Last active
May 7, 2020 12:26
-
-
Save mrT4ntr4/55f5e02407933344e26d80c2cde5e835 to your computer and use it in GitHub Desktop.
Python solution script for ASM2 challenge from zh3r0 CTF '20
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
''' | |
Challenge Source Backup : | |
https://gist.github.com/mrT4ntr4/4e02a52c0bc89ecac7f03e38e0934628 | |
Manually dissecting the assembly code and porting it to python | |
''' | |
def f(x): | |
if(x): | |
if(x != 1): | |
res3 = f(x-1) | |
res4 = f(x-2) | |
final_res = res3 + res4 | |
return final_res | |
return 1 | |
return 0 | |
def start(arg1,arg2): | |
res1 = f(arg1) # [rbp-4] | |
res2 = f(arg2) # [rbp-8] | |
print res1,res2 | |
got1 = 0 | |
got2 = 0 | |
while (res1): | |
ecx = ((((res1 * 1717986919)>>32)/4) - (res1>>31)) | |
eax = ecx * 4 | |
eax += ecx | |
eax += eax | |
ecx = res1 - eax | |
edx = ((res1 * 1717986919) >> 32)/4 - (res1>>31) | |
eax = edx * 4 | |
eax += edx | |
eax += eax | |
esi = res1 - eax | |
eax = esi * ecx | |
got1 += eax # [rbp-12] | |
res1 = ((res1 * 1717986919) >> 32)/4 - (res1>>31) | |
while (res2): | |
ecx = ((((res2 * 1717986919)>>32)/4) - (res2>>31)) | |
eax = ecx*4 | |
eax += ecx | |
eax += eax | |
ecx = res2 - eax | |
edx = ((res2 * 1717986919) >> 32)/4 - (res2>>31) | |
eax = edx * 4 | |
eax += edx | |
eax += eax | |
esi = res2 - eax | |
eax = esi * ecx | |
got2 += eax # [rbp-16] | |
res2 = ((res2 * 1717986919) >> 32)/4 - (res2>>31) | |
print got1, got2 | |
got_final = 0 # [rbp-20] | |
i = 1 # [rbp-24] | |
while(i <= 99): | |
j = 1 # [rbp-28] | |
while(j <= 99): | |
got_final += (got1*i) + (got2*j) | |
j+=1 | |
i+=1 | |
return got_final | |
if __name__ == '__main__': | |
ret_val = start(7,8) | |
print ret_val |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment