36 lines
1.1 KiB
Python
36 lines
1.1 KiB
Python
import hashlib
|
|
|
|
def buggy_shift_right_1(data: bytes) -> bytes:
|
|
"""Replicates the VM's flawed, per-byte shift that ignores carries."""
|
|
return bytes(b >> 1 for b in data)
|
|
|
|
def bitwise_not(data: bytes) -> bytes:
|
|
"""Inverts all bits in the byte array."""
|
|
return bytes(~b & 0xFF for b in data)
|
|
|
|
def generate_dragonfly(flag: bytes) -> bytes:
|
|
assert len(flag) == 29, "Flag must be exactly 29 bytes!"
|
|
|
|
current_state = bitwise_not(flag)
|
|
out_blob = bytearray()
|
|
|
|
# 8 iterations: hash, then shift
|
|
for _ in range(8):
|
|
out_blob.extend(hashlib.sha256(current_state).digest())
|
|
current_state = buggy_shift_right_1(current_state)
|
|
|
|
return bytes(out_blob)
|
|
|
|
if __name__ == "__main__":
|
|
# A test flag that matches your 29-byte requirement and format
|
|
# 9 byte prefix + 19 byte payload + 1 byte suffix = 29 bytes
|
|
test_flag = b"dach2026{0123456789abcdefgh!}"
|
|
|
|
blob = generate_dragonfly(test_flag)
|
|
|
|
with open("dragonfly.bin", "wb") as f:
|
|
f.write(blob)
|
|
|
|
print(f"[+] Wrote {len(blob)} bytes to dragonfly.bin")
|
|
print("[!] Swap this file into the VM environment and test it.")
|