Jumble_Mumble_solver.py (python 3)

Jumble_Mumble_solver.py

import struct
import hashlib

def ROR(x, n):
    return ((x >> n) | (x << (32 - n))) & 0xFFFFFFFF
    
def ROL(x, n):
    return ((x << n) | ((x) >> (32-(n)))) & 0xFFFFFFFF
    
def matrix_print(matrix):
    for x in range(len(matrix[0])):
        line1 = ''
        for y in range(len(matrix)):
           line1 += ' {0:02X}'.format(matrix[x][y])
        print(line1)
        
def matrix_inv(matrix):
    result = [[0 for x in range(len(matrix[0]))] for x in range(len(matrix))] 
    
    for x in range(len(matrix[0])):
        for y in range(len(matrix)):
            result[x][y] = matrix[y][len(matrix[0]) - x - 1]
    return result
    
def matrix_modify(counter, matrix):
    
    result = 0
    
    r_matrix = [[0 for x in range(len(matrix[0]))] for x in range(len(matrix))] 
    
    for y in range(len(matrix)):
    
        a1,a2,a3,a4 = struct.unpack_from("<LLLL", bytearray(matrix[y]))

        c0 = counter & 0x1F
        if (counter & 0x3F) > 31:
            if c0 > 15:
                result = (a3 ^ (a2 | ~a4)) & 0xFFFFFFFF
                result = (ROR(result, 0x19) ^ a1) & 0xFFFFFFFF
            else:
                
                result = (a2 ^ a4 ^ a3) & 0xFFFFFFFF
                result = (ROR(result, 0x19) ^ a1) & 0xFFFFFFFF
        elif c0 > 15:
            result = (a3 & ~a4 | a4 & a2) & 0xFFFFFFFF
            result = (ROR(result, 0x19) ^ a1) & 0xFFFFFFFF
        else:
            result = (a3 & a2 | a4 & ~a2) & 0xFFFFFFFF
            result = (ROR(result, 0x19) ^ a1) & 0xFFFFFFFF
            
        result = (result + a2) & 0xFFFFFFFF
        result = struct.pack("<LLLL", a4,result,a2,a3)

        for i in range(len(result)):
            r_matrix[y][i] = result[i]

    return r_matrix
    
def reversed_matrix_inv(matrix):
    result = [[0 for x in range(len(matrix[0]))] for x in range(len(matrix))] 
    
    for x in range(len(matrix[0])):
        for y in range(len(matrix)):
            result[y][x] = matrix[len(matrix[0]) - x - 1][y]
    return result   
    
def reversed_matrix_modify(counter, matrix):
    
    result = 0
    
    r_matrix = [[0 for x in range(len(matrix[0]))] for x in range(len(matrix))] 
    
    for y in range(len(matrix)):
    
        a4,r0,a2,a3 = struct.unpack_from("<LLLL", bytearray(matrix[y]))
        
        r0 = (r0 - a2) & 0xFFFFFFFF
        
        c0 = counter & 0x1F
        if (counter & 0x3F) > 31:
            if c0 > 15:
                r1 = (a3 ^ (a2 | ~a4)) & 0xFFFFFFFF
                a1 = (ROR(r1, 0x19) ^ r0) & 0xFFFFFFFF
            else:
                r1 = (a2 ^ a4 ^ a3) & 0xFFFFFFFF
                a1 = (ROR(r1, 0x19) ^ r0) & 0xFFFFFFFF
        elif c0 > 15:
            r1 = (a3 & ~a4 | a4 & a2) & 0xFFFFFFFF
            a1 = (ROR(r1, 0x19) ^ r0) & 0xFFFFFFFF
        else:
            r1 = (a3 & a2 | a4 & ~a2) & 0xFFFFFFFF
            a1 = (ROR(r1, 0x19) ^ r0) & 0xFFFFFFFF
            
        result = struct.pack("<LLLL", a1,a2,a3,a4)

        for i in range(len(result)):
            r_matrix[y][i] = result[i]

    return r_matrix    
    
def main():


    expected_result = [[0x54,0x68,0x65,0x20,0x66,0x6C,0x61,0x67,0x20,0x69,0x73,0x20,0x2A,0x6E,0x6F,0x74],
    [0x2A,0x20,0x70,0x6F,0x6F,0x70,0x2C,0x20,0x62,0x75,0x74,0x20,0x79,0x6F,0x75,0x20],
    [0x63,0x61,0x6E,0x20,0x74,0x72,0x79,0x20,0x74,0x68,0x61,0x74,0x20,0x61,0x6E,0x79],
    [0x77,0x61,0x79,0x20,0x62,0x65,0x63,0x61,0x75,0x73,0x65,0x20,0x79,0x6F,0x75,0x20],
    [0x73,0x74,0x72,0x69,0x6E,0x67,0x73,0x27,0x64,0x20,0x74,0x68,0x69,0x73,0x20,0x62],
    [0x69,0x6E,0x61,0x72,0x79,0x20,0x61,0x6E,0x64,0x20,0x73,0x61,0x77,0x20,0x73,0x6F],
    [0x6D,0x65,0x74,0x68,0x69,0x6E,0x67,0x20,0x74,0x68,0x61,0x74,0x20,0x6C,0x6F,0x6F],
    [0x6B,0x65,0x64,0x20,0x69,0x6E,0x74,0x65,0x72,0x65,0x73,0x74,0x69,0x6E,0x67,0x20],
    [0x61,0x6E,0x64,0x20,0x6A,0x75,0x73,0x74,0x20,0x68,0x61,0x64,0x20,0x74,0x6F,0x20],
    [0x74,0x72,0x79,0x20,0x69,0x74,0x2E,0x2E,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00],
    [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]]

    matrix_print(expected_result)
    
    new1 = expected_result
    for i in reversed(range(0x80)):
        new1 = reversed_matrix_inv(new1)
        new1 = reversed_matrix_modify(i, new1)
    print('----')
    matrix_print(new1)
    
    str1 = ''
    for x in range(len(new1[0])):
        for y in range(len(new1)):
            str1 += '{0:02x}'.format(new1[x][y])
    
    str1 = str1.strip('0')
    
    md5 = hashlib.md5()
    md5.update(str1.encode('ascii'))
    print('----')
    print("Plaid CTF 2015 Jumble Mumble flag: {0:s}".format(md5.hexdigest()))

    '''
    for i in range(0x80):
        new1 = matrix_modify(i, new1)
        new1 = matrix_inv(new1)
    print('----')
    matrix_print(new1)
    '''
    
if __name__ == '__main__':
    main()