import ctypes
libc = ctypes.CDLL("libc.so.6")
libc.srand(0x7E6)
stream = [libc.rand() for i in range(47)]

from unicorn import *
from unicorn.x86_const import *
from capstone import *

base_addr = 0x7C00
entry_point = base_addr
mem_size = 0x10000

with open("oldschool", "rb") as fp:
    mbr = fp.read()

def emu(flag):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    md = Cs(CS_ARCH_X86, CS_MODE_16)

    mu.mem_map(0, mem_size)
    mu.mem_write(base_addr, mbr[:512])

    mu_stdin = flag
    mu_stdout = []

    def hook_code(mu, address, size, user_data):
        nonlocal md

        code = mu.mem_read(address, size)
        insns = list(md.disasm(bytes(code), address, count=1))

        if len(insns) == 0:
            raise Exception(f"cant disasm insn at {address}")

        insn = insns[0]
        address = insn.address
        size = insn.size
        mnemonic = insn.mnemonic
        op_str = insn.op_str

        print("%.8x:\t%s\t%s" % (address, mnemonic, op_str))

        if address == 0x7c6a:
            ax = mu.reg_read(UC_X86_REG_AX)
            bx = mu.reg_read(UC_X86_REG_BX)
            dx = mu.reg_read(UC_X86_REG_DX)
            di = mu.reg_read(UC_X86_REG_DI)
            print("ax: %.4x\tbx: %.4x\tdx: %.4x\tdi: %.4x" % (ax, bx, dx, di))


    def hook_intr(mu, intno, user_data):
        nonlocal mu_stdin
        nonlocal mu_stdout

        ah = mu.reg_read(UC_X86_REG_AH)
        al = mu.reg_read(UC_X86_REG_AL)
        di = mu.reg_read(UC_X86_REG_DI)

        if intno == 0x10:
            if ah == 0x0E:  # print char
                mu_stdout.append(al)
        elif intno == 0x16:
            mu.reg_write(UC_X86_REG_AL, mu_stdin[di - 0x7D80])
        else:
            raise Exception("unk intr no: %xh" % intno)


    try:
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_INTR, hook_intr)
        mu.emu_start(begin=entry_point, until=0)
    except Exception as e:
        print(e)
        mu.emu_stop()

    return bytes(mu_stdout)

out=emu(b"0123456789ABCDEF")
print(bytes(out).decode())

import z3
from Crypto.Util.number import long_to_bytes as l2b

S = z3.Solver()

flags = [z3.BitVec("s%d" % i, 16) for i in range(4)]
flag = z3.Concat(*flags)

# check 0
ax, bx, dx, di = flags[0], flags[1], flags[2], flags[3]
S.add(ax & 0x0F0F == 0x700)
bx ^= dx
bx ^= 0x0F00
bx &= 0xFF00
di &= 0xFF00
S.add(bx == di)

# check 1
ax, bx, dx, di = flags[1], flags[0], flags[2], flags[3]
S.add(ax & 0xFF == 0x54)
bx ^= dx
bx = z3.RotateLeft(bx, 1)
bx ^= 0xF0
bx &= 0xF0F0
di &= 0xF0F0
S.add(bx == di)

# check 2
ax, bx, dx, di = flags[2], flags[0], flags[1], flags[3]
S.add(ax & 0x0F0F == 0x0D02)
bx ^= dx
bx ^= 0x3536
S.add(bx == di)


# check 3
ax, bx, dx, di = flags[3], flags[0], flags[1], flags[2]
S.add(ax & 0x0F == 2)
bx ^= dx
bx &= 0xF0F0
di &= 0xF0F0
S.add(bx == di)

S.check()
m = S.model()
solved=l2b(m.eval(flag).as_long())
print(solved)
#w00TMbrR

struct maze_t
{
  int *buf;
  int ptr;
  int x;
  int y;
  int towards;
  int win_or_lose;
  int field_1C;
};

struct machine_t
{
  char *insn;
  maze_t maze;
  int count;
  int field_2C;
  int *field_30;
  int state;
  int field_3C;
};

#!/usr/bin/env python3

# NOTE:
# If this script keeps providing inconsistent results, consider confining it
# inside a single-core environment with docker:
# $ docker image build . -t tbased
# $ docker run -v $PWD:/app -e <opt> -it --rm --cpus='1' tbased <prog>

import string
import subprocess
import timeit
import sys
import os

def spawn(cmd:str,_stdin:bytes)->float:
    f=lambda:subprocess.Popen(cmd,stdin=subprocess.PIPE,stdout=subprocess.DEVNULL).communicate(_stdin)
    return timeit.timeit(f,number=1)

def tbased(cmd:str,keys=string.digits,max_length=16,attempts=5):
    print("***** TIMING BASED SIDE-CHANNEL ADVERSARY *****")
    print(f"[-] Finding length of password")
    sum_of_elapsed={}
    for i in range(1,max_length+1):
        sum_of_elapsed[i]=0.00
    for _ in range(attempts):
        for i in range(1,max_length+1):
            sum_of_elapsed[i]+=spawn(cmd,(keys[0]*i).encode())
    length=max(sum_of_elapsed,key=sum_of_elapsed.get)
    print(f"[+] Done! Assuming password length to be {length}")

    print(f"[-] Finding password")
    p=""
    for j in range(length):
        sum_of_elapsed = {}
        for k in keys:
            payload=p+k+keys[0]*(length-1-len(p))
            sum_of_elapsed[k]=spawn(cmd,payload.encode())
        c=max(sum_of_elapsed,key=sum_of_elapsed.get)
        p+=c
        print(f"[+] Done: Assuming p[{j}] to be {c}")

    if len(p)==0:
        print("[-] Attack failed.")
        return None

    print(f"[+] Done! Password is \n{p}")
    return p

if __name__=="__main__":
    if len(sys.argv)<2:
        print("Usage: docker run -v $PWD:/app -e <opt> -it --rm --cpus='1' tbased <prog>")
        exit(0)

    cmd=f"/app/{sys.argv[1]}"
    keys=os.environ["TBASED_CHARSET"] if "TBASED_CHARSET" in os.environ else string.digits
    max_length=os.environ["TBASED_MAX_LEN"] if "TBASED_MAX_LEN" in os.environ else 16
    attempts=os.environ["TBASED_ATTEMPTS"] if "TBASED_ATTEMPTS" in os.environ else 5

    result=tbased(cmd=cmd,keys=keys,max_length=max_length,attempts=attempts)
    if result is not None:
        print("***** EXECUTION *****")
        subprocess.Popen(cmd,stdin=subprocess.PIPE).communicate(result.encode())

FROM python:slim
LABEL Maintainer="ctf"
VOLUME /app
COPY tbased.py /
RUN chmod a+x /tbased.py
ENTRYPOINT ["/tbased.py"]

import json
from Crypto.Hash import SHA256
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from sage.all import *

p = 12143520799543738643
def read_matrix(file_name):
    data = open(file_name, 'r').read().strip()
    rows = [list(eval(row)) for row in data.splitlines()]
    return Matrix(GF(p), rows)

D = read_matrix('matrix.txt')
P = read_matrix('public_key.txt')
digD ,A = D.diagonalization()
digP = A.inverse() * P * A
vD = [digD[i][i] for i in range(12)]
vP = [digP[i][i] for i in range(12)]

G = GF(p)
K = discrete_log(G(vP[11]), G(vD[11]))

key = SHA256.new(data=str(K).encode()).digest()
with open("encrypted_flag.txt", "r") as ff:
    data_dict = json.load(ff)
    iv = bytes.fromhex(data_dict["iv"])
    ciphertext = bytes.fromhex(data_dict["ciphertext"])
cipher = AES.new(key, AES.MODE_CBC, iv)
flag = cipher.decrypt(ciphertext).decode()[:46]
print(flag)
#CyberErudites{Di4g0n4l1zabl3_M4tric3s_d4_b3st}

from sage.all import *

with open("message.py", "r") as f:
    exec(f.read())
R_3 = ct[0]

def vec(pt):
    return [(3*pow(pt, 3, N)) % N, (3*pow(pt, 6, N)) % N]

def ct2val(val, pt):
    return (val - R_3 - pow(pt, 9, N)) % N

def val2ct(vec, num):
    return (vec + R_3 + pow(pt, 9, N)) % N

prefix = b"CyberErudites{}"
vec1 = vec(prefix[0])
vec2 = vec(prefix[1])
T = matrix(Zmod(N), [[vec1[0],vec2[0]], [vec1[1],vec2[1]]])
T_ = T.inverse()

val1 = ct2val(ct[1], prefix[0])
val2 = ct2val(ct[2], prefix[1])
table = {}

for pt in range(32, 127):
    mat = vector(vec(pt))
    l1,l2 = T_ * mat
    val3 = (val1*l1 + val2*l2) % N
    table[val2ct(val3, pt)] = chr(pt)

flag = "".join([table[v] for v in ct[1:]])
print(flag)
#CyberErudites{Fr4nkl1n_W3_n33d_an0th3R_S3450N_A54P}