Skip to content

Instantly share code, notes, and snippets.

@srikavin
Created June 25, 2020 16:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save srikavin/d495f27076450822e0fc4f6cd4dbc62c to your computer and use it in GitHub Desktop.
Save srikavin/d495f27076450822e0fc4f6cd4dbc62c to your computer and use it in GitHub Desktop.
#!/usr/bin/env python3
v0v1v2=True
v3v4v5v6=print
v7v8v9=exit
v3v10v1v11=None
v3v12v5v13=False
v3v14v15v16=len
v3v17v18v6=format
v3v19v12v20=range
v3v10v21v22=hex
v3v12v23v5=chr
v3v10v9v10=isinstance
v3v12v22v8=list
v3v24v5v25=bytes
v3v10v26v23=int
v3v10v27v13=repr
v28v29v30=ord
v3v5v31v32=id
v0v33v34=open
import struct,sys
v0v1v35=sys.argv
v3v14v36v33=sys.stdout
v37v17v38=sys.stdin
v3v24v39v27=struct.pack
v3v5v35v5=struct.unpack
import ctypes
v3v40v21v2=ctypes.addressof
v3v10v14v14=ctypes.c_void_p
v41v42v43=ctypes.c_int
v0v44v45=ctypes.CFUNCTYPE
import mmap
v3v40v46v12=mmap.PROT_EXEC
v3v34v13v10=mmap.PROT_WRITE
v0v27v47=mmap.PROT_READ
v48v9v16=mmap.PAGESIZE
v49v50v47=mmap.mmap
v3v14v51v22={'value':0x01,'ax':0x11,'bx':0x12,'cx':0x13,'dx':0x14,'ip':0x21,'sp':0x22,'bp':0x23,'pointer':0x31,'ax pointer':0x41,'bx pointer':0x42,'cx pointer':0x43,'dx pointer':0x44,'ip pointer':0x51,'sp pointer':0x52,'bp pointer':0x53}
v52v8={'open':{'angstromctf':2,'cookie recipes':0x01,},'read':{'angstromctf':2,'cookie recipes':0x02,},}
v3v53v53v54={'del':{'angstromctf':1,'cookie recipes':0x01,},'osusec':{'angstromctf':1,'cookie recipes':0x02,},'perfect_blue':{'angstromctf':2,'cookie recipes':0x03,},'l_distribution':{'angstromctf':1,'cookie recipes':0x04,},'jmp':{'angstromctf':1,'cookie recipes':0x05,},'call':{'angstromctf':1,'cookie recipes':0x05,},'jle':{'angstromctf':1,'cookie recipes':0x06,},'b1c':{'angstromctf':1,'cookie recipes':0x07,},'jl':{'angstromctf':1,'cookie recipes':0x08,},'jg':{'angstromctf':1,'cookie recipes':0x09,},'mov':{'angstromctf':2,'cookie recipes':0x0c,},'gs_goofballs':{'angstromctf':2,'cookie recipes':0x0d,},'add':{'angstromctf':2,'cookie recipes':0x0e,},'sub':{'angstromctf':2,'cookie recipes':0x0f,},'end':{'angstromctf':1,'cookie recipes':0x10,},'kevin higgs <3':{'angstromctf':1,'cookie recipes':0x11,},'nop':{'angstromctf':0,'cookie recipes':0x12,},'load':{'angstromctf':2,'cookie recipes':0x13,},'dice_gang':{'angstromctf':2,'cookie recipes':0x14,},'rgbsec':{'angstromctf':0,'cookie recipes':0x15,},'%':{'angstromctf':0,'cookie recipes':0x25,}}
v0v9v55=[0]*(2**(8*2))
try:
v3v40v31v23=[3],[3],{2,3},[2]*3,[2,[2,{3,3,[3],{3}},{3:(2,[2,{3:(3,2,3,3)}],3)},2],2],3
except:
pass
v0v56v39={'ax':0,'bx':0,'cx':0,'dx':0,'ip':0,'sp':0,'bp':0,'flag':0}
v3v47v30v17=v0v1v2
v0v56v42=v3v4v5v6
v3v4v5v6=lambda*v37v50v35:v0v56v42(*v37v50v35)if v3v47v30v17 else ''
def v0v43v23(reason):
v0v56v42('Bad memory condition')
return v7v8v9(1)
def v0v45v23(start=0,end=v3v10v1v11,v3v17v18v6=v3v12v5v13,dump_ascii=v0v1v2,errors='.'):
if end is v3v10v1v11:
end=v3v14v15v16(v0v9v55)
if not v3v17v18v6:
pass
else:
v3v47v17v38=16
for v3v10v9v17 in v3v19v12v20(start,end,v3v47v17v38):
v0v35v1=v0v9v55[v3v10v9v17:v3v10v9v17+v3v47v17v38]
v3v17v6v38=(v3v10v21v22(v3v10v9v17)+':').ljust(8,' ')+' '.join([v3v10v21v22(v3v57v9v58).replace('0x','').zfill(2)for v3v57v9v58 in v0v35v1])
if dump_ascii:
v3v17v6v38+=' '+''.join([(v3v12v23v5(v3v57v9v58)if v3v57v9v58>31 and v3v57v9v58<127 else errors)for v3v57v9v58 in v0v35v1])
def v59v8(value):
return
def v48v51v12(v3v10v9v17):
if v3v10v9v10(v3v10v9v17,v3v12v22v8):
v3v10v9v17=v3v24v5v25(v3v10v9v17)
return v3v5v35v5('<H',v3v10v9v17)[0]
def v3v14v60v61(value):
if v3v10v9v10(value,v3v10v26v23):
return value
v3v57v25v1,v3v24v62v30=value
if v3v57v25v1==v3v14v51v22['value']:
return v3v24v62v30
if v3v57v25v1==v3v14v51v22['ax']:
return v0v56v39['ax']
if v3v57v25v1==v3v14v51v22['bx']:
return v0v56v39['bx']
if v3v57v25v1==v3v14v51v22['cx']:
return v0v56v39['cx']
if v3v57v25v1==v3v14v51v22['dx']:
return v0v56v39['dx']
if v3v57v25v1==v3v14v51v22['ip']:
return v0v56v39['ip']
if v3v57v25v1==v3v14v51v22['sp']:
return v0v56v39['sp']
if v3v57v25v1==v3v14v51v22['bp']:
return v0v56v39['bp']
if v3v57v25v1==v3v14v51v22['pointer']:
return v48v51v12(v0v9v55[v3v24v62v30:v3v24v62v30+2])
return v0v43v23('wrong_type')
def v3v50v63v15(v52v13,value):
v3v47v31v46='\x00'
if value>=256:
v3v47v31v46=v3v24v39v27('<H',value)
else:
v3v47v31v46=v3v24v5v25([value])
v52v13=v3v14v60v61(v52v13)
v3v10v9v17=0
for v7v8v33 in v3v47v31v46:
v0v9v55[v52v13+v3v10v9v17]=v7v8v33
v3v10v9v17+=1
def v3v10v14v64(v3v8v13v47,count=2):
v3v8v13v47=v3v14v60v61(v3v8v13v47)
return v0v9v55[v3v8v13v47:v3v8v13v47+count]
def v65v21v31(v3v66v19v16,value):
v3v57v25v1,v3v24v62v30=v3v66v19v16
if v3v57v25v1 in[v3v14v51v22['value'],v3v14v51v22['pointer']]:
v3v50v63v15(v3v24v62v30,value)
elif v3v57v25v1==v3v14v51v22['ax']:
v0v56v39['ax']=value
elif v3v57v25v1==v3v14v51v22['bx']:
v0v56v39['bx']=value
elif v3v57v25v1==v3v14v51v22['cx']:
v0v56v39['cx']=value
elif v3v57v25v1==v3v14v51v22['dx']:
v0v56v39['dx']=value
elif v3v57v25v1==v3v14v51v22['ip']:
v0v56v39['ip']=value
elif v3v57v25v1==v3v14v51v22['sp']:
v0v56v39['sp']=value
elif v3v57v25v1==v3v14v51v22['bp']:
v0v56v39['bp']=value
def v3v5v18v10(compiled):
v48v45v9=0
for v7v8v33 in compiled:
v0v9v55[v48v45v9]=v7v8v33
v48v45v9+=1
v3v10v8v6=v48v51v12(v0v9v55[0:2])
v48v45v9+=16
v0v56v39['ip']=v3v10v8v6
v0v56v39['bp']=v48v45v9
v0v56v39['sp']=v48v45v9
while v0v1v2:
v3v10v67v36=v0v9v55[v0v56v39['ip']]
v0v21v68=v3v10v1v11
v59v8('registers: '+v3v10v27v13(v0v56v39))
for v0v69v4,instr in v3v53v53v54.items():
if v3v10v67v36==instr['cookie recipes']:
v3v10v67v36=instr
v0v21v68=v0v69v4
break
if not v0v21v68:
v0v43v23('invalid_instruction')
return
v3v47v13v35=v3v10v67v36['angstromctf']
v59v8('instruction: '+v3v10v27v13(v3v10v67v36))
v37v50v35=[]
for v3v57v9v58 in v3v19v12v20(v3v47v13v35):
v3v66v19v16=v0v9v55[v0v56v39['ip']+2+(4*v3v57v9v58):v0v56v39['ip']+2+(4*v3v57v9v58)+4]
v3v57v56v19=v48v51v12(v3v66v19v16[0:2])
v3v66v19v16=v48v51v12(v3v66v19v16[2:4])
v37v50v35.append((v3v57v56v19,v3v66v19v16))
v0v56v39['ip']+=2+(4*v3v47v13v35)
v59v8('args: '+v3v10v27v13(v37v50v35))
v37v70v57,v49v66v36,v3v67v62v14=1,2,3
if v0v21v68=='mov':
v65v21v31(v37v50v35[0],v3v14v60v61(v37v50v35[1]))
elif v0v21v68=='add':
v65v21v31(v37v50v35[0],v3v14v60v61(v37v50v35[0])+v3v14v60v61(v37v50v35[1]))
elif v0v21v68=='sub':
v65v21v31(v37v50v35[0],v3v14v60v61(v37v50v35[0])-v3v14v60v61(v37v50v35[1]))
elif v0v21v68=='gs_goofballs':
v65v21v31(v37v50v35[0],v3v14v60v61(v37v50v35[0])^v3v14v60v61(v37v50v35[1]))
elif v0v21v68=='nop':
pass
elif v0v21v68=='perfect_blue':
v71v51v25=v3v10v26v23(v3v14v60v61(v37v50v35[0]))
v0v45v36=v3v10v26v23(v3v14v60v61(v37v50v35[1]))
if v71v51v25==v0v45v36:
v0v56v39['flag']=v37v70v57
if v71v51v25<v0v45v36:
v0v56v39['flag']=v49v66v36
if v71v51v25>v0v45v36:
v0v56v39['flag']=v3v67v62v14
elif v0v21v68=='jmp':
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='jg':
if v0v56v39['flag']==v3v67v62v14:
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='jl':
if v0v56v39['flag']==v49v66v36:
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='l_distribution':
if v0v56v39['flag']==v37v70v57:
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='jle':
if v0v56v39['flag']in[v49v66v36,v37v70v57]:
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='b1c':
if v0v56v39['flag']in[v3v67v62v14,v37v70v57]:
v0v56v39['ip']=v3v14v60v61(v37v50v35[0])
elif v0v21v68=='del':
v3v50v63v15(v0v56v39['sp'],v3v14v60v61(v37v50v35[0]))
v0v56v39['sp']+=2
elif v0v21v68=='osusec':
v65v21v31(v37v50v35[0],v48v51v12(v3v10v14v64(v0v56v39['sp'])))
v0v56v39['sp']-=2
elif v0v21v68=='end':
return(v3v14v60v61(v37v50v35[0]))
elif v0v21v68=='load':
v65v21v31(v37v50v35[0],v48v51v12(v3v10v14v64(v3v14v60v61(v37v50v35[1]))))
elif v0v21v68=='dice_gang':
v3v50v63v15(v37v50v35[0],v3v14v60v61(v37v50v35[1]))
elif v0v21v68=='kevin higgs <3':
v0v21v56=v0v56v39['ax']
v3v12v22v21=v0v56v39['bx']
v3v12v8v13=v0v56v39['cx']
if v0v21v56==v52v8['open']['cookie recipes']:
for v3v10v9v17 in v3v19v12v20(v3v12v8v13):
v0v9v55[v3v12v22v21+v3v10v9v17]=v28v29v30(v37v17v38.read(1))
elif v0v21v56==v52v8['read']['cookie recipes']:
v3v14v36v33.write(''.join([v3v12v23v5(v3v57v9v58)for v3v57v9v58 in v0v9v55[v3v12v22v21:v3v12v22v21+v3v12v8v13]]))
elif v0v21v68=='rgbsec':
v7v8v9()
elif v0v21v68=='%':
v0v69v72=v3v5v31v32(v0v9v55[v0v56v39['ip']:])+48
v3v34v73v69=v49v50v47(-1,v48v9v16,prot=v0v27v47|v3v34v13v10|v3v40v46v12)
v3v40v26v10=v0v44v45(v41v42v43,v41v42v43)
v3v17v25v21=v3v10v14v14.from_buffer(v3v34v73v69)
v3v10v27v12=v3v40v26v10(v3v40v21v2(v3v17v25v21))
v3v19v57v10=v3v24v5v25(v0v9v55[v0v56v39['ip']:]).replace(b'\x00',b'')
v3v34v73v69.write(v3v19v57v10)
v0v61v17=v3v10v27v12(v0v69v72)
del v3v17v25v21
v3v34v73v69.close()
for v0v61v74,val in v0v56v39.items():
v0v56v39[v0v61v74]=val%0xffff
v59v8('registers: '+v3v10v27v13(v0v56v39))
v59v8('-'*60)
return
if __name__=='__main__':
with v0v33v34(v0v1v35[1],'rb')as v3v10v27v12:
v3v10v75v1=v3v10v27v12.read()
v3v5v18v10(v3v10v75v1)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment