DEFCON 2014 Writeup 100lines

solve.py

import time
import socket

def calc(sum, buf, i, j):
 ret = ((ord(buf[i/8 + j]) << (i%8))%0x100000000)|((ord(buf[i/8 + j +1]) >> (8 - i%8))%0x100000000)
 ret %= 0x100
 sum |= (ret << (24-j*8));
 return sum;

mem = open("hoge.bin").read()
def search(ind, len):
    p = ind/4/len
    q = (ind/4)%len

    sum = 0
    for j in range(4):
        sum = calc(sum, mem, p, j)

    sum2 = 0 
    for k in range(4):
        sum2 = calc(sum2, mem, q, k)

    sum2 ^= sum

    for k in range(4):
        if (p*len+q)*4+k == ind:
            eax =  (sum2 >> (24 - k*8)) % 0x100
            return eax

 
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('100lines_53ac15fc7aa93da92629d37a669e106c.2014.shallweplayaga.me', 20689))
s = sock.recv(4096) + sock.recv(4096)
print s
g = [search(int(i,16),16256992) for i in s.split("locations:\n")[1].split(" ")[:-1]]

t = "".join(chr((eax-(((((((eax + eax + eax) << 5) + eax)>>8) + ((eax - ((((eax + eax + eax) << 5) + eax)>>8))>>1))>>6)*0x5d))%0x100+0x20) for eax in g)
sock.send(t)

hoge = sock.recv(4096)+sock.recv(4096)
l = hoge[1:].replace("\n", "").split(",")

k = ""
for i in range(0x26):
    k += chr(int(l[i],16) ^ g[i])
print k