2025/4/26 07:00(JST) - 2025/4/28 07:00(JST)で開催された UMDCTF 2025 に参加した.
個人で参加し,結果は,536 点で 708 チーム中 386 位だった.以下大会期間中に自分で解けた問題には✔をつけている.
他の方のwriteupの一部
・ https://github.com/Harry1053/UMDCTF2025_Writeups/tree/main
・ https://github.com/rehackxyz/REUN10N/blob/main/CTF-writeups/2025/umdctf-2025/
rev
✔ deobfuscation (111pt [390 Solves])
the chall is not that complex. the key is to read ASSEMBLY!
flag
Ghidraでflagファイルを静的解析する.
./ghidraRun で実行し,プロジェクトを選択後,File > import File… からflagファイルを選択する.
void processEntry entry(void)
{
long i;
long j;
syscall();
syscall();
for (i = 0; (&DAT_0040209c)[i] != 10; i = i + 1) {
(&DAT_0040211c)[i] = (&DAT_0040209c)[i] ^ (&DAT_00402034)[i];
}
if (i == 0x34) {
i = 0;
do {
j = i;
if ((&DAT_00402000)[j] != (&DAT_0040211c)[j]) goto LAB_0040109a;
i = j + 1;
} while (j + 1 < 0x34);
(&DAT_0040209d)[j] = 0;
syscall();
}
else {
LAB_0040109a:
syscall();
}
syscall();
/* WARNING: Bad instruction - Truncating control flow here */
halt_baddata();
}
入力値&DAT_0040209c
と鍵&DAT_00402034
とをXORした結果と,値&DAT_00402000
が一致するかを求めるプログラムである.
なので,鍵&DAT_00402034
と値&DAT_00402000
をXORしてあげればよさそう.
鍵&DAT_00402034
と値&DAT_00402000
は16進で値が確認できる.
Ghidraで値のコピーは,範囲選択後,右クリック > Copy Special… > Python List などで可能.
データ型を変えたい場合は,範囲選択後,右クリック > Data > TerminatedUnicode などで可能.
DAT_00402000 = [0x20, 0x22, 0x20, 0x26, 0x35, 0x37, 0x14, 0x07, 0x46, 0x00, 0x5a, 0x17, 0x44, 0x35, 0x52, 0x0c, 0x70, 0x28, 0x37, 0x1c, 0x5b, 0x1d, 0x70, 0x16, 0x76, 0x50, 0x69, 0x5c, 0x6e, 0x6c, 0x1b, 0x12, 0x54, 0x69, 0x2d, 0x38, 0x06, 0x23, 0x11, 0x3d, 0x2f, 0x00, 0x02, 0x4a, 0x68, 0x45, 0x3b, 0x64, 0x1a, 0x20, 0x55, 0x05]
DAT_00402034 = [0x75, 0x6f, 0x64, 0x65, 0x61, 0x71, 0x6f, 0x75, 0x75, 0x76, 0x69, 0x45, 0x60, 0x70, 0x7f, 0x65, 0x54, 0x77, 0x63, 0x74, 0x68, 0x42, 0x53, 0x54, 0x45, 0x03, 0x3d, 0x7f, 0x31, 0x58, 0x75, 0x46, 0x75, 0x44, 0x60, 0x78, 0x6a, 0x74, 0x51, 0x4f, 0x1c, 0x5f, 0x76, 0x79, 0x0b, 0x2d, 0x75, 0x45, 0x4b, 0x55, 0x66, 0x78]
result = [a ^ b for a, b in zip(DAT_00402000, DAT_00402034)]
unicode_str = ''.join(chr(r) for r in result)
print(unicode_str)
# UMDCTF{r3v3R$E-i$_Th3_#B3ST#_4nT!-M@lW@r3_t3chN!Qu3}
Pythonを実行するとflagが得られた.
UMDCTF{r3v3R$E-i$_Th3_#B3ST#_4nT!-M@lW@r3_t3chN!Qu3}
nyt
✔ sudoku (375pt [134 Solves])
try this numbers game, minus the math
nc ~
nc で接続すると,入力受付画面となり,適当に入力するとエラーが表示された.
$ nc ~
input: 1111
Traceback (most recent call last):
File "/app/run", line 2, in <module>
(s := [*map(int,input("input: "))]) is not s[69] == s[68] > s[58] == s[26] > s[18] == s[43] > s[28] == s[48] == s[78] > s[5] == s[62] == s[72] > s[70] == s[51] == s[2] > s[31] == s[57] > s[41] == s[10] > s[24] == s[55] == s[36] == s[39] > 0 != s[45] != 0 != s[30] != 0 != s[32] != 0 != s[42] != 0 != s[16] != 0 != s[80] != 0 != s[44] != 0 != s[8] != 0 != s[72] != 0 != s[43] != 0 != s[4] != 0 != s[12] != 0 != s[78] != 0 != s[79] != 0 != s[66] != 0 != s[62] != 0 != s[41] != 0 != s[25] != 0 != s[31] != 0 != s[34] != 0 != s[1] != 0 != s[77] != 0 != s[69] != 0 != s[68] != 0 != s[5] != 0 != s[11] != 0 != s[18] != 0 != s[65] != 0 != s[59] != 0 != s[3] != 0 != s[55] != 0 != s[73] != 0 != s[39] != 0 != s[21] != 0 != s[76] != 0 != s[54] != 0 != s[22] != 0 != s[27] != 0 != s[60] != 0 != s[67] != 0 != s[61] != 0 != s[63] != 0 != s[19] != 0 != s[9] != 0 != s[6] != 0 != s[57] != 0 != s[50] != 0 != s[29] != 0 != s[52] != 0 != s[14] != 0 != s[49] != 0 != s[53] != 0 != s[64] != 0 != s[13] != 0 != s[36] != 0 != s[74] != 0 != s[15] != 0 != s[7] != 0 != s[47] != 0 != s[2] != 0 != s[26] != 0 != s[37] != 0 != s[10] != 0 != s[28] != 0 != s[51] != 0 != s[71] != 0 != s[17] != 0 != s[75] != 0 != s[24] != 0 != s[33] != 0 != s[70] != 0 != s[35] != 0 != s[46] != 0 != s[58] != 0 != s[56] != 0 != s[48] != 0 != s[38] != 0 != s[20] != 0 != s[0] != 0 != s[40] != 0 != s[23] != s[31] != s[53] != s[43] != s[24] != s[48] != s[74] != s[50] != s[29] != s[42] != s[7] != s[29] != s[44] != s[68] != s[67] != s[37] != s[48] != s[22] != s[28] != s[72] != s[13] != s[67] != s[65] != s[61] != s[35] != s[59] != s[54] != s[18] != s[53] != s[6] != s[72] != s[76] != s[64] != s[7] != s[33] != s[43] != s[61] != s[49] != s[65] != s[43] != s[37] != s[1] != s[65] != s[6] != s[31] != s[2] != s[9] != s[73] != s[60] != s[25] != s[26] != s[78] != s[76] != s[70] != s[16] != s[12] != s[17] != s[57] != s[48] != s[43] != s[35] != s[15] != s[80] != s[69] != s[52] != s[46] != s[63] != s[25] != s[17] != s[2] != s[66] != s[52] != s[9] != s[59] != s[8] != s[35] != s[67] != s[51] != s[55] != s[14] != s[75] != s[4] != s[14] != s[10] != s[5] != s[66] != s[47] != s[31] != s[43] != s[64] != s[44] != s[11] != s[2] != s[3] != s[52] != s[30] != s[27] != s[35] != s[32] != s[8] != s[20] != s[46] != s[4] != s[36] != s[71] != s[59] != s[5] != s[56] != s[17] != s[50] != s[25] != s[47] != s[11] != s[28] != s[30] != s[13] != s[7] != s[28] != s[42] != s[1] != s[25] != s[19] != s[71] != s[60] != s[8] != s[34] != s[64] != s[30] != s[76] != s[29] != s[41] != s[70] != s[15] != s[13] != s[60] != s[33] != s[71] != s[23] != s[2] != s[57] != s[78] != s[69] != s[33] != s[64] != s[79] != s[20] != s[44] != s[75] != s[30] != s[11] != s[3] != s[72] != s[15] != s[79] != s[41] != s[36] != s[32] != s[44] != s[71] != s[34] != s[50] != s[78] != s[12] != s[2] != s[73] != s[33] != s[8] != s[49] != s[24] != s[17] != s[21] != s[40] != s[30] != s[4] != s[72] != s[31] != s[40] != s[65] != s[8] != s[18] != s[75] != s[53] != s[14] != s[18] != s[4] != s[41] != s[17] != s[18] != s[23] != s[9] != s[71] != s[68] != s[55] != s[64] != s[32] != s[29] != s[75] != s[3] != s[23] != s[56] != s[25] != s[42] != s[32] != s[28] != s[10] != s[53] != s[4] != s[11] != s[0] != s[61] != s[27] != s[69] != s[25] != s[57] != s[58] != s[16] != s[50] != s[71] != s[13] != s[68] != s[1] != s[24] != s[41] != s[19] != s[78] != s[73] != s[39] != s[53] != s[37] != s[70] != s[13] != s[36] != s[20] != s[15] != s[49] != s[48] != s[77] != s[17] != s[8] != s[12] != s[19] != s[59] != s[20] != s[41] != s[76] != s[21] != s[16] != s[61] != s[44] != s[60] != s[62] != s[66] != s[22] != s[49] != s[35] != s[51] != s[49] != s[53] != s[40] != s[9] != s[27] != s[31] != s[11] != s[29] != s[37] != s[12] != s[18] != s[69] != s[2] != s[5] != s[18] != s[10] != s[4] != s[28] != s[9] != s[50] != s[46] != s[16] != s[48] != s[58] != s[0] != s[72] != s[10] != s[13] != s[79] != s[34] != s[9] != s[66] != s[17] != s[45] != s[75] != s[7] != s[15] != s[59] != s[50] != s[12] != s[74] != s[65] != s[51] != s[79] != s[33] != s[80] != s[78] != s[56] != s[57] != s[26] != s[80] != s[20] != s[4] != s[3] != s[31] != s[67] != s[36] != s[7] != s[51] != s[58] != s[63] != s[13] != s[54] != s[66] != s[8] != s[80] != s[47] != s[23] != s[69] != s[47] != s[73] != s[4] != s[79] != s[7] != s[44] != s[28] != s[66] != s[40] != s[55] != s[79] != s[43] != s[68] != s[40] != s[6] != s[27] != s[16] != s[26] != s[17] != s[76] != s[15] != s[36] != s[60] != s[67] != s[53] != s[24] != s[77] != s[51] != s[27] != s[22] != s[53] != s[73] != s[18] != s[57] != s[50] != s[26] != s[37] != s[58] != s[25] != s[12] != s[26] != s[70] != s[63] != s[45] != s[70] != s[12] != s[29] != s[28] != s[52] != s[22] != s[24] != s[45] != s[19] != s[56] != s[71] != s[67] != s[49] != s[68] != s[61] != s[77] != s[19] != s[23] != s[34] != s[33] != s[59] != s[34] != s[51] != s[43] != s[62] != s[59] != s[32] != s[75] != s[11] != s[6] != s[74] != s[70] != s[29] != s[46] != s[12] != s[54] != s[60] != s[26] != s[56] != s[58] != s[77] != s[1] != s[48] != s[53] != s[27] != s[40] != s[0] != s[47] != s[3] != s[6] != s[39] != s[40] != s[1] != s[14] != s[27] != s[28] != s[69] != s[30] != s[70] != s[42] != s[41] != s[52] != s[11] != s[32] != s[13] != s[61] != s[67] != s[24] != s[37] != s[21] != s[74] != s[1] != s[6] != s[47] != s[5] != s[50] != s[37] != s[16] != s[1] != s[55] != s[6] != s[21] != s[65] != s[32] != s[15] != s[10] != s[30] != s[22] != s[37] != s[31] != s[39] != s[77] != s[78] != s[21] != s[58] != s[42] != s[46] != s[76] != s[77] != s[16] != s[39] != s[75] != s[28] != s[3] != s[79] != s[52] != s[10] != s[64] != s[72] != s[47] != s[9] != s[69] != s[22] != s[6] != s[68] != s[51] != s[16] != s[29] != s[45] != s[32] != s[7] != s[62] != s[80] != s[49] != s[32] != s[20] != s[7] != s[55] != s[35] != s[16] != s[24] != s[78] != s[60] != s[69] != s[26] != s[74] != s[77] != s[35] != s[65] != s[14] != s[22] != s[39] != s[10] != s[73] != s[14] != s[74] != s[46] != s[38] != s[52] != s[20] != s[35] != s[39] != s[51] != s[64] != s[62] != s[34] != s[7] != s[45] != s[11] != s[23] != s[66] != s[12] != s[56] != s[63] != s[29] != s[26] != s[73] != s[5] != s[23] != s[72] != s[63] != s[30] != s[15] != s[44] != s[79] != s[38] != s[76] != s[45] != s[21] != s[41] != s[46] != s[37] != s[74] != s[24] != s[19] != s[34] != s[54] != s[36] != s[79] != s[32] != s[80] != s[71] != s[61] != s[55] != s[74] != s[58] != s[1] != s[38] != s[42] != s[45] != s[77] != s[27] != s[39] != s[14] != s[6] != s[23] != s[0] != s[22] != s[43] != s[55] != s[65] != s[15] != s[8] != s[62] != s[12] != s[57] != s[38] != s[4] != s[39] != s[18] != s[9] != s[5] != s[75] != s[52] != s[27] != s[58] != s[35] != s[80] != s[54] != s[71] != s[5] != s[53] != s[0] != s[3] != s[46] != s[79] != s[62] != s[54] != s[17] != s[62] != s[33] != s[47] != s[2] != s[6] != s[0] != s[39] != s[61] != s[60] != s[47] != s[78] != s[41] != s[77] != s[0] != s[16] != s[74] != s[29] != s[38] != s[58] != s[39] != s[5] != s[19] != s[21] != s[48] != s[63] != s[38] != s[56] != s[34] != s[60] != s[80] != s[34] != s[55] != s[21] != s[24] != s[31] != s[49] != s[55] != s[62] != s[51] != s[33] != s[78] != s[17] != s[19] != s[76] != s[24] != s[58] != s[61] != s[51] != s[0] != s[14] != s[5] != s[4] != s[52] != s[72] != s[75] != s[42] != s[63] != s[41] != s[3] != s[20] != s[13] != s[76] != s[63] != s[15] != s[64] != s[36] != s[68] != s[21] != s[1] != s[56] != s[59] != s[49] != s[37] != s[77] != s[21] != s[14] != s[40] != s[52] != s[36] != s[61] != s[54] != s[57] != s[8] != s[54] != s[67] != s[55] != s[33] != s[25] != s[48] != s[38] != s[25] != s[78] != s[45] != s[46] != s[36] != s[3] != s[30] != s[9] != s[19] != s[57] != s[66] != s[73] != s[69] != s[40] != s[28] != s[45] != s[38] != s[70] != s[10] != s[76] != s[42] != s[44] != s[54] != s[2] != s[62] != s[18] != s[47] != s[26] != s[46] != s[70] != s[64] != s[13] != s[44] != s[45] != s[41] != s[38] != s[20] != s[49] != s[43] != s[7] != s[11] != s[42] != s[57] != s[1] != s[63] != s[64] != s[20] != s[65] != s[68] != s[35] != s[0] != s[2] != s[72] != s[30] != s[66] != s[69] != s[5] != s[34] != s[43] != s[67] != s[22] != s[9] != s[56] != s[42] != s[48] != s[31] != s[22] != s[40] != s[74] != s[68] != s[14] != s[31] != s[0] != s[27] != s[66] != s[18] != s[2] != s[8] != s[71] != s[62] != s[57] != s[63] != s[10] != s[11] != s[72] != s[70] != s[50] != s[19] != s[26] != s[33] != s[54] != s[68] != s[60] != s[59] != s[65] != s[80] != s[73] != s[23] != s[50] != s[56] != s[48] != s[67] != s[44] != s[36] != s[38] != s[3] != s[10] != s[75] != s[73] != s[25] != s[80] != s[59] != s[23] is not print(open("flag.txt").read())
IndexError: list index out of range
これはPythonにおける複数の比較演算子の連結記法(連鎖比較; chained comparison)であり,z3-solver
を用いることで解くことが出来そう.
!pip install z3-solver
import re
from z3 import *
def parse_constraint(line, s):
tokens = re.findall(r's\[\d+\]|\d+|==|!=|>=|<=|>|<', line)
# s[...]や数字をZ3のオブジェクトに変換する
def resolve(token):
if token.startswith('s['):
index = int(token[2:-1])
return s[index]
else:
return int(token)
conditions = []
for i in range(0, len(tokens) - 2, 2):
left = resolve(tokens[i])
op = tokens[i + 1]
right = resolve(tokens[i + 2])
# Z3 の比較式を構築
if op == '==':
cond = left == right
elif op == '!=':
cond = left != right
elif op == '>':
cond = left > right
elif op == '<':
cond = left < right
elif op == '>=':
cond = left >= right
elif op == '<=':
cond = left <= right
else:
raise ValueError(f"Unknown operator: {op}")
conditions.append(cond)
return conditions
s = [Int(f's[{i}]') for i in range(81)] # s[0] to s[80]
solver = Solver()
input = """
s[69] == s[68] > s[58] == s[26] > s[18] == s[43] > s[28] == s[48] == s[78] > s[5] == s[62] == s[72] > s[70] == s[51] == s[2] > s[31] == s[57] > s[41] == s[10] > s[24] == s[55] == s[36] == s[39] > 0 != s[45] != 0 != s[30] != 0 != s[32] != 0 != s[42] != 0 != s[16] != 0 != s[80] != 0 != s[44] != 0 != s[8] != 0 != s[72] != 0 != s[43] != 0 != s[4] != 0 != s[12] != 0 != s[78] != 0 != s[79] != 0 != s[66] != 0 != s[62] != 0 != s[41] != 0 != s[25] != 0 != s[31] != 0 != s[34] != 0 != s[1] != 0 != s[77] != 0 != s[69] != 0 != s[68] != 0 != s[5] != 0 != s[11] != 0 != s[18] != 0 != s[65] != 0 != s[59] != 0 != s[3] != 0 != s[55] != 0 != s[73] != 0 != s[39] != 0 != s[21] != 0 != s[76] != 0 != s[54] != 0 != s[22] != 0 != s[27] != 0 != s[60] != 0 != s[67] != 0 != s[61] != 0 != s[63] != 0 != s[19] != 0 != s[9] != 0 != s[6] != 0 != s[57] != 0 != s[50] != 0 != s[29] != 0 != s[52] != 0 != s[14] != 0 != s[49] != 0 != s[53] != 0 != s[64] != 0 != s[13] != 0 != s[36] != 0 != s[74] != 0 != s[15] != 0 != s[7] != 0 != s[47] != 0 != s[2] != 0 != s[26] != 0 != s[37] != 0 != s[10] != 0 != s[28] != 0 != s[51] != 0 != s[71] != 0 != s[17] != 0 != s[75] != 0 != s[24] != 0 != s[33] != 0 != s[70] != 0 != s[35] != 0 != s[46] != 0 != s[58] != 0 != s[56] != 0 != s[48] != 0 != s[38] != 0 != s[20] != 0 != s[0] != 0 != s[40] != 0 != s[23] != s[31] != s[53] != s[43] != s[24] != s[48] != s[74] != s[50] != s[29] != s[42] != s[7] != s[29] != s[44] != s[68] != s[67] != s[37] != s[48] != s[22] != s[28] != s[72] != s[13] != s[67] != s[65] != s[61] != s[35] != s[59] != s[54] != s[18] != s[53] != s[6] != s[72] != s[76] != s[64] != s[7] != s[33] != s[43] != s[61] != s[49] != s[65] != s[43] != s[37] != s[1] != s[65] != s[6] != s[31] != s[2] != s[9] != s[73] != s[60] != s[25] != s[26] != s[78] != s[76] != s[70] != s[16] != s[12] != s[17] != s[57] != s[48] != s[43] != s[35] != s[15] != s[80] != s[69] != s[52] != s[46] != s[63] != s[25] != s[17] != s[2] != s[66] != s[52] != s[9] != s[59] != s[8] != s[35] != s[67] != s[51] != s[55] != s[14] != s[75] != s[4] != s[14] != s[10] != s[5] != s[66] != s[47] != s[31] != s[43] != s[64] != s[44] != s[11] != s[2] != s[3] != s[52] != s[30] != s[27] != s[35] != s[32] != s[8] != s[20] != s[46] != s[4] != s[36] != s[71] != s[59] != s[5] != s[56] != s[17] != s[50] != s[25] != s[47] != s[11] != s[28] != s[30] != s[13] != s[7] != s[28] != s[42] != s[1] != s[25] != s[19] != s[71] != s[60] != s[8] != s[34] != s[64] != s[30] != s[76] != s[29] != s[41] != s[70] != s[15] != s[13] != s[60] != s[33] != s[71] != s[23] != s[2] != s[57] != s[78] != s[69] != s[33] != s[64] != s[79] != s[20] != s[44] != s[75] != s[30] != s[11] != s[3] != s[72] != s[15] != s[79] != s[41] != s[36] != s[32] != s[44] != s[71] != s[34] != s[50] != s[78] != s[12] != s[2] != s[73] != s[33] != s[8] != s[49] != s[24] != s[17] != s[21] != s[40] != s[30] != s[4] != s[72] != s[31] != s[40] != s[65] != s[8] != s[18] != s[75] != s[53] != s[14] != s[18] != s[4] != s[41] != s[17] != s[18] != s[23] != s[9] != s[71] != s[68] != s[55] != s[64] != s[32] != s[29] != s[75] != s[3] != s[23] != s[56] != s[25] != s[42] != s[32] != s[28] != s[10] != s[53] != s[4] != s[11] != s[0] != s[61] != s[27] != s[69] != s[25] != s[57] != s[58] != s[16] != s[50] != s[71] != s[13] != s[68] != s[1] != s[24] != s[41] != s[19] != s[78] != s[73] != s[39] != s[53] != s[37] != s[70] != s[13] != s[36] != s[20] != s[15] != s[49] != s[48] != s[77] != s[17] != s[8] != s[12] != s[19] != s[59] != s[20] != s[41] != s[76] != s[21] != s[16] != s[61] != s[44] != s[60] != s[62] != s[66] != s[22] != s[49] != s[35] != s[51] != s[49] != s[53] != s[40] != s[9] != s[27] != s[31] != s[11] != s[29] != s[37] != s[12] != s[18] != s[69] != s[2] != s[5] != s[18] != s[10] != s[4] != s[28] != s[9] != s[50] != s[46] != s[16] != s[48] != s[58] != s[0] != s[72] != s[10] != s[13] != s[79] != s[34] != s[9] != s[66] != s[17] != s[45] != s[75] != s[7] != s[15] != s[59] != s[50] != s[12] != s[74] != s[65] != s[51] != s[79] != s[33] != s[80] != s[78] != s[56] != s[57] != s[26] != s[80] != s[20] != s[4] != s[3] != s[31] != s[67] != s[36] != s[7] != s[51] != s[58] != s[63] != s[13] != s[54] != s[66] != s[8] != s[80] != s[47] != s[23] != s[69] != s[47] != s[73] != s[4] != s[79] != s[7] != s[44] != s[28] != s[66] != s[40] != s[55] != s[79] != s[43] != s[68] != s[40] != s[6] != s[27] != s[16] != s[26] != s[17] != s[76] != s[15] != s[36] != s[60] != s[67] != s[53] != s[24] != s[77] != s[51] != s[27] != s[22] != s[53] != s[73] != s[18] != s[57] != s[50] != s[26] != s[37] != s[58] != s[25] != s[12] != s[26] != s[70] != s[63] != s[45] != s[70] != s[12] != s[29] != s[28] != s[52] != s[22] != s[24] != s[45] != s[19] != s[56] != s[71] != s[67] != s[49] != s[68] != s[61] != s[77] != s[19] != s[23] != s[34] != s[33] != s[59] != s[34] != s[51] != s[43] != s[62] != s[59] != s[32] != s[75] != s[11] != s[6] != s[74] != s[70] != s[29] != s[46] != s[12] != s[54] != s[60] != s[26] != s[56] != s[58] != s[77] != s[1] != s[48] != s[53] != s[27] != s[40] != s[0] != s[47] != s[3] != s[6] != s[39] != s[40] != s[1] != s[14] != s[27] != s[28] != s[69] != s[30] != s[70] != s[42] != s[41] != s[52] != s[11] != s[32] != s[13] != s[61] != s[67] != s[24] != s[37] != s[21] != s[74] != s[1] != s[6] != s[47] != s[5] != s[50] != s[37] != s[16] != s[1] != s[55] != s[6] != s[21] != s[65] != s[32] != s[15] != s[10] != s[30] != s[22] != s[37] != s[31] != s[39] != s[77] != s[78] != s[21] != s[58] != s[42] != s[46] != s[76] != s[77] != s[16] != s[39] != s[75] != s[28] != s[3] != s[79] != s[52] != s[10] != s[64] != s[72] != s[47] != s[9] != s[69] != s[22] != s[6] != s[68] != s[51] != s[16] != s[29] != s[45] != s[32] != s[7] != s[62] != s[80] != s[49] != s[32] != s[20] != s[7] != s[55] != s[35] != s[16] != s[24] != s[78] != s[60] != s[69] != s[26] != s[74] != s[77] != s[35] != s[65] != s[14] != s[22] != s[39] != s[10] != s[73] != s[14] != s[74] != s[46] != s[38] != s[52] != s[20] != s[35] != s[39] != s[51] != s[64] != s[62] != s[34] != s[7] != s[45] != s[11] != s[23] != s[66] != s[12] != s[56] != s[63] != s[29] != s[26] != s[73] != s[5] != s[23] != s[72] != s[63] != s[30] != s[15] != s[44] != s[79] != s[38] != s[76] != s[45] != s[21] != s[41] != s[46] != s[37] != s[74] != s[24] != s[19] != s[34] != s[54] != s[36] != s[79] != s[32] != s[80] != s[71] != s[61] != s[55] != s[74] != s[58] != s[1] != s[38] != s[42] != s[45] != s[77] != s[27] != s[39] != s[14] != s[6] != s[23] != s[0] != s[22] != s[43] != s[55] != s[65] != s[15] != s[8] != s[62] != s[12] != s[57] != s[38] != s[4] != s[39] != s[18] != s[9] != s[5] != s[75] != s[52] != s[27] != s[58] != s[35] != s[80] != s[54] != s[71] != s[5] != s[53] != s[0] != s[3] != s[46] != s[79] != s[62] != s[54] != s[17] != s[62] != s[33] != s[47] != s[2] != s[6] != s[0] != s[39] != s[61] != s[60] != s[47] != s[78] != s[41] != s[77] != s[0] != s[16] != s[74] != s[29] != s[38] != s[58] != s[39] != s[5] != s[19] != s[21] != s[48] != s[63] != s[38] != s[56] != s[34] != s[60] != s[80] != s[34] != s[55] != s[21] != s[24] != s[31] != s[49] != s[55] != s[62] != s[51] != s[33] != s[78] != s[17] != s[19] != s[76] != s[24] != s[58] != s[61] != s[51] != s[0] != s[14] != s[5] != s[4] != s[52] != s[72] != s[75] != s[42] != s[63] != s[41] != s[3] != s[20] != s[13] != s[76] != s[63] != s[15] != s[64] != s[36] != s[68] != s[21] != s[1] != s[56] != s[59] != s[49] != s[37] != s[77] != s[21] != s[14] != s[40] != s[52] != s[36] != s[61] != s[54] != s[57] != s[8] != s[54] != s[67] != s[55] != s[33] != s[25] != s[48] != s[38] != s[25] != s[78] != s[45] != s[46] != s[36] != s[3] != s[30] != s[9] != s[19] != s[57] != s[66] != s[73] != s[69] != s[40] != s[28] != s[45] != s[38] != s[70] != s[10] != s[76] != s[42] != s[44] != s[54] != s[2] != s[62] != s[18] != s[47] != s[26] != s[46] != s[70] != s[64] != s[13] != s[44] != s[45] != s[41] != s[38] != s[20] != s[49] != s[43] != s[7] != s[11] != s[42] != s[57] != s[1] != s[63] != s[64] != s[20] != s[65] != s[68] != s[35] != s[0] != s[2] != s[72] != s[30] != s[66] != s[69] != s[5] != s[34] != s[43] != s[67] != s[22] != s[9] != s[56] != s[42] != s[48] != s[31] != s[22] != s[40] != s[74] != s[68] != s[14] != s[31] != s[0] != s[27] != s[66] != s[18] != s[2] != s[8] != s[71] != s[62] != s[57] != s[63] != s[10] != s[11] != s[72] != s[70] != s[50] != s[19] != s[26] != s[33] != s[54] != s[68] != s[60] != s[59] != s[65] != s[80] != s[73] != s[23] != s[50] != s[56] != s[48] != s[67] != s[44] != s[36] != s[38] != s[3] != s[10] != s[75] != s[73] != s[25] != s[80] != s[59] != s[23]
"""
for i in range(81):
solver.add(s[i] >= 0, s[i] <= 9) # s[i]は1桁の数字
constraints = parse_constraint(input, s)
for c in constraints:
solver.add(c)
if solver.check() == sat:
model = solver.model()
solution = [model.evaluate(s[i]).as_long() for i in range(81)]
num_str = "".join(map(str, solution))
print(num_str)
else:
print("No solution found")
これを実行すると,224945891227236799775446158763132236157152174561681439614389755963829948537883684
が得られた.
$ nc ~
input: 224945891227236799775446158763132236157152174561681439614389755963829948537883684
UMDCTF{has_operator_chaining_gone_too_far}
UMDCTF{has_operator_chaining_gone_too_far}