Solution for white box from RHME3 Qualifier.

rhme3_quals_whitebox.py

from array import array

# 2^16 bytes of dumped memory from 0x6651C0
# create as follows: gdb ./whitebox -ex 'br *0x4007fd' -ex r -ex 'dump memory tab.bin 0x6651c0 0x6651c0+0x10000' -ex q
tab = array('B',open('tab.bin').read())
sbox = array('B',
    '637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0'
    'b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b275'
    '09832c1a1b6e5aa0523bd6b329e32f8453d100ed20fcb15b6acbbe394a4c58cf'
    'd0efaafb434d338545f9027f503c9fa851a3408f929d38f5bcb6da2110fff3d2'
    'cd0c13ec5f974417c4a77e3d645d197360814fdc222a908846eeb814de5e0bdb'
    'e0323a0a4906245cc2d3ac629195e479e7c8376d8dd54ea96c56f4ea657aae08'
    'ba78252e1ca6b4c6e8dd741f4bbd8b8a703eb5664803f60e613557b986c11d9e'
    'e1f8981169d98e949b1e87e9ce5528df8ca1890dbfe6426841992d0fb054bb16'.decode('hex'))

K = []
for i in range(0x10):
    for a in range(0x100):
        keys = set()
        for j in range(0x100):
            k =  sbox[j^a] ^ tab[i*256+j]
            keys.add(k)
        if len(keys)==1:
            K.append(k)
assert len(K) == 16

rcon = [0, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54]
def invert_keyschedule(key, round):
    for i in range(round, 0, -1):
        for j in range(15, 3, -1):
            key[j] ^= key[j-4]
        for j in range(3, -1, -1):
            key[j] ^= sbox[key[12+(j+1)%4]] ^ (0 if j else rcon[i])
    return key

print array('B',invert_keyschedule(K, 10)).tostring()