Skip to content

Instantly share code, notes, and snippets.

@pawlos
Created April 10, 2021 17:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pawlos/149fd497023dfc9c949e70bd864d8791 to your computer and use it in GitHub Desktop.
Save pawlos/149fd497023dfc9c949e70bd864d8791 to your computer and use it in GitHub Desktop.
MindnightSun 2021 murmur solution script
const = 0xc6a4a7935bd1e995
#simplified mangle algorith form the binary
def mangle(a, i):
b = 1
c = 0x1337
temp = c ^ (b * const)
j = b
if b & 0x7 == 7:
temp ^= (a[i + 0x6] << 0x30) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x5] << 0x28) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x4] << 0x20) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x3] << 0x18) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x2] << 0x10) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 6:
temp ^= (a[i + 0x5] << 0x28) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x4] << 0x20) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x3] << 0x18) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x2] << 0x10) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 5:
temp ^= (a[i + 0x4] << 0x20) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x3] << 0x18) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x2] << 0x10) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 4:
temp ^= (a[i + 0x3] << 0x18) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x2] << 0x10) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 3:
temp ^= (a[i + 0x2] << 0x10) & 0xFFFFFFFFFFFFFFFF
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 2:
temp ^= (a[i + 0x1] << 0x8) & 0xFFFFFFFFFFFFFFFF
temp = (temp ^ a[i] * const) & 0xFFFFFFFFFFFFFFFF
elif b & 0x7 == 1:
temp = ((temp ^ a[i]) * const) & 0xFFFFFFFFFFFFFFFF
uVar2 = ((temp ^ (temp >> 0x2f)) * const) & 0xFFFFFFFFFFFFFFFF
return (uVar2 ^ (uVar2 >> 0x2f)) & 0xFFFFFFFFFFFFFFFF
import itertools
import string
import struct
flag = [
0x188CF31A079D66FC,
0xA12C8AF2572DFA48,
0x1FF01EBC0C7408CB,
0xD58E3BA2FBEF9D8C,
0x5674B7653639CB87,
0x3EB8B6A6F0753E49,
0x1FF01EBC0C7408CB,
0xF9DFA617052DFD5E,
0x34514C558BA5E73B,
0xF9DFA617052DFD5E,
0x3A9C8840CEBAEA9E,
0xB13E0ECBEBA2478F,
0x827AEE59DF4BCCE8,
0x3A9C8840CEBAEA9E,
0xB13E0ECBEBA2478F,
0x827AEE59DF4BCCE8,
0x7641DBD6CD9D79AF,
0x7641DBD6CD9D79AF,
0x7641DBD6CD9D79AF]
res = []
for out in flag:
for c in string.printable:
v = mangle([ord(c)], 0)
if v == out:
res.append(c)
break
print(''.join(res))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment