Skip to content

Instantly share code, notes, and snippets.

View mkow's full-sized avatar

Michał Kowalczyk mkow

View GitHub Profile
@mkow
mkow / backdoor_decomp.c
Last active March 31, 2024 14:05
xz decompiled backdoor key setting
// +0xABC0 (in .o)
bool ensure_calling_only_once_and_set_key_bit(
unsigned __int64 addr_to_disasm_if_valid,
unsigned int key_bit_ind,
unsigned int a3,
unsigned int ket_init_unique_id)
{
char *addr; // rax
char *retaddr; // [rsp+0h] [rbp+0h]
@mkow
mkow / crc_hard_solver.cpp
Created January 15, 2022 22:55
Solver for CRC Recursive Challenge from Dragon CTF 2021
// Solver for CRC Recursive Challenge from Dragon CTF 2021
// Author: Michał "Redford" Kowalczyk
//
// Could probably be much simpler, but this code was evolving for too long
// without a rewrite ¯\_(ツ)_/¯
#include <iostream>
#include <cstdio>
#include <cstddef>
#include <cstring>
@mkow
mkow / The Watness 2 solver.py
Created April 26, 2020 18:06
Solver for The Watness 2 (re 450) from PlaidCTF 2020
def split_by(data, cnt):
return [data[i : i+cnt] for i in range(0, len(data), cnt)]
MAX_PATH = 150 # just some guessed estimate, should be fine
LEVELS = [
'rbrr rgb rb r brgrbrgb grrgbbg grg bgrg bbgrbg',
'rrbrb rg g bgrbgggr ggrgr gr rg brr b bggrbgbb',
'rbr bbggrgrggb bggbb b b bbrbbgg gbrrbgrbbb g',
]
@mkow
mkow / YOU_wa_SHOCKWAVE_solver.py
Created April 26, 2020 17:04
Solver for YOU wa SHOCKWAVE (re 250) from PlaidCTF 2020
from struct import pack, unpack
# reversed from the challenge
def zz_helper(x, y, z):
if y > z:
return [1, z - x]
a, b = zz_helper(y, x + y, z)
if b >= x:
return [2 * a + 1, b - x]
@mkow
mkow / verifier2_solver.py
Created April 4, 2020 16:26
Solver for Verifier 2 from Midnight Sun CTF 2020 Quals
#!/usr/bin/env python3
from pwn import *
from hashlib import sha1, sha256
from random import randint
def h(msg):
# hash = sha256()
hash = sha1()
hash.update(msg.encode('ascii'))
hash = hash.digest()
@mkow
mkow / compilerbot_solver.py
Created December 31, 2019 01:42
Solver for compilerbot challenge from hxp 36C3 CTF (misc/medium/256 pts/30 solves)
import socket
from base64 import b64encode, b64decode
from string import printable
def test(code):
host = '88.198.154.157'
port = 8011
s = socket.create_connection((host, port))
s.sendall(b64encode(code) + '\n')
@mkow
mkow / ridl.py
Last active March 24, 2020 19:26
RIDL (Google Capture The Flag 2019 Finals solution)
#!/usr/bin/env python2
# Challenge: https://gctf-2019.appspot.com/#challenges/sandbox-sandbox-ridl
from pwn import *
import os
def split_by(data, cnt):
return [data[i : i+cnt] for i in xrange(0, len(data), cnt)]
@mkow
mkow / not_so_hard_rsa_solver.py
Created October 19, 2019 15:54
not so hard RSA (HITCON Quals 2019, solver by adami)
import random
a=[
(61608417975397048843788515638593839325111098880518441270527767841153782846066445099077365303960932518098100778959123136871039627996767023258612684873083420234538156646585282154245553305607644427220207313162116929585370583379703086997585339296145409828300576290109728682441066135201997295424597733433471586151L, 60032368056605168202792776655067640210910930719068898740685488293392455428589220656480049668823171895161714617099267690524276842795335016835073541061601545456195765907623303970146386500563913899580929779870429659650425339185233299118860275385880359287380867251468679962048998842668813298548390941601249105855L, '1e4433543ad3eab1d5a5490e33ee98c34785945c7b69dd0fd0a371c28e5ff45f6627ad0559d9837fd6439367543ff5670f4df4fd36cbee75950db62e51811f98e3f34db66b07196a5dfbd9867952d8e6d67c43becf086087181e5f78582e98945e5c8c08d754b998ef01e836729f9620cdcd2cc8aae9cb4bf3d8e4beec3ca8fd'),
(520845950547682175226769793427553933063050991694149479605080490571193295371620790711007735401727806998429748389734535178
@mkow
mkow / lost_modulus_solver.py
Created October 19, 2019 15:47
Lost Modulus Again (HITCON Quals 2019, solver by adami)
e = 1048583
d = 20899585599499852848600179189763086698516108548228367107221738096450499101070075492197700491683249172909869748620431162381087017866603003080844372390109407618883775889949113518883655204495367156356586733638609604914325927159037673858380872827051492954190012228501796895529660404878822550757780926433386946425164501187561418082866346427628551763297010068329425460680225523270632454412376673863754258135691783420342075219153761633410012733450586771838248239221434791288928709490210661095249658730871114233033907339401132548352479119599592161475582267434069666373923164546185334225821332964035123667137917080001159691927
x = 22886390627173202444468626406642274959028635116543626995297684671305848436910064602418012808595951325519844918478912090039470530649857775854959462500919029371215000179065185673136642143061689849338228110909931445119687113803523924040922470616407096745128917352037282612768345609735657018628096338779732460743
y = 13835601215715092703311781486294192443763777504037974697077837692193374
@mkow
mkow / rar4_vm_asm.py
Created September 24, 2019 15:15
Assembler for RAR v4 VM (anti-antivirus challenge, Real World CTF 2019 Quals)
import sys
VMCF_OP0 = 0
VMCF_OP1 = 1
VMCF_OP2 = 2
VMCF_OPMASK = 3
VMCF_BYTEMODE = 4
VMCF_JUMP = 8
VMCF_PROC = 16
VMCF_USEFLAGS = 32