Google CTF 2019
FriendSpaceBookPlusAllAccessRedPremium
Having snooped around like the expert spy you were never trained to be, you found something that takes your interest: “Cookie/www.FriendSpaceBookPlusAllAccessRedPremium.com” But unbeknownst to you, it was only the 700nm Wavelength herring rather than a delicious cookie that you could have found. It looks exactly like a credential for another system. You find yourself in search of a friendly book to read. Having already spent some time trying to find a way to gain more intelligence… and learn about those fluffy creatures, you (several)-momentarily divert your attention here. It’s a place of all the individuals in the world sharing large amounts of data with one another. Strangely enough, all of the inhabitants seem to speak using this weird pictorial language. And there is hot disagreement over what the meaning of an eggplant is. But not much Cauliflower here. They must be very private creatures. SarahH has left open some proprietary tools, surely running this will take you to them. Decipher this language and move forth!
You can find my all CTF solution in here
When I download the Attachment I saw two file. One of them is python script another of them is tex file.
vm.py
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 |
import sys # Implements a simple stack-based VM class VM: def __init__(self, rom): self.rom = rom self.accumulator1 = 0 self.accumulator2 = 0 self.instruction_pointer = 1 self.stack = [] def step(self): cur_ins = self.rom[self.instruction_pointer] self.instruction_pointer += 1 fn = VM.OPERATIONS.get(cur_ins, None) if cur_ins[0] == '🖋': return if fn is None: raise RuntimeError("Unknown instruction '{}' at {}".format( repr(cur_ins), self.instruction_pointer - 1)) else: fn(self) def add(self): self.stack.append(self.stack.pop() + self.stack.pop()) def sub(self): a = self.stack.pop() b = self.stack.pop() self.stack.append(b - a) def if_zero(self): if self.stack[-1] == 0: while self.rom[self.instruction_pointer] != '😐': if self.rom[self.instruction_pointer] in ['🏀', '⛰']: break self.step() else: self.find_first_endif() self.instruction_pointer += 1 def if_not_zero(self): if self.stack[-1] != 0: while self.rom[self.instruction_pointer] != '😐': if self.rom[self.instruction_pointer] in ['🏀', '⛰']: break self.step() else: self.find_first_endif() self.instruction_pointer += 1 def find_first_endif(self): while self.rom[self.instruction_pointer] != '😐': self.instruction_pointer += 1 def jump_to(self): marker = self.rom[self.instruction_pointer] if marker[0] != '💰': print('Incorrect symbol : ' + marker[0]) raise SystemExit() marker = '🖋' + marker[1:] self.instruction_pointer = self.rom.index(marker) + 1 def jump_top(self): self.instruction_pointer = self.stack.pop() def exit(self): print('\nDone.') raise SystemExit() def print_top(self): sys.stdout.write(chr(self.stack.pop())) sys.stdout.flush() def push(self): if self.rom[self.instruction_pointer] == '🥇': self.stack.append(self.accumulator1) elif self.rom[self.instruction_pointer] == '🥈': self.stack.append(self.accumulator2) else: raise RuntimeError('Unknown instruction {} at position {}'.format( self.rom[self.instruction_pointer], str(self.instruction_pointer))) self.instruction_pointer += 1 def pop(self): if self.rom[self.instruction_pointer] == '🥇': self.accumulator1 = self.stack.pop() elif self.rom[self.instruction_pointer] == '🥈': self.accumulator2 = self.stack.pop() else: raise RuntimeError('Unknown instruction {} at position {}'.format( self.rom[self.instruction_pointer], str(self.instruction_pointer))) self.instruction_pointer += 1 def pop_out(self): self.stack.pop() def load(self): num = 0 if self.rom[self.instruction_pointer] == '🥇': acc = 1 elif self.rom[self.instruction_pointer] == '🥈': acc = 2 else: raise RuntimeError('Unknown instruction {} at position {}'.format( self.rom[self.instruction_pointer], str(self.instruction_pointer))) self.instruction_pointer += 1 while self.rom[self.instruction_pointer] != '✋': num = num * 10 + (ord(self.rom[self.instruction_pointer][0]) - ord('0')) self.instruction_pointer += 1 if acc == 1: self.accumulator1 = num else: self.accumulator2 = num self.instruction_pointer += 1 def clone(self): self.stack.append(self.stack[-1]) def multiply(self): a = self.stack.pop() b = self.stack.pop() self.stack.append(b * a) def divide(self): a = self.stack.pop() b = self.stack.pop() self.stack.append(b // a) def modulo(self): a = self.stack.pop() b = self.stack.pop() self.stack.append(b % a) def xor(self): a = self.stack.pop() b = self.stack.pop() self.stack.append(b ^ a) OPERATIONS = { '🍡': add, '🤡': clone, '📐': divide, '😲': if_zero, '😄': if_not_zero, '🏀': jump_to, '🚛': load, '📬': modulo, '⭐': multiply, '🍿': pop, '📤': pop_out, '🎤': print_top, '📥': push, '🔪': sub, '🌓': xor, '⛰': jump_top, '⌛': exit } if __name__ == '__main__': if len(sys.argv) != 2: print('Missing program') raise SystemExit() with open(sys.argv[1], 'r') as f: print('Running ....') all_ins = [''] all_ins.extend(f.read().split()) vm = VM(all_ins) while 1: vm.step() |
program
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 |
🚛 🥇 0️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 7️⃣ 4️⃣ 8️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 6️⃣ 7️⃣ 5️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 6️⃣ 5️⃣ 9️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 6️⃣ 2️⃣ 8️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 6️⃣ 0️⃣ 9️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 5️⃣ 5️⃣ 0️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 5️⃣ 4️⃣ 1️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 4️⃣ 8️⃣ 3️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 4️⃣ 4️⃣ 5️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 3️⃣ 8️⃣ 9️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 3️⃣ 9️⃣ 2️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 3️⃣ 4️⃣ 3️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 2️⃣ 8️⃣ 3️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 2️⃣ 7️⃣ 4️⃣ 1️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 2️⃣ 5️⃣ 3️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 1️⃣ 5️⃣ 0️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 1️⃣ 3️⃣ 4️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 5️⃣ 0️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 5️⃣ 5️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 3️⃣ 1️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 7️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 8️⃣ 9️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 8️⃣ 9️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 6️⃣ 6️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 7️⃣ 4️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 2️⃣ 6️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 3️⃣ 4️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 2️⃣ 6️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 3️⃣ 3️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 2️⃣ 0️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 2️⃣ 1️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 2️⃣ 4️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 7️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 7️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 4️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 1️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 1️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 1️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥈 1️⃣ ✋ 🖋💠🔶🎌🚩🏁 🍿 🥇 📥 🥈 📥 🥇 🚛 🥇 3️⃣ 8️⃣ 9️⃣ ✋ 📥 🥇 📥 🥈 🏀 💰🏁🚩🎌💠🔶 🌓 🎤 🚛 🥇 1️⃣ ✋ 📥 🥇 🍡 🍿 🥈 😄 🏀 💰💠🔶🎌🚩🏁 😐 🚛 🥇 9️⃣ 8️⃣ 4️⃣ 2️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 7️⃣ 8️⃣ 5️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 7️⃣ 6️⃣ 0️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 7️⃣ 2️⃣ 8️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 6️⃣ 8️⃣ 1️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 6️⃣ 4️⃣ 4️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 6️⃣ 3️⃣ 5️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 5️⃣ 9️⃣ 3️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 4️⃣ 8️⃣ 6️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 4️⃣ 9️⃣ 5️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 4️⃣ 6️⃣ 6️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 4️⃣ 4️⃣ 4️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 3️⃣ 9️⃣ 6️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 3️⃣ 7️⃣ 6️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥈 9️⃣ 9️⃣ ✋ 🖋💠🏁🎌🔶🚩 🍿 🥇 📥 🥈 📥 🥇 🚛 🥇 5️⃣ 6️⃣ 8️⃣ ✋ 📥 🥇 📥 🥈 🏀 💰🏁🚩🎌💠🔶 🌓 🎤 🚛 🥇 1️⃣ ✋ 📥 🥇 🍡 🍿 🥈 😄 🏀 💰💠🏁🎌🔶🚩 😐 🚛 🥇 1️⃣ 0️⃣ 1️⃣ 1️⃣ 4️⃣ 1️⃣ 0️⃣ 5️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 1️⃣ 0️⃣ 6️⃣ 0️⃣ 2️⃣ 0️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 1️⃣ 0️⃣ 3️⃣ 0️⃣ 0️⃣ 5️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 9️⃣ 9️⃣ 8️⃣ 9️⃣ 6️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 8️⃣ 8️⃣ 7️⃣ 9️⃣ 9️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 7️⃣ 6️⃣ 7️⃣ 0️⃣ 8️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 7️⃣ 0️⃣ 7️⃣ 0️⃣ 3️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 6️⃣ 5️⃣ 6️⃣ 1️⃣ 1️⃣ 1️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 4️⃣ 0️⃣ 4️⃣ 0️⃣ 9️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 1️⃣ 6️⃣ 0️⃣ 9️⃣ 2️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 1️⃣ 3️⃣ 1️⃣ 0️⃣ 1️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 1️⃣ 1️⃣ 1️⃣ 1️⃣ 0️⃣ 0️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 0️⃣ 5️⃣ 9️⃣ 9️⃣ 2️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 0️⃣ 4️⃣ 9️⃣ 9️⃣ 8️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 0️⃣ 0️⃣ 3️⃣ 0️⃣ 0️⃣ 4️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 8️⃣ 9️⃣ 9️⃣ 9️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 8️⃣ 1️⃣ 8️⃣ 5️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 8️⃣ 0️⃣ 8️⃣ 1️⃣ 5️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 7️⃣ 8️⃣ 8️⃣ 4️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 6️⃣ 5️⃣ 7️⃣ 9️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 5️⃣ 7️⃣ 5️⃣ 6️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 3️⃣ 8️⃣ 3️⃣ 0️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 3️⃣ 5️⃣ 4️⃣ 2️⃣ 7️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 3️⃣ 2️⃣ 2️⃣ 8️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 3️⃣ 1️⃣ 4️⃣ 9️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 2️⃣ 7️⃣ 3️⃣ 8️⃣ 8️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 2️⃣ 6️⃣ 3️⃣ 7️⃣ 6️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 2️⃣ 3️⃣ 2️⃣ 1️⃣ 3️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 2️⃣ 1️⃣ 3️⃣ 9️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 1️⃣ 9️⃣ 1️⃣ 5️⃣ 4️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 1️⃣ 8️⃣ 0️⃣ 8️⃣ 2️⃣ ✋ 📥 🥇 🚛 🥇 9️⃣ 9️⃣ 1️⃣ 6️⃣ 2️⃣ 3️⃣ 9️⃣ ✋ 📥 🥇 🚛 🥈 7️⃣ 6️⃣ 5️⃣ ✋ 🖋🚩💠🎌🔶🏁 🍿 🥇 📥 🥈 📥 🥇 🚛 🥇 1️⃣ 0️⃣ 2️⃣ 3️⃣ ✋ 📥 🥇 📥 🥈 🏀 💰🏁🚩🎌💠🔶 🌓 🎤 🚛 🥇 1️⃣ ✋ 📥 🥇 🍡 🍿 🥈 😄 🏀 💰🚩💠🎌🔶🏁 😐 ⌛ 🖋🏁🚩🎌💠🔶 🚛 🥇 2️⃣ ✋ 📥 🥇 🖋💠🎌🏁🚩🔶 🏀 💰🚩🔶🏁🎌💠 🖋🔶🎌🚩💠🏁 😲 📤 🏀 💰🔶🚩💠🏁🎌 ✋ 😐 📤 🏀 💰🎌🏁💠🔶🚩 🖋🎌🏁🚩🔶💠 😲 📤 🏀 💰🔶🚩💠🏁🎌 😐 📤 🍿 🥇 🚛 🥈 1️⃣ ✋ 📥 🥈 🔪 😲 📤 🍿 🥈 📥 🥇 📥 🥈 ⛰ 😐 📥 🥇 🖋🔶🚩💠🏁🎌 🚛 🥈 1️⃣ ✋ 📥 🥈 🍡 🏀 💰💠🎌🏁🚩🔶 🖋🚩🔶🏁🎌💠 🤡 🚛 🥇 2️⃣ ✋ 📥 🥇 🖋🎌🚩💠🔶🏁 🔪 😲 📤 🚛 🥇 1️⃣ ✋ 📥 🥇 🏀 💰🔶🎌🚩💠🏁 😐 📤 🤡 📥 🥇 📬 😲 🏀 💰🔶🎌🚩💠🏁 😐 📤 🤡 📥 🥇 🚛 🥇 1️⃣ ✋ 📥 🥇 🍡 🤡 🍿 🥇 🏀 💰🎌🚩💠🔶🏁 🖋🎌🏁💠🔶🚩 🤡 🤡 🚛 🥈 0️⃣ ✋ 📥 🥈 🖋🏁💠🔶🚩🎌 🚛 🥇 1️⃣ 0️⃣ ✋ 📥 🥇 ⭐ 🍿 🥈 📥 🥇 📬 📥 🥈 🍡 🍿 🥈 🍿 🥇 🤡 📥 🥈 🔪 😲 📤 🚛 🥈 1️⃣ ✋ 📥 🥈 🏀 💰🎌🏁🚩🔶💠 😐 📤 📥 🥇 🚛 🥇 1️⃣ 0️⃣ ✋ 📥 🥇 📐 😲 🏀 💰🎌🏁🚩🔶💠 😐 🤡 📥 🥈 🏀 💰🏁💠🔶🚩🎌 |
The program file is such as Stack-based VM
So first we must understand the code. I executed the python script with the program.
|
1 2 3 |
python3 vm.py program Running .... http://emoji-t0anaxn |
Its try to extract website and this getting slower. I think decoding program is starting to complex. So that I must to find way wat to decode program.
I forget to mention about the stact-based vm. These program is need accumulator (1,2) and stact to executation and instruction pointer to know where the code.
So I try to print that value before the print char.
I added this below code in print_top() function
|
1 2 3 4 5 6 7 8 |
print() print ("Acc1:") print(self.accumulator1) print ("Acc2:") print(self.accumulator2) print ("Stack:") print(self.stack) print ("Char:") |
Output is:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 |
python3 vm.py program Running .... Acc1: 2 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 113, 119, 1, 104] Char: h Acc1: 3 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 113, 2, 116] Char: t Acc1: 5 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 3, 116] Char: t Acc1: 7 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 4, 112] Char: p Acc1: 11 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 5, 58] Char: : Acc1: 101 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 6, 47] Char: / Acc1: 131 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 7, 47] Char: / Acc1: 151 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 8, 101] Char: e Acc1: 181 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 9, 109] Char: m Acc1: 191 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 10, 111] Char: o Acc1: 313 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 11, 106] Char: j Acc1: 353 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 12, 105] Char: i Acc1: 373 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 13, 45] Char: - Acc1: 383 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 14, 116] Char: t Acc1: 727 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 15, 48] Char: 0 Acc1: 757 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 16, 97] Char: a Acc1: 787 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 17, 110] Char: n |
when I look at it
before the calculation new char program executed XOR operation between acc1 and end of the stack
Also when we loak at the operation list and program it is show the before the print_top operation always xor happens
I can put the print function before the XOR happens
Output is:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 |
python3 vm.py program Running .... Acc1: 2 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 113, 119, 1, 106, 2] Char: h Acc1: 3 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 113, 2, 119, 3] Char: t Acc1: 5 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 119, 3, 113, 5] Char: t Acc1: 7 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 49, 4, 119, 7] Char: p Acc1: 11 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 74, 5, 49, 11] Char: : Acc1: 101 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 172, 6, 74, 101] Char: / Acc1: 131 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 242, 7, 172, 131] Char: / Acc1: 151 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 216, 8, 242, 151] Char: e Acc1: 181 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 208, 9, 216, 181] Char: m Acc1: 191 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 339, 10, 208, 191] Char: o Acc1: 313 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 264, 11, 339, 313] Char: j Acc1: 353 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 344, 12, 264, 353] Char: i Acc1: 373 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 267, 13, 344, 373] Char: - Acc1: 383 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 743, 14, 267, 383] Char: t Acc1: 727 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 660, 15, 743, 727] Char: 0 Acc1: 757 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 893, 16, 660, 757] Char: a Acc1: 787 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 892, 17, 893, 787] Char: n Acc1: 797 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 1007, 18, 892, 797] Char: a Acc1: 919 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 975, 19, 1007, 919] Char: x Acc1: 929 Acc2: 389 Stack: [0, 17488, 16758, 16599, 16285, 16094, 15505, 15417, 14832, 14450, 13893, 13926, 13437, 12833, 12741, 12533, 11504, 11342, 10503, 10550, 10319, 20, 975, 929] Char: n |
When I search the ACC1: serieas I figure out the this is a Palindromic primes. I found the python code in the https://oeis.org/A002385
|
1 2 3 4 5 6 |
from itertools import chain from sympy import isprime A002385 = sorted((n for n in chain((int(str(x)+str(x)[::-1]) for x in range(1, 10**5)), (int(str(x)+str(x)[-2::-1]) for x in range(1, 10**5))) if isprime(n))) # Chai Wah Wu, Aug 16 2014 |
After that I write all ACC1 value and index value you can find index values in program file. End of the ACC1 values it shows the index value
After that I write the python code the extract website
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 |
#!/usr/bin/env python3 from itertools import chain from sympy import isprime A002385 = sorted((n for n in chain((int(str(x)+str(x)[::-1]) for x in range(1, 10**5)), (int(str(x)+str(x)[-2::-1]) for x in range(1, 10**5))) if isprime(n))) # Chai Wah Wu, Aug 16 2014 ACC1_1 = [ 106, 119, 113, 119, 49, 74, 172, 242, 216, 208, 339, 264, 344, 267, 743, 660, 893, 892, 1007, 975, 10319, 10550, 10503, 11342, 11504, 12533, 12741, 12833, 13437, 13926, 13893, 14450, 14832, 15417, 15505, 16094, 16285, 16599, 16758, 17488, ] ACC1_2 = [ 93766, 93969, 94440, 94669, 94952, 94865, 95934, 96354, 96443, 96815, 97280, 97604, 97850, 98426, ] ACC1_3 = [ 9916239, 9918082, 9919154, 9921394, 9923213, 9926376, 9927388, 9931494, 9932289, 9935427, 9938304, 9957564, 9965794, 9978842, 9980815, 9981858, 9989997, 100030045, 100049982, 100059926, 100111100, 100131019, 100160922, 100404094, 100656111, 100707036, 100767085, 100887990, 100998966, 101030055, 101060206, 101141058, ] index = 1-1 i = 0 for val in ACC1_1: chracter = ACC1_1[i]^A002385[index] print(chr(chracter),end='') i += 1 index += 1 index = 99-1 i = 0 for val in ACC1_2: chracter = ACC1_2[i]^A002385[index] print(chr(chracter),end='') i += 1 index += 1 index = 765-1 i = 0 for val in ACC1_3: chracter = ACC1_3[i]^A002385[index] print(chr(chracter),end='') i += 1 index += 1 print() |
When I run the program
|
1 2 |
./decoder.py http://emoji-t0anaxnr3nacpt4na.web.ctfcompetition.com/humans_and_cauliflowers_network/ |
It gives the address.
In that website you can find the flag in Amber profile
http://emoji-t0anaxnr3nacpt4na.web.ctfcompetition.com/humans_and_cauliflowers_network/
That is the FLAG:
CTF{Peace_from_Cauli!}