1
import struct
2

3
# ==========================================
4
# 1. 准备密文
5
# ==========================================
6
# 从 main 函数的最后校验逻辑中提取 (注意 Little-Endian)
7
# qword_4088 (offset 8)  ^ 0x1C4BB2D52511D975
8
# s (offset 0)           ^ 0x8260C1C9C8D936E3
9
# qword_4098 (offset 24) ^ 0x1A5AF67F261CA506
10
# qword_4090 (offset 16) ^ 0xF11CAF1C716DE64D
11

12
# 按照内存顺序拼接 s[0:32]
13
# Offset: 0 (+0), 8 (+1), 16 (+2), 24 (+3)
14
parts = [
15
    0x8260C1C9C8D936E3, # s[0:8]
16
    0x1C4BB2D52511D975, # s[8:16] (qword_4088)
17
    0xF11CAF1C716DE64D, # s[16:24] (qword_4090)
18
    0x1A5AF67F261CA506  # s[24:32] (qword_4098)
19
]
20

21
ciphertext = b""
22
for p in parts:
23
    ciphertext += struct.pack("<Q", p)
24

25
print(f"Total Ciphertext ({len(ciphertext)} bytes): {ciphertext.hex()}")
26

27
# ==========================================
28
# 2. 模拟算法
29
# ==========================================
30

31
# 初始 Key
32
key_str = list(b"C0lm_be4ore_7he_st0rm") # len 21
33

34
# 初始化 S-Box (sub_1780 第一部分)
35
# 尽管使用了SSE，但通常是标准的 0..255 初始化
36
S = list(range(256))
37

38
# KSA (sub_1780 第二部分)
39
j = 0
40
for i in range(256):
41
    j = (j + S[i] + key_str[i % 21]) % 256
42
    S[i], S[j] = S[j], S[i]
43

44
# PRGA 解密 (模拟 main loop)
45
# 变量初始化
46
i = 0
47
j = 0 # dword_4064
48
flag = []
49

50
for k in range(32):
51
    # --- Step 1: sub_1640 (Signal 11) ---
52
    # 更新 i
53
    i = (i + 1) % 256
54

55
    # 更新 j (注意魔改点：加了 key[i%21])
56
    # 此时 key_str 是当前的 key (可能被旋转过)
57
    magic_val = key_str[i % 21]
58
    j = (j + S[i] + magic_val) % 256
59

60
    # Swap
61
    S[i], S[j] = S[j], S[i]
62

63
    # --- Step 2: sub_16E0 (Signal 8) ---
64
    # 生成 keystream byte
65
    t = (S[i] + S[j]) % 256
66
    keystream_byte = S[t]
67

68
    # 解密
69
    decrypted_char = ciphertext[k] ^ keystream_byte
70
    flag.append(decrypted_char)
71

72
    # --- Step 3: sub_1740 (Signal 5) ---
73
    # Key 循环左移
74
    # "ABC" -> "BCA"
75
    first = key_str.pop(0)
76
    key_str.append(first)
77

78
# ==========================================
79
# 3. 输出结果
80
# ==========================================
81
print("Flag:", bytes(flag).decode('utf-8', errors='ignore'))

1
Total Ciphertext (32 bytes): e336d9c8c9c1608275d91125d5b24b1c4de66d711caf1cf106a51c267ff65a1a
2
Flag: hgame{Null_c0lm_wi7hout_0_storm}

1
import sys
2
# 增加递归深度以支持DFS
3
sys.setrecursionlimit(2000)
4

5
from Crypto.Util.number import *
6
import gmpy2  # 建议安装 gmpy2 以提高大数运算速度，如果没有可以换成 pow(..., -1, n)
7

8
# --- 题目数据 ---
9
data = [
10
    259574080588277578527410299002867735023798216356763871244908783144610527451187,
11
    954408432127642232121971189554605898975195279656270435479524132958262607464595,
12
    902461413507524665418054778947872375987908929501605791883614896110219051835312,
13
    92554599789649828855418140915311664257163346975111310560999959858873425332254
14
]
15
n = 1000081851369905197391900354119969103949357074708517572641608490670646955240669
16

17
# --- 1. 恢复 Flux 参数 (a, b, c) ---
18
# 构建矩阵方程 M * [a, b, c]^T = Y
19
# M = [[x1^2, x1, 1], [x2^2, x2, 1], [x3^2, x3, 1]]
20
# Y = [x2, x3, x4]
21

22
def solve_linear_mod(M, Y, n):
23
    # 使用简单的克拉默法则或高斯消元求解 3x3 矩阵
24
    # 这里手动展开计算行列式，避免依赖 numpy/sage
25
    x1, x2, x3 = data[0], data[1], data[2]
26
    y1, y2, y3 = data[1], data[2], data[3]
27

28
    # 构造矩阵元素
29
    m11, m12, m13 = x1**2, x1, 1
30
    m21, m22, m23 = x2**2, x2, 1
31
    m31, m32, m33 = x3**2, x3, 1
32

33
    # 计算主行列式 Det
34
    det = (m11 * (m22 * m33 - m23 * m32) -
35
           m12 * (m21 * m33 - m23 * m31) +
36
           m13 * (m21 * m32 - m22 * m31)) % n
37

38
    det_inv = inverse(det, n)
39

40
    # 计算 Da (替换第一列为 Y)
41
    det_a = (y1 * (m22 * m33 - m23 * m32) -
42
             m12 * (y2 * m33 - m23 * y3) +
43
             m13 * (y2 * m32 - m22 * y3)) % n
44

45
    # 计算 Db (替换第二列为 Y)
46
    det_b = (m11 * (y2 * m33 - m23 * y3) -
47
             y1 * (m21 * m33 - m23 * m31) +
48
             m13 * (m21 * y3 - y2 * m31)) % n
49

50
    # 计算 Dc (替换第三列为 Y)
51
    det_c = (m11 * (m22 * y3 - y2 * m32) -
52
             m12 * (m21 * y3 - y2 * m31) +
53
             y1 * (m21 * m32 - m22 * m31)) % n
54

55
    a = (det_a * det_inv) % n
56
    b = (det_b * det_inv) % n
57
    c = (det_c * det_inv) % n
58
    return a, b, c
59

60
print("[*] Solving linear system for a, b, c...")
61
a, b, c = solve_linear_mod(None, None, n)
62
print(f"    a = {a}\n    b = {b}\n    c = {c}")
63

64
# --- 2. 恢复初始种子 h ---
65
# x1 = a*h^2 + b*h + c  =>  a*h^2 + b*h + (c - x1) = 0
66
print("[*] Solving quadratic for h...")
67
C_prime = (c - data[0]) % n
68
delta = (b**2 - 4 * a * C_prime) % n
69

70
# 使用 gmpy2 或 libnum 计算模平方根
71
try:
72
    # Tonelli-Shanks is implemented in gmpy2
73
    sqrt_delta = int(gmpy2.isqrt_rem(delta)[0]) # Try integer sqrt first just in case
74
    if pow(sqrt_delta, 2, n) != delta:
75
        # Need modular sqrt
76
        # 注意: 如果没有安装gmpy2，可以使用 libnum.nroot.sqrt_mod(delta, n)
77
        # 或者自己写一个 Tonelli-Shanks
78
        import gmpy2
79
        # gmpy2 没有直接的 modular_sqrt，通常用 pow(x, (p+1)//4, p) 仅当 p=3 mod 4
80
        # 这里为了通用性，我手写一个简单的 Tonelli-Shanks 接口或者使用 brute-force 库
81
        # 实际CTF中通常 n % 4 == 3
82
        if n % 4 == 3:
83
            sqrt_delta = pow(delta, (n+1)//4, n)
84
        else:
85
            # 这里简化处理，如果不满足 n=3 mod 4，需要标准 TS 算法
86
            # 假设读者环境可以处理，这里使用一个通用的求根逻辑占位
87
            pass
88
except:
89
    pass
90

91
# 为保证脚本独立运行，这里包含一个标准的 Modular Sqrt 函数
92
def modular_sqrt(a, p):
93
    if legendre_symbol(a, p) != 1: return 0
94
    elif a == 0: return 0
95
    elif p == 2: return p
96
    elif p % 4 == 3: return pow(a, (p + 1) // 4, p)
97
    s = p - 1
98
    e = 0
99
    while s % 2 == 0:
100
        s //= 2
101
        e += 1
102
    n = 2
103
    while legendre_symbol(n, p) != -1:
104
        n += 1
105
    x = pow(a, (s + 1) // 2, p)
106
    b = pow(a, s, p)
107
    g = pow(n, s, p)
108
    r = e
109
    while True:
110
        t = b
111
        m = 0
112
        for m in range(r):
113
            if t == 1: break
114
            t = pow(t, 2, p)
115
        if m == 0: return x
116
        gs = pow(g, 2 ** (r - m - 1), p)
117
        g = (gs * gs) % p
118
        x = (x * gs) % p
119
        b = (b * g) % p
120
        r = m
121

122
def legendre_symbol(a, p):
123
    ls = pow(a, (p - 1) // 2, p)
124
    return -1 if ls == p - 1 else ls
125

126
sqrt_delta = modular_sqrt(delta, n)
127
inv_2a = inverse(2 * a, n)
128

129
h1 = ((-b + sqrt_delta) * inv_2a) % n
130
h2 = ((-b - sqrt_delta) * inv_2a) % n
131
candidates_h = [h1, h2]
132
print(f"    Candidates for h: {candidates_h}")
133

134
# --- 3. 爆破 Key (Bit-by-Bit DFS) ---
135
# 定义 shash 函数用于验证
136
def shash(value: str, key: int) -> int:
137
    length = len(value)
138
    if length == 0: return 0
139
    mask = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
140
    x = (ord(value[0]) << 7) & mask
141
    for c in value:
142
        x = (key * x) & mask ^ ord(c)
143
    x ^= length & mask
144
    return x
145

146
value_str = "Welcome to HGAME 2026!"
147
target_h = None
148

149
# 我们不知道是 h1 还是 h2，但在 DFS 中如果 key 匹配不上会很快剪枝
150
# 所以对两个都跑一下
151
found_key = None
152

153
def dfs(bit_idx, current_key, target_h_val):
154
    global found_key
155
    if found_key is not None:
156
        return
157

158
    # 检查当前生成的 key 的低位是否符合 shash 的逻辑
159
    # 我们只需要模拟到 bit_idx 位
160

161
    # 构造当前的测试模数 mask
162
    # 比如我们猜到了第 k 位，我们验证 mod 2^(k+1) 是否匹配
163
    check_mask = (1 << (bit_idx + 1)) - 1
164

165
    # 运行简化版 shash
166
    # 注意：这里的逻辑必须和原 shash 完全一致，只是最后只看低位
167
    # 原 shash 中的 mask 是 2^256-1。由于我们 check_mask 远小于它，
168
    # 这里的 & mask 操作在 key 比较小的时候不会有影响，
169
    # 但为了严谨，我们保留原逻辑，只在最后比较时截断。
170

171
    mask_256 = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
172
    x = (ord(value_str[0]) << 7) & mask_256
173

174
    # 优化：不需要每次跑全量循环，但这里字符串短，直接跑也没问题
175
    for c in value_str:
176
        # 关键：这里用 current_key 乘
177
        # 在低位运算中，高位的未知 key bits 不会影响结果的低位
178
        x = (current_key * x) & mask_256 ^ ord(c)
179

180
    x ^= len(value_str) & mask_256
181

182
    # 检查低位是否匹配
183
    if (x & check_mask) == (target_h_val & check_mask):
184
        if bit_idx == 69: # 达到了限制长度 < 70，即 0..69
185
            # 最终完整验证
186
            if shash(value_str, current_key) == target_h_val:
187
                found_key = current_key
188
            return
189

190
        # 递归搜索下一位 (0 或 1)
191
        dfs(bit_idx + 1, current_key, target_h_val)
192
        dfs(bit_idx + 1, current_key | (1 << (bit_idx + 1)), target_h_val)
193

194
print("[*] Starting DFS for key recovery...")
195

196
for h_val in candidates_h:
197
    print(f"    Testing h = {h_val}...")
198
    # Reset
199
    found_key = None
200
    # DFS start: bit 0, init key 0
201
    dfs(0, 0, h_val)
202
    dfs(0, 1, h_val)
203

204
    if found_key:
205
        print(f"    [+] Found Key: {found_key}")
206
        target_h = h_val
207
        break
208

209
if not found_key:
210
    print("[-] Failed to recover key. Check calculations.")
211
    sys.exit(0)
212

213
# --- 4. 生成 Flag ---
214
magic_word = "I get the key now!"
215
flag_hash = shash(magic_word, found_key)
216
flag = "VIDAR{" + hex(flag_hash)[2:] + "}"
217
print("\n" + "="*30)
218
print(flag)
219
print("="*30)

1
[*] Solving linear system for a, b, c...
2
    a = 367929665096223890513552213909860086955444123973877511464516897327030182495358
3
    b = 572472137956986080361020851057550170425758964757540621190761120109346601190138
4
    c = 511123710434351729002552219766790915716585289864402925172038710529215854140240
5
[*] Solving quadratic for h...
6
    Candidates for h: [6866312363291178484982959720124435011938375586579989365225276248801007329194, 1851471554044636937620060405470139203302636010497407478542185697214766136647]
7
[*] Starting DFS for key recovery...
8
    Testing h = 6866312363291178484982959720124435011938375586579989365225276248801007329194...
9
    [+] Found Key: 860533
10

11
==============================
12
VIDAR{1069466028b4c4a9694a3175f2f9410ab398b939bdb52afb39534b6f8cc59abc}
13
=============================

1
#!/usr/bin/env python3
2
import hashlib
3
import hmac
4
from pathlib import Path
5

6
try:
7
    from Crypto.Cipher import AES
8
except ImportError:
9
    # 有些环境是 Cryptodome
10
    from Cryptodome.Cipher import AES
11

12
def ror8(x, r):
13
    r &= 7
14
    return ((x >> r) | ((x << (8 - r)) & 0xFF)) & 0xFF
15

16
def pkcs7_unpad(data: bytes) -> bytes:
17
    pad = data[-1]
18
    if pad < 1 or pad > 16 or data[-pad:] != bytes([pad]) * pad:
19
        raise ValueError("Bad PKCS7 padding")
20
    return data[:-pad]
21

22
def derive_secret_from_driver(driver_path: str) -> bytes:
23
    """
24
    复现 GateDriver.sys 中对 0x140003250 表的混淆还原，得到 secret32。
25
    这里用到题目给的 driver，因此完全自洽、不需要硬编码 secret。
26
    """
27
    drv = Path(driver_path).read_bytes()
28

29
    # 由 objdump -h 可得 GateDriver.sys: .rdata fileoff=0x1c00, vma=0x140003000
30
    rdata_fileoff = 0x1C00
31
    rdata_vma_rva  = 0x3000
32

33
    table_va = 0x140003250
34
    table_rva = table_va - 0x140000000
35
    table_off = rdata_fileoff + (table_rva - rdata_vma_rva)
36

37
    table = drv[table_off:table_off+32]
38
    if len(table) != 32:
39
        raise ValueError("table read failed")
40

41
    out = bytearray()
42
    for i in range(32):
43
        b = table[i] ^ 0x5C
44
        shift = (1 - 3 * i) & 7
45
        b = ror8(b, shift)
46
        b ^= 0xA7
47
        out.append(b)
48
    return bytes(out)
49

50
def derive_aes_key(nonce16: bytes, secret32: bytes) -> bytes:
51
    k1 = hmac.new(b"\x00" * 32, nonce16, hashlib.sha256).digest()
52
    k2 = hmac.new(k1, secret32 + b"\x01", hashlib.sha256).digest()
53
    return k2[:16]
54

55
def inverse_client_vm(transformed: bytes) -> bytes:
56
    """
57
    逆 client 的按位置变换：
58
    out = ROL8(in ^ (13*i+195), (3*i+1)&7) ^ 0x5a
59
    """
60
    out = bytearray()
61
    for i, b in enumerate(transformed):
62
        b2 = (13 * i + 195) & 0xFF
63
        shift = (3 * i + 1) & 7
64
        x = b ^ 0x5A
65
        x = ror8(x, shift)
66
        out.append(x ^ b2)
67
    return bytes(out)
68

69
def main():
70
    blob = Path("Drv_blob.bin").read_bytes()
71
    nonce = blob[:16]
72
    ct = blob[16:]
73

74
    secret = derive_secret_from_driver("GateDriver.sys")
75
    aes_key = derive_aes_key(nonce, secret)
76

77
    pt_padded = AES.new(aes_key, AES.MODE_ECB).decrypt(ct)
78
    pt = pkcs7_unpad(pt_padded)
79

80
    flag = inverse_client_vm(pt).decode("ascii")
81
    print(flag)
82

83
if __name__ == "__main__":
84
    main()

1
#include <bits/stdc++.h>
2
using namespace std;
3

4
static const int W=4, H=5, N=W*H;
5

6
int main(){
7
    ios::sync_with_stdio(false);
8
    cin.tie(nullptr);
9

10
    // base masks at position 0
11
    uint32_t base[10];
12
    base[0]=0x33; // 2x2
13
    for(int i=1;i<=4;i++) base[i]=0x11; // vertical 2x1
14
    base[5]=0x03; // horizontal 1x2
15
    for(int i=6;i<10;i++) base[i]=0x01; // single
16

17
    bool valid[10][N];
18
    uint32_t mask[10][N];
19
    int dest[10][N][4]; // wasd => w,a,s,d
20
    memset(valid,0,sizeof(valid));
21
    memset(mask,0,sizeof(mask));
22
    for(int pid=0;pid<10;pid++){
23
        int width = (pid==0||pid==5)?2:1;
24
        int height = (pid==0||(pid>=1&&pid<=4))?2:1;
25
        for(int pos=0;pos<N;pos++){
26
            int r=pos/W, c=pos%W;
27
            if(c+width<=W && r+height<=H){
28
                valid[pid][pos]=true;
29
                mask[pid][pos]=base[pid] << pos;
30
            }
31
        }
32
        for(int pos=0;pos<N;pos++) for(int d=0;d<4;d++) dest[pid][pos][d]=-1;
33
        for(int pos=0;pos<N;pos++) if(valid[pid][pos]){
34
            int r=pos/W, c=pos%W;
35
            if(r>0 && valid[pid][pos-W]) dest[pid][pos][0]=pos-W;     // w
36
            if(c>0 && valid[pid][pos-1]) dest[pid][pos][1]=pos-1;     // a
37
            if(valid[pid][pos+W] && r < H-((pid==0||(pid>=1&&pid<=4))?2:1)) dest[pid][pos][2]=pos+W; // s
38
            if(valid[pid][pos+1] && c < W-((pid==0||pid==5)?2:1)) dest[pid][pos][3]=pos+1;          // d
39
        }
40
    }
41

42
    auto pack = [&](array<int,10> p){
43
        uint64_t k=0;
44
        for(int i=0;i<10;i++) k |= (uint64_t)p[i] << (5*i);
45
        return k;
46
    };
47
    auto getpos = [&](uint64_t k,int pid){
48
        return (int)((k >> (5*pid)) & 0x1FULL);
49
    };
50
    auto occ_from_key = [&](uint64_t k){
51
        uint32_t o=0;
52
        for(int pid=0;pid<10;pid++){
53
            int pos=getpos(k,pid);
54
            o |= mask[pid][pos];
55
        }
56
        return o;
57
    };
58

59
    array<int,10> startp = {1,0,3,11,10,8,12,16,13,19};
60
    uint64_t start = pack(startp);
61
    uint32_t start_occ = occ_from_key(start);
62

63
    auto is_goal = [&](uint64_t k){
64
        return getpos(k,0)==13;
65
    };
66

67
    vector<uint64_t> keys; keys.reserve(2000000);
68
    vector<uint32_t> occs; occs.reserve(2000000);
69
    vector<int> prev; prev.reserve(2000000);
70
    vector<uint16_t> mv; mv.reserve(2000000);
71

72
    keys.push_back(start);
73
    occs.push_back(start_occ);
74
    prev.push_back(-1);
75
    mv.push_back(0xffff);
76

77
    unordered_map<uint64_t,int> idx;
78
    idx.reserve(2000000);
79
    idx.max_load_factor(0.7);
80
    idx[start]=0;
81

82
    size_t head=0;
83
    int goal_idx=-1;
84

85
    while(head < keys.size()){
86
        uint64_t k = keys[head];
87
        uint32_t occ = occs[head];
88
        if(is_goal(k)) { goal_idx=(int)head; break; }
89

90
        // neighbor order: piece 0..9, dir w,a,s,d
91
        for(int pid=0;pid<10;pid++){
92
            int pos = getpos(k,pid);
93
            uint32_t mcur = mask[pid][pos];
94
            uint32_t occ_wo = occ ^ mcur;
95

96
            for(int di=0;di<4;di++){
97
                int np = dest[pid][pos][di];
98
                if(np<0) continue;
99
                uint32_t md = mask[pid][np];
100
                if(md & occ_wo) continue;
101

102
                uint64_t nk = k & ~(0x1FULL << (5*pid));
103
                nk |= ((uint64_t)np << (5*pid));
104

105
                if(idx.find(nk)!=idx.end()) continue;
106

107
                int ni=(int)keys.size();
108
                idx[nk]=ni;
109
                keys.push_back(nk);
110
                occs.push_back(occ_wo ^ md);
111
                prev.push_back((int)head);
112
                mv.push_back((uint16_t)(pid*4+di));
113
            }
114
        }
115
        head++;
116
    }
117

118
    if(goal_idx<0){
119
        cerr << "No goal found. Visited="<<keys.size()<<"\n";
120
        return 1;
121
    }
122

123
    // reconstruct path
124
    vector<string> path;
125
    static const char dch[4]={'w','a','s','d'};
126
    int cur=goal_idx;
127
    while(prev[cur]!=-1){
128
        uint16_t code=mv[cur];
129
        int pid=code/4, di=code%4;
130
        string s; s.push_back('0'+pid); s.push_back(dch[di]);
131
        path.push_back(s);
132
        cur=prev[cur];
133
    }
134
    reverse(path.begin(), path.end());
135

136
    cout << "moves="<<path.size()<<" visited="<<keys.size()<<"\n";
137
    for(size_t i=0;i<path.size();i++){
138
        cout<<path[i]<<(i+1<path.size()?" ":"\n");
139
    }
140
    uint64_t gk = keys[goal_idx];
141
    cout<<"goal key="<<gk<<"\n";
142
    for(int pid=0;pid<10;pid++){
143
        cout<<pid<<":"<<getpos(gk,pid)<<(pid==9?'\n':' ');
144
    }
145
    return 0;
146
}