View glitchtarget.ino
#include <Hash.h>
void setup() {
Serial.begin(9600);
Serial.println("Welcome to the glitchtastic adventure!");
}
int g1 = 0;
String data = "A";
View 34c3-morph.py
#!/usr/bin/python -w
f = open("1.bin","rb")
data = f.read()
f.close()
out = ""
for i in range(0,23):
ref_char = data[(i * 17) + 4]
View tuctf-neverending.py
#!/usr/bin/python
import pwn
target = "a?!=-,':_ .%($&/+)!0*#;$!"
soln = {}
p = pwn.remote("neverending.tuctf.com",12345)
View tuctf-grammarless-z3.py
#!/usr/bin/env python
# checkkey(S,R) :- lt_paren(S,S1), key(S1,S2,V1), rt_paren(S2,R), V1 is 82944.
# key(S,R,V) :- oct(S,S1,V1), amper(S1,S2), oct(S2,R,V2), V is V1 * V2.
# oct(S,R,V) :- quad(S,S1,V1), hyphen(S1,S2), quad(S2,R,V2), V is V1 + V2.
# quad(S,R,V) :- pair(S,S1,V1), comma(S1,S2), pair(S2,R,V2), V is V1* V2.
# pair(S,R,V) :- digit(S,S1,V1), digit(S1,R,V2), V is V1 + V2.
# nc grammarlesson.tuctf.com 6661
# (96,57-57,72&35,53-79,77)
View tuctf-future-z3.py
#!/usr/bin/env python
from z3 import *
import string
solver = z3.Solver()
for x in range(0,5):
for y in range(0,5):
varname = "mat_%i_%i" % (x,y)
globals()[varname] = BitVec(varname,32)
View flash_suppressor.v
`timescale 1ns / 1ps
module flash_suppressor(
input youre_not_the_boss_of_me_in,
input sw0_in,
output[3:0] lights,
output glitch_out
);
reg [31:0] glitch_status = 32'b0;
View m3_programmer.py
#!/usr/bin/env python
import sys
import struct
# use arm-linux-gnueabi-as / ld / objcopy to spit out bin files.
print "\n -- m3 programmer -- \n"
f = open("a.bin","rb")
View klctf-backdoor-pi.py
#!/usr/bin/python
import hashlib
import sys
i = 0
while i < 99999999:
pincode = "%08d" % i
val = '{}:{}'.format("b4ckd00r_us3r",pincode)
key = hashlib.sha256(val).hexdigest()
View flashkit.py
#!/usr/bin/python
# SPI MX25L6405D (8MB)
# ALL ABOARD THE MAGIC SCHOOL BUS
import sys
import struct
lastpkt = 0
pkt_mosi = []
View twctf-rev.py
#!/usr/bin/python
import angr
import simuvex
p = angr.Project('rev')
#p.hook(0x400520,hooked_ptrace)
pg = p.factory.path_group()
pg.explore(find=0x08048679)
s = pg.found[0].state