huge commit

2026/srdnlen_quals/forensic/chapter2/output/audit.txt

@@ -0,0 +1,132 @@
+Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
+Audit File
+
+Foremost started at Sun Mar  1 00:28:43 2026
+Invocation: foremost -v -i virtual_machine_ram.bin 
+Output directory: /home/cato/ctf/2026/srdnlen_quals/forensic/chapter2/output
+Configuration file: /etc/foremost.conf
+------------------------------------------------------------------
+File: virtual_machine_ram.bin
+Start: Sun Mar  1 00:28:43 2026
+Length: 128 MB (134221824 bytes)
+ 
+Num	 Name (bs=512)	       Size	 File Offset	 Comment 
+
+0:	00041511.jpg 	     225 KB 	   21253656 	 
+1:	00045798.jpg 	     110 KB 	   23448600 	 
+2:	00049393.jpg 	     171 KB 	   25289240 	 
+3:	00104056.gif 	      840 B 	   53276672 	  (168 x 1)
+4:	00104770.gif 	       60 B 	   53642400 	  (12 x 16)
+5:	00104770_1.gif 	       82 B 	   53642464 	  (13 x 16)
+6:	00104770_2.gif 	      114 B 	   53642552 	  (16 x 16)
+7:	00103872.bmp 	      43 KB 	   53182464 	  (182 x 237)
+8:	00104770.bmp 	       5 KB 	   53642672 	  (310 x 35)
+9:	00146504.bmp 	     576 KB 	   75010048 	  (512 x 384)
+10:	00014799.wav 	       36 B 	    7577580 	 
+11:	00038872.wav 	     676 KB 	   19902464 	 
+12:	00043867.avi 	      11 KB 	   22459912 	 
+13:	00046949.avi 	     143 KB 	   24038224 	 
+14:	00056278.wav 	       36 B 	   28814684 	 
+15:	00072813.wav 	     676 KB 	   37280640 	 
+16:	00094229.avi 	     143 KB 	   48245584 	 
+17:	00099048.wav 	       1 KB 	   50712576 	 
+18:	00039384.ole 	       5 KB 	   20164608 	 
+19:	00041504.ole 	      13 KB 	   21250048 	 
+20:	00080064.ole 	       3 KB 	   40992768 	 
+21:	00080096.ole 	       3 KB 	   41009152 	 
+22:	00134328.ole 	       3 KB 	   68775936 	 
+23:	00134351.ole 	       3 KB 	   68788160 	 
+24:	00136808.ole 	       3 KB 	   70045696 	 
+25:	00024392.dll 	     460 KB 	   12488704 	 04/23/1999 00:45:39
+26:	00034840.exe 	      28 KB 	   17838080 	 06/30/2000 06:00:31
+27:	00035216.dll 	      68 KB 	   18030592 	 04/23/1999 16:38:33
+28:	00035816.exe 	      84 KB 	   18337792 	 04/29/1998 03:43:39
+29:	00036248.dll 	      72 KB 	   18558976 	 04/23/1999 16:37:42
+30:	00036416.exe 	     304 KB 	   18644992 	 07/03/2000 01:48:09
+31:	00037032.dll 	     482 KB 	   18960384 	 06/06/2000 23:01:57
+32:	00038984.dll 	     172 KB 	   19959808 	 04/23/1999 16:37:36
+33:	00039344.dll 	     236 KB 	   20144128 	 04/23/1999 16:39:10
+34:	00040032.exe 	      60 KB 	   20496384 	 11/21/2000 15:17:04
+35:	00040584.dll 	      44 KB 	   20779008 	 04/23/1999 16:38:11
+36:	00040744.dll 	      52 KB 	   20860928 	 04/23/1999 16:37:34
+37:	00041304.dll 	      84 KB 	   21147648 	 04/23/1999 16:38:30
+38:	00041480.dll 	     120 KB 	   21237760 	 04/23/1999 16:37:37
+39:	00042312.exe 	      28 KB 	   21663744 	 04/29/1998 02:45:47
+40:	00042464.dll 	     362 KB 	   21741568 	 06/06/2000 23:21:28
+41:	00044176.exe 	      68 KB 	   22618112 	 04/23/1998 03:35:12
+42:	00044400.exe 	     132 KB 	   22732800 	 04/23/1999 02:18:57
+43:	00046392.dll 	      32 KB 	   23752704 	 06/27/2000 18:42:52
+44:	00046752.exe 	      24 KB 	   23937024 	 06/30/2000 06:15:08
+45:	00046800.dll 	      36 KB 	   23961600 	 04/23/1999 16:37:37
+46:	00046976.dll 	     668 KB 	   24051712 	 11/21/2000 15:18:11
+47:	00049808.dll 	     176 KB 	   25501696 	 07/03/2000 01:50:07
+48:	00050824.dll 	      76 KB 	   26021888 	 06/30/2000 06:17:32
+49:	00051224.dll 	      20 KB 	   26226688 	 06/27/2000 18:42:48
+50:	00052064.dll 	     144 KB 	   26656768 	 04/23/1999 16:39:00
+51:	00057720.dll 	     293 KB 	   29552640 	 06/06/2000 23:21:20
+52:	00058424.dll 	      88 KB 	   29913088 	 06/30/2000 06:17:32
+53:	00059856.exe 	     132 KB 	   30646272 	 04/23/1999 02:18:57
+54:	00060416.dll 	      24 KB 	   30932992 	 04/23/1999 16:38:40
+55:	00070672.dll 	     196 KB 	   36184064 	 04/23/1999 16:37:51
+56:	00071960.dll 	     136 KB 	   36843520 	 04/23/1999 16:37:54
+57:	00073032.exe 	     176 KB 	   37392384 	 03/18/1998 22:04:02
+58:	00074680.exe 	     176 KB 	   38236160 	 03/18/1998 22:04:02
+59:	00076840.dll 	     795 KB 	   39342080 	 06/06/2000 23:21:25
+60:	00079328.dll 	      24 KB 	   40615936 	 04/23/1999 16:38:46
+61:	00080024.dll 	     140 KB 	   40972288 	 06/30/2000 06:17:32
+62:	00081368.exe 	      24 KB 	   41660416 	 06/30/2000 06:15:08
+63:	00081936.dll 	      36 KB 	   41951232 	 06/30/2000 06:17:32
+64:	00082128.dll 	     124 KB 	   42049536 	 06/30/2000 05:16:36
+65:	00082384.dll 	      76 KB 	   42180608 	 10/17/1998 09:54:50
+66:	00083584.dll 	       1 MB 	   42795008 	 04/23/1999 16:37:36
+67:	00088240.dll 	     421 KB 	   45178880 	 11/03/1999 00:57:56
+68:	00089632.exe 	      56 KB 	   45891584 	 06/30/2000 06:11:16
+69:	00090992.exe 	     304 KB 	   46587904 	 07/03/2000 01:48:09
+70:	00092040.exe 	      60 KB 	   47124480 	 11/21/2000 15:17:04
+71:	00092544.dll 	      76 KB 	   47382528 	 06/30/2000 06:17:32
+72:	00092704.dll 	     392 KB 	   47464448 	 06/17/1998 18:52:10
+73:	00094000.exe 	      28 KB 	   48128000 	 06/30/2000 06:00:31
+74:	00094264.exe 	      32 KB 	   48263168 	 04/23/1999 01:30:00
+75:	00094792.dll 	     140 KB 	   48533504 	 02/22/1999 19:48:21
+76:	00096072.dll 	     480 KB 	   49188864 	 06/30/2000 05:27:07
+77:	00098808.dll 	     398 KB 	   50589696 	 06/06/2000 23:21:23
+78:	00103152.dll 	     164 KB 	   52813824 	 04/23/1999 16:38:20
+79:	00103720.dll 	      17 KB 	   53104640 	 08/31/1999 23:07:49
+80:	00104112.dll 	     240 KB 	   53305344 	 04/19/1999 15:29:48
+81:	00104800.dll 	     383 KB 	   53657600 	 06/06/2000 23:21:33
+82:	00106336.dll 	       2 MB 	   54444032 	 06/06/2000 23:21:20
+83:	00112544.dll 	     580 KB 	   57622528 	 06/30/2000 06:17:34
+84:	00113848.dll 	       1 MB 	   58290176 	 03/06/1999 09:02:12
+85:	00119856.dll 	      17 KB 	   61366272 	 04/23/1999 16:39:21
+86:	00122392.dll 	     164 KB 	   62664704 	 04/23/1999 16:38:55
+87:	00122984.exe 	      60 KB 	   62967808 	 06/30/2000 06:12:01
+88:	00124112.exe 	      60 KB 	   63545344 	 06/30/2000 06:12:01
+89:	00125024.dll 	      84 KB 	   64012288 	 06/30/2000 06:17:32
+90:	00125704.dll 	     120 KB 	   64360448 	 06/30/2000 06:17:33
+91:	00127096.dll 	      28 KB 	   65073152 	 06/30/2000 06:17:32
+92:	00127216.exe 	      72 KB 	   65134592 	 06/30/2000 06:12:33
+93:	00127808.exe 	      72 KB 	   65437696 	 06/30/2000 06:12:33
+94:	00128376.dll 	     256 KB 	   65728512 	 06/30/2000 06:17:35
+95:	00129656.dll 	      36 KB 	   66383872 	 06/30/2000 06:17:35
+96:	00129856.dll 	      72 KB 	   66486272 	 06/30/2000 06:17:34
+97:	00130000.dll 	      89 KB 	   66560000 	 07/18/1999 17:06:44
+98:	00132464.exe 	      56 KB 	   67821568 	 06/30/2000 06:11:16
+99:	00133256.exe 	      44 KB 	   68227072 	 04/29/1998 02:56:24
+100:	00133784.dll 	      28 KB 	   68497408 	 06/30/2000 06:17:33
+101:	00136552.dll 	      24 KB 	   69914624 	 06/30/2000 05:15:10
+102:	00137760.exe 	     336 KB 	   70533120 	 01/28/1998 17:12:18
+103:	00144784.exe 	      20 KB 	   74129408 	 05/24/2000 11:51:54
+104:	00147880.exe 	      29 KB 	   75714560 	 06/06/2000 20:41:52
+Finish: Sun Mar  1 00:28:45 2026
+
+105 FILES EXTRACTED
+	
+jpg:= 3
+gif:= 4
+bmp:= 3
+rif:= 8
+ole:= 7
+exe:= 80
+------------------------------------------------------------------
+
+Foremost finished at Sun Mar  1 00:28:45 2026

2026/srdnlen_quals/forensic/chapter2/output/bmp/xor_bmp.py

@@ -0,0 +1,37 @@
+import os
+from PIL import Image
+import numpy as np
+
+# Find all BMP files in the current directory
+bmps = [f for f in os.listdir('.') if f.endswith('.bmp')]
+print(bmps)
+images = {}
+
+for b in bmps:
+    try:
+        img = np.array(Image.open(b))
+        shape = img.shape
+        # Group images by their exact pixel dimensions
+        if shape not in images:
+            images[shape] = []
+        images[shape].append((b, img))
+    except Exception as e:
+        pass
+
+print(images.items())
+
+# Find the pair of relics and XOR them
+for shape, imgs in images.items():
+    print(len(imgs))
+    if len(imgs) == 2:
+
+        print(f"[+] Found matching relics: {imgs[0][0]} and {imgs[1][0]}")
+        
+        # This is the "remember to XOR"
+        result = np.bitwise_xor(imgs[0][1], imgs[1][1])
+        
+        out_name = f"final_armory_{imgs[0][0]}.png"
+        Image.fromarray(result).save(out_name)
+        print(f"[!] The forge is lit. Open {out_name} to claim the flag.")
+    else:
+        print("found no pairs")