solved connivance

2026-03-24 00:35:37 +01:00
parent c6fe17930d
commit c223c4e3fa
42 changed files with 291 additions and 117 deletions
--- a/2026/cscg/rev/connivance/solve.c
+++ b/2026/cscg/rev/connivance/solve.c
@@ -0,0 +1,97 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <openssl/sha.h>
+
+int main() {
+    FILE *f = fopen("romfs/dragonfly.bin", "r");
+    if (!f) {
+        perror("Failed to open file");
+        return 1;
+    }
+
+    // Get file size
+    fseek(f, 0, SEEK_END);
+    long file_size = ftell(f);
+    fseek(f, 0, SEEK_SET);
+
+    uint8_t *dragonfly = malloc(file_size);
+    if (!dragonfly) {
+        perror("malloc failed");
+        fclose(f);
+        return 1;
+    }
+
+    fread(dragonfly, 1, file_size, f);
+    fclose(f);
+
+    uint8_t flag[0x1d] = {0};  // 29 bytes
+
+    for (int i = 7; i >= 0; i--) {
+        uint8_t *target_hash = dragonfly + SHA256_DIGEST_LENGTH * (7 - i);
+        int found = 0;
+
+        uint64_t max_n = 1ULL << sizeof(flag);
+        for (uint64_t n = 0; n < max_n; n++) {
+            uint64_t tmp = n;
+            for (int j = 0; j < sizeof(flag); j++) {
+                uint8_t bit = tmp & 1;
+                tmp >>= 1;
+                flag[j] = (flag[j] & 0xFE) | bit;
+            }
+
+            // Compute SHA-256
+            uint8_t hash[SHA256_DIGEST_LENGTH];
+            SHA256(flag, sizeof(flag), hash);
+
+            if (memcmp(hash, target_hash, SHA256_DIGEST_LENGTH) == 0) {
+                found = 1;
+                break;
+            }
+
+            if (n % 1000000 == 0) {
+                printf("\r%09lu", n);
+                fflush(stdout);
+            }
+        }
+
+        printf("\n");
+        if (!found) {
+            printf("Could not find it on level: %d\n", i);
+            break;
+        }
+
+        // Print flag in hex
+        for (int j = 0; j < sizeof(flag); j++) {
+            printf("%02x", flag[j]);
+        }
+        printf("\n");
+
+        // Shift left by 1
+        for (int j = 0; j < sizeof(flag); j++) {
+            flag[j] = (flag[j] << 1) & 0xFF;
+        }
+    }
+
+    // Print final flag
+    for (int j = 0; j < sizeof(flag); j++) {
+        printf("%02x", flag[j]);
+    }
+    printf("\n");
+
+    // Bitwise NOT
+    for (int j = 0; j < sizeof(flag); j++) {
+        flag[j] = (~flag[j]) & 0xFF;
+    }
+
+    for (int j = 0; j < sizeof(flag); j++) {
+        printf("%02x", flag[j]);
+    }
+    printf("\n");
+
+    printf("%s\n", flag);
+
+    free(dragonfly);
+    return 0;
+}