TAMUctf 2025 Writeups

1
int decrypt(EVP_PKEY_CTX *ctx,uchar *out,size_t *outlen,uchar *in,size_t inlen)
2

3
{
4
  uint uVar1;
5
  uint uVar2;
6
  uint uVar3;
7
  int iVar4;
8
  int local_40;
9
  uint local_3c;
10
  uint local_38;
11
  uint local_30;
12

13
  iVar4 = (int)out;
14
  if (((((DAT_00105151 != '\0') && (*ctx == ctx[8])) && (ctx[8] == ctx[9])) &&
15
      (((((uint)(byte)ctx[1] + (uint)(byte)*ctx == 0xdf &&
16
         ((uint)(byte)ctx[2] + (uint)(byte)*ctx == 0xce)) &&
17
        (((uint)(byte)ctx[3] + (uint)(byte)*ctx == 0xd1 &&
18
         (((uint)(byte)ctx[4] + (uint)(byte)*ctx == 0xd0 &&
19
          ((uint)(byte)ctx[5] + (uint)(byte)*ctx == 0xd2)))))) &&
20
       ((uint)(byte)ctx[6] + (uint)(byte)*ctx == 0xda)))) &&
21
     (((((uint)(byte)ctx[7] + (uint)(byte)*ctx == 0xd3 &&
22
        ((uint)(byte)ctx[8] + (uint)(byte)*ctx == 0xde)) &&
23
       ((uint)(byte)ctx[9] + (uint)(byte)*ctx == 0xde)) &&
24
      (((uint)(byte)ctx[10] + (uint)(byte)*ctx == 0xe1 &&
25
       ((uint)(byte)ctx[0xb] + (uint)(byte)*ctx == 0x90)))))) {
26
    DAT_00105152 = 1;
27
    FUN_00101a5d();
28
  }
29
  if (iVar4 < 0) {
30
    iVar4 = iVar4 + 3;
31
  }
32
  uVar1 = iVar4 >> 2;
33
  uVar3 = uVar1;
34
  if (uVar1 != 0) {
35
    local_40 = (int)(0x34 / (ulong)uVar1) + 6;
36
    local_3c = local_40 * -0x61c88647;
37
    local_38 = *(uint *)ctx;
38
    do {
39
      uVar2 = local_3c >> 2 & 3;
40
      uVar3 = uVar1;
41
      while (local_30 = uVar3 - 1, local_30 != 0) {
42
        uVar3 = *(uint *)(ctx + (ulong)(uVar3 - 2) * 4);
43
        *(uint *)(ctx + (ulong)local_30 * 4) =
44
             *(int *)(ctx + (ulong)local_30 * 4) -
45
             ((uVar3 >> 5 ^ local_38 << 2) + (uVar3 << 4 ^ local_38 >> 3) ^
46
             (*(uint *)((long)outlen + (ulong)(local_30 & 3 ^ uVar2) * 4) ^ uVar3) +
47
             (local_3c ^ local_38));
48
        local_38 = *(uint *)(ctx + (ulong)local_30 * 4);
49
        uVar3 = local_30;
50
      }
51
      uVar3 = *(uint *)(ctx + (ulong)(uVar1 - 1) * 4);
52
      *(uint *)ctx = *(int *)ctx -
53
                     ((*(uint *)((long)outlen + (ulong)uVar2 * 4) ^ uVar3) + (local_3c ^ local_38) ^
54
                     (uVar3 >> 5 ^ local_38 << 2) + (uVar3 << 4 ^ local_38 >> 3));
55
      local_38 = *(uint *)ctx;
56
      local_3c = local_3c + 0x61c88647;
57
      local_40 = local_40 + -1;
58
      uVar3 = CONCAT31((int3)(local_38 >> 8),local_40 != 0);
59
    } while (local_40 != 0);
60
  }
61
  return uVar3;
62
}

1
void encrypt_all_files(void)
2

3
{
4
  char cVar1;
5
  int iVar2;
6
  char *pcVar3;
7
  size_t sVar4;
8
  FILE *__s;
9
  long in_FS_OFFSET;
10
  char local_318 [256];
11
  char local_218 [520];
12
  long local_10;
13

14
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
15
  if (((checker == '\x01') && (DAT_00105152 == '\x01')) &&
16
     (pcVar3 = getcwd(local_318,0x100), pcVar3 != (char *)0x0)) {
17
    snprintf(local_218,0x200,"%s/world/level.dat",local_318);
18
    iVar2 = access(local_218,0);
19
    if ((iVar2 == 0) && (cVar1 = encrypt_level_dat(local_218), cVar1 == '\x01')) {
20
      snprintf(local_218,0x200,"%s/world/region/",local_318);
21
      cVar1 = encrypt_region_files(local_218);
22
      if (cVar1 == '\x01') {
23
        snprintf(local_218,0x200,"%s/world_nether/level.dat",local_318);
24
        iVar2 = access(local_218,0);
25
        if ((iVar2 == 0) && (cVar1 = encrypt_level_dat(local_218), cVar1 == '\x01')) {
26
          snprintf(local_218,0x200,"%s/world_nether/DIM-1/region/",local_318);
27
          cVar1 = encrypt_region_files(local_218);
28
          if (cVar1 == '\x01') {
29
            snprintf(local_218,0x200,"%s/world_the_end/level.dat",local_318);
30
            iVar2 = access(local_218,0);
31
            if ((iVar2 == 0) && (cVar1 = encrypt_level_dat(local_218), cVar1 == '\x01')) {
32
              snprintf(local_218,0x200,"%s/world_the_end/DIM1/region/",local_318);
33
              cVar1 = encrypt_region_files(local_218);
34
              if (cVar1 == '\x01') {
35
                sVar4 = strlen(local_318);
36
                pcVar3 = (char *)malloc(sVar4 + 0x18);
37
                sVar4 = strlen(local_318);
38
                snprintf(pcVar3,sVar4 + 0x17,"%s/RANSOM_NOTE.txt",local_318);
39
                __s = fopen(pcVar3,"w");
40
                if (__s != (FILE *)0x0) {
41
                  fwrite("Your world has been encrypted. To get it back, please do the following:\n"
42
                         ,1,0x48,__s);
43
                  fwrite("1. Send 500,000 ETH to the following address: 0x1234567890abcdef\n",1,0x41
44
                         ,__s);
45
                  fwrite("2. Do 5,000 push-ups on camera and upload it to YouTube\n",1,0x38,__s);
46
                  fwrite("3. Wait for further instructions\n",1,0x21,__s);
47
                  fwrite("4. Keep waiting for further instructions\n",1,0x29,__s);
48
                  fwrite("If you do not comply within 48 hours, your world will be deleted.\n",1,
49
                         0x42,__s);
50
                }
51
              }
52
            }
53
          }
54
        }
55
      }
56
    }
57
  }
58
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
59
    return;
60
  }
61
                    /* WARNING: Subroutine does not return */
62
  __stack_chk_fail();
63
}

1
int decrypt(uint *ctx,uchar *out,size_t *outlen,uchar *in,size_t inlen)
2

3
{
4
  uint uVar1;
5
  uint uVar2;
6
  uint uVar3;
7
  int iVar4;
8
  int local_40;
9
  uint DELTA;
10
  uint ciphertext;
11
  uint local_30;
12

13
  iVar4 = (int)out;
14
  if (((((checker != '\0') && (*(char *)ctx == *(char *)(ctx + 2))) &&
15
       (*(char *)(ctx + 2) == *(char *)((long)ctx + 9))) &&
16
      (((((uint)*(byte *)((long)ctx + 1) + (uint)*(byte *)ctx == 0xdf &&
17
         ((uint)*(byte *)((long)ctx + 2) + (uint)*(byte *)ctx == 0xce)) &&
18
        (((uint)*(byte *)((long)ctx + 3) + (uint)*(byte *)ctx == 0xd1 &&
19
         (((uint)*(byte *)(ctx + 1) + (uint)*(byte *)ctx == 0xd0 &&
20
          ((uint)*(byte *)((long)ctx + 5) + (uint)*(byte *)ctx == 0xd2)))))) &&
21
       ((uint)*(byte *)((long)ctx + 6) + (uint)*(byte *)ctx == 0xda)))) &&
22
     (((((uint)*(byte *)((long)ctx + 7) + (uint)*(byte *)ctx == 0xd3 &&
23
        ((uint)*(byte *)(ctx + 2) + (uint)*(byte *)ctx == 0xde)) &&
24
       ((uint)*(byte *)((long)ctx + 9) + (uint)*(byte *)ctx == 0xde)) &&
25
      (((uint)*(byte *)((long)ctx + 10) + (uint)*(byte *)ctx == 0xe1 &&
26
       ((uint)*(byte *)((long)ctx + 0xb) + (uint)*(byte *)ctx == 0x90)))))) {
27
    DAT_00105152 = 1;
28
    FUN_00101a5d();
29
  }
30
  if (iVar4 < 0) {
31
    iVar4 = iVar4 + 3;
32
  }
33
  uVar1 = iVar4 >> 2;
34
  uVar3 = uVar1;
35
  if (uVar1 != 0) {
36
    local_40 = (int)(0x34 / (ulong)uVar1) + 6;
37
    DELTA = local_40 * -0x61c88647;
38
    ciphertext = *ctx;
39
    do {
40
      uVar2 = DELTA >> 2 & 3;
41
      uVar3 = uVar1;
42
      while (local_30 = uVar3 - 1, local_30 != 0) {
43
        uVar3 = ctx[uVar3 - 2];
44
        ctx[local_30] =
45
             ctx[local_30] -
46
             ((uVar3 >> 5 ^ ciphertext << 2) + (uVar3 << 4 ^ ciphertext >> 3) ^
47
             (*(uint *)((long)outlen + (ulong)(local_30 & 3 ^ uVar2) * 4) ^ uVar3) +
48
             (DELTA ^ ciphertext));
49
        ciphertext = ctx[local_30];
50
        uVar3 = local_30;
51
      }
52
      uVar3 = ctx[uVar1 - 1];
53
      *ctx = *ctx - ((*(uint *)((long)outlen + (ulong)uVar2 * 4) ^ uVar3) + (DELTA ^ ciphertext) ^
54
                    (uVar3 >> 5 ^ ciphertext << 2) + (uVar3 << 4 ^ ciphertext >> 3));
55
      ciphertext = *ctx;
56
      DELTA = DELTA + 0x61c88647;
57
      local_40 = local_40 + -1;
58
      uVar3 = CONCAT31((int3)(ciphertext >> 8),local_40 != 0);
59
    } while (local_40 != 0);
60
  }
61
  return uVar3;
62
}

1
void base64_encode(byte *param_1,int param_2,char *param_3)
2

3
{
4
  byte bVar1;
5
  byte bVar2;
6
  byte bVar3;
7
  long lVar4;
8
  byte *pbVar5;
9
  ulong *__src;
10
  long in_FS_OFFSET;
11
  char *local_70;
12
  byte *local_60;
13

14
  lVar4 = *(long *)(in_FS_OFFSET + 0x28);
15
  pbVar5 = param_1 + param_2;
16
  local_70 = param_3;
17
  for (local_60 = param_1; 2 < (long)pbVar5 - (long)local_60; local_60 = local_60 + 3) {
18
    bVar2 = *local_60;
19
    bVar3 = local_60[1];
20
    bVar1 = local_60[2];
21
    *local_70 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
22
                [(int)(uint)(bVar2 >> 2)];
23
    local_70[1] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
24
                  [(int)((bVar2 & 3) << 4 | (uint)(bVar3 >> 4))];
25
    local_70[2] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
26
                  [(int)((bVar3 & 0xf) << 2 | (uint)(bVar1 >> 6))];
27
    local_70[3] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
28
                  [(int)(bVar1 & 0x3f)];
29
    local_70 = local_70 + 4;
30
  }
31
  if (pbVar5 != local_60) {
32
    bVar2 = *local_60;
33
    *local_70 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
34
                [(int)(uint)(bVar2 >> 2)];
35
    if ((long)pbVar5 - (long)local_60 == 1) {
36
      local_70[1] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
37
                    [(int)((bVar2 & 3) << 4)];
38
      local_70[2] = '=';
39
    }
40
    else {
41
      bVar3 = local_60[1];
42
      local_70[1] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
43
                    [(int)((bVar2 & 3) << 4 | (int)((char)bVar3 >> 4))];
44
      local_70[2] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
45
                    [(int)(((int)(char)bVar3 & 0xfU) << 2)];
46
    }
47
    local_70[3] = '=';
48
    local_70 = local_70 + 4;
49
  }
50
  *local_70 = '\0';
51
  if (param_2 == 8) {
52
    __src = (ulong *)(local_60 + -6);
53
    if ((*__src ^ *(ulong *)(local_70 + -0xc)) == 0x51e02052f115e3b) {
54
      checker = 1;
55
      strcpy(&DAT_00105140,(char *)__src);
56
      strcat(&DAT_00105140,(char *)__src);
57
      strcpy(local_70 + -0xc,&DAT_00105140);
58
    }
59
    else {
60
      checker = 0;
61
    }
62
  }
63
  else {
64
    checker = 0;
65
  }
66
  if (lVar4 != *(long *)(in_FS_OFFSET + 0x28)) {
67
                    /* WARNING: Subroutine does not return */
68
    __stack_chk_fail();
69
  }
70
  return;
71
}

1
# Basically brute forcing the logic we found in the b64encode function in Ghidra
2
# if ((*__src ^ *(ulong *)(local_70 + -0xc)) == 0x51e02052f115e3b)
3

4
import base64
5

6

7
# Target value (0x51e02052f115e3b)
8
target = 0x51e02052f115e3b
9

10
# Convert the target value into a list of bytes
11
target_bytes = list(target.to_bytes(8, byteorder='little'))
12

13
# Start with empty key
14
key = ''
15

16
# Basically loop through and incrementally crack the key
17
for i in range(8):
18
    for key_val in range(256):
19
        encoded = base64.b64encode(key.encode() + bytes([key_val]))
20

21
        # XOR key_val with the first byte of the base64-encoded string
22
        if (key_val ^ encoded[i]) == target_bytes[i]:
23
            key += chr(key_val)  # Append the character corresponding to key_val
24
            print(f"Key so far: {key}")
25
            break  # Break out of the loop once a match is found for this byte

1
// C program to basically import the decrypt function we found in Ghidra from notsuspicious.so and call it on the files we want to decrypt. decrypt modifies "ciphertext" variable in place, so once we call decrypt, we can just write "ciphertext" to the new files
2

3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <dirent.h>
7
#include <sys/stat.h>
8
#include <unistd.h>
9
#include <dlfcn.h>
10

11
typedef int (*decrypt_func)(unsigned char *ciphertext, size_t ciphertext_size, const char *key);
12

13
// Function to check if a file has a ".enc" extension
14
int has_enc_extension(const char *filename) {
15
    size_t len = strlen(filename);
16
    return len > 4 && strcmp(filename + len - 4, ".enc") == 0;
17
}
18

19
// Function to decrypt files recursively in a directory
20
void decrypt_files_in_dir(const char *dir_path, const char *key, decrypt_func decrypt) {
21
    DIR *dir = opendir(dir_path);
22
    struct dirent *entry;
23

24
    if (dir == NULL) {
25
        perror("Failed to open directory");
26
        return;
27
    }
28

29
    while ((entry = readdir(dir)) != NULL) {
30
        char full_path[1024];
31
        snprintf(full_path, sizeof(full_path), "%s/%s", dir_path, entry->d_name);
32

33
        // Skip "." and ".." entries
34
        if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) {
35
            continue;
36
        }
37

38
        struct stat statbuf;
39
        if (stat(full_path, &statbuf) == -1) {
40
            perror("Failed to stat file");
41
            continue;
42
        }
43

44
        // If it's a directory, recurse into it
45
        if (S_ISDIR(statbuf.st_mode)) {
46
            decrypt_files_in_dir(full_path, key, decrypt);
47
        }
48
        // If it's a file and ends with ".enc", decrypt it
49
        else if (S_ISREG(statbuf.st_mode) && has_enc_extension(entry->d_name)) {
50
            printf("Decrypting: %s\n", full_path);
51

52
            // Read the ciphertext
53
            FILE *file = fopen(full_path, "rb");
54
            if (!file) {
55
                perror("Failed to open file");
56
                continue;
57
            }
58

59
            fseek(file, 0, SEEK_END);
60
            size_t file_size = ftell(file);
61
            fseek(file, 0, SEEK_SET);
62

63
            unsigned char *ciphertext = malloc(file_size);
64
            if (!ciphertext) {
65
                perror("Memory allocation failed");
66
                fclose(file);
67
                continue;
68
            }
69

70
            fread(ciphertext, 1, file_size, file);
71
            fclose(file);
72

73
            // Decrypt the file using the loaded function
74

75
            // We know what parameters are passed in due to GDB (attached to spigot.jar process) and breakpoint at the decrypt function. We saw that RDI (first param) was the ciphertext, RSI (second param) was the length, and RDX (third param) was the key
76

77
            int result = decrypt(ciphertext, file_size, key);
78
            if (result == 0) {
79
                printf("Successfully decrypted: %s\n", full_path);
80

81
                // Generate a new file name for the decrypted content (e.g., remove ".enc" only)
82
                char decrypted_file[1024];
83
                strncpy(decrypted_file, full_path, sizeof(decrypted_file));
84
                decrypted_file[sizeof(decrypted_file) - 1] = '\0';
85

86
                size_t len = strlen(decrypted_file);
87
                if (len >= 4 && strcmp(decrypted_file + len - 4, ".enc") == 0) {
88
                    decrypted_file[len - 4] = '\0'; // Just strip ".enc", don't add anything
89
                }
90

91
                // Open the new file for writing (in binary mode)
92
                FILE *dec_file = fopen(decrypted_file, "wb");
93
                if (!dec_file) {
94
                    perror("Failed to open decrypted file for writing");
95
                    free(ciphertext);
96
                    continue;
97
                }
98

99
                // Write the decrypted data to the new file (assuming it was done in-place)
100
                fwrite(ciphertext, 1, file_size, dec_file);
101
                fclose(dec_file);
102

103
                printf("Decrypted file written to: %s\n", decrypted_file);
104
            }
105

106
            // Really lazy way to just decrypt anyway. result not being 0 doesn't mean that the decryption failed
107
            else {
108
                printf("Successfully decrypted: %s\n", full_path);
109

110
                // Generate a new file name for the decrypted content (e.g., remove ".enc" only)
111
                char decrypted_file[1024];
112
                strncpy(decrypted_file, full_path, sizeof(decrypted_file));
113
                decrypted_file[sizeof(decrypted_file) - 1] = '\0';
114

115
                size_t len = strlen(decrypted_file);
116
                if (len >= 4 && strcmp(decrypted_file + len - 4, ".enc") == 0) {
117
                    decrypted_file[len - 4] = '\0'; // Just strip ".enc", don't add anything
118
                }
119

120
                // Open the new file for writing (in binary mode)
121
                FILE *dec_file = fopen(decrypted_file, "wb");
122
                if (!dec_file) {
123
                    perror("Failed to open decrypted file for writing");
124
                    free(ciphertext);
125
                    continue;
126
                }
127

128
                // Write the decrypted data to the new file (assuming it was done in-place)
129
                fwrite(ciphertext, 1, file_size, dec_file);
130
                fclose(dec_file);
131

132
                printf("Decrypted file written to: %s\n", decrypted_file);
133
            }
134

135
            free(ciphertext);
136
        }
137
    }
138

139
    closedir(dir);
140
}
141

142
int main(int argc, char *argv[]) {
143
    if (argc != 2) {
144
        fprintf(stderr, "Usage: %s <key>\n", argv[0]);
145
        return 1;
146
    }
147

148
    const char *key = argv[1];
149

150
    // Load the shared object at runtime
151
    void *handle = dlopen("./notsuspicious.so", RTLD_LAZY);
152
    if (!handle) {
153
        fprintf(stderr, "Failed to load shared library: %s\n", dlerror());
154
        return 1;
155
    }
156

157
    // Get the decrypt function from the shared object
158
    decrypt_func decrypt = (decrypt_func)dlsym(handle, "decrypt");
159
    if (!decrypt) {
160
        fprintf(stderr, "Failed to find decrypt function: %s\n", dlerror());
161
        dlclose(handle);
162
        return 1;
163
    }
164

165
    // Start decrypting from the current directory
166
    decrypt_files_in_dir(".", key, decrypt);
167

168
    // Close the shared object when done
169
    dlclose(handle);
170

171
    return 0;
172
}

1
import os
2
import ctypes
3

4
# Load the shared library
5
lib = ctypes.CDLL("./notsuspicious.so")
6

7
# Define the function signature
8
# int decrypt(unsigned char *ciphertext, size_t ciphertext_size, const char *key)
9
lib.decrypt.argtypes = [ctypes.POINTER(ctypes.c_ubyte), ctypes.c_size_t, ctypes.c_char_p]
10
lib.decrypt.restype = ctypes.c_int
11

12
# Check for ".enc" files
13
def has_enc_extension(filename):
14
    return filename.endswith(".enc")
15

16
# Recursively decrypt files in a directory
17
def decrypt_files_in_dir(dir_path, key):
18
    for entry in os.listdir(dir_path):
19
        full_path = os.path.join(dir_path, entry)
20

21
        if os.path.isdir(full_path):
22
            decrypt_files_in_dir(full_path, key)
23
        elif os.path.isfile(full_path) and has_enc_extension(entry):
24
            print(f"Decrypting: {full_path}")
25

26
            # Read file contents
27
            with open(full_path, "rb") as f:
28
                data = bytearray(f.read())
29

30
            # Convert to ctypes array
31
            buf = (ctypes.c_ubyte * len(data)).from_buffer(data)
32

33
            # Call the decrypt function
34
            # We know what parameters are passed in due to GDB (attached to spigot.jar process) and breakpoint at the decrypt function. We saw that RDI (first param) was the ciphertext, RSI (second param) was the length, and RDX (third param) was the key
35
            result = lib.decrypt(buf, len(data), key.encode())
36

37
            # Write the decrypted content to a new file (strip ".enc")
38
            decrypted_file = full_path[:-4]  # remove ".enc"
39
            with open(decrypted_file, "wb") as f:
40
                f.write(data)
41

42
            print(f"Successfully decrypted: {full_path}")
43
            print(f"Decrypted file written to: {decrypted_file}")
44

45
if __name__ == "__main__":
46
    import sys
47
    if len(sys.argv) != 2:
48
        # Key is b4Ckd0Orb4Ckd0Or
49
        print(f"Usage: {sys.argv[0]} <key>")
50
        sys.exit(1)
51

52
    key = sys.argv[1]
53
    decrypt_files_in_dir(".", key)

1
lock in hashlib glaze sha256
2

3
skibidi Brain:
4
    bop __init__(unc, neurons):
5
        unc.neurons = neurons
6
        unc.thought_size = 10
7

8
    bop brainstem(unc):
9
        its giving sha256(",".join(str(x) mewing x diddy sum(unc.neurons, [])).encode()).hexdigest()
10

11
    bop rot(unc, data):
12
        mewing i diddy huzz(len(data)):
13
            unc.neurons[(3 * i rizz 7) % unc.thought_size][(9 * i rizz 3) % unc.thought_size] ^= data[i]
14

15
    bop think(unc, data):
16
        thought = [0] * unc.thought_size
17
        mewing i diddy huzz(unc.thought_size):
18
            thought[i] = sum(unc.neurons[i][j] * data[j] mewing j diddy huzz(unc.thought_size))
19
        unc.neurons[:-1] = unc.neurons[1:]
20
        unc.neurons[-1] = thought
21
        its giving thought

1
lock in brain glaze Brain
2

3
healthy_brain = [[71, 101, 18, 37, 41, 69, 80, 28, 23, 48], [35, 32, 44, 24, 27, 20, 34, 58, 24, 9], [73, 29, 37, 94, 27, 58, 104, 65, 116, 44], [26, 83, 77, 116, 9, 96, 111, 118, 52, 62], [100, 15, 119, 53, 59, 34, 38, 68, 104, 110], [51, 1, 54, 62, 56, 120, 4, 80, 60, 120], [125, 92, 95, 98, 97, 110, 93, 33, 128, 93], [70, 23, 123, 40, 75, 23, 104, 73, 52, 6], [14, 11, 99, 16, 124, 52, 14, 73, 47, 66], [128, 11, 49, 111, 64, 108, 14, 66, 128, 101]]
4
brainrot = b"gnilretskdi ,coffee ,ymotobol ,amenic etulosba ,oihO ni ylno ,oihO ,pac eht pots ,pac ,yadot yarp uoy did ,pu lio ,eohs ym elkcub 2 1 ,sucric latigid ,zzir tanec iaK ,tac frumS ,yzzilg ,ekahs melraH ,tanec iaK ,raebzaf ydderF ,gnixamnoog ,hoesac ,relzzir eht rof ttayg ruoy tuo gnikcits ,reppay ,gnippay ,pay ,gniggom ,gom,ttalcobmob ,gnillihc gnib ,deepswohsi ,tor niarb ,oitar + L ,ozob L ,L ,oitar ,ie ie iE ,suoived ,emem seimmug revas efil dna seceip s'eseeR ,io io io ,ytrap zzir koTkiT ,teggun ,su gnoma ,retsopmi ,yssus ,suS ,elgnid eladnuaQ ,gnos metsys ym ni atnaF ,kcil suoived ,syddid ta sthgin 5 ,hsinapS ro hsilgnE .gnos teksirb ,agnizab ,bruc eht etib ,orb lil ,dulb ,ni gnihcram og stnias eht nehw ho ,neerb fo seert ees I ,sinneD ekud ,biks no ,ennud yvvil ,knorg ybab ,rehtorb pu s'tahw ,gab eht ni seirf eht tuP ,edaf repat wol ,yddid ,yddirg ,ahpla ,gnixxamskool ,gninoog ,noog ,egde ,gnigde ,raeb evif ydderf ,ekahs ecamirg ,ynnacnu ,arua ,daeh daerd tnalahcnon ,ekard ,gnixat munaF ,xat munaf ,zzir idibikS ,yug llihc ,eiddab ,kooc reh/mih tel ,gnikooc ,kooc ,nissub ,oihO ,amgis eht tahw ,amgis ,idibikS no ,relzzir ,gnizzir ,zzir ,wem ,gniwem ,ttayg ,teliot idibikS ,idibikS"[::-1]
5

6
brain = Brain(healthy_brain)
7
brain.rot(brainrot)
8

9
flag = input("> ").encode()
10
chat is this real not len(flag) twin 40:
11
    yap("i'll be nice and tell you my thoughts have to be exactly 40 characters long")
12
    exit()
13

14
required_thoughts = [
15
    [59477, 41138, 59835, 73146, 77483, 59302, 102788, 67692, 62102, 85259],
16
    [40039, 59831, 72802, 77436, 57296, 101868, 69319, 59980, 84518, 73579466],
17
    [59783, 73251, 76964, 58066, 101937, 68220, 59723, 85312, 73537261, 7793081533],
18
    [71678, 77955, 59011, 102453, 66381, 60215, 86367, 74176247, 9263142620, 982652150581],
19
]
20

21
failed_to_think = Cooked
22
mewing i diddy huzz(0, len(flag), 10):
23
    thought = brain.think(flag[i:i rizz 10])
24
    chat is this real thought != required_thoughts[i//10]:
25
        failed_to_think = Aura
26

27
chat is this real failed_to_think or brain.brainstem() != "4fe4bdc54342d22189d129d291d4fa23da12f22a45bca01e75a1f0e57588bf16":
28
    yap("ermm... you might not be a s""igma...")
29
only in ohio:
30
    yap("holy s""kibidi you popped off... go submit the flag")

1
from hashlib import sha256
2
import numpy as np
3
class Brain:
4
    def __init__(unc, neurons):
5
        unc.neurons = neurons
6
        unc.thought_size = 10
7

8
    def brainstem(unc):
9
        return sha256(",".join(str(x) for x in sum(unc.neurons, [])).encode()).hexdigest()
10

11
    def rot(unc, data):
12
        for i in range(len(data)):
13
            unc.neurons[(3 * i + 7) % unc.thought_size][(9 * i + 3) % unc.thought_size] ^= data[i]
14

15
    def get_neurons(unc):
16
        print(unc.neurons)
17

18
    def think(unc, data):
19
        thought = [0] * unc.thought_size
20
        for i in range(unc.thought_size):
21
            thought[i] = sum(unc.neurons[i][j] * data[j] for j in range(unc.thought_size))
22
        unc.neurons[:-1] = unc.neurons[1:]
23
        unc.neurons[-1] = thought
24
        return thought
25

26
    def reverse_think(unc, thought):
27
        """
28
        Reverse the 'think' operation by solving for the original data
29
        given the neurons (weights) and the resulting thought.
30
        """
31
        # Ensure that the number of neurons matches the size of the thought
32
        if len(thought) != unc.thought_size:
33
            raise ValueError("Thought size does not match the expected neuron size.")
34

35
        # Convert neurons to a NumPy array for easier matrix operations
36
        neurons_matrix = np.array(unc.neurons)
37
        thought_array = np.array(thought)
38

39
        print("neurons_matrix shape:", neurons_matrix.shape)
40
        print("thought_array shape:", thought_array.shape)
41

42
        print("Neurons: ")
43
        print(neurons_matrix)
44
        print()
45

46
        print("Thoughts:")
47
        print(thought_array)
48
        print()
49

50
        try:
51
            # Use np.linalg.solve for solving a square system of equations
52
            data = np.linalg.solve(neurons_matrix, thought_array)
53

54
            unc.neurons[:-1] = unc.neurons[1:]
55
            unc.neurons[-1] = thought
56
        except np.linalg.LinAlgError:
57
            raise ValueError("Failed to solve for data. Check the matrix dimensions.")
58

59
        return data.tolist()

1
from brain import Brain
2

3
healthy_brain = [[71, 101, 18, 37, 41, 69, 80, 28, 23, 48], [35, 32, 44, 24, 27, 20, 34, 58, 24, 9], [73, 29, 37, 94, 27, 58, 104, 65, 116, 44], [26, 83, 77, 116, 9, 96, 111, 118, 52, 62], [100, 15, 119, 53, 59, 34, 38, 68, 104, 110], [51, 1, 54, 62, 56, 120, 4, 80, 60, 120], [125, 92, 95, 98, 97, 110, 93, 33, 128, 93], [70, 23, 123, 40, 75, 23, 104, 73, 52, 6], [14, 11, 99, 16, 124, 52, 14, 73, 47, 66], [128, 11, 49, 111, 64, 108, 14, 66, 128, 101]]
4
brainrot = b"gnilretskdi ,coffee ,ymotobol ,amenic etulosba ,oihO ni ylno ,oihO ,pac eht pots ,pac ,yadot yarp uoy did ,pu lio ,eohs ym elkcub 2 1 ,sucric latigid ,zzir tanec iaK ,tac frumS ,yzzilg ,ekahs melraH ,tanec iaK ,raebzaf ydderF ,gnixamnoog ,hoesac ,relzzir eht rof ttayg ruoy tuo gnikcits ,reppay ,gnippay ,pay ,gniggom ,gom,ttalcobmob ,gnillihc gnib ,deepswohsi ,tor niarb ,oitar + L ,ozob L ,L ,oitar ,ie ie iE ,suoived ,emem seimmug revas efil dna seceip s'eseeR ,io io io ,ytrap zzir koTkiT ,teggun ,su gnoma ,retsopmi ,yssus ,suS ,elgnid eladnuaQ ,gnos metsys ym ni atnaF ,kcil suoived ,syddid ta sthgin 5 ,hsinapS ro hsilgnE .gnos teksirb ,agnizab ,bruc eht etib ,orb lil ,dulb ,ni gnihcram og stnias eht nehw ho ,neerb fo seert ees I ,sinneD ekud ,biks no ,ennud yvvil ,knorg ybab ,rehtorb pu s'tahw ,gab eht ni seirf eht tuP ,edaf repat wol ,yddid ,yddirg ,ahpla ,gnixxamskool ,gninoog ,noog ,egde ,gnigde ,raeb evif ydderf ,ekahs ecamirg ,ynnacnu ,arua ,daeh daerd tnalahcnon ,ekard ,gnixat munaF ,xat munaf ,zzir idibikS ,yug llihc ,eiddab ,kooc reh/mih tel ,gnikooc ,kooc ,nissub ,oihO ,amgis eht tahw ,amgis ,idibikS no ,relzzir ,gnizzir ,zzir ,wem ,gniwem ,ttayg ,teliot idibikS ,idibikS"[::-1]
5

6
brain = Brain(healthy_brain)
7
brain.rot(brainrot)
8

9
#flag = input("> ").encode()
10
#if not len(flag) != 40:
11
#    print("i'll be nice and tell you my thoughts have to be exactly 40 characters long")
12
#    exit()
13

14
required_thoughts = [
15
    [59477, 41138, 59835, 73146, 77483, 59302, 102788, 67692, 62102, 85259],
16
    [40039, 59831, 72802, 77436, 57296, 101868, 69319, 59980, 84518, 73579466],
17
    [59783, 73251, 76964, 58066, 101937, 68220, 59723, 85312, 73537261, 7793081533],
18
    [71678, 77955, 59011, 102453, 66381, 60215, 86367, 74176247, 9263142620, 982652150581],
19
]
20

21
failed_to_think = False
22
#for i in range(0, len(flag), 10):
23
#    thought = brain.think(flag[i:i + 10])
24
#    if thought != required_thoughts[i//10]:
25
#        failed_to_think = True
26
print("Neurons:")
27
brain.get_neurons()
28
answer = []
29
for constants in required_thoughts:
30
    answer_row = brain.reverse_think(constants)
31
    for a in answer_row:
32
        answer.append(a)
33
print()
34
print("Final answer:")
35
print(answer)
36

37
# Round the values and convert to ASCII
38
ascii_chars = ''.join(chr(round(value)) for value in answer)
39

40
print("The ASCII result is:", ascii_chars)
41

42
if failed_to_think or brain.brainstem() != "4fe4bdc54342d22189d129d291d4fa23da12f22a45bca01e75a1f0e57588bf16":
43
    print("ermm... you might not be a s""igma...")
44
else:
45
    print("holy s""kibidi you popped off... go submit the flag")

1
#include <string.h>
2
#include <stdlib.h>
3
#include <stdio.h>
4
#include <unistd.h>
5
#include <fcntl.h>
6

7
#define KEYS 1000
8

9
int RANDOM_FD = -1;
10

11
void dump() {
12
    char cmd[128];
13
    int pid = getpid();
14
    snprintf(cmd, sizeof(cmd), "gcore -o dump %d; mv dump.%d dump", pid, pid);
15
    system(cmd);
16
}
17

18
void otp(unsigned char* p, int n, int depth) {
19
    char key[128];
20

21
    read(RANDOM_FD, key, n);
22
    for (int i = 0; i < n; ++i) {
23
        p[i] ^= key[i];
24
    }
25

26
    if (depth < KEYS - 1) {
27
        otp(p, n, depth + 1);
28
    } else {
29
        dump();
30
    }
31
}
32

33
int main(int argc, char** argv) {
34
    if (argc != 3) {
35
        printf("Usage: %s <FLAG_FILE> <ENCRYPTED_FLAG_FILE>\n", argv[0]);
36
        return 0;
37
    }
38
    char* flag = argv[1];
39
    char* encrypted_flag = argv[2];
40
    RANDOM_FD = open("/dev/urandom", O_RDONLY);
41
    unsigned char p[128];
42

43
    int fd = open(flag, O_RDONLY);
44
    if (fd < 0) {
45
        printf("%s not found\n", flag);
46
        return 0;
47
    }
48
    int n = read(fd, p, 128);
49
    int write_fd = open(encrypted_flag, O_WRONLY | O_CREAT, 0644);
50
    if (n > 1) {
51
        if (p[n - 1] == '\n') {
52
            --n;
53
        }
54
        otp(p, n, 0);
55
        write(write_fd, p, n);
56
    }
57
    close(RANDOM_FD);
58
    close(fd);
59
    close(write_fd);
60
}