cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

z3 training

Browse Source
This commit is contained in:
cato447
2025-11-28 12:23:07 +01:00
parent dc96452364
commit 9144e50e85
11 changed files with 910 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
training/h4tum/IntroZ3/tasks/chall2_dreamer/exploit.py
View File

@@ -19,13 +19,11 @@ def ROR(X, N):
return ((((X) >> (N)) | ((X) << (64 - (N)))) % (2 ** 64))
def custom_random(state):
NEW_STATE = ROL(state,30) ^ ROR(state,12) ^ ROL(state,42) ^ ROL(state,4) ^ ROR(state,5);
return NEW_STATE % 256, NEW_STATE;
NEW_STATE = ROL(state,30) ^ ROR(state,12) ^ ROL(state,42) ^ ROL(state,4) ^ ROR(state,5)
return NEW_STATE % 256, NEW_STATE
pwn.context.arch = 'x86_64'
shc = pwn.asm("""
cdq;
push rdi;
@@ -35,8 +33,6 @@ shc = pwn.asm("""
syscall
""")
def get_seed_for_sequence(bytesequence):
s = z3.Solver()
base_state = z3.BitVec("base_state", 64)