Skip to content

Instantly share code, notes, and snippets.

@00xc

00xc/solve.py Secret

Last active March 29, 2021 18:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 00xc/2037a7d5e9887bba256705b7891c16fd to your computer and use it in GitHub Desktop.
Save 00xc/2037a7d5e9887bba256705b7891c16fd to your computer and use it in GitHub Desktop.
UMassCTF 2021 - Chains: solution script
import itertools
import sys
import subprocess
import shlex
from functools import lru_cache
# Array of values used, as an array of bytes
from arr import arr as ar
def grouper(n, iterable, fillvalue=None):
args = [iter(iterable)] * n
return itertools.zip_longest(*args, fillvalue=fillvalue)
@lru_cache(maxsize=4096*2)
def get_pos(v1, v2):
cmd = "sed -n '{} p' vals/{}.out".format(v2, v1)
s = subprocess.run(shlex.split(cmd), stdout=subprocess.PIPE, stderr=subprocess.PIPE)
o, _ = map(int, s.stdout.decode().split())
return o
if __name__ == '__main__':
# Convert the array of bytes into an array of ints
arr = []
for grp in grouper(4, ar):
if None in grp:
arr.append(0)
else:
arr.append(int.from_bytes(grp, "little"))
i = 0
flag = ""
while True:
if i > 0x29f7:
flag += ord(10)
print(ord(10))
break
print(i, end="\r")
try:
v1 = arr[i]
v2 = arr[i+1]
except:
print(flag)
sys.exit()
j = get_pos(v1, v2)
flag += chr((j + 0xca5b17ff) % 256)
i += 2
print("")
print(flag)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment