1
seed = key_seed + target_floor + boss_interval + view_radius
2
for i, v in ipairs(enc_flag) do
3
  k = (seed + (i-1)) % 255
4
  out = out .. string.char(v ~ k)   -- ~ 是 bxor
5
end

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3

4
import struct
5
import sys
6
from pathlib import Path
7

8
XOR = 0x9C
9

10
# ---------- stage0: decrypt game ----------
11
def decrypt_game(buf: bytes) -> bytes:
12
    if not buf or buf[0] != 0x1B:
13
        raise ValueError("bad file: first byte != 0x1B")
14
    return bytes([buf[0]] + [b ^ XOR for b in buf[1:]])
15

16
# ---------- stage1: reader + waw-varint ----------
17
class R:
18
    def __init__(self, b: bytes, pos=0):
19
        self.b = b
20
        self.p = pos
21

22
    def read(self, n: int) -> bytes:
23
        out = self.b[self.p:self.p+n]
24
        if len(out) != n:
25
            raise EOFError("read past end")
26
        self.p += n
27
        return out
28

29
    def u8(self) -> int:
30
        return self.read(1)[0]
31

32
    def u32(self) -> int:
33
        return struct.unpack("<I", self.read(4))[0]
34

35
    def i64(self) -> int:
36
        return struct.unpack("<q", self.read(8))[0]
37

38
    def f64(self) -> float:
39
        return struct.unpack("<d", self.read(8))[0]
40

41
    # ✅ MSB=1 ends (reversed from normal Lua 5.4)
42
    def loadUnsigned(self) -> int:
43
        res = 0
44
        while True:
45
            c = self.u8()
46
            res = (res << 7) | (c & 0x7F)
47
            if c & 0x80:
48
                return res
49

50
    # loadStringN: size varint; 0 => None; else read size-1 bytes (no '\0')
51
    def loadStringN(self):
52
        sz = self.loadUnsigned()
53
        if sz == 0:
54
            return None
55
        return self.read(sz - 1)
56

57
def parse_constants(r: R, n: int):
58
    out = []
59
    for _ in range(n):
60
        t = r.u8()
61
        if t == 0:
62
            out.append(("nil", None))
63
        elif t == 1:
64
            out.append(("bool", False))
65
        elif t == 0x11:
66
            out.append(("bool", True))
67
        elif t == 3:       # int64
68
            out.append(("int", r.i64()))
69
        elif t == 0x13:    # float64
70
            out.append(("num", r.f64()))
71
        elif t in (4, 0x14):
72
            out.append(("str", r.loadStringN()))
73
        else:
74
            raise ValueError(f"unknown const tag {t:#x} at {r.p}")
75
    return out
76

77
def parse_proto(r: R, parent_source=None):
78
    src = r.loadStringN()
79
    if src is None:
80
        src = parent_source
81

82
    lined = r.loadUnsigned()
83
    last = r.loadUnsigned()
84
    numparams = r.u8()
85
    is_vararg = r.u8()
86
    maxstack = r.u8()
87

88
    sizecode = r.loadUnsigned()
89
    code = [r.u32() for _ in range(sizecode)]
90

91
    sizek = r.loadUnsigned()
92
    k = parse_constants(r, sizek)
93

94
    sizeup = r.loadUnsigned()
95
    upvals = [tuple(r.u8() for _ in range(3)) for __ in range(sizeup)]
96

97
    sizep = r.loadUnsigned()
98
    ps = [parse_proto(r, src) for _ in range(sizep)]
99

100
    sizeline = r.loadUnsigned()
101
    _lineinfo = r.read(sizeline)
102

103
    sizeabs = r.loadUnsigned()
104
    for _ in range(sizeabs):
105
        r.loadUnsigned(); r.loadUnsigned()
106

107
    sizeloc = r.loadUnsigned()
108
    for _ in range(sizeloc):
109
        r.loadStringN(); r.loadUnsigned(); r.loadUnsigned()
110

111
    upflag = r.loadUnsigned()
112
    if upflag:
113
        for _ in range(sizeup):
114
            r.loadStringN()
115

116
    return {
117
        "source": src,
118
        "numparams": numparams,
119
        "maxstack": maxstack,
120
        "code": code,
121
        "k": k,
122
        "p": ps,
123
    }
124

125
def decode_inst(raw: int):
126
    # waw VM format
127
    op = raw >> 25
128
    A  = raw & 0xFF
129
    k  = (raw >> 8) & 1
130
    B  = (raw >> 9) & 0xFF
131
    C  = (raw >> 17) & 0xFF
132
    Bx = (raw >> 8) & 0x1FFFF
133
    sBx = Bx - 65535
134
    return op, A, k, B, C, Bx, sBx
135

136
def flatten(root):
137
    out = []
138
    def rec(p):
139
        out.append(p)
140
        for c in p["p"]:
141
            rec(c)
142
    rec(root)
143
    return out
144

145
# ---------- stage2: extract GameConfig fields + enc_flag from root bytecode ----------
146
def extract_config_and_enc(root):
147
    k = root["k"]
148
    code = root["code"]
149

150
    # map string-const bytes -> index
151
    str_to_idx = {}
152
    for i, (t, v) in enumerate(k):
153
        if t == "str" and v is not None:
154
            str_to_idx[v] = i
155

156
    def idx(name: str) -> int:
157
        b = name.encode()
158
        if b not in str_to_idx:
159
            raise ValueError(f"missing const string: {name}")
160
        return str_to_idx[b]
161

162
    idx_key_seed   = idx("key_seed")
163
    idx_target     = idx("target_floor")
164
    idx_boss       = idx("boss_interval")
165
    idx_view       = idx("view_radius")
166
    idx_enc        = idx("enc_flag")
167

168
    # op numbers (from reverse):
169
    OP_LOADI   = 1
170
    OP_SETFIELD= 19
171
    OP_SETLIST = 74
172

173
    config = {}
174

175
    # collect config numeric values (they are set via SETFIELD with const int)
176
    for raw in code:
177
        op, A, kbit, B, C, Bx, sBx = decode_inst(raw)
178
        if op == OP_SETFIELD and B in (idx_key_seed, idx_target, idx_boss, idx_view):
179
            key = k[B][1].decode()
180
            if kbit != 1:
181
                raise ValueError("unexpected: config value not in constants")
182
            val_t, val_v = k[C]
183
            if val_t != "int":
184
                raise ValueError("unexpected: config value not int")
185
            config[key] = int(val_v)
186

187
    # find enc_flag assignment: SETFIELD (key=enc_flag, value=register)
188
    enc_set_pc = None
189
    enc_reg = None
190
    for pc, raw in enumerate(code):
191
        op, A, kbit, B, C, Bx, sBx = decode_inst(raw)
192
        if op == OP_SETFIELD and B == idx_enc and kbit == 0:
193
            enc_set_pc = pc
194
            enc_reg = C
195
            break
196
    if enc_set_pc is None:
197
        raise ValueError("enc_flag assignment not found")
198

199
    # find nearest preceding SETLIST that fills that register-table
200
    setlist_pc = None
201
    n_elems = None
202
    for pc in range(enc_set_pc - 1, -1, -1):
203
        op, A, kbit, B, C, Bx, sBx = decode_inst(code[pc])
204
        if op == OP_SETLIST and A == enc_reg:
205
            setlist_pc = pc
206
            n_elems = B
207
            break
208
    if setlist_pc is None:
209
        raise ValueError("SETLIST for enc_flag not found")
210

211
    # rebuild last LOADI values up to setlist_pc
212
    last_loadi = {}
213
    for raw in code[:setlist_pc+1]:
214
        op, A, kbit, B, C, Bx, sBx = decode_inst(raw)
215
        if op == OP_LOADI:
216
            last_loadi[A] = sBx & 0xFF
217

218
    enc_flag = []
219
    for reg in range(enc_reg + 1, enc_reg + n_elems + 1):
220
        if reg not in last_loadi:
221
            raise ValueError(f"missing LOADI for enc_flag element reg R{reg}")
222
        enc_flag.append(last_loadi[reg])
223

224
    return config, enc_flag
225

226
# ---------- stage3: decrypt ----------
227
def decrypt_flag(config, enc_flag):
228
    seed = config["key_seed"] + config["target_floor"] + config["boss_interval"] + config["view_radius"]
229
    pt = bytes([(enc_flag[i] ^ ((seed + i) % 255)) & 0xFF for i in range(len(enc_flag))])
230
    return pt
231

232
def main():
233
    if len(sys.argv) != 2:
234
        print(f"Usage: {sys.argv[0]} ./game")
235
        sys.exit(1)
236

237
    raw = Path(sys.argv[1]).read_bytes()
238
    dec = decrypt_game(raw)
239

240
    # header
241
    pos = 0
242
    if dec[pos] != 0x1B: raise ValueError("bad signature")
243
    pos += 1
244
    if dec[pos:pos+3] != b"Waw": raise ValueError("not Waw chunk")
245
    pos += 3
246
    pos += 1  # ver
247
    pos += 1  # fmt
248
    pos += 6  # LUAC_DATA
249
    pos += 3  # sizes
250
    pos += 8  # LUAC_INT
251
    pos += 8  # LUAC_NUM
252
    pos += 1  # main_nups
253

254
    r = R(dec, pos)
255
    root = parse_proto(r, None)
256

257
    config, enc_flag = extract_config_and_enc(root)
258
    flag_bytes = decrypt_flag(config, enc_flag)
259
    try:
260
        print(flag_bytes.decode())
261
    except:
262
        print(flag_bytes)
263

264
if __name__ == "__main__":
265
    main()

1
(async () => {
2
  const rpcUrl = `${location.origin}/rpc`;
3
  const provider = new ethers.JsonRpcProvider(rpcUrl);
4

5
  const entrance = "0x39529fdA4CbB4f8Bfca2858f9BfAeb28B904Adc0";
6
  const coin = "0xc5273abfb36550090095b1edec019216ad21be6c";
7

8
  // 1) 常见 ERC20/Ownable 视图函数探测
9
  const erc20 = new ethers.Contract(coin, [
10
    "function name() view returns (string)",
11
    "function symbol() view returns (string)",
12
    "function decimals() view returns (uint8)",
13
    "function totalSupply() view returns (uint256)",
14
    "function balanceOf(address) view returns (uint256)",
15
    "function owner() view returns (address)"
16
  ], provider);
17

18
  const info = {};
19
  for (const f of ["name","symbol","decimals","totalSupply"]) {
20
    try { info[f] = await erc20[f](); } catch { info[f] = "(no)"; }
21
  }
22
  try { info.owner = await erc20.owner(); } catch { info.owner = "(no owner)"; }
23
  try { info.balanceOfEntrance = (await erc20.balanceOf(entrance)).toString(); } catch { info.balanceOfEntrance = "(no balanceOf)"; }
24

25
  console.log("=== ERC20 INFO ===");
26
  console.table(info);
27

28
  // 2) 拉 bytecode，抽出可见 ASCII 字符串（搜 flag/ctf/{/}）
29
  console.log("=== BYTECODE STRINGS (filtered) ===");
30
  const code = await provider.getCode(coin);
31
  console.log("bytecode bytes =", (code.length - 2) / 2);
32

33
  const bytes = ethers.getBytes(code);
34
  let cur = "";
35
  const strs = [];
36
  for (const b of bytes) {
37
    if (b >= 0x20 && b <= 0x7e) cur += String.fromCharCode(b);
38
    else { if (cur.length >= 6) strs.push(cur); cur = ""; }
39
  }
40
  if (cur.length >= 6) strs.push(cur);
41

42
  const hits = strs.filter(s => /flag|ctf|{|}|vidar|punk|coin/i.test(s));
43
  console.log(hits);
44

45
  // 3) 扫前 40 个 storage slot（很多题直接把密文/片段塞这里）
46
  console.log("=== NONZERO STORAGE SLOTS [0..39] ===");
47
  for (let i = 0; i < 40; i++) {
48
    const pos = ethers.toBeHex(i, 32);
49
    const v = await provider.getStorage(coin, pos);
50
    if (v !== "0x" + "0".repeat(64)) {
51
      console.log("slot", i, v);
52
    }
53
  }
54

55
  // 可选：同样扫 entrance 合约（有时 flag 明文在这里）
56
  console.log("=== ENTRANCE BYTECODE STRING HITS ===");
57
  const ecode = await provider.getCode(entrance);
58
  const ebytes = ethers.getBytes(ecode);
59
  let ecur = "";
60
  const estrs = [];
61
  for (const b of ebytes) {
62
    if (b >= 0x20 && b <= 0x7e) ecur += String.fromCharCode(b);
63
    else { if (ecur.length >= 6) estrs.push(ecur); ecur = ""; }
64
  }
65
  if (ecur.length >= 6) estrs.push(ecur);
66
  console.log(estrs.filter(s => /flag|ctf|{|}|vidar|punk|coin/i.test(s)));
67
})();

1
VM382:26
2
(索引)
3
值
4
name  'VidarCoin'
5
symbol  '0x6960606a647c542a413134374d5275626d7e5e6c6f48562a44556258764672502c5d7b5d3537646364377c'
6
decimals  26n
7
totalSupply  0n
8
owner  '(no owner)'
9
balanceOfEntrance  '0'
10
Object
11
VM382:29 === BYTECODE STRINGS (filtered) ===
12
VM382:31 bytecode bytes = 4644
13
VM382:43
14
['{V[___']
15
0
16
:
17
"{V[___"
18
length
19
:
20
1
21
[[Prototype]]
22
:
23
Array(0)
24
VM382:46 === NONZERO STORAGE SLOTS [0..39] ===
25
VM382:51 slot 3 0x5669646172436f696e0000000000000000000000000000000000000000000012
26
VM382:51 slot 4 0x564944415200000000000000000000000000000000000000000000000000000a
27
VM382:51 slot 5 0x0000000000000000000000000000000000000000000000000000000000000057
28
VM382:56 === ENTRANCE BYTECODE STRING HITS ===
29
VM382:66
30
(7) ['{"name":"VidarPunks #', '","description":"VidarPunks Vaul_', 'darCoin.","attributes":[', '{"trait_type":"Linked Coin Addre_', '],"vidar_coin":"', 'V[a"}` ', 'a${Wa$za"']
31
0
32
:
33
"{\"name\":\"VidarPunks #"
34
1
35
:
36
"\",\"description\":\"VidarPunks Vaul_"
37
2
38
:
39
"darCoin.\",\"attributes\":["
40
3
41
:
42
"{\"trait_type\":\"Linked Coin Addre_"
43
4
44
:
45
"],\"vidar_coin\":\""
46
5
47
:
48
"V[a\"}` "
49
6
50
:
51
"a${Wa$za\""
52
length
53
:
54
7
55
[[Prototype]]
56
:
57
Array(0)

1
0x6960606a647c542a413134374d5275626d7e5e6c6f48562a44556258764672502c5d7b5d3537646364377c

1
(() => {
2
  const sym = "0x6960606a647c542a413134374d5275626d7e5e6c6f48562a44556258764672502c5d7b5d3537646364377c";
3
  const enc = ethers.getBytes(sym); // 43 bytes
4

5
  const mask = new Uint8Array(enc.length);
6
  for (let i = 0; i < mask.length; i++) mask[i] = (i % 2 === 0) ? 0x01 : 0x07;
7

8
  const dec = new Uint8Array(enc.length);
9
  for (let i = 0; i < enc.length; i++) dec[i] = enc[i] ^ mask[i];
10

11
  console.log(new TextDecoder().decode(dec));
12
})();

1
objdump -s -j .rodata ./marionette | head -n 20

1
TARGET = 8cadb48febfd6fae8660ad44c3c75a31

1
SEED16 = 5a097c137b8d4f2132be3b19af449c01

1
aesenc     0x70(%r12), %xmm0
2
aesenc     0x80(%r12), %xmm0
3
...
4
aesenclast 0xc0(%r12), %xmm0

1
5a097c137b8d4f2132be3b19af449c0140d7006a3b5a4f4b09e47452a6a0e853
2
a24ced4e9916a20590f2d65736523e04a6fe1f4b3fe8bd4eaf1a6b199948551d
3
fc02bba5c3ea06eb6cf06df2f5b838ef8005644343ef62a82f1f0f5adaa737b5
4
fc9fb114bf70d3bc906fdce64ac8eb5354765cc2eb068f7e7b69539831a1b8cb
5
e61a43050d1ccc7b76759fe347d42728b5d677a5b8cabbdecebf243d896b0315f
6
cad2e02446795dc8ad8b1e103b3b2f4fd9a9179b9fd04a53325b544309607b0b5
7
5f767d0ca272d83f87c79c0f11c02c

1
# solve.py  (pure python, no third-party libs)
2

3
TARGET = bytes.fromhex("8cadb48febfd6fae8660ad44c3c75a31")
4

5
RK_DUMP = bytes.fromhex(
6
"5a097c137b8d4f2132be3b19af449c0140d7006a3b5a4f4b09e47452a6a0e853"
7
"a24ced4e9916a20590f2d65736523e04a6fe1f4b3fe8bd4eaf1a6b199948551d"
8
"fc02bba5c3ea06eb6cf06df2f5b838ef8005644343ef62a82f1f0f5adaa737b5"
9
"fc9fb114bf70d3bc906fdce64ac8eb5354765cc2eb068f7e7b69539831a1b8cb"
10
"e61a43050d1ccc7b76759fe347d42728b5d677a5b8cabbdecebf243d896b0315f"
11
"cad2e02446795dc8ad8b1e103b3b2f4fd9a9179b9fd04a53325b544309607b0b5"
12
"5f767d0ca272d83f87c79c0f11c02c"
13
)
14

15
# --- AES primitives ---
16
SBOX = [
17
0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
18
0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
19
0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
20
0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
21
0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
22
0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
23
0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
24
0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
25
0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
26
0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
27
0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
28
0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
29
0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
30
0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
31
0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
32
0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16
33
]
34
INV = [0]*256
35
for i,v in enumerate(SBOX): INV[v]=i
36

37
def mul(a,b):
38
    r=0
39
    for _ in range(8):
40
        if b&1: r ^= a
41
        hi=a&0x80
42
        a=(a<<1)&0xff
43
        if hi: a ^= 0x1b
44
        b >>= 1
45
    return r
46

47
def inv_shift_rows(s):
48
    for r in range(1,4):
49
        row=[s[c*4+r] for c in range(4)]
50
        row=row[-r:]+row[:-r]
51
        for c in range(4): s[c*4+r]=row[c]
52

53
def inv_sub_bytes(s):
54
    for i in range(16): s[i]=INV[s[i]]
55

56
def inv_mix_columns(s):
57
    for c in range(4):
58
        a0,a1,a2,a3=[s[c*4+r] for r in range(4)]
59
        s[c*4+0]=mul(a0,14)^mul(a1,11)^mul(a2,13)^mul(a3,9)
60
        s[c*4+1]=mul(a0,9)^mul(a1,14)^mul(a2,11)^mul(a3,13)
61
        s[c*4+2]=mul(a0,13)^mul(a1,9)^mul(a2,14)^mul(a3,11)
62
        s[c*4+3]=mul(a0,11)^mul(a1,13)^mul(a2,9)^mul(a3,14)
63

64
def add_rk(s,rk):
65
    for i in range(16): s[i]^=rk[i]
66

67
def aes192_decrypt(ct, round_keys):
68
    s=list(ct)
69
    Nr=len(round_keys)-1
70
    add_rk(s, round_keys[Nr])
71
    inv_shift_rows(s); inv_sub_bytes(s)
72
    for r in range(Nr-1,0,-1):
73
        add_rk(s, round_keys[r])
74
        inv_mix_columns(s); inv_shift_rows(s); inv_sub_bytes(s)
75
    add_rk(s, round_keys[0])
76
    return bytes(s)
77

78
# round keys (13 blocks)
79
RKS=[RK_DUMP[i:i+16] for i in range(0,len(RK_DUMP),16)]
80

81
# Step1: get y
82
y=aes192_decrypt(TARGET,RKS)
83

84
# Step2: invert y[i]=x[i]^x[i-1]
85
x=bytearray(16)
86
x[0]=y[0]
87
for i in range(1,16):
88
    x[i]=y[i]^x[i-1]
89

90
flaghex=x.hex()
91
print("INPUT =", flaghex)
92
print("FLAG  =", f"hgame{{{flaghex}}}")

1
jdh2rzUxbpRxlfFro3YGuhHhmpWq4eHqTvK3N1njLjMnkSUS3I6VDg==

1
public static native void chall_init(boolean z, Context context);
2
public static native String encrypt(byte[] bArr, int i);
3
public static native void makekey();

1
LDRB W8, [byte_505DF0]
2
TBZ  W8,#0, loc_1A5AD0   ; 0 分支
3
...                      ; 1 分支

1
LDRB W8, [SP,#arg_3C]
2
CSET W8, NE
3
STRB W8, [byte_505DF0]

1
fopen("/proc/self/cmdline","r");
2
fread(buf, 1, a2-1, stream);
3
strlen(buf)

1
import base64, struct
2

3
CIPH_B64 = "jdh2rzUxbpRxlfFro3YGuhHhmpWq4eHqTvK3N1njLjMnkSUS3I6VDg=="
4

5
def mix(d, c):
6
    return ((d ^ c) * (~c & 0xFFFFFFFF)) & 0xFFFFFFFF
7

8
POLY = (-713996727) & 0xFFFFFFFF  # 0xD571B5D9
9

10
def crc_custom(data: bytes):
11
    v = 0xFFFFFFFF
12
    for b in data:
13
        v ^= b
14
        for _ in range(8):
15
            v = ((v >> 1) ^ POLY) if (v & 1) else (v >> 1)
16
            v &= 0xFFFFFFFF
17
    return (~v) & 0xFFFFFFFF
18

19
def xxtea_decrypt(v, key, delta):
20
    n = len(v)
21
    rounds = 0x34 // n + 6
22
    summ = (rounds * delta) & 0xFFFFFFFF
23
    y = v[0]
24
    while rounds:
25
        e = (summ >> 2) & 3
26
        for p in range(n - 1, 0, -1):
27
            z = v[p - 1]
28
            mx = (((4*y) ^ (z >> 5)) + ((16*z) ^ (y >> 3))) ^ ((summ ^ y) + (key[(p & 3) ^ e] ^ z))
29
            v[p] = (v[p] - mx) & 0xFFFFFFFF
30
            y = v[p]
31
        z = v[n - 1]
32
        mx = (((4*y) ^ (z >> 5)) + ((16*z) ^ (y >> 3))) ^ ((summ ^ y) + (key[e] ^ z))
33
        v[0] = (v[0] - mx) & 0xFFFFFFFF
34
        y = v[0]
35
        summ = (summ - delta) & 0xFFFFFFFF
36
        rounds -= 1
37
    return v
38

39
# delta: 按 so 里那串 mix 链算出来
40
delta = 0x1A9B8F52
41

42
# cmdline 关键：AppZygote 的名字
43
cmdline = b"com.vidar.chall_zygote"
44
crc = crc_custom(cmdline)
45
key = [crc, crc ^ delta, (crc + delta) & 0xFFFFFFFF, (crc - delta) & 0xFFFFFFFF]
46

47
cipher = base64.b64decode(CIPH_B64)
48
v = list(struct.unpack("<10I", cipher))
49
p = xxtea_decrypt(v, key, delta)
50
plain = struct.pack("<10I", *p).rstrip(b"\x00")
51
print(plain.decode())

1
import zipfile
2

3
A = 1103515245
4
C = 12345
5
MASK = 0xFFFFFFFF
6

7
DB_PATH = r"application-data.db"   # 按你的实际路径改
8
OFFSET = 128
9
KNOWN = b"PK\x03\x04"
10

11
def lcg_next(s: int) -> int:
12
    return (A * s + C) & MASK
13

14
def lcg_prev(s: int, a_inv: int) -> int:
15
    return (a_inv * ((s - C) & MASK)) & MASK
16

17
def recover_seed(cipher: bytes) -> int:
18
    # keystream bytes at positions OFFSET..OFFSET+3
19
    ks = bytes([cipher[OFFSET+i] ^ KNOWN[i] for i in range(4)])
20
    x0, x1, x2, x3 = ks
21

22
    # We brute-force full s_{OFFSET+1} (here s129) consistent with 4 output bytes.
23
    # s129 structure: [high8][x0][low16]
24
    cand_s = None
25
    for high8 in range(256):
26
        base = (high8 << 24) | (x0 << 16)
27
        for low16 in range(65536):
28
            s = base | low16
29
            s1 = lcg_next(s)
30
            if ((s1 >> 16) & 0xFF) != x1:
31
                continue
32
            s2 = lcg_next(s1)
33
            if ((s2 >> 16) & 0xFF) != x2:
34
                continue
35
            s3 = lcg_next(s2)
36
            if ((s3 >> 16) & 0xFF) != x3:
37
                continue
38
            cand_s = s
39
            break
40
        if cand_s is not None:
41
            break
42

43
    if cand_s is None:
44
        raise RuntimeError("No candidate state found. OFFSET/KNOWN might be wrong.")
45

46
    # cand_s is s_{OFFSET+1}. Need to rewind OFFSET+1 steps to get s0
47
    a_inv = pow(A, -1, 2**32)
48
    s = cand_s
49
    for _ in range(OFFSET + 1):
50
        s = lcg_prev(s, a_inv)
51
    return s
52

53
def decrypt(cipher: bytes, seed: int) -> bytes:
54
    s = seed & MASK
55
    out = bytearray(cipher)
56
    for i in range(len(out)):
57
        s = lcg_next(s)
58
        out[i] ^= (s >> 16) & 0xFF
59
    return bytes(out)
60

61
def main():
62
    cipher = open(DB_PATH, "rb").read()
63
    seed = recover_seed(cipher)
64
    plain = decrypt(cipher, seed)
65

66
    if plain[OFFSET:OFFSET+4] != KNOWN:
67
        raise RuntimeError("Decryption failed sanity check (PK header mismatch).")
68

69
    payload = plain[OFFSET:]
70
    open("payload.jar", "wb").write(payload)
71
    print(f"[+] seed = 0x{seed:08x}")
72
    print(f"[+] wrote payload.jar ({len(payload)} bytes)")
73

74
    # quick scan for flag-like strings in classfiles
75
    try:
76
        z = zipfile.ZipFile("payload.jar", "r")
77
        hits = []
78
        for name in z.namelist():
79
            if not name.endswith(".class"):
80
                continue
81
            data = z.read(name)
82
            if b"flag{" in data or b"FLAG{" in data or b"HGAME" in data:
83
                hits.append(name)
84
        print("[+] suspicious classes:")
85
        for h in hits:
86
            print("   ", h)
87
    except Exception as e:
88
        print("[!] zip read failed:", e)
89

90
if __name__ == "__main__":
91
    main()

1
import re
2
import subprocess
3

4
PAYLOAD_JAR = "payload.jar"
5
CLS = "com.seal.ouroboroscore.OuroborosVM"
6

7
DERIVE_KEY = 0x7e40bec8
8
KEYBYTE = DERIVE_KEY & 0xff
9

10
def get_javap():
11
    out = subprocess.check_output(
12
        ["javap", "-classpath", PAYLOAD_JAR, "-c", "-p", CLS],
13
        text=True, errors="ignore"
14
    )
15
    return out
16

17
def extract_firmware_bytes(javap_text: str):
18
    # 从 <clinit> 里找 bipush X + bastore 这种初始化 byte[] 的序列
19
    # 这能稳定拿到 FIRMWARE 的原始字节（有符号）
20
    vals = []
21
    for m in re.finditer(r"bipush\s+(-?\d+)\s*\n\s*\d+:\s*bastore", javap_text):
22
        vals.append(int(m.group(1)) & 0xff)
23
    return bytes(vals)
24

25
def decrypt_firmware(enc: bytes):
26
    return bytes(b ^ KEYBYTE for b in enc)
27

28
def decode_to_flag(fw: bytes):
29
    # 根据你这题的固件结构：是大量重复片段
30
    # PUSH idx; LOAD; PUSH val; XOR; JZ +1; RET
31
    # 先特殊处理开头的 LEN 校验，然后提取每个 idx 的 val
32
    pc = 0
33
    stack = []
34
    expected = {}
35

36
    def read_u16():
37
        nonlocal pc
38
        v = (fw[pc] << 8) | fw[pc+1]
39
        pc += 2
40
        return v
41

42
    while pc < len(fw):
43
        op = fw[pc]; pc += 1
44
        if op == 0x10:      # PUSH imm16
45
            stack.append(read_u16())
46
        elif op == 0x20:    # LEN
47
            # 这里只用于约束长度，提取 flag 不必真的跑
48
            stack.append("LEN")
49
        elif op == 0x30:    # LOAD
50
            idx = stack.pop()
51
            stack.append(("MEM", idx))
52
        elif op == 0x35:    # XOR
53
            b = stack.pop()
54
            a = stack.pop()
55
            # 只识别 (MEM, idx) XOR imm 的形态
56
            if isinstance(a, tuple) and a[0] == "MEM" and isinstance(b, int):
57
                stack.append(("XORCHK", a[1], b))
58
            elif isinstance(b, tuple) and b[0] == "MEM" and isinstance(a, int):
59
                stack.append(("XORCHK", b[1], a))
60
            else:
61
                stack.append(("XOR", a, b))
62
        elif op == 0x4A:    # JZ rel
63
            rel = int.from_bytes(bytes([fw[pc]]), "big", signed=True)
64
            pc += 1
65
            top = stack.pop()
66
            # 如果 top 是 XORCHK(idx, val)，说明这是一个“字符相等性校验”
67
            if isinstance(top, tuple) and top[0] == "XORCHK":
68
                _, idx, val = top
69
                expected[idx] = val
70
            # 真 VM 会根据 top==0 决定跳不跳；提取 flag 不需要真的跳
71
        elif op == 0xFF:    # RET
72
            # 结束或失败返回点，忽略
73
            stack.clear()
74
        else:
75
            # NOP/未知
76
            pass
77

78
    # firmware 首条校验要求长度为 33（你也能从 expected 的最大 idx+1 看出来）
79
    n = max(expected.keys()) + 1
80
    s = "".join(chr(expected.get(i, ord("?"))) for i in range(n))
81
    return s
82

83
if __name__ == "__main__":
84
    javap_text = get_javap()
85
    enc_fw = extract_firmware_bytes(javap_text)
86
    fw = decrypt_firmware(enc_fw)
87
    flag = decode_to_flag(fw)
88
    print(flag)

1
#!/usr/bin/env python3
2
from pwn import remote, context
3
import base64
4
from Crypto.Util.number import bytes_to_long, long_to_bytes
5
from Crypto.Util.Padding import unpad
6

7
HOST, PORT = "1.116.118.188", 32550   # 改成你实际端口
8

9
MENU = b"Your choice > "
10

11
def b64_to_int(line: bytes) -> int:
12
    return bytes_to_long(base64.b64decode(line))
13

14
def recv_menu(io):
15
    io.recvuntil(MENU)
16

17
def encrypt(io, m: int, x: int) -> int:
18
    recv_menu(io)
19
    io.sendline(b"1")
20
    io.recvuntil(b"plz give me your plaintext:\n")          # 吃掉 \n
21
    io.sendline(str(m).encode())
22
    io.recvuntil(b"and the bit you want to flip:\n")        # 吃掉 \n
23
    io.sendline(str(x).encode())
24
    line = io.recvline().strip()
25
    return b64_to_int(line)
26

27
def decrypt(io, c: int) -> bytes:
28
    recv_menu(io)
29
    io.sendline(b"2")
30
    io.recvuntil(b"plz give me your ciphertext:\n")         # 吃掉 \n
31
    io.sendline(str(c).encode())
32
    line = io.recvline().strip()
33
    return base64.b64decode(line)  # safe=False 时被 disguise，但最后 1 字节仍是真实的
34

35
def get_flag_cipher(io) -> int:
36
    recv_menu(io)
37
    io.sendline(b"3")
38
    line = io.recvline().strip()
39
    return b64_to_int(line)
40

41
def main():
42
    context.log_level = "debug"  # 想看交互就改成 debug
43
    io = remote(HOST, PORT)
44

45
    # 1) 恢复 n：Encrypt(-1, x=1) => (-1)^(odd) = n-1
46
    n_minus_1 = encrypt(io, -1, 1)
47
    n = n_minus_1 + 1
48
    print(f"[+] n bitlen = {n.bit_length()}")
49

50
    # 2) 计算 g = 256^e mod n
51
    t = encrypt(io, 256, 0)      # 256^(e-1) mod n (因为 e 必为奇数，e xor 1 = e-1)
52
    g = (t * 256) % n            # 256^e mod n
53

54
    # 3) 拿到 flag 密文（之后 safe=False）
55
    c0 = get_flag_cipher(io)
56

57
    inv_n_256 = pow(n % 256, -1, 256)
58
    k = (n.bit_length() + 7) // 8  # 1024-bit 一般 128 轮；不稳就 k += 2
59

60
    q = 0
61
    c = c0
62
    for i in range(1, k + 1):
63
        c = (c * g) % n
64
        pt = decrypt(io, c)
65
        lsb = pt[-1]                       # 真实的 (m*256^i mod n) 的最低字节
66
        digit = (-lsb * inv_n_256) % 256   # 得到 q_i 的最低 base256 位
67
        q = q * 256 + digit
68

69
    B = 256 ** k
70
    m = (q * n + B - 1) // B               # m = ceil(q*n / 256^k)
71

72
    flag_padded = long_to_bytes(m, 127)
73
    try:
74
        flag = unpad(flag_padded, 127)
75
    except ValueError:
76
        flag = flag_padded
77

78
    print("[+] flag =", flag.decode(errors="ignore"))
79
    io.close()
80

81
if __name__ == "__main__":
82
    main()

1
[DEBUG] Received 0x41 bytes:
2
    b'\n'
3
    b'1. Encrypt message\n'
4
    b'2. Decrypt message\n'
5
    b'3. Get flag\n'
6
    b'Your choice > '
7
[+] flag = hgame{E2RSA_1s_sTll1_PREttY-ez,riGht?41edd1}
8
[*] Closed connection to 1.116.118.188 port 32550

1
# -*- coding: utf-8 -*-
2
import zlib, pickletools, base64, hashlib
3
import sympy as sp
4
import requests
5
from Crypto.Cipher import AES
6
from Crypto.Util.Padding import unpad
7
from Crypto.Util.number import long_to_bytes
8

9
DATA_PATH = "data.sobj"
10
CIPH_B64 = "ieJNk5335o9lCy6Ar2XymrDy+HVHcQhikluNSra0kBafw1WDCyyuNPkLACeBsavy"
11

12
# ====== 你的 FactorDB 两个 162 位因子 ======
13
P_STR = "282964522500710252996522860321128988886949295243765606602614844463493284542147924563568163094392590450939540920228998768405900675902689378522299357223754617695943"
14
Q_STR = "511405127645157121220046316928395473344738559750412727565053675377154964183416414295066240070803421575018695355362581643466329860038567115911393279779768674224503"
15
# =========================================
16

17
ALPH32 = set("0123456789abcdefghijklmnopqrstuv")
18

19

20
# ---------- 读取 data.sobj ----------
21
def extract_ints_from_sobj(path):
22
    raw = open(path, "rb").read()
23
    try:
24
        dec = zlib.decompress(raw)
25
    except zlib.error:
26
        dec = raw
27

28
    nums = []
29
    for op, arg, pos in pickletools.genops(dec):
30
        if op.name in ("BINUNICODE", "SHORT_BINUNICODE", "UNICODE"):
31
            if isinstance(arg, str) and len(arg) > 10 and set(arg) <= ALPH32:
32
                nums.append(int(arg, 32))
33
    return nums
34

35

36
def parse_n_a_b(nums):
37
    if not nums:
38
        raise ValueError("no integers extracted from data.sobj")
39

40
    # n 是最大的那个
41
    idx_n = max(range(len(nums)), key=lambda i: nums[i].bit_length())
42
    n = nums[idx_n]
43
    det_a = nums[idx_n + 1] % n
44

45
    # 找第二个 n（Sage pickle 常见：会重复存 modulus）
46
    idx_n2 = None
47
    for j in range(idx_n + 2, min(idx_n + 60, len(nums))):
48
        if nums[j] == n:
49
            idx_n2 = j
50
            break
51
    if idx_n2 is None:
52
        idx_n2 = idx_n + 2  # 兜底
53

54
    a_entries = nums[idx_n2 + 1: idx_n2 + 5]
55
    det_b = nums[idx_n2 + 5] % n
56
    b_entries = nums[idx_n2 + 6: idx_n2 + 10]
57

58
    if len(a_entries) != 4 or len(b_entries) != 4:
59
        raise ValueError(f"parse failed: got a={len(a_entries)} b={len(b_entries)}")
60

61
    a = [[a_entries[0] % n, a_entries[1] % n],
62
         [a_entries[2] % n, a_entries[3] % n]]
63
    b = [[b_entries[0] % n, b_entries[1] % n],
64
         [b_entries[2] % n, b_entries[3] % n]]
65
    return n, a, b, det_a, det_b
66

67

68
# ---------- FactorDB 因子分解（递归展开） ----------
69
def factordb_query(n: int):
70
    url = f"http://factordb.com/api?query={n}"
71
    return requests.get(url, timeout=20).json()
72

73

74
def factordb_factorint(n: int):
75
    """
76
    返回 dict: {prime_or_prp: exp, ...}
77
    FactorDB 可能返回合数因子，这里递归展开。
78
    """
79
    j = factordb_query(n)
80
    status = j.get("status", "")
81

82
    if status in ("P", "PRP"):
83
        return {n: 1}
84

85
    factors = j.get("factors", [])
86
    if not factors:
87
        # fallback：本地试一下
88
        return sp.factorint(n)
89

90
    out = {}
91
    for f_str, e_str in factors:
92
        f = int(f_str)
93
        e = int(e_str)
94
        sub = factordb_factorint(f) if f != n else sp.factorint(f)
95
        for pp, ee in sub.items():
96
            out[pp] = out.get(pp, 0) + ee * e
97
    return out
98

99

100
# ---------- 由 (p-1) 的分解快速求元素阶 ----------
101
def element_order_from_pminus1(g: int, p: int, fac_p1: dict):
102
    """
103
    g in F_p^*, order | (p-1)
104
    用 fac(p-1) 逐步约简阶，避免 sympy.n_order 卡在分解。
105
    返回 (ord, ord_factorization_dict)
106
    """
107
    order = p - 1
108
    ord_fac = dict(fac_p1)  # prime->exp
109

110
    for r in list(ord_fac.keys()):
111
        e = ord_fac[r]
112
        for _ in range(e):
113
            if order % r != 0:
114
                break
115
            cand = order // r
116
            if pow(g, cand, p) == 1:
117
                order = cand
118
                ord_fac[r] -= 1
119
                if ord_fac[r] == 0:
120
                    del ord_fac[r]
121
            else:
122
                break
123

124
    if pow(g, order, p) != 1:
125
        raise ValueError("order computation failed (sanity check)")
126
    return int(order), ord_fac
127

128

129
# ---------- dlog：用 SymPy 内部 Pohlig–Hellman ----------
130
def dlog_pohlig_hellman_prime(p: int, g: int, h: int, order: int, order_factors: dict):
131
    """
132
    solve g^x = h (mod p) in subgroup of size 'order'
133
    """
134
    from sympy.ntheory.residue_ntheory import _discrete_log_pohlig_hellman
135
    return int(_discrete_log_pohlig_hellman(p, h, g, int(order), order_factors))
136

137

138
def recover_k_mod_prime(p: int, det_a: int, det_b: int):
139
    da = det_a % p
140
    db = det_b % p
141
    if da == 0 or db == 0:
142
        raise ValueError("det is 0 mod prime, determinant method not applicable")
143

144
    fac_p1 = factordb_factorint(p - 1)           # 用 FactorDB 快速分解 p-1
145
    ord_da, fac_ord = element_order_from_pminus1(da, p, fac_p1)
146

147
    print(f"    [mod prime] ord(det_a) bitlen = {ord_da.bit_length()}")
148

149
    k_mod = dlog_pohlig_hellman_prime(p, da, db, ord_da, fac_ord)
150
    return k_mod, ord_da
151

152

153
# ---------- 通用 CRT（支持模数不互素） ----------
154
def egcd(a, b):
155
    if b == 0:
156
        return a, 1, 0
157
    g, x1, y1 = egcd(b, a % b)
158
    return g, y1, x1 - (a // b) * y1
159

160

161
def crt_general(a1, m1, a2, m2):
162
    """
163
    解:
164
      x ≡ a1 (mod m1)
165
      x ≡ a2 (mod m2)
166
    返回 (x0, lcm) 其中 x ≡ x0 (mod lcm)
167
    若无解抛异常
168
    """
169
    a1 %= m1
170
    a2 %= m2
171
    g, s, t = egcd(m1, m2)
172
    if (a2 - a1) % g != 0:
173
        raise ValueError("CRT: inconsistent congruences")
174

175
    lcm = m1 // g * m2
176
    # x = a1 + m1 * k
177
    # m1*k ≡ (a2-a1) (mod m2)
178
    k = ((a2 - a1) // g * s) % (m2 // g)
179
    x = (a1 + m1 * k) % lcm
180
    return x, lcm
181

182

183
def lift_k_with_crt(congs):
184
    r, M = congs[0]
185
    for r2, m2 in congs[1:]:
186
        r, M = crt_general(r, M, r2, m2)
187
    return r, M
188

189

190
# ---------- 找 1000-bit prime 的 k 并解密 ----------
191
def find_1000bit_prime_candidates(r, M):
192
    lo = 1 << 999
193
    hi = 1 << 1000
194

195
    t0 = (lo - r + M - 1) // M
196
    cands = []
197
    for t in range(max(0, t0 - 3), t0 + 20):
198
        k = r + t * M
199
        if lo <= k < hi and sp.isprime(k):
200
            cands.append(k)
201
    return cands
202

203

204
def decrypt_flag(k):
205
    key = hashlib.md5(long_to_bytes(k)).digest()
206
    ct = base64.b64decode(CIPH_B64)
207
    pt = AES.new(key, AES.MODE_ECB).decrypt(ct)
208
    try:
209
        return unpad(pt, 16)
210
    except ValueError:
211
        return pt
212

213

214
def main():
215
    p = int(P_STR)
216
    q = int(Q_STR)
217

218
    nums = extract_ints_from_sobj(DATA_PATH)
219
    n, a, b, det_a, det_b = parse_n_a_b(nums)
220

221
    print("[+] n bitlen =", n.bit_length())
222
    print("[+] det_a bitlen =", det_a.bit_length())
223
    print("[+] det_b bitlen =", det_b.bit_length())
224
    print("[+] check p*q == n ?", (p * q == n))
225

226
    print("[*] solving discrete log mod p...")
227
    kp, mp = recover_k_mod_prime(p, det_a, det_b)
228
    print("    k ≡", kp, "(mod", mp, ")")
229

230
    print("[*] solving discrete log mod q...")
231
    kq, mq = recover_k_mod_prime(q, det_a, det_b)
232
    print("    k ≡", kq, "(mod", mq, ")")
233

234
    r, M = lift_k_with_crt([(kp, mp), (kq, mq)])
235
    print("[+] combined: k ≡ r (mod M)")
236
    print("    M bitlen =", M.bit_length())
237

238
    cands = find_1000bit_prime_candidates(r, M)
239
    print("[+] prime candidates:", len(cands))
240

241
    for i, k in enumerate(cands):
242
        flag = decrypt_flag(k)
243
        print(f"[+] cand {i}: k bitlen={k.bit_length()}  decrypted={flag}")
244
        if isinstance(flag, (bytes, bytearray)) and (b"{" in flag or b"flag" in flag or b"HGAME" in flag):
245
            break
246

247

248
if __name__ == "__main__":
249
    main()

1
[+] n bitlen = 1074
2
[+] det_a bitlen = 1071
3
[+] det_b bitlen = 1072
4
[+] check p*q == n ? True
5
[*] solving discrete log mod p...
6
    [mod prime] ord(det_a) bitlen = 536
7
    k ≡ 52667753106966975782716551178346612993779763057471591956442663755590760938250730438530201096693603009616300385149850720497921006714509073486101967205417901945848 (mod 141482261250355126498261430160564494443474647621882803301307422231746642271073962281784081547196295225469770460114499384202950337951344689261149678611877308847971 )
8
[*] solving discrete log mod q...
9
    [mod prime] ord(det_a) bitlen = 538
10
    k ≡ 97793690266943406431658643072078654035411321038962116230462569216011685651545408039832085776884476346748323733709768043043618444157526539743259646621167459948583 (mod 511405127645157121220046316928395473344738559750412727565053675377154964183416414295066240070803421575018695355362581643466329860038567115911393279779768674224502 )
11
[+] combined: k ≡ r (mod M)
12
    M bitlen = 1073
13
[+] prime candidates: 1
14
[+] cand 0: k bitlen=1000  decrypted=b'hgame{1s_m@trix_d1p_rEal1y_sImpLe??}'