import enum
import string
from pwn import p8
shufPtr1 = 0xab
shufPtr2 = 0x00
storage1 = b'Fd1)d\x86\xed\x9c\xd7\x1f\xc2\x07%H \xa2\xc4\xa8Z\xeb\x0b AIO\x8b\xf1\xf8\xcd0\xf1\x13\x94"<\xf8\xa8)\x95\x80IW\x87n\x9f\xa7\x11c'
storage2 = b'PkN[\x8c\x8f\xa4\xdb\x1b\x95\xd3\xe8\xc5\xc5PZ\xe77\xad\x90`\xe7\xefV>h\x18\xdd>)A\x8e\x94\x8f\xe9 \x1f\x8d\xfb:"\xcf"\xe8\x94\xb7B{'
shufTable = [
0x49, 0xbc, 0x1d, 0x5a, 0x1c, 0x47, 0x74, 0x99, 0x67, 0x34, 0x19, 0x2f, 0xcf, 0x9f, 0x93, 0x84,
0x6e, 0xb0, 0xaa, 0x3c, 0x78, 0x24, 0xca, 0x88, 0xc1, 0xd5, 0x47, 0x82, 0xaa, 0x18, 0x45, 0x05,
0xcf, 0x3d, 0x4d, 0x12, 0xe8, 0x2d, 0xd5, 0xd5, 0xf3, 0x66, 0xd0, 0x78, 0xad, 0xa5, 0xc3, 0x66,
0xfb, 0x80, 0x7c, 0xff, 0x04, 0xcd, 0x6d, 0x38, 0x1d, 0x62, 0x80, 0x7f, 0xc3, 0x2b, 0x4e, 0xa1,
0x66, 0x0b, 0xcc, 0x3e, 0x51, 0x32, 0x68, 0x8d, 0xeb, 0x02, 0xf0, 0xf9, 0xff, 0x18, 0xce, 0x2f,
0xfa, 0xc6, 0x4e, 0x5b, 0x31, 0xa0, 0xf8, 0xb9, 0x79, 0x05, 0x3b, 0x7e, 0xca, 0x8d, 0xdb, 0x5a,
0xc2, 0x97, 0x21, 0xb4, 0xdd, 0x3c, 0xc8, 0x20, 0x20, 0xd2, 0xf1, 0xa8, 0xcb, 0x26, 0x4b, 0x0b,
0xda, 0x91, 0x43, 0x69, 0x57, 0x9a, 0x8c, 0xf4, 0xf6, 0xab, 0x36, 0x54, 0x03, 0x45, 0x24, 0xee,
0x64, 0x7a, 0x28, 0xdc, 0x50, 0x77, 0xbd, 0x8c, 0xc9, 0x38, 0x64, 0x3c, 0x6f, 0xa0, 0xad, 0x82,
0xef, 0xad, 0x11, 0x3f, 0x89, 0xe0, 0xcb, 0x76, 0xb9, 0xfb, 0x9f, 0xbf, 0xcb, 0xa4, 0x23, 0xc6,
0x41, 0x92, 0xef, 0xb0, 0x35, 0x45, 0x93, 0xe9, 0x2a, 0x43, 0x58, 0xcf, 0x6c, 0xbd, 0xab, 0xa4,
0x72, 0x6a, 0x66, 0xed, 0xe8, 0x77, 0xb3, 0x51, 0x3a, 0x33, 0x0f, 0x6d, 0x8d, 0xdf, 0x54, 0x42,
0xc0, 0x54, 0x29, 0x80, 0xc3, 0xb3, 0x0b, 0xc2, 0xa9, 0x80, 0xae, 0x88, 0x52, 0x4a, 0x1e, 0xd9,
0x5d, 0xa3, 0x64, 0xab, 0x8e, 0xc9, 0x34, 0x29, 0xb5, 0x02, 0x69, 0x05, 0xff, 0xfb, 0xef, 0x02,
0x45, 0x76, 0x13, 0xe2, 0x62, 0xdc, 0xc2, 0x34, 0x5c, 0xb8, 0x96, 0x9a, 0x9b, 0xe6, 0x08, 0x41,
0xeb, 0xb9, 0x3e, 0x9f, 0xd4, 0xac, 0xec, 0xc8, 0xa0, 0x92, 0x54, 0xa0, 0xc7, 0x66, 0xda, 0xb7,
]
checkTable = [
0x00, 0x00, 0x00, 0x00, 0x00, 0xa8, 0x00, 0x64, 0x00, 0x00, 0xcd, 0x00, 0x00, 0x00, 0x80, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00,
0xf1, 0x00, 0x00, 0x00, 0x63, 0x00, 0x11, 0x20, 0xa2, 0x29, 0xd7, 0x00, 0x00, 0x49, 0x00, 0xf1,
0x00, 0x46, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x87, 0x00, 0x00, 0x00, 0x00, 0xf8, 0x49, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa8, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x20, 0x00, 0x07, 0x6e, 0x00, 0x00, 0xa7, 0x00, 0x00, 0x00, 0x00, 0xc2, 0x3c, 0x00, 0x00,
0x57, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00,
0x94, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, 0xf8, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x9c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x95, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x22, 0x00, 0x29, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x5a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86, 0x64,
0x00, 0x48, 0x00, 0x00, 0x00, 0xeb, 0x00, 0x00, 0x00, 0x1f, 0x00, 0xed, 0x00, 0x00, 0x00, 0x00,
]
swaps = []
for i in range(0x30):
mask = 0x80
while mask != 0:
secret = storage1[i]
if secret & mask == 0:
pass
else:
# regY
idx1 = shufPtr1 & 0x3f
if idx1 >= 0x30:
idx1 = idx1 - 0x30 & 0xff
carry = 0
# regX
idx2 = shufPtr2 & 0x3f
if idx2 >= 0x30:
if idx2 >= 0x30:
carry = 1
idx2 = idx2 - 0x30 & 0xff
swaps.append((idx1, idx2, ))
temp = mask + 0xe3 + carry & 0xff
# addition overflowed, carry set
if temp <= mask:
carry = 1
else:
carry = 0
lowest = shufPtr1 & 1
ror = (carry << 7) | (shufPtr1 >> 1)
shufPtr1 = shufTable[temp ^ ror]
ror = (lowest << 7) | (shufPtr2 >> 1)
shufPtr2 = shufTable[temp ^ ror]
mask >>= 1
print(swaps)
def findall(bytes: list[int], byte: int):
pos = enumerate(bytes)
pos = filter(lambda e: e[1] == byte, pos)
pos = map(lambda e: e[0], pos)
return list(pos)
whitelist = string.ascii_letters + string.digits + "_{}"
thing = bytearray(b"an__c_e__ogt_lae}ltoafn{ttote_thttagn_ffhlnog_fh")
for a, b in reversed(swaps):
temp = thing[a]
thing[a] = thing[b]
thing[b] = temp
print(thing)
thing = []
for a, b in zip(storage1, storage2):
assert a in checkTable
positions = findall(checkTable, a)
ps = []
for position in positions:
input = position ^ b
if chr(input) in whitelist:
ps.append(chr(input))
thing.append(ps)
"""
input[i] = checkTable[storage[0x30 + i] ^ input[i]]
storage[i] == input[i]
"""
for a, b in reversed(swaps):
temp = thing[a]
thing[a] = thing[b]
thing[b] = temp
from pprint import pprint
pprint(thing)