tumctf-zwiebel.py

#!/usr/bin/python

import sys
import struct
import binascii

f = open("result.bin")
data = bytearray(f.read())
f.close()

lastChunkSize = 0xFFFFFFFF
# rules = []

flag = bytearray("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

f3 = open("rules.lst","w")

oldkey = flag[0x1D]
newkey = oldkey & 2
flag[0x1D] = chr(newkey)

def seekKey(location):
  for i in range(0,100):
    if data[location+i:location+i+2] == bytearray("\x8A\x40") and data[location+i+3] == 0x24 and data[location+i+5] == 0x74:
      if data[location+i+5] == 0x74:
        char_array = data[location+i+2]
        char_value = data[location+i+4]
        oldkey = flag[char_array]
        if oldkey & char_value == 0:
          newkey = oldkey + char_value
        else:
          newkey = oldkey
        flag[char_array] = chr(newkey)
        f3.write("flag[0x%x] & 0x%x != 0\n" % (char_array,char_value))
      elif data[location+i+5] == 0x75:
        f3.write("flag[0x%x] & 0x%x == 0\n" % (char_array,char_value))
      else:
        print "DAFUQ?"
        sys.exit(0)
      return

def decryptChunk(location):
  if location == 0:
    return False
  nextChunkSize = struct.unpack("I",data[location:location+4])[0]
  nextXorKey = struct.unpack("I",data[location+4:location+8])[0]
  print "next chunk is 0x%08x, key 0x%08x, decrypting..." % (nextChunkSize,nextXorKey)
  # x = raw_input().rstrip()
  # if x == 'y':
  if nextChunkSize < lastChunkSize:
    for i in range(2,nextChunkSize):
      nextDataBlock = struct.unpack("I",data[location + (i*4):location + ((i +1) * 4)])[0]
      nextData = nextDataBlock ^ nextXorKey
      nextDataWrite = struct.pack("I",nextData)
      data[location + (i*4):location + ((i +1) * 4)] = nextDataWrite
    seekKey(location + 4)
    return True
  else:
    return False
  #else:
  #  return 0

def seekNext(offset):
  for i in range(offset + 1,len(data)):
    # print data[i:i+12]
    if data[i:i+12] == bytearray("\xB8\x3C\x00\x00\x00\xBF\x01\x00\x00\x00\x0F\x05"):
      # print "found, offset %d" % (i+12)
      return i + 12
  return 0

offset = 0x49
r = True
while r:
  r = decryptChunk(offset)
  offset = seekNext(offset)

print "done, writing to file..."
f2 = open("out.bin","wb")
f2.write(data)
f2.close()

f3.close()

print flag