Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- from socket import *
- import time
- randpad = "FC8A4551678CA9C0B0FDF76FB850F12F7A6266E3D3C36EBE373933683BC6761EAEAA83ED571AF129E6C1B99EDDA2862C1ADC499D8201D53AB5D333121CCE942BC3B06CBC4673395E7BC7B49E56F0AD725E83C705C5E92E85887994F7E7AC34FE5CCE2E13F1CC8EEA6083BEDC4ABBE8DF6520EF44ADFAD61283D5DC94AD1FE15FE8FA7E3FDA61E3DFAB5B4F2A6C2482AD1789BA29B946347464F745228DAF33D652B5DE10E4535D96B7E22ECBB175BC745A21298C57B3165EC7C8C22635482D3C607B5DDDA8296119D0EFEE6D04DD2051951D01E1DADAB4A546D9CBAF56B52005D06BD222212F2DD373975689AEAC02B635D21487C649DF0E178564E5AF6E9361".decode('hex')
- """
- def loop(table, size):
- idx1=0
- loop_count = size - 0x20
- while idx1 < loop_count:
- idx2=0
- calculated = 0
- while idx2 <= 3:
- calculated = calculated | calc(table, idx1, idx2)
- idx2 += 1
- idx3 = 0
- while idx3 < loop_count:
- idx4 = 0
- calculated2 = 0
- while idx4 <= 3:
- calculated2 = calculated2 | calc(table, idx3, idx4)
- idx4 += 1
- calculated2 = calculated ^ calculated2
- idx5 = 0
- while idx5 <= 3:
- offset = (idx3 + loop_count * idx1)*4 + idx5
- ecx = (((-idx5) & 0xFFFFFFFF) << 3) + 0x18
- eax = calculated2 >> (ecx & 0xFF)
- result[offset] = eax & 0xFF
- idx5 += 1
- """
- def calc(table, idx1, idx2):
- offset = (idx1 >> 3) + idx2
- edx = ((ord(table[offset]) << (idx1 & 7)) | (ord(table[offset + 1]) >> (8 - (idx1 & 7)))) & 0xFF
- ecx = (((-idx2) & 0xFF) << 3) + 0x18
- edx = edx << (ecx & 0xFF)
- return edx
- def optimized_loop(table, size, offset):
- loop_count = size - 0x20
- idx5 = offset & 3
- offset -= idx5
- offset = offset / 4
- idx3 = offset % loop_count
- idx1 = offset / loop_count
- calculated = 0
- idx2 = 0
- while idx2 <= 3:
- calculated = calculated | calc(table, idx1, idx2)
- idx2 += 1
- calculated2 = 0
- idx4 = 0
- while idx4 <= 3:
- calculated2 = calculated2 | calc(table, idx3, idx4)
- idx4 += 1
- calculated2 = calculated ^ calculated2
- ecx = (((-idx5) & 0xFFFFFFFF) << 3) + 0x18
- eax = calculated2 >> (ecx & 0xFF)
- return eax & 0xFF
- def calc2(idx1, idx2):
- global randpad
- offset = (idx1 >> 3) + idx2
- edx = ((optimized_loop(randpad, 0x7e0, offset) << (idx1 & 7)) | (optimized_loop(randpad, 0x7e0, offset + 1) >> (8 - idx1 & 7))) & 0xFF
- ecx = ((-idx2) << 3) + 0x18
- edx = edx << (ecx & 0xFF)
- return edx
- def findAnswer(offset):
- loop_count = 0xf81000 - 0x20
- idx5 = offset & 3
- offset -= idx5
- offset = offset / 4
- idx3 = offset % loop_count
- idx1 = offset / loop_count
- calculated = 0
- idx2 = 0
- while idx2 <= 3:
- calculated = calculated | calc2(idx1, idx2)
- idx2 += 1
- calculated2 = 0
- idx4 = 0
- while idx4 <= 3:
- calculated2 = calculated2 | calc2(idx3, idx4)
- idx4 += 1
- calculated2 = calculated ^ calculated2
- ecx = (((-idx5) & 0xFFFFFFFF) << 3) + 0x18
- eax = calculated2 >> (ecx & 0xFF)
- return eax & 0xFF
- s = socket(AF_INET , SOCK_STREAM)
- s.connect(('100lines_53ac15fc7aa93da92629d37a669e106c.2014.shallweplayaga.me', 20689))
- time.sleep(0.5)
- data = s.recv(65000)
- data += s.recv(65000)
- data = data.split(None)[2:]
- print data
- OTP = [int(x[2:],16) for x in data]
- for i in range(0, 8):
- #s.send(findAnswer(int(data[i][2:],16)))
- #number = int(data[i][2:],16)
- #print hex(number)
- number = OTP[i]
- answer = findAnswer(number)
- edx = answer
- eax = edx*3
- eax = eax << 5
- eax += edx
- eax = (eax & 0xFFFF0000) + ((eax & 0xFFFF) >> 8)
- ecx = edx
- ecx -= eax
- ecx = (ecx & 0xFFFFFF00) + ((ecx & 0xFF) >> 1)
- eax += ecx
- eax = (eax & 0xFFFFFF00) + ((eax & 0xFF) >> 6)
- ecx = 0x5D
- eax = eax * ecx
- edx -= eax
- eax = edx
- eax = (eax & 0xFF) + 0x20
- print hex(eax)
- s.send(chr(eax))
- time.sleep(3)
- data = ""
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data += s.recv(1024)
- data = data.strip()
- flags = data.split(",")
- if len(flags) > 1:
- flags = [int(x[2:],16) for x in flags]
- answer = ""
- i=0
- while i<len(flags):
- answer += chr( findAnswer( OTP[i] ) ^ flags[i] )
- i+=1
- print answer
- s.close()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement