Skip to content

Instantly share code, notes, and snippets.

@KaoRz
Created September 29, 2019 21:27
Show Gist options
  • Save KaoRz/1a4acd946689cb44f89b1ccebed96bd3 to your computer and use it in GitHub Desktop.
Save KaoRz/1a4acd946689cb44f89b1ccebed96bd3 to your computer and use it in GitHub Desktop.
bmphide solver - Flare-On 2019 CTF
using System;
using System.Drawing;
using System.IO;
namespace BMPExtractor {
internal class Program {
private static int len_key = 6;
private static byte[] ExtractBytes(Bitmap bm)
{
byte[] data = new byte[len_key];
int num = 0;
for (int i = 0; i < bm.Width; i++)
{
for (int j = 0; j < bm.Height; j++)
{
if (num >= len_key)
break;
Color pixel = bm.GetPixel(i, j);
data[num] = (byte)((pixel.R & 7) | ((pixel.G & 7) << 3) | ((pixel.B & 3) << 6));
num++;
}
}
return data;
}
private static byte Reverse_b(byte target, int num)
{
for (int i = 0; i < num; i++)
{
byte aux = (byte)(target << 7);
target = (byte)(target >> 1 | aux);
}
return target;
}
private static byte Reverse_d(byte target, int num)
{
for (int i = 0; i < num; i++)
{
byte aux = (byte)(target >> 7);
target = (byte)(target << 1 | aux);
}
return target;
}
private static byte Reverse_e(byte target, byte k)
{
return (byte)(target ^ k);
}
private static byte g(int idx)
{
byte b = (byte)((long)(idx + 1) * (long)((ulong)309030853));
byte k = (byte)((idx + 2) * 209897853);
return Reverse_e(b, k);
}
private static byte[] DecryptBytes(byte[] target)
{
int num = 0;
for (int i = 0; i < target.Length; i++)
{
num += 2;
target[i] = Reverse_d(target[i], 3);
target[i] = Reverse_e(target[i], g(num - 1));
target[i] = Reverse_b(target[i], 7);
target[i] = Reverse_e(target[i], g(num - 2));
}
return target;
}
private static int getSizeHeader(byte[] bytes)
{
int result = 0;
for (int i = 0; i < 4; i++)
result += bytes[i + 2] << 8 * i;
return result;
}
public static void Main(string[] args) {
string path = Path.GetFullPath(args[0]);
string out_path = Path.GetFullPath(args[1]);
Bitmap bitmap = new Bitmap(path);
Console.WriteLine("[*] Trying to extract header...");
byte[] data = ExtractBytes(bitmap);
Console.Write("[+] Header bytes extracted successfully: ");
Console.WriteLine(BitConverter.ToString(data).Replace("-", " "));
Console.WriteLine("[*] Decrypting header...");
byte[] decrypted = DecryptBytes(data);
Console.Write("[+] Header bytes decrypted successfully: ");
Console.WriteLine(BitConverter.ToString(decrypted).Replace("-", " "));
Program.len_key = getSizeHeader(decrypted);
Console.WriteLine("[+] File length: " + Program.len_key);
Console.WriteLine("[*] Trying to extract file...");
data = ExtractBytes(bitmap);
Console.WriteLine("[+] File bytes extracted successfully.");
Console.WriteLine("[*] Decrypting file...");
decrypted = DecryptBytes(data);
Console.WriteLine("[*] Writing file...");
File.WriteAllBytes(out_path, decrypted);
Console.WriteLine("[+] File wrote successfully.");
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment