Created
September 29, 2019 21:27
-
-
Save KaoRz/1a4acd946689cb44f89b1ccebed96bd3 to your computer and use it in GitHub Desktop.
bmphide solver - Flare-On 2019 CTF
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Drawing; | |
using System.IO; | |
namespace BMPExtractor { | |
internal class Program { | |
private static int len_key = 6; | |
private static byte[] ExtractBytes(Bitmap bm) | |
{ | |
byte[] data = new byte[len_key]; | |
int num = 0; | |
for (int i = 0; i < bm.Width; i++) | |
{ | |
for (int j = 0; j < bm.Height; j++) | |
{ | |
if (num >= len_key) | |
break; | |
Color pixel = bm.GetPixel(i, j); | |
data[num] = (byte)((pixel.R & 7) | ((pixel.G & 7) << 3) | ((pixel.B & 3) << 6)); | |
num++; | |
} | |
} | |
return data; | |
} | |
private static byte Reverse_b(byte target, int num) | |
{ | |
for (int i = 0; i < num; i++) | |
{ | |
byte aux = (byte)(target << 7); | |
target = (byte)(target >> 1 | aux); | |
} | |
return target; | |
} | |
private static byte Reverse_d(byte target, int num) | |
{ | |
for (int i = 0; i < num; i++) | |
{ | |
byte aux = (byte)(target >> 7); | |
target = (byte)(target << 1 | aux); | |
} | |
return target; | |
} | |
private static byte Reverse_e(byte target, byte k) | |
{ | |
return (byte)(target ^ k); | |
} | |
private static byte g(int idx) | |
{ | |
byte b = (byte)((long)(idx + 1) * (long)((ulong)309030853)); | |
byte k = (byte)((idx + 2) * 209897853); | |
return Reverse_e(b, k); | |
} | |
private static byte[] DecryptBytes(byte[] target) | |
{ | |
int num = 0; | |
for (int i = 0; i < target.Length; i++) | |
{ | |
num += 2; | |
target[i] = Reverse_d(target[i], 3); | |
target[i] = Reverse_e(target[i], g(num - 1)); | |
target[i] = Reverse_b(target[i], 7); | |
target[i] = Reverse_e(target[i], g(num - 2)); | |
} | |
return target; | |
} | |
private static int getSizeHeader(byte[] bytes) | |
{ | |
int result = 0; | |
for (int i = 0; i < 4; i++) | |
result += bytes[i + 2] << 8 * i; | |
return result; | |
} | |
public static void Main(string[] args) { | |
string path = Path.GetFullPath(args[0]); | |
string out_path = Path.GetFullPath(args[1]); | |
Bitmap bitmap = new Bitmap(path); | |
Console.WriteLine("[*] Trying to extract header..."); | |
byte[] data = ExtractBytes(bitmap); | |
Console.Write("[+] Header bytes extracted successfully: "); | |
Console.WriteLine(BitConverter.ToString(data).Replace("-", " ")); | |
Console.WriteLine("[*] Decrypting header..."); | |
byte[] decrypted = DecryptBytes(data); | |
Console.Write("[+] Header bytes decrypted successfully: "); | |
Console.WriteLine(BitConverter.ToString(decrypted).Replace("-", " ")); | |
Program.len_key = getSizeHeader(decrypted); | |
Console.WriteLine("[+] File length: " + Program.len_key); | |
Console.WriteLine("[*] Trying to extract file..."); | |
data = ExtractBytes(bitmap); | |
Console.WriteLine("[+] File bytes extracted successfully."); | |
Console.WriteLine("[*] Decrypting file..."); | |
decrypted = DecryptBytes(data); | |
Console.WriteLine("[*] Writing file..."); | |
File.WriteAllBytes(out_path, decrypted); | |
Console.WriteLine("[+] File wrote successfully."); | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment