Some Assembly Required 4

some_assembly_required_4/sol.py

@@ -0,0 +1,92 @@
+#!/home/maxime/.pyvenv/bin/python3
+import string
+
+mem_str = b"\x18j|a\x118i7[H~Jh^Ko\x1f]\x5cw4kP\x15pO?\x5cEo\x14\x06\x05}>=\x04\x16.\x12L\x00\x00"
+reference = b"picoCTF{"
+
+corr_mem_str = b""
+for i in range(0, len(mem_str)-1, 2):
+    corr_mem_str += chr(mem_str[i+1]).encode() + chr(mem_str[i]).encode()
+
+def shift_fwrd(char):
+    if char // 128 > 0:
+        return char | 0xffffff00
+    else:
+        return char
+
+def shift_bwrd(char):
+    char &= 0xff
+    return char
+
+def transform(S,enc):
+    result = b""
+    temp = ""
+    if enc == 0:
+        for i in range(0, len(S)-1, 2):
+            temp += chr(S[i+1]) + chr(S[i])
+        S = temp.encode()
+    for i in range(len(S)):
+        if enc > 0:
+            buf = result
+            shift_fun = shift_fwrd
+        else:
+            buf = S
+            shift_fun = shift_bwrd
+        char = S[i]
+        char = shift_fwrd(char)
+        char ^= 20
+        if i > 0:
+            prev = buf[i-1]
+            #prev = shift_fun(prev)
+            #char = shift_fun(char)
+            char ^= prev
+        if i > 2:
+            prev = buf[i-3]
+            #prev = shift_fun(prev)
+            #char = shift_fun(char)
+            char ^= prev
+        m10 = i%10
+        #char = shift_fun(char)
+        char ^= m10
+        if i%2 == 0:
+            #char = shift_fun(char)
+            char ^= 9
+        else:
+            #char = shift_fun(char)
+            char ^= 8
+        if i%3 == 0:
+            #char = shift_fun(char)
+            char ^= 7
+        elif i%3 == 1:
+            #char = shift_fun(char)
+            char ^= 6
+        else:
+            #char = shift_fun(char)
+            char ^= 5
+
+        result += chr(char).encode()
+    return result
+
+print(transform(mem_str, 0))
+
+temp = ""
+next_found = False
+for i in range(0, len(mem_str)-1, 2):
+    temp += chr(mem_str[i+1]) + chr(mem_str[i])
+mem_str = temp.encode()
+print(mem_str)
+
+temp = ""
+while True:
+    for char in string.punctuation+string.ascii_letters + string.digits+' ':
+        result = transform((temp+char).encode(), 1)
+        if result in mem_str[:len(temp)+1]:
+            temp += char
+            next_found = True
+            break
+    if next_found:
+        next_found = False
+    else:
+        print(temp)
+        break
+