Skip to content

Instantly share code, notes, and snippets.

@00xc

00xc/solve.py Secret

Created December 22, 2020 12:09
Show Gist options
  • Save 00xc/f9b0a7734a3ec0f2c7cb6af7e523f9c6 to your computer and use it in GitHub Desktop.
Save 00xc/f9b0a7734a3ec0f2c7cb6af7e523f9c6 to your computer and use it in GitHub Desktop.
hxp CTF 2020 - EXCELlent
from constraint import *
h7_table = [17, 34, 51, 68, 85]
def h7(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ h7_table[cnt]) >> 2) % 256
return (((serial[cnt] ^ h7_table[cnt]) >> 2) + h7(serial, cnt-1)) % 256
i11_table = [17, 34, 51, 68]
def i11(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ i11_table[cnt]) >> 2) % 256
return ( ((serial[cnt] ^ i11_table[cnt]) >> 2) + i11(serial, cnt-1) ) % 256
j15_table = [17, 34, 51, 68]
def j15(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ j15_table[cnt]) >> 2) % 256
return ( ((serial[cnt] ^ j15_table[cnt]) >> 2) + j15(serial, cnt-1) ) % 256
h20_table = [17, 34, 51, 68, 85]
def h20(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ h20_table[cnt]) >> 2) % 256
return (((serial[cnt] ^ h20_table[cnt]) >> 2) + h20(serial, cnt-1)) % 256
table_a = [6, 5, 4, 3, 2, 1, 0, 8, 7, 6, 5, 4, 3, 2, 1, 0, 8, 7]
table_b = [2, 3, 4, 5, 6, 7, 8, 0, 1, 2, 3, 4, 5, 6, 7, 8, 0, 1]
def nfunc(letter, n):
return ((letter >> table_b[n]) & 255) | ((letter << table_a[n]) & 255)
table_k7 = [85, 68, 51, 34 ,17]
def k7(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ table_k7[cnt]) << 2) % 256
return (((serial[cnt] ^ table_k7[cnt]) << 2) + k7(serial, cnt-1)) % 256
table_m15 = [68, 51, 34, 17]
def m15(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ table_m15[cnt]) << 2) % 256
return (((serial[cnt] ^ table_m15[cnt]) << 2) + m15(serial, cnt-1)) % 256
table_l11 = [68, 51, 34, 17]
def l11(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ table_l11[cnt]) << 2) % 256
return (((serial[cnt] ^ table_l11[cnt]) << 2) + l11(serial, cnt-1)) % 256
table_l20 = [85, 68, 51, 34, 17]
def l20(serial, cnt):
if cnt == 0:
return ((serial[cnt] ^ table_l20[cnt]) << 2) % 256
return (((serial[cnt] ^ table_l20[cnt]) << 2) + l20(serial, cnt-1)) % 256
if __name__ == '__main__':
p = Problem()
p.addVariables(range(0, 18), range(65, 91)) # G21
p.addConstraint(lambda *serial: sum(serial[0:5]) - sum(serial[5:9]) + sum(serial[9:13]) - sum(serial[13:]) - 14 == 0) # F24
p.addConstraint(lambda *serial: sum(serial) % 256 == 57, [0, 5, 9, 13]) # M3
p.addConstraint(lambda *serial: sum(serial) % 256 == 38, [1, 6, 10, 14]) # M4
p.addConstraint(lambda *serial: sum(serial) % 256 == 57, [2, 7, 11, 15]) # M5
p.addConstraint(lambda *serial: sum(serial) % 256 == 47, [3, 8, 12, 16]) # M6
p.addConstraint(lambda *serial: sum(serial) % 256 == 169, [4, 17]) # M7
p.addConstraint(lambda *serial: sum(serial) % 256 == 62, [1, 2, 15, 16]) # R3
p.addConstraint(lambda *serial: h7(serial, 4) in (81, 87), [0,1,2,3,4]) # H7
p.addConstraint(lambda *serial: i11(serial, 3) == 79, [5,6,7,8]) # I11
p.addConstraint(lambda *serial: j15(serial, 3) == 74, [9,10,11,12]) # J15
p.addConstraint(lambda *serial: h20(serial, 4) == 82, [13,14,15,16,17]) # H20
p.addConstraint(lambda a, b: (nfunc(a, 4) ^ nfunc(b, 13)) == 116, [4, 13]) # P7
p.addConstraint(lambda a, b, c, d: ( (nfunc(a, 0) ^ nfunc(b, 17)) ^ (nfunc(c, 8) ^ nfunc(d, 9)) ) == 133, [0,17,8,9]) # Q3
p.addConstraint(lambda a, b, c, d: ( (nfunc(a, 1) ^ nfunc(b, 16)) ^ (nfunc(c, 7) ^ nfunc(d, 10)) ) == 225, [1,16,7,10]) # Q4
p.addConstraint(lambda a, b, c, d: ( (nfunc(a, 2) ^ nfunc(b, 15)) ^ (nfunc(c, 6) ^ nfunc(d, 11)) ) == 163, [2,15,6,11]) # Q5
p.addConstraint(lambda a, b, c, d: ( (nfunc(a, 3) ^ nfunc(b, 14)) ^ (nfunc(c, 5) ^ nfunc(d, 12)) ) == 212, [3,14,5,12]) # Q6
p.addConstraint(lambda *serial: k7(serial, 4) == 248, [0,1,2,3,4]) # K7
p.addConstraint(lambda *serial: l11(serial, 3) == 36, [5,6,7,8]) # L11
p.addConstraint(lambda *serial: m15(serial, 3) == 176, [9,10,11,12]) # M15
p.addConstraint(lambda *serial: l20(serial, 4) == 60, [13,14,15,16,17]) # L20
solution = p.getSolution()
out = [chr(solution[c]) for c in sorted(solution)]
print("-".join(("".join(out[:5]), "".join(out[5:9]), "".join(out[9:13]), "".join(out[13:]))))
# Result: VLLKZ-JKNF-RCGP-GLXNO
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment