cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dingdong

Browse Source
This commit is contained in:
cato447
2025-03-24 22:08:34 +01:00
parent 04a5de372e
commit f8f73b47ef
14 changed files with 52 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
training/IntroZ3/tasks/chall2_dreamer/exploit.py
View File

@@ -6,10 +6,17 @@ import sys
def ROL(X, N):
return ((((X) << (N)) | ((X) >> (64 - (N)))) % (2 ** 64))
if isinstance(X, z3.BitVecRef):
return z3.RotateLeft(X,N)
else:
return ((((X) << (N)) | ((X) >> (64 - (N)))) % (2 ** 64))
def ROR(X, N):
return ((((X) >> (N)) | ((X) << (64 - (N)))) % (2 ** 64))
if isinstance(X, z3.BitVecRef):
return z3.RotateRight(X,N)
else:
return ((((X) >> (N)) | ((X) << (64 - (N)))) % (2 ** 64))
def custom_random(state):
NEW_STATE = ROL(state,30) ^ ROR(state,12) ^ ROL(state,42) ^ ROL(state,4) ^ ROR(state,5);

3
training/IntroZ3/tasks/chall2_dreamer/test.py
View File

@@ -24,6 +24,7 @@ def get_seed_for_sequence(bytesequence):
s = z3.Solver()
base_state = z3.BitVec("base_state", 64)
cur_state = base_state
s.add(base_state > 0)
for byte in bytesequence:
gen_byte, cur_state = custom_random(cur_state)
s.add(gen_byte == byte)
@@ -44,7 +45,7 @@ def gen_sequence(seed, length):
return bytes(r)
test = random.getrandbits(32).to_bytes(4)
test = random.getrandbits(32).to_bytes(4, "little")
seed = get_seed_for_sequence(test)
print(seed)
print(test)