custom code - Codegate 2024 Finals

データを2次元の画像データに変換するプログラムが与えられる

フラグを変換した画像も与えられるが、一部欠損していて正常にデコードできない

https://scrapbox.io/files/687532bdf253eb8cd5da802f.png

プログラムを読むと、パリティをつけてエンコードしていることがわかる

パリティとエラーから元の値を復元する方法がわからなかったので、bruteforceしてエラーが起きないデータを探すとフラグが得られた

code:python

import sys

import itertools

import string

from PIL import Image

def size(img):

w, h = img.size

ww = (w - 400) // 100

hh = (h - 400) // 100

return ww, hh

def at(img, x, y):

xx = 200 + x * 100

yy = 200 + y * 100

if result > 0.5:

return 1

else:

return 0

def read(filename):

img = Image.open(filename)

w, h = size(img)

print(w, h)

data = []

for x in range(0, w, 2):

for y in range(h):

for dx in range(2):

data.append(at(img, x + dx, y))

table_v65 = {}

for v65 in range(32):

v113 = v65 << 10

v67 = v113

for k in range(14, 9, -1):

if v113 >> k == 1:

v118 = k - 10

v113 = v113 ^ (1335 << v118)

table_v65_inv = {v: k for k, v in table_v65.items()}

def decode(v76):

v58 = []

for i in range(0, len(v76), 15):

for j in range(len(v158)):

min_diff = 0x10000

min_diff_candidate = 0

for candidate in range(32):

v76_ = []

diff = 0

diff += int.bit_count(expect ^ actual)

if diff < min_diff:

min_diff = diff

min_diff_candidate = candidate

v60 = 0

for j in range(8):

for j in range(5):

v58.append((v60 >> (8*(5-j-1))) & 0xff)

return v58

def b(text):

buffer1 = list(text)

for i in range(0xf-len(buffer1)):

buffer1.append(0)

for i in range(5):

buffer2 = []

for j in range(0xb):

if v17 and v20:

else:

v21 = 0

buffer2.append(v21)

for j in range(0xb):

# v76 = read('flag.png')

# v58 = decode(v76)

# v58 = [

# 'c', 'o', 'd', 'e', 'g', 'a', 't', 'e', '2', '0', '2', '4', '{', 'a', '9', 'a', '7', '4', '4', '8', '1', '2', '5',

# 'd', '9', '0', 'd', '0', '6', 'd', '6', 'f', '5', '8', '3', '9', '1', '8', 'd', 'a', '7', '0', '8', '9', '0', '5',

# '8', 'f', 'f', '2', '3', '0', '9', '0', '1', '0', '7', '7', '5', '7', '1', '5', '0', '8', '9', '8', 'f', '0', '5',

# 'd', '3', 'b', '3', '8', '6', 'a', '8', '}', '\x00', 'ÿ',

# ]

v58 = [

'c', 'o', 'd', 'e', 'g', 'a', 't', 'e', '2', '0', '2', '4', '{', 'a', '9', 'a', '7', '4', '4', '8', '8', 'd', '0',

'1', 'c', '0', 'd', '0', '6', 'd', '6', 'f', '7', '3', '9', '9', '1', '8', 'd', 'a', '7', '0', '8', '9', '0', '3', 'e', '0', 'b', 'd', '3', '0', '9', '0', '1', '0', '7', '7', '5', '7', 'e', '2', '8', '8', '9', '8', 'f', '0', '5', 'd', '3', 'b', '3', '8', '6', 'a', '8', '}', '\x00', 'ÿ',

]

flag_parts = []

parity_parts = []

for i in range(0, len(flag) // 5):

flag_parts.append(flag_part)

parity_parts.append(parity_part)

print('i', i)

print('parity', p1)

print('parity', p2)

if p1 == p2:

print('OK')

else:

print('NG')

print()

N = 10

L = 0

min_diff = 1000000

min_c = 0

for c in '0123456789abcdef':

diff = 0

if diff < min_diff:

min_diff = diff

min_c = c

print(min_c)

# for N in range(0, len(flag_parts)):

# min_diff = 1000000

# min_flag_part = ''

# candidate = None

# if N == 0 or N == 1 or N == 15:

# candidate = set('0123456789abcdef{}codegate')

# else:

# candidate = set('0123456789abcdef')

# for flag_part in itertools.permutations(candidate, 5):

# if diff < min_diff:

# min_diff = diff

# min_flag_part = flag_part

# print(''.join(min_flag_part), end='')

# sys.stdout.flush()

# print()