1
from collections import deque
2

3
START = (1, 0, 3, 11, 10, 8, 12, 16, 13, 19)
4
DIRS = [('w', -4), ('a', -1), ('s', 4), ('d', 1)]
5

6
def piece_cells(anchor, pid):
7
    if pid == 0:
8
        return (anchor, anchor + 1, anchor + 4, anchor + 5)
9
    if 1 <= pid <= 4:
10
        return (anchor, anchor + 4)
11
    if pid == 5:
12
        return (anchor, anchor + 1)
13
    return (anchor,)
14

15
def valid_shape(anchor, pid):
16
    r, c = divmod(anchor, 4)
17
    if pid == 0:
18
        return r <= 3 and c <= 2
19
    if 1 <= pid <= 4:
20
        return r <= 3
21
    if pid == 5:
22
        return c <= 2
23
    return 0 <= anchor < 20
24

25
def build_occ(state):
26
    occ = [-1] * 20
27
    pcs = []
28
    for pid, a in enumerate(state):
29
        if not valid_shape(a, pid):
30
            return None, None
31
        cells = piece_cells(a, pid)
32
        for x in cells:
33
            if not (0 <= x < 20) or occ[x] != -1:
34
                return None, None
35
            occ[x] = pid
36
        pcs.append(cells)
37
    return occ, pcs
38

39
def can_move(cells, occ, ch, d):
40
    for x in cells:
41
        if ch == 'a' and x % 4 == 0:
42
            return False
43
        if ch == 'd' and x % 4 == 3:
44
            return False
45
        nx = x + d
46
        if not (0 <= nx < 20):
47
            return False
48
        if occ[nx] != -1 and nx not in cells:
49
            return False
50
    return True
51

52
def bfs():
53
    q = deque([START])
54
    prev = {START: (None, None)}
55
    while q:
56
        s = q.popleft()
57
        if s[0] == 13:
58
            path = []
59
            cur = s
60
            while prev[cur][0] is not None:
61
                p, act = prev[cur]
62
                path.append(act)
63
                cur = p
64
            path.reverse()
65
            return path
66
        occ, pcs = build_occ(s)
67
        if occ is None:
68
            continue
69
        for pid in range(10):
70
            cells = pcs[pid]
71
            for ch, d in DIRS:
72
                if can_move(cells, occ, ch, d):
73
                    ns = list(s)
74
                    ns[pid] += d
75
                    ns = tuple(ns)
76
                    if ns not in prev:
77
                        prev[ns] = (s, (pid, ch))
78
                        q.append(ns)
79
    return None
80

81
if __name__ == "__main__":
82
    path = bfs()
83
    print(len(path))
84
    print(" ".join(f"{pid}{ch}" for pid, ch in path))

1
import struct
2

3
def solve():
4

5
    key_str = b"C0lm_be4ore_7he_st0rm"
6

7
    targets = [
8
        0x8260C1C9C8D936E3, #s[0:8]
9
        0x1C4BB2D52511D975, #s[8:16]
10
        0xF11CAF1C716DE64D, #s[16:24]
11
        0x1A5AF67F261CA506  #s[24:32]
12
    ]
13

14
    S = list(range(256))
15
    j = 0
16
    for i in range(256):
17
        j = (j + S[i] + key_str[i % 21]) % 256
18
        S[i], S[j] = S[j], S[i]
19
    i_ptr = 0
20
    j_ptr = 0
21
    current_rot_str = list(key_str)
22
    keystream = []
23

24
    for _ in range(32):
25
        i_ptr = (i_ptr + 1) % 256
26
        v2 = S[i_ptr]
27
        j_ptr = (j_ptr + v2 + current_rot_str[i_ptr % 21]) % 256
28
        S[i_ptr], S[j_ptr] = S[j_ptr], S[i_ptr]
29
        res_idx = (S[i_ptr] + S[j_ptr]) % 256
30
        keystream.append(S[res_idx])
31
        first = current_rot_str.pop(0)
32
        current_rot_str.append(first)
33
    ks_qwords = [
34
        struct.unpack("<Q", bytes(keystream[i:i+8]))[0]
35
        for i in range(0, 32, 8)
36
    ]
37
    flag_parts = []
38
    for i in range(4):
39
        flag_parts.append(struct.pack("<Q", targets[i] ^ ks_qwords[i]))
40

41
    flag = b"".join(flag_parts)
42
    print(flag.decode(errors='ignore'))
43

44
if __name__ == "__main__":
45
    solve()
46

47
# hgame{Null_c0lm_wi7hout_0_storm}

1
from Crypto.Cipher import AES
2
import hmac
3
import hashlib
4
import sys
5

6
BYTE_3250_HEX = "BFE743BAE2BFAB5291E64BA4200E2ED39179FBA4C10A2000F9EF029FEE029645"
7
byte_3250 = bytes.fromhex(BYTE_3250_HEX)
8

9
PROG_RAW = bytes([
10
    0x05,0x02,0x0D,
11
    0x04,0x02,0xC3,
12
    0x02,0x00,0x02,
13
    0x01,0x03,0x01,
14
    0x05,0x03,0x03,
15
    0x04,0x03,0x01,
16
    0x06,0x03,0x07,
17
    0x07,0x00,0x03,
18
    0x03,0x00,0x5A,
19
    0x00,0x00,0x00,
20
    0x00,0x00,0x00,
21
    0x00,0x00,0x00
22
])
23

24
def ror8(x: int, r: int) -> int:
25
    r &= 7
26
    return ((x >> r) | ((x << (8 - r)) & 0xFF)) & 0xFF
27

28
def rol8(x: int, r: int) -> int:
29
    r &= 7
30
    return (((x << r) & 0xFF) | (x >> (8 - r))) & 0xFF
31

32
def pkcs7_unpad(x: bytes) -> bytes:
33
    if not x:
34
        return x
35
    pad = x[-1]
36
    if pad == 0 or pad > 16 or pad > len(x):
37
        return x
38
    if x[-pad:] != bytes([pad]) * pad:
39
        return x
40
    return x[:-pad]
41

42
def build_v39() -> bytes:
43
    out = bytearray(32)
44
    for i in range(32):
45
        rot = (1 - 3 * i) & 7
46
        out[i] = ror8(byte_3250[i] ^ 0x5C, rot) ^ 0xA7
47
    return bytes(out)
48

49
def derive_aes_key_from_nonce(nonce16: bytes) -> bytes:
50
    if len(nonce16) != 16:
51
        raise ValueError("nonce must be 16 bytes")
52

53
    # v10 = HMAC_SHA256(key=00*32, msg=nonce)
54
    v10 = hmac.new(b"\x00" * 32, nonce16, hashlib.sha256).digest()
55

56
    # v11 = HMAC_SHA256(key=v10, msg=v39||0x01)
57
    v39 = build_v39()
58
    v11 = hmac.new(v10, v39 + b"\x01", hashlib.sha256).digest()
59

60
    return v11[:16]
61

62
def client_forward_byte(ch: int, idx: int) -> int:
63
    st = [ch & 0xFF, idx & 0xFF, 0, 0]
64
    op = 0
65
    dst = 2
66
    src = 1
67

68
    p = 0
69
    for _ in range(256):
70
        if not (0 <= op <= 6):
71
            break
72
        if not (0 <= dst <= 3):
73
            break
74

75
        if op == 0:
76
            if not (0 <= src <= 3): break
77
            st[dst] = st[src]
78
        elif op == 1:
79
            if not (0 <= src <= 3): break
80
            st[dst] ^= st[src]
81
        elif op == 2:
82
            st[dst] ^= (src & 0xFF)
83
        elif op == 3:
84
            st[dst] = (st[dst] + (src & 0xFF)) & 0xFF
85
        elif op == 4:
86
            st[dst] = (st[dst] * (src & 0xFF)) & 0xFF
87
        elif op == 5:
88
            st[dst] &= (src & 0xFF)
89
        elif op == 6:
90
            if not (0 <= src <= 3): break
91
            st[dst] = rol8(st[dst], st[src] & 7)
92

93
        if p + 2 >= len(PROG_RAW):
94
            break
95
        b0 = PROG_RAW[p]
96
        b1 = PROG_RAW[p + 1]
97
        b2 = PROG_RAW[p + 2]
98
        p += 3
99

100
        dst = b1
101
        src = b2
102
        op = ((b0 - 1) & 0xFF)
103

104
    return st[0] & 0xFF
105

106

107
def build_inverse_table_for_index(idx: int):
108
    inv = [-1] * 256
109
    for b in range(256):
110
        o = client_forward_byte(b, idx)
111
        if inv[o] == -1:
112
            inv[o] = b
113
    return inv
114

115
def inverse_client_transform(data: bytes) -> bytes:
116
    out = bytearray(len(data))
117
    for i, c in enumerate(data):
118
        inv = build_inverse_table_for_index(i & 0xFF)
119
        v = inv[c]
120
        if v == -1:
121
            v = c
122
        out[i] = v
123
    return bytes(out)
124

125
def solve_blob(blob: bytes):
126
    if len(blob) < 32:
127
        raise ValueError("blob too short")
128

129
    nonce = blob[:16]
130
    ct = blob[16:]
131

132
    if len(ct) % 16 != 0:
133
        raise ValueError(f"ciphertext len {len(ct)} is not multiple of 16")
134

135
    key = derive_aes_key_from_nonce(nonce)
136

137
    pt_trans = AES.new(key, AES.MODE_ECB).decrypt(ct)
138
    pt_trans = pkcs7_unpad(pt_trans)
139

140
    pt_raw = inverse_client_transform(pt_trans)
141
    return nonce, key, pt_trans, pt_raw
142

143

144
def print_best_text(bs: bytes):
145
    print("[+] recovered (bytes):", bs)
146
    for enc in ("utf-8", "gbk", "latin1"):
147
        try:
148
            s = bs.decode(enc)
149
            print(f"[+] recovered ({enc}): {s}")
150
            return
151
        except Exception:
152
            pass
153
    print("[+] recovered (text): <decode failed>")
154

155

156
def main():
157
    in_file = "Drv_blob.bin"
158
    if len(sys.argv) >= 2:
159
        in_file = sys.argv[1]
160

161
    with open(in_file, "rb") as f:
162
        blob = f.read()
163

164
    nonce, key, pt_trans, pt_raw = solve_blob(blob)
165

166
    print("[+] file      :", in_file)
167
    print("[+] nonce     :", nonce.hex())
168
    print("[+] aes_key   :", key.hex())
169
    print("[+] trans_len :", len(pt_trans))
170
    print("[+] raw_len   :", len(pt_raw))
171
    print("[+] transformed(hex):", pt_trans.hex())
172
    print_best_text(pt_raw)
173

174
    low = pt_raw.lower()
175
    if b"flag{" in low or b"hgame{" in low or b"vidar{" in low:
176
        print("[+] possible flag detected.")
177

178

179
if __name__ == "__main__":
180
    main()

1
package com.seal.ouroborosapp.domain;
2

3
import com.seal.ouroborosapi.RiskEngine;
4
import org.springframework.stereotype.Service;
5

6
@Service
7
/* loaded from: ouroboros-app-0.0.1-SNAPSHOT.jar:BOOT-INF/classes/com/seal/ouroborosapp/domain/TradeService.class */
8
public class TradeService {
9
    private RiskEngine riskEngine = new RiskPolicy();
10

11
    public String executeTrade(String token, double amount) {
12
        return this.riskEngine.check(token, amount);
13
    }
14
}

1
package com.seal.ouroborosapp.domain;
2

3
import com.seal.ouroborosapi.RiskEngine;
4

5
/* loaded from: ouroboros-app-0.0.1-SNAPSHOT.jar:BOOT-INF/classes/com/seal/ouroborosapp/domain/RiskPolicy.class */
6
public class RiskPolicy implements RiskEngine {
7
    @Override // com.seal.ouroborosapi.RiskEngine
8
    public String check(String token, double amount) {
9
        return null;
10
    }
11
}

1
public com.seal.ouroborosapi.RiskEngine initContext() throws java.lang.IllegalAccessException, java.lang.NoSuchMethodException, java.lang.ClassNotFoundException, java.lang.SecurityException, java.io.IOException, java.lang.IllegalArgumentException, java.lang.reflect.InvocationTargetException {
2
        /*
3
            Method dump skipped, instructions count: 830
4
            To view this dump change 'Code comments level' option to 'DEBUG'
5
        */
6
        throw new UnsupportedOperationException("Method not decompiled: com.seal.ouroborosapp.infra.ShadowLoader.initContext():com.seal.ouroborosapi.RiskEngine");
7
}

1
int k = IntegrityVerifier.getDeriveKey();
2
byte[] d = read("/application-data.db"); //R_NAME
3

4
long s = k & 0xffffffffL;
5
for i in [0..len-1]:
6
    s = (s * 1103515245 + 12345) & 0xffffffff
7
    x = (s >>> 16) & 0xff
8
    d[i] ^= x
9

10
payload = d[128:]
11
JarInputStream(payload) -> load classes
12
target class endsWith("RealRiskEngine")

1
public class RealRiskEngine
2
implements RiskEngine {
3
    private static final byte[] LEGACY_STORE = new byte[]{-9, -17, -49, 7, 49, -50, -2, 54, 21, -65, -60, 107, 30, -42, 124, -83, 95, -100, -119, 108, 76, 62, -60, 14, -100, -19, -34, 63, -8, 6, -119, 1, -103, 17, 42, 82, -103, 23, 90, 73, -65, -85, 107, -22, 116, 115, 11, -41};
4
    private static final String LEGACY_KEY = "Ouroboros_Legacy";
5
    private static final String LEGACY_IV = "1234567812345678";
6

7
    public String check(String token, double amount) {
8
        if (this.checkLegacy(token)) {
9
            return "Legacy Access: Validated (But version expired).";
10
        }
11
        boolean isCorrect = OuroborosVM.execute(token, amount);
12
        if (isCorrect) {
13
            return "ACCESS GRANTED: Core Logic Validated.";
14
        }
15
        return null;
16
    }
17

18
    private boolean checkLegacy(String inputToken) {
19
        try {
20
            if (inputToken == null || inputToken.length() < 10) {
21
                return false;
22
            }
23
            IvParameterSpec iv = new IvParameterSpec(LEGACY_IV.getBytes(StandardCharsets.UTF_8));
24
            SecretKeySpec skeySpec = new SecretKeySpec(LEGACY_KEY.getBytes(StandardCharsets.UTF_8), "AES");
25
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
26
            cipher.init(2, (Key)skeySpec, iv);
27
            byte[] original = cipher.doFinal(LEGACY_STORE);
28
            String decoyFlag = new String(original, StandardCharsets.UTF_8);
29
            return inputToken.equals(decoyFlag);
30
        }
31
        catch (Exception ex) {
32
            return false;
33
        }
34
    }
35
}

1
v6 += 2LL;
2
v25.m128i_i8[v5++] = v10 | (16 * v9);
3
...
4
while ( v5 <= 0xF );
5
if ( v5 != 16 )
6
  return 1;

1
set pagination off
2
set confirm off
3
set disassemble-next-line off
4

5
set follow-fork-mode parent
6
set detach-on-fork on
7

8
handle SIGALRM nostop noprint pass
9
handle SIGPIPE nostop noprint pass
10

11
set logging file gdb_trace.log
12
set logging overwrite on
13
set logging enabled on
14

15
define pidxblk
16
    set $idx = (unsigned int)$edx
17
    set $tbl = (unsigned long long)0x405070
18
    set $tpl = *(unsigned long long*)($tbl + $idx*8)
19
    printf "[IDX] %u tpl=%#lx\n", $idx, $tpl
20
    x/6i $tpl
21
end
22

23
catch fork
24
commands
25
    silent
26
    continue
27
end
28

29
b *0x4015A6
30
commands
31
    silent
32
    pidxblk
33
    continue
34
end
35

36
run
37

38
set logging enabled off
39
shell awk '/^\[IDX\] /{print $2}' gdb_trace.log > idx_seq.txt
40

41
run

1
import re
2

3
target = bytes.fromhex("8cadb48febfd6fae8660ad44c3c75a31")
4
key0   = bytes.fromhex("5a097c137b8d4f2132be3b19af449c01")
5

6
S = [
7
0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
8
0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
9
0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
10
0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
11
0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
12
0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
13
0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
14
0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
15
0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
16
0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
17
0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
18
0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
19
0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
20
0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
21
0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
22
0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16
23
]
24
IS = [0]*256
25
for i,v in enumerate(S): IS[v]=i
26

27
def xtime(x):
28
    x <<= 1
29
    if x & 0x100: x ^= 0x11B
30
    return x & 0xff
31

32
def mul(a,b):
33
    r = 0
34
    while b:
35
        if b & 1: r ^= a
36
        a = xtime(a)
37
        b >>= 1
38
    return r
39

40
def rotw(w): return w[1:]+w[:1]
41
def subw(w): return bytes(S[x] for x in w)
42
def xorb(a,b): return bytes(x^y for x,y in zip(a,b))
43

44
def expand_key(k, rounds):
45
    ws = [k[i:i+4] for i in range(0,16,4)]
46
    rcon = 1
47
    while len(ws) < 4*(rounds+1):
48
        t = ws[-1]
49
        if len(ws) % 4 == 0:
50
            t = xorb(subw(rotw(t)), bytes([rcon,0,0,0]))
51
            rcon = xtime(rcon)
52
        ws.append(xorb(ws[-4], t))
53
    return [b''.join(ws[i*4:(i+1)*4]) for i in range(rounds+1)]
54

55
def b2s(b): return [[b[c*4+r] for c in range(4)] for r in range(4)]
56
def s2b(s): return bytes(s[r][c] for c in range(4) for r in range(4))
57

58
def addk(s, rk):
59
    k = b2s(rk)
60
    for r in range(4):
61
        for c in range(4):
62
            s[r][c] ^= k[r][c]
63

64
def inv_sub(s):
65
    for r in range(4):
66
        for c in range(4):
67
            s[r][c] = IS[s[r][c]]
68

69
def inv_shift(s):
70
    for r in range(1,4):
71
        s[r] = s[r][-r:] + s[r][:-r]
72

73
def inv_mix(s):
74
    for c in range(4):
75
        a = [s[r][c] for r in range(4)]
76
        s[0][c] = mul(a[0],14)^mul(a[1],11)^mul(a[2],13)^mul(a[3],9)
77
        s[1][c] = mul(a[0],9)^mul(a[1],14)^mul(a[2],11)^mul(a[3],13)
78
        s[2][c] = mul(a[0],13)^mul(a[1],9)^mul(a[2],14)^mul(a[3],11)
79
        s[3][c] = mul(a[0],11)^mul(a[1],13)^mul(a[2],9)^mul(a[3],14)
80

81
def dec_custom(ct, key, rounds):
82
    rks = expand_key(key, rounds)
83
    s = b2s(ct)
84
    addk(s, rks[rounds]); inv_shift(s); inv_sub(s)
85
    for r in range(rounds-1,0,-1):
86
        addk(s, rks[r]); inv_mix(s); inv_shift(s); inv_sub(s)
87
    addk(s, rks[0])
88
    return s2b(s)
89

90
idx = [int(x) for x in re.findall(r'\d+', open('idx_seq.txt').read())]
91
txt = open('gdb_trace.log').read()
92

93
sec = {int(i):b for i,b in re.findall(r'(?ms)^\[IDX\]\s+(\d+)\s*\n(.*?)(?=^\[IDX\]\s+\d+\s*\n|\Z)', txt)}
94
body = ''.join(sec.get(i,'') for i in idx) if sec else txt
95

96
rounds = body.count('aesenc ') + body.count('aesenclast ') or 12
97
mid = bytearray(dec_custom(target, key0, rounds))
98

99
if 'xor' in body and any(x in body for x in ('%al','%cl','%dl')):
100
    for i in range(1,16):
101
        mid[i] ^= mid[i-1]
102

103
print(mid.hex())