#include #include #include #include #include int main() { FILE *f = fopen("romfs/dragonfly.bin", "r"); if (!f) { perror("Failed to open file"); return 1; } // Get file size fseek(f, 0, SEEK_END); long file_size = ftell(f); fseek(f, 0, SEEK_SET); uint8_t *dragonfly = malloc(file_size); if (!dragonfly) { perror("malloc failed"); fclose(f); return 1; } fread(dragonfly, 1, file_size, f); fclose(f); uint8_t flag[0x1d] = {0}; // 29 bytes for (int i = 7; i >= 0; i--) { uint8_t *target_hash = dragonfly + SHA256_DIGEST_LENGTH * (7 - i); int found = 0; uint64_t max_n = 1ULL << sizeof(flag); for (uint64_t n = 0; n < max_n; n++) { uint64_t tmp = n; for (int j = 0; j < sizeof(flag); j++) { uint8_t bit = tmp & 1; tmp >>= 1; flag[j] = (flag[j] & 0xFE) | bit; } // Compute SHA-256 uint8_t hash[SHA256_DIGEST_LENGTH]; SHA256(flag, sizeof(flag), hash); if (memcmp(hash, target_hash, SHA256_DIGEST_LENGTH) == 0) { found = 1; break; } if (n % 1000000 == 0) { printf("\r%09lu", n); fflush(stdout); } } printf("\n"); if (!found) { printf("Could not find it on level: %d\n", i); break; } // Print flag in hex for (int j = 0; j < sizeof(flag); j++) { printf("%02x", flag[j]); } printf("\n"); // Shift left by 1 for (int j = 0; j < sizeof(flag); j++) { flag[j] = (flag[j] << 1) & 0xFF; } } // Print final flag for (int j = 0; j < sizeof(flag); j++) { printf("%02x", flag[j]); } printf("\n"); // Bitwise NOT for (int j = 0; j < sizeof(flag); j++) { flag[j] = (~flag[j]) & 0xFF; } for (int j = 0; j < sizeof(flag); j++) { printf("%02x", flag[j]); } printf("\n"); printf("%s\n", flag); free(dragonfly); return 0; }