sks ^ -1
sk = inverse(pks * sks, n) - 1
log.info(f"sk: {sk}")
data = b'Hello, Welcome to ISCC2021!'
e = int(data.hex(), 16)
k = 2
tsm2 = server.TSM2('0xdeadbeaf')
P1_P2 = tsm2._kg(k, server.G)
R = int(P1_P2[:64], 16) + e
s = inverse(1+sk, n) * (k - R*sk) % n
r.sendlineafter(b"op: ", b"verify")
r.sendlineafter(b"msg:", data)
r.sendlineafter(b"sign:", hex(R)[2:].zfill(64) + hex(s)[2:].zfill(64))
r.interactive()

拿到flag