-
-
Save 00xc/2037a7d5e9887bba256705b7891c16fd to your computer and use it in GitHub Desktop.
UMassCTF 2021 - Chains: solution script
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import itertools | |
import sys | |
import subprocess | |
import shlex | |
from functools import lru_cache | |
# Array of values used, as an array of bytes | |
from arr import arr as ar | |
def grouper(n, iterable, fillvalue=None): | |
args = [iter(iterable)] * n | |
return itertools.zip_longest(*args, fillvalue=fillvalue) | |
@lru_cache(maxsize=4096*2) | |
def get_pos(v1, v2): | |
cmd = "sed -n '{} p' vals/{}.out".format(v2, v1) | |
s = subprocess.run(shlex.split(cmd), stdout=subprocess.PIPE, stderr=subprocess.PIPE) | |
o, _ = map(int, s.stdout.decode().split()) | |
return o | |
if __name__ == '__main__': | |
# Convert the array of bytes into an array of ints | |
arr = [] | |
for grp in grouper(4, ar): | |
if None in grp: | |
arr.append(0) | |
else: | |
arr.append(int.from_bytes(grp, "little")) | |
i = 0 | |
flag = "" | |
while True: | |
if i > 0x29f7: | |
flag += ord(10) | |
print(ord(10)) | |
break | |
print(i, end="\r") | |
try: | |
v1 = arr[i] | |
v2 = arr[i+1] | |
except: | |
print(flag) | |
sys.exit() | |
j = get_pos(v1, v2) | |
flag += chr((j + 0xca5b17ff) % 256) | |
i += 2 | |
print("") | |
print(flag) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment