from pwn import *

p = remote('localhost', 1337)

p.recvuntil(b'Insert luma code: \n')

payload = b'''OAN l5
STF l5,l5
OAN lax
RALK lax,l5
MISZ l2,lax
OAN l2
XKA l2,l5
STF lax,lax
STF lax,l5
MISZ l4,lax
OAN l4
MISZ l1,lax
QER l1,l5
LQDM l1,l5
RALK l1,lax
MISZ l3, l1
OAN l3
RALK l2,l3
MISZ l0,l5
XKA l0,l5
OAN l0
STF l0,l0
STF l0,l5
XKA l0,l5
MISZ lax,l2
LQDM lax,l5
MAZ lax
SQL l0,lax
FLG
'''

p.sendline(payload)

response = p.recv()
print(response.decode())

p.close()

def generator(cnt):
    coeffs = []
    for i in range(cnt):
        aux = []
        for j in range(cnt):
            aux.append(nums[(i + j) * 1337 % 256])
        coeffs.append(aux)
    return coeffs

coeffs = generator(FLAG_LEN)

def calc_line(k, password):
    rez = 0
    for i in range(len(password)):
        rez += password[i] * coeffs[k][i]
    return rez

def hash(password):
    password = password.encode()
    rez = []
    for i in range(FLAG_LEN):
        rez.append(calc_line(i, password))
    final = []
    for k in range(FLAG_LEN):
        aux = 0
        for i in range(FLAG_LEN):
            aux += coeffs[i][i] * rez[k] ** i
        final.append(aux)
    data = 'X'.join((lambda .0: [ str(i) for i in .0 ])(final))
    data = lzma.compress(data.encode())
    return data

def protect_pytransform():
    pass

protect_pytransform()
if __name__ == '__main__':
    if len(sys.argv) != 2:
        print('Usage: python3 hasher.py <password>')
        sys.exit(1)
    password = sys.argv[1]
    f = open('flag.tfc', 'wb')
    f.write(hash(password))
    f.close()
    return None

def brute_force(n):
    res = 256
    while True:
        fin = 0
        for i in range(FLAG_LEN-1,-1,-1):
            fin += coeffs[i][i] * res**i
            if fin > n:
                res += 1
                break
        if fin < n:
            res += 1
        elif fin ==n:
            return res
        elif fin > n :
            return 0       # res < 256 인 케이스 (없었음)
            
def fin_to_rez(data):
    final = lzma.decompress(data).decode().split('X')
    rez = []  
    for i in range(FLAG_LEN):
        fin = int(final[i])
        rez.append(brute_force(fin))
    return rez

def rez_to_password(rez):
    result =''
    rez_vector = np.array(rez)
    coeff_matrix = np.array(coeffs)
    solution_vector = np.linalg.solve(coeff_matrix,rez_vector)
    for sol in solution_vector:
        result +=chr(int(round(sol)))
    return result

import sys
import lzma
import np
FLAG_LEN = 17
nums = [
    203,
    99,
    1,
    ... # 표기 상 생략
    63,
    179,
    136]

def generator(cnt):
    coeffs = []
    for i in range(cnt):
        aux = []
        for j in range(cnt):
            aux.append(nums[(i + j) * 1337 % 256])
        coeffs.append(aux)
    return coeffs

coeffs = generator(FLAG_LEN)

def brute_force(n):
    res = 256
    
    while True:
        fin = 0
        for i in range(FLAG_LEN-1,-1,-1):
            fin += coeffs[i][i] * res**i
            if fin > n:
                res += 1
                print("ouch")
                break
        if fin < n:
            res += 1
        elif fin ==n:
            return res
        elif fin > n :
            return 0       # res < 256 인 케이스 
            
def fin_to_rez(data):
    final = lzma.decompress(data).decode().split('X')
    rez = []
    for i in range(FLAG_LEN):
        fin = int(final[i])
        rez.append(brute_force(fin))
    return rez

def rez_to_password(rez):
    result =''
    rez_vector = np.array(rez)
    coeff_matrix = np.array(coeffs)
    solution_vector = np.linalg.solve(coeff_matrix,rez_vector)
    for sol in solution_vector:
        result +=chr(int(round(sol)))
    return result

if __name__=='__main__':
    f = open('./dist/flag.tfc', 'rb')
    data = f.read()
    rez = fin_to_rez(data)
    password = rez_to_password(rez)
    print(password)

import idc
import idaapi
import idautils
import ida_dbg

# 결과를 저장할 파일 경로
output_file_path = "./function.txt"

def hook_call_instruction(ea, iterations=10):
    with open(output_file_path, "a") as file:
        count = 0
        while count < iterations:
            ida_dbg.add_bpt(ea)
            idaapi.run_to(ea)
            ida_dbg.wait_for_next_event(ida_dbg.WFNE_SUSP, -1)

            r15_value = idc.get_reg_value("r15")
            call_address = idc.get_qword(r15_value + 0x20) # 호출 함수 주소
            
            result = f"Iteration {count+1}: Address: 0x{ea:X}, r15: 0x{r15_value:X}, call [r15+20h]: 0x{call_address:X}\n"
            print(result)
            file.write(result)

            ida_dbg.del_bpt(ea)
            count += 1

        print(f"Finished {iterations} iterations. Results saved to {output_file_path}")

call_instruction_address = 0x5555555659D7  # 'call qword ptr [r15+20h]' 명령어의 주소
hook_call_instruction(call_instruction_address, iterations=10000)

import idc
import idaapi
import idautils
import ida_dbg

output_file_path = "flag.txt"

def set_cl_to_1(): # mov cl, 1
    cl_value = 1
    rcx_value = idc.get_reg_value("rcx")
    new_rcx_value = (rcx_value & 0xFFFFFFFFFFFFFF00) | cl_value
    idc.set_reg_value(new_rcx_value, "rcx")

def extract_and_xor(xor_ea, cmp_ea, iterations=10):
    flag = ''
    patch_ea = 0x00005555555670B3
    with open(output_file_path, "a") as file:
        count = 0
        ida_dbg.add_bpt(xor_ea)
        ida_dbg.add_bpt(cmp_ea)
        ida_dbg.add_bpt(patch_ea)

        while count < iterations:
            # 1 .text:0000555555566EDF xor [rsi+rax+401h], cl
            idaapi.run_to(xor_ea)
            ida_dbg.wait_for_next_event(ida_dbg.WFNE_SUSP, -1)
            cl_value = idc.get_reg_value("cl")

            # 2 .text:000055555556709F cmp cl, [rsi+rax+401h]
            idaapi.run_to(cmp_ea)
            ida_dbg.wait_for_next_event(ida_dbg.WFNE_SUSP, -1)

            rsi_value = idc.get_reg_value("rsi")
            rax_value = idc.get_reg_value("rax")
            memory_address = rsi_value + rax_value + 0x401
            memory_value_after = idc.get_wide_byte(memory_address)

            ### result
            xor_result = cl_value ^ memory_value_after
            result_char = chr(xor_result)
            
            result = f"Iteration {count+1}: CL: 0x{cl_value:X}, After: 0x{memory_value_after:X}, chr(a^b): {result_char}\n"
            flag +=result_char
            print(result)
            file.write(result)
            file.write(f"flag:{flag}\n")
            
            # 3. cmp2 결과 항상 참으로 패치
            idaapi.run_to(patch_ea)
            ida_dbg.wait_for_next_event(ida_dbg.WFNE_SUSP, -1)
            set_cl_to_1()
            count += 1
        
xor_instruction_address = 0x555555566EDF  # xor_final -> 'xor [rsi+rax+401h], cl' 
cmp_instruction_address = 0x55555556709F  # cmp2 -> 'cmp cl, [rsi+rax+401h]' 
iterations = 100

extract_and_xor(xor_instruction_address, cmp_instruction_address, iterations=iterations)