ARITH = re.compile(rb'Calculate (-?\d+) ([-+*]) (-?\d+): $') REV = re.compile(rb"Reverse the string '([A-Za-z]+)': $") SWAP = re.compile(rb"Swap the case of '([A-Za-z]+)': $") CAES = re.compile(rb"Caesar shift (\d+) on '([A-Za-z]+)': $")
def answer_of(tail): """tail = 已收到数据中最后一个 '\n' 之后的部分，即当前题面。""" m = ARITH.search(tail) if m: a, op, b = int(m[1]), m[2], int(m[3]) return str(a + b if op == b'+' else a - b if op == b'-' else a * b).encode() m = REV.search(tail) if m: return m[1][::-1] m = SWAP.search(tail) if m: return m[1].swapcase() m = CAES.search(tail) if m: k, s = int(m[1]), m[2] return bytes((97 + (c - 97 + k) % 26) if 97 <= c <= 122 else (65 + (c - 65 + k) % 26) for c in s) return None
def main(): for i in range(1, TOTAL + 1): pending = b'' try: while True: pending += io.recvuntil(b': ') # 题面与轮次提示都以 ": " 结尾 ans = answer_of(pending.rsplit(b'\n', 1)[-1]) if ans is not None: break except EOFError: log.failure('connection closed at question %d/%d', i, TOTAL) return io.sendline(ans) # 立即回包，抢 1s 窗口 if i % 10 == 0: log.info('answered %d/%d', i, TOTAL)
int hidden_maint() { int result; // eax char p_nptr[32]; // [rsp+0h] [rbp-20h] BYREF
puts("[MAINT] maintenance channel opened."); puts("[MAINT] authorized maintainers only, all actions are logged."); printf("[MAINT] password> "); result = read_line(p_nptr, 32); if ( result >= 0 ) { if ( check_pass(p_nptr) ) { puts("[MAINT] identity verified, maintenance session started."); maint_session = 1; result = emergency_unlock(); maint_session = 0; } else { return puts("[MAINT] access denied, incident reported."); } } return result; } int emergency_unlock() { int result; // eax char v1[64]; // [rsp+0h] [rbp-40h] BYREF
puts("[MAINT] --- emergency unlock procedure ---"); puts("[MAINT] cutting mains power to the magnetic lock ..."); power_normal = 0; puts("[MAINT] enter your personal authorization code to proceed:"); printf("[MAINT] code> "); gets(v1); result = printf("[MAINT] code rejected, power restored: \"%s\"\n", v1); power_normal = 1; return result; }
pwndbg> fmtarg 0x7fffffffcc20 The index of format argument : 8 (\"\%7$p\") pwndbg> fmtarg 0x7fffffffce28 The index of format argument : 73 (\"\%72$p\")