UMDCTF 2025 Writeup

Apr 28, 2025

2025/4/26 07:00(JST) - 2025/4/28 07:00(JST)で開催された UMDCTF 2025 に参加した.

個人で参加し,結果は,536 点で 708 チーム中 386 位だった.以下大会期間中に自分で解けた問題には✔をつけている.

https://umdctf.io/

他の方のwriteupの一部
https://github.com/Harry1053/UMDCTF2025_Writeups/tree/main
https://github.com/rehackxyz/REUN10N/blob/main/CTF-writeups/2025/umdctf-2025/

rev

✔ deobfuscation (111pt [390 Solves])

the chall is not that complex. the key is to read ASSEMBLY!
flag

Ghidraでflagファイルを静的解析する.

./ghidraRun で実行し,プロジェクトを選択後,File > import File… からflagファイルを選択する.

void processEntry entry(void)

{
  long i;
  long j;
  
  syscall();
  syscall();
  for (i = 0; (&DAT_0040209c)[i] != 10; i = i + 1) {
    (&DAT_0040211c)[i] = (&DAT_0040209c)[i] ^ (&DAT_00402034)[i];
  }
  if (i == 0x34) {
    i = 0;
    do {
      j = i;
      if ((&DAT_00402000)[j] != (&DAT_0040211c)[j]) goto LAB_0040109a;
      i = j + 1;
    } while (j + 1 < 0x34);
    (&DAT_0040209d)[j] = 0;
    syscall();
  }
  else {
    LAB_0040109a:
    syscall();
  }
  syscall();
                    /* WARNING: Bad instruction - Truncating control flow here */
  halt_baddata();
}

入力値&DAT_0040209cと鍵&DAT_00402034とをXORした結果と,値&DAT_00402000が一致するかを求めるプログラムである. なので,鍵&DAT_00402034と値&DAT_00402000をXORしてあげればよさそう.

&DAT_00402034と値&DAT_00402000は16進で値が確認できる.

Ghidraで値のコピーは,範囲選択後,右クリック > Copy Special… > Python List などで可能.
データ型を変えたい場合は,範囲選択後,右クリック > Data > TerminatedUnicode などで可能.

DAT_00402000 = [0x20, 0x22, 0x20, 0x26, 0x35, 0x37, 0x14, 0x07, 0x46, 0x00, 0x5a, 0x17, 0x44, 0x35, 0x52, 0x0c, 0x70, 0x28, 0x37, 0x1c, 0x5b, 0x1d, 0x70, 0x16, 0x76, 0x50, 0x69, 0x5c, 0x6e, 0x6c, 0x1b, 0x12, 0x54, 0x69, 0x2d, 0x38, 0x06, 0x23, 0x11, 0x3d, 0x2f, 0x00, 0x02, 0x4a, 0x68, 0x45, 0x3b, 0x64, 0x1a, 0x20, 0x55, 0x05]
DAT_00402034 = [0x75, 0x6f, 0x64, 0x65, 0x61, 0x71, 0x6f, 0x75, 0x75, 0x76, 0x69, 0x45, 0x60, 0x70, 0x7f, 0x65, 0x54, 0x77, 0x63, 0x74, 0x68, 0x42, 0x53, 0x54, 0x45, 0x03, 0x3d, 0x7f, 0x31, 0x58, 0x75, 0x46, 0x75, 0x44, 0x60, 0x78, 0x6a, 0x74, 0x51, 0x4f, 0x1c, 0x5f, 0x76, 0x79, 0x0b, 0x2d, 0x75, 0x45, 0x4b, 0x55, 0x66, 0x78]

result = [a ^ b for a, b in zip(DAT_00402000, DAT_00402034)]
unicode_str = ''.join(chr(r) for r in result)
print(unicode_str)
# UMDCTF{r3v3R$E-i$_Th3_#B3ST#_4nT!-M@lW@r3_t3chN!Qu3}

Pythonを実行するとflagが得られた.

UMDCTF{r3v3R$E-i$_Th3_#B3ST#_4nT!-M@lW@r3_t3chN!Qu3}

nyt

✔ sudoku (375pt [134 Solves])

try this numbers game, minus the math
nc ~

nc で接続すると,入力受付画面となり,適当に入力するとエラーが表示された.

$ nc ~
input: 1111
Traceback (most recent call last):
  File "/app/run", line 2, in <module>
    (s := [*map(int,input("input: "))]) is not s[69] == s[68] > s[58] == s[26] > s[18] == s[43] > s[28] == s[48] == s[78] > s[5] == s[62] == s[72] > s[70] == s[51] == s[2] > s[31] == s[57] > s[41] == s[10] > s[24] == s[55] == s[36] == s[39] > 0 != s[45] != 0 != s[30] != 0 != s[32] != 0 != s[42] != 0 != s[16] != 0 != s[80] != 0 != s[44] != 0 != s[8] != 0 != s[72] != 0 != s[43] != 0 != s[4] != 0 != s[12] != 0 != s[78] != 0 != s[79] != 0 != s[66] != 0 != s[62] != 0 != s[41] != 0 != s[25] != 0 != s[31] != 0 != s[34] != 0 != s[1] != 0 != s[77] != 0 != s[69] != 0 != s[68] != 0 != s[5] != 0 != s[11] != 0 != s[18] != 0 != s[65] != 0 != s[59] != 0 != s[3] != 0 != s[55] != 0 != s[73] != 0 != s[39] != 0 != s[21] != 0 != s[76] != 0 != s[54] != 0 != s[22] != 0 != s[27] != 0 != s[60] != 0 != s[67] != 0 != s[61] != 0 != s[63] != 0 != s[19] != 0 != s[9] != 0 != s[6] != 0 != s[57] != 0 != s[50] != 0 != s[29] != 0 != s[52] != 0 != s[14] != 0 != s[49] != 0 != s[53] != 0 != s[64] != 0 != s[13] != 0 != s[36] != 0 != s[74] != 0 != s[15] != 0 != s[7] != 0 != s[47] != 0 != s[2] != 0 != s[26] != 0 != s[37] != 0 != s[10] != 0 != s[28] != 0 != s[51] != 0 != s[71] != 0 != s[17] != 0 != s[75] != 0 != s[24] != 0 != s[33] != 0 != s[70] != 0 != s[35] != 0 != s[46] != 0 != s[58] != 0 != s[56] != 0 != s[48] != 0 != s[38] != 0 != s[20] != 0 != s[0] != 0 != s[40] != 0 != s[23] != s[31] != s[53] != s[43] != s[24] != s[48] != s[74] != s[50] != s[29] != s[42] != s[7] != s[29] != s[44] != s[68] != s[67] != s[37] != s[48] != s[22] != s[28] != s[72] != s[13] != s[67] != s[65] != s[61] != s[35] != s[59] != s[54] != s[18] != s[53] != s[6] != s[72] != s[76] != s[64] != s[7] != s[33] != s[43] != s[61] != s[49] != s[65] != s[43] != s[37] != s[1] != s[65] != s[6] != s[31] != s[2] != s[9] != s[73] != s[60] != s[25] != s[26] != s[78] != s[76] != s[70] != s[16] != s[12] != s[17] != s[57] != s[48] != s[43] != s[35] != s[15] != s[80] != s[69] != s[52] != s[46] != s[63] != s[25] != s[17] != s[2] != s[66] != s[52] != s[9] != s[59] != s[8] != s[35] != s[67] != s[51] != s[55] != s[14] != s[75] != s[4] != s[14] != s[10] != s[5] != s[66] != s[47] != s[31] != s[43] != s[64] != s[44] != s[11] != s[2] != s[3] != s[52] != s[30] != s[27] != s[35] != s[32] != s[8] != s[20] != s[46] != s[4] != s[36] != s[71] != s[59] != s[5] != s[56] != s[17] != s[50] != s[25] != s[47] != s[11] != s[28] != s[30] != s[13] != s[7] != s[28] != s[42] != s[1] != s[25] != s[19] != s[71] != s[60] != s[8] != s[34] != s[64] != s[30] != s[76] != s[29] != s[41] != s[70] != s[15] != s[13] != s[60] != s[33] != s[71] != s[23] != s[2] != s[57] != s[78] != s[69] != s[33] != s[64] != s[79] != s[20] != s[44] != s[75] != s[30] != s[11] != s[3] != s[72] != s[15] != s[79] != s[41] != s[36] != s[32] != s[44] != s[71] != s[34] != s[50] != s[78] != s[12] != s[2] != s[73] != s[33] != s[8] != s[49] != s[24] != s[17] != s[21] != s[40] != s[30] != s[4] != s[72] != s[31] != s[40] != s[65] != s[8] != s[18] != s[75] != s[53] != s[14] != s[18] != s[4] != s[41] != s[17] != s[18] != s[23] != s[9] != s[71] != s[68] != s[55] != s[64] != s[32] != s[29] != s[75] != s[3] != s[23] != s[56] != s[25] != s[42] != s[32] != s[28] != s[10] != s[53] != s[4] != s[11] != s[0] != s[61] != s[27] != s[69] != s[25] != s[57] != s[58] != s[16] != s[50] != s[71] != s[13] != s[68] != s[1] != s[24] != s[41] != s[19] != s[78] != s[73] != s[39] != s[53] != s[37] != s[70] != s[13] != s[36] != s[20] != s[15] != s[49] != s[48] != s[77] != s[17] != s[8] != s[12] != s[19] != s[59] != s[20] != s[41] != s[76] != s[21] != s[16] != s[61] != s[44] != s[60] != s[62] != s[66] != s[22] != s[49] != s[35] != s[51] != s[49] != s[53] != s[40] != s[9] != s[27] != s[31] != s[11] != s[29] != s[37] != s[12] != s[18] != s[69] != s[2] != s[5] != s[18] != s[10] != s[4] != s[28] != s[9] != s[50] != s[46] != s[16] != s[48] != s[58] != s[0] != s[72] != s[10] != s[13] != s[79] != s[34] != s[9] != s[66] != s[17] != s[45] != s[75] != s[7] != s[15] != s[59] != s[50] != s[12] != s[74] != s[65] != s[51] != s[79] != s[33] != s[80] != s[78] != s[56] != s[57] != s[26] != s[80] != s[20] != s[4] != s[3] != s[31] != s[67] != s[36] != s[7] != s[51] != s[58] != s[63] != s[13] != s[54] != s[66] != s[8] != s[80] != s[47] != s[23] != s[69] != s[47] != s[73] != s[4] != s[79] != s[7] != s[44] != s[28] != s[66] != s[40] != s[55] != s[79] != s[43] != s[68] != s[40] != s[6] != s[27] != s[16] != s[26] != s[17] != s[76] != s[15] != s[36] != s[60] != s[67] != s[53] != s[24] != s[77] != s[51] != s[27] != s[22] != s[53] != s[73] != s[18] != s[57] != s[50] != s[26] != s[37] != s[58] != s[25] != s[12] != s[26] != s[70] != s[63] != s[45] != s[70] != s[12] != s[29] != s[28] != s[52] != s[22] != s[24] != s[45] != s[19] != s[56] != s[71] != s[67] != s[49] != s[68] != s[61] != s[77] != s[19] != s[23] != s[34] != s[33] != s[59] != s[34] != s[51] != s[43] != s[62] != s[59] != s[32] != s[75] != s[11] != s[6] != s[74] != s[70] != s[29] != s[46] != s[12] != s[54] != s[60] != s[26] != s[56] != s[58] != s[77] != s[1] != s[48] != s[53] != s[27] != s[40] != s[0] != s[47] != s[3] != s[6] != s[39] != s[40] != s[1] != s[14] != s[27] != s[28] != s[69] != s[30] != s[70] != s[42] != s[41] != s[52] != s[11] != s[32] != s[13] != s[61] != s[67] != s[24] != s[37] != s[21] != s[74] != s[1] != s[6] != s[47] != s[5] != s[50] != s[37] != s[16] != s[1] != s[55] != s[6] != s[21] != s[65] != s[32] != s[15] != s[10] != s[30] != s[22] != s[37] != s[31] != s[39] != s[77] != s[78] != s[21] != s[58] != s[42] != s[46] != s[76] != s[77] != s[16] != s[39] != s[75] != s[28] != s[3] != s[79] != s[52] != s[10] != s[64] != s[72] != s[47] != s[9] != s[69] != s[22] != s[6] != s[68] != s[51] != s[16] != s[29] != s[45] != s[32] != s[7] != s[62] != s[80] != s[49] != s[32] != s[20] != s[7] != s[55] != s[35] != s[16] != s[24] != s[78] != s[60] != s[69] != s[26] != s[74] != s[77] != s[35] != s[65] != s[14] != s[22] != s[39] != s[10] != s[73] != s[14] != s[74] != s[46] != s[38] != s[52] != s[20] != s[35] != s[39] != s[51] != s[64] != s[62] != s[34] != s[7] != s[45] != s[11] != s[23] != s[66] != s[12] != s[56] != s[63] != s[29] != s[26] != s[73] != s[5] != s[23] != s[72] != s[63] != s[30] != s[15] != s[44] != s[79] != s[38] != s[76] != s[45] != s[21] != s[41] != s[46] != s[37] != s[74] != s[24] != s[19] != s[34] != s[54] != s[36] != s[79] != s[32] != s[80] != s[71] != s[61] != s[55] != s[74] != s[58] != s[1] != s[38] != s[42] != s[45] != s[77] != s[27] != s[39] != s[14] != s[6] != s[23] != s[0] != s[22] != s[43] != s[55] != s[65] != s[15] != s[8] != s[62] != s[12] != s[57] != s[38] != s[4] != s[39] != s[18] != s[9] != s[5] != s[75] != s[52] != s[27] != s[58] != s[35] != s[80] != s[54] != s[71] != s[5] != s[53] != s[0] != s[3] != s[46] != s[79] != s[62] != s[54] != s[17] != s[62] != s[33] != s[47] != s[2] != s[6] != s[0] != s[39] != s[61] != s[60] != s[47] != s[78] != s[41] != s[77] != s[0] != s[16] != s[74] != s[29] != s[38] != s[58] != s[39] != s[5] != s[19] != s[21] != s[48] != s[63] != s[38] != s[56] != s[34] != s[60] != s[80] != s[34] != s[55] != s[21] != s[24] != s[31] != s[49] != s[55] != s[62] != s[51] != s[33] != s[78] != s[17] != s[19] != s[76] != s[24] != s[58] != s[61] != s[51] != s[0] != s[14] != s[5] != s[4] != s[52] != s[72] != s[75] != s[42] != s[63] != s[41] != s[3] != s[20] != s[13] != s[76] != s[63] != s[15] != s[64] != s[36] != s[68] != s[21] != s[1] != s[56] != s[59] != s[49] != s[37] != s[77] != s[21] != s[14] != s[40] != s[52] != s[36] != s[61] != s[54] != s[57] != s[8] != s[54] != s[67] != s[55] != s[33] != s[25] != s[48] != s[38] != s[25] != s[78] != s[45] != s[46] != s[36] != s[3] != s[30] != s[9] != s[19] != s[57] != s[66] != s[73] != s[69] != s[40] != s[28] != s[45] != s[38] != s[70] != s[10] != s[76] != s[42] != s[44] != s[54] != s[2] != s[62] != s[18] != s[47] != s[26] != s[46] != s[70] != s[64] != s[13] != s[44] != s[45] != s[41] != s[38] != s[20] != s[49] != s[43] != s[7] != s[11] != s[42] != s[57] != s[1] != s[63] != s[64] != s[20] != s[65] != s[68] != s[35] != s[0] != s[2] != s[72] != s[30] != s[66] != s[69] != s[5] != s[34] != s[43] != s[67] != s[22] != s[9] != s[56] != s[42] != s[48] != s[31] != s[22] != s[40] != s[74] != s[68] != s[14] != s[31] != s[0] != s[27] != s[66] != s[18] != s[2] != s[8] != s[71] != s[62] != s[57] != s[63] != s[10] != s[11] != s[72] != s[70] != s[50] != s[19] != s[26] != s[33] != s[54] != s[68] != s[60] != s[59] != s[65] != s[80] != s[73] != s[23] != s[50] != s[56] != s[48] != s[67] != s[44] != s[36] != s[38] != s[3] != s[10] != s[75] != s[73] != s[25] != s[80] != s[59] != s[23] is not print(open("flag.txt").read())

IndexError: list index out of range

これはPythonにおける複数の比較演算子の連結記法(連鎖比較; chained comparison)であり,z3-solverを用いることで解くことが出来そう.

!pip install z3-solver

import re
from z3 import *

def parse_constraint(line, s):
    tokens = re.findall(r's\[\d+\]|\d+|==|!=|>=|<=|>|<', line)

    # s[...]や数字をZ3のオブジェクトに変換する
    def resolve(token):
        if token.startswith('s['):
            index = int(token[2:-1])
            return s[index]
        else:
            return int(token)

    conditions = []
    for i in range(0, len(tokens) - 2, 2):
        left = resolve(tokens[i])
        op = tokens[i + 1]
        right = resolve(tokens[i + 2])
        
        # Z3 の比較式を構築
        if op == '==':
            cond = left == right
        elif op == '!=':
            cond = left != right
        elif op == '>':
            cond = left > right
        elif op == '<':
            cond = left < right
        elif op == '>=':
            cond = left >= right
        elif op == '<=':
            cond = left <= right
        else:
            raise ValueError(f"Unknown operator: {op}")
        
        conditions.append(cond)

    return conditions

s = [Int(f's[{i}]') for i in range(81)] # s[0] to s[80]
solver = Solver()

input = """
s[69] == s[68] > s[58] == s[26] > s[18] == s[43] > s[28] == s[48] == s[78] > s[5] == s[62] == s[72] > s[70] == s[51] == s[2] > s[31] == s[57] > s[41] == s[10] > s[24] == s[55] == s[36] == s[39] > 0 != s[45] != 0 != s[30] != 0 != s[32] != 0 != s[42] != 0 != s[16] != 0 != s[80] != 0 != s[44] != 0 != s[8] != 0 != s[72] != 0 != s[43] != 0 != s[4] != 0 != s[12] != 0 != s[78] != 0 != s[79] != 0 != s[66] != 0 != s[62] != 0 != s[41] != 0 != s[25] != 0 != s[31] != 0 != s[34] != 0 != s[1] != 0 != s[77] != 0 != s[69] != 0 != s[68] != 0 != s[5] != 0 != s[11] != 0 != s[18] != 0 != s[65] != 0 != s[59] != 0 != s[3] != 0 != s[55] != 0 != s[73] != 0 != s[39] != 0 != s[21] != 0 != s[76] != 0 != s[54] != 0 != s[22] != 0 != s[27] != 0 != s[60] != 0 != s[67] != 0 != s[61] != 0 != s[63] != 0 != s[19] != 0 != s[9] != 0 != s[6] != 0 != s[57] != 0 != s[50] != 0 != s[29] != 0 != s[52] != 0 != s[14] != 0 != s[49] != 0 != s[53] != 0 != s[64] != 0 != s[13] != 0 != s[36] != 0 != s[74] != 0 != s[15] != 0 != s[7] != 0 != s[47] != 0 != s[2] != 0 != s[26] != 0 != s[37] != 0 != s[10] != 0 != s[28] != 0 != s[51] != 0 != s[71] != 0 != s[17] != 0 != s[75] != 0 != s[24] != 0 != s[33] != 0 != s[70] != 0 != s[35] != 0 != s[46] != 0 != s[58] != 0 != s[56] != 0 != s[48] != 0 != s[38] != 0 != s[20] != 0 != s[0] != 0 != s[40] != 0 != s[23] != s[31] != s[53] != s[43] != s[24] != s[48] != s[74] != s[50] != s[29] != s[42] != s[7] != s[29] != s[44] != s[68] != s[67] != s[37] != s[48] != s[22] != s[28] != s[72] != s[13] != s[67] != s[65] != s[61] != s[35] != s[59] != s[54] != s[18] != s[53] != s[6] != s[72] != s[76] != s[64] != s[7] != s[33] != s[43] != s[61] != s[49] != s[65] != s[43] != s[37] != s[1] != s[65] != s[6] != s[31] != s[2] != s[9] != s[73] != s[60] != s[25] != s[26] != s[78] != s[76] != s[70] != s[16] != s[12] != s[17] != s[57] != s[48] != s[43] != s[35] != s[15] != s[80] != s[69] != s[52] != s[46] != s[63] != s[25] != s[17] != s[2] != s[66] != s[52] != s[9] != s[59] != s[8] != s[35] != s[67] != s[51] != s[55] != s[14] != s[75] != s[4] != s[14] != s[10] != s[5] != s[66] != s[47] != s[31] != s[43] != s[64] != s[44] != s[11] != s[2] != s[3] != s[52] != s[30] != s[27] != s[35] != s[32] != s[8] != s[20] != s[46] != s[4] != s[36] != s[71] != s[59] != s[5] != s[56] != s[17] != s[50] != s[25] != s[47] != s[11] != s[28] != s[30] != s[13] != s[7] != s[28] != s[42] != s[1] != s[25] != s[19] != s[71] != s[60] != s[8] != s[34] != s[64] != s[30] != s[76] != s[29] != s[41] != s[70] != s[15] != s[13] != s[60] != s[33] != s[71] != s[23] != s[2] != s[57] != s[78] != s[69] != s[33] != s[64] != s[79] != s[20] != s[44] != s[75] != s[30] != s[11] != s[3] != s[72] != s[15] != s[79] != s[41] != s[36] != s[32] != s[44] != s[71] != s[34] != s[50] != s[78] != s[12] != s[2] != s[73] != s[33] != s[8] != s[49] != s[24] != s[17] != s[21] != s[40] != s[30] != s[4] != s[72] != s[31] != s[40] != s[65] != s[8] != s[18] != s[75] != s[53] != s[14] != s[18] != s[4] != s[41] != s[17] != s[18] != s[23] != s[9] != s[71] != s[68] != s[55] != s[64] != s[32] != s[29] != s[75] != s[3] != s[23] != s[56] != s[25] != s[42] != s[32] != s[28] != s[10] != s[53] != s[4] != s[11] != s[0] != s[61] != s[27] != s[69] != s[25] != s[57] != s[58] != s[16] != s[50] != s[71] != s[13] != s[68] != s[1] != s[24] != s[41] != s[19] != s[78] != s[73] != s[39] != s[53] != s[37] != s[70] != s[13] != s[36] != s[20] != s[15] != s[49] != s[48] != s[77] != s[17] != s[8] != s[12] != s[19] != s[59] != s[20] != s[41] != s[76] != s[21] != s[16] != s[61] != s[44] != s[60] != s[62] != s[66] != s[22] != s[49] != s[35] != s[51] != s[49] != s[53] != s[40] != s[9] != s[27] != s[31] != s[11] != s[29] != s[37] != s[12] != s[18] != s[69] != s[2] != s[5] != s[18] != s[10] != s[4] != s[28] != s[9] != s[50] != s[46] != s[16] != s[48] != s[58] != s[0] != s[72] != s[10] != s[13] != s[79] != s[34] != s[9] != s[66] != s[17] != s[45] != s[75] != s[7] != s[15] != s[59] != s[50] != s[12] != s[74] != s[65] != s[51] != s[79] != s[33] != s[80] != s[78] != s[56] != s[57] != s[26] != s[80] != s[20] != s[4] != s[3] != s[31] != s[67] != s[36] != s[7] != s[51] != s[58] != s[63] != s[13] != s[54] != s[66] != s[8] != s[80] != s[47] != s[23] != s[69] != s[47] != s[73] != s[4] != s[79] != s[7] != s[44] != s[28] != s[66] != s[40] != s[55] != s[79] != s[43] != s[68] != s[40] != s[6] != s[27] != s[16] != s[26] != s[17] != s[76] != s[15] != s[36] != s[60] != s[67] != s[53] != s[24] != s[77] != s[51] != s[27] != s[22] != s[53] != s[73] != s[18] != s[57] != s[50] != s[26] != s[37] != s[58] != s[25] != s[12] != s[26] != s[70] != s[63] != s[45] != s[70] != s[12] != s[29] != s[28] != s[52] != s[22] != s[24] != s[45] != s[19] != s[56] != s[71] != s[67] != s[49] != s[68] != s[61] != s[77] != s[19] != s[23] != s[34] != s[33] != s[59] != s[34] != s[51] != s[43] != s[62] != s[59] != s[32] != s[75] != s[11] != s[6] != s[74] != s[70] != s[29] != s[46] != s[12] != s[54] != s[60] != s[26] != s[56] != s[58] != s[77] != s[1] != s[48] != s[53] != s[27] != s[40] != s[0] != s[47] != s[3] != s[6] != s[39] != s[40] != s[1] != s[14] != s[27] != s[28] != s[69] != s[30] != s[70] != s[42] != s[41] != s[52] != s[11] != s[32] != s[13] != s[61] != s[67] != s[24] != s[37] != s[21] != s[74] != s[1] != s[6] != s[47] != s[5] != s[50] != s[37] != s[16] != s[1] != s[55] != s[6] != s[21] != s[65] != s[32] != s[15] != s[10] != s[30] != s[22] != s[37] != s[31] != s[39] != s[77] != s[78] != s[21] != s[58] != s[42] != s[46] != s[76] != s[77] != s[16] != s[39] != s[75] != s[28] != s[3] != s[79] != s[52] != s[10] != s[64] != s[72] != s[47] != s[9] != s[69] != s[22] != s[6] != s[68] != s[51] != s[16] != s[29] != s[45] != s[32] != s[7] != s[62] != s[80] != s[49] != s[32] != s[20] != s[7] != s[55] != s[35] != s[16] != s[24] != s[78] != s[60] != s[69] != s[26] != s[74] != s[77] != s[35] != s[65] != s[14] != s[22] != s[39] != s[10] != s[73] != s[14] != s[74] != s[46] != s[38] != s[52] != s[20] != s[35] != s[39] != s[51] != s[64] != s[62] != s[34] != s[7] != s[45] != s[11] != s[23] != s[66] != s[12] != s[56] != s[63] != s[29] != s[26] != s[73] != s[5] != s[23] != s[72] != s[63] != s[30] != s[15] != s[44] != s[79] != s[38] != s[76] != s[45] != s[21] != s[41] != s[46] != s[37] != s[74] != s[24] != s[19] != s[34] != s[54] != s[36] != s[79] != s[32] != s[80] != s[71] != s[61] != s[55] != s[74] != s[58] != s[1] != s[38] != s[42] != s[45] != s[77] != s[27] != s[39] != s[14] != s[6] != s[23] != s[0] != s[22] != s[43] != s[55] != s[65] != s[15] != s[8] != s[62] != s[12] != s[57] != s[38] != s[4] != s[39] != s[18] != s[9] != s[5] != s[75] != s[52] != s[27] != s[58] != s[35] != s[80] != s[54] != s[71] != s[5] != s[53] != s[0] != s[3] != s[46] != s[79] != s[62] != s[54] != s[17] != s[62] != s[33] != s[47] != s[2] != s[6] != s[0] != s[39] != s[61] != s[60] != s[47] != s[78] != s[41] != s[77] != s[0] != s[16] != s[74] != s[29] != s[38] != s[58] != s[39] != s[5] != s[19] != s[21] != s[48] != s[63] != s[38] != s[56] != s[34] != s[60] != s[80] != s[34] != s[55] != s[21] != s[24] != s[31] != s[49] != s[55] != s[62] != s[51] != s[33] != s[78] != s[17] != s[19] != s[76] != s[24] != s[58] != s[61] != s[51] != s[0] != s[14] != s[5] != s[4] != s[52] != s[72] != s[75] != s[42] != s[63] != s[41] != s[3] != s[20] != s[13] != s[76] != s[63] != s[15] != s[64] != s[36] != s[68] != s[21] != s[1] != s[56] != s[59] != s[49] != s[37] != s[77] != s[21] != s[14] != s[40] != s[52] != s[36] != s[61] != s[54] != s[57] != s[8] != s[54] != s[67] != s[55] != s[33] != s[25] != s[48] != s[38] != s[25] != s[78] != s[45] != s[46] != s[36] != s[3] != s[30] != s[9] != s[19] != s[57] != s[66] != s[73] != s[69] != s[40] != s[28] != s[45] != s[38] != s[70] != s[10] != s[76] != s[42] != s[44] != s[54] != s[2] != s[62] != s[18] != s[47] != s[26] != s[46] != s[70] != s[64] != s[13] != s[44] != s[45] != s[41] != s[38] != s[20] != s[49] != s[43] != s[7] != s[11] != s[42] != s[57] != s[1] != s[63] != s[64] != s[20] != s[65] != s[68] != s[35] != s[0] != s[2] != s[72] != s[30] != s[66] != s[69] != s[5] != s[34] != s[43] != s[67] != s[22] != s[9] != s[56] != s[42] != s[48] != s[31] != s[22] != s[40] != s[74] != s[68] != s[14] != s[31] != s[0] != s[27] != s[66] != s[18] != s[2] != s[8] != s[71] != s[62] != s[57] != s[63] != s[10] != s[11] != s[72] != s[70] != s[50] != s[19] != s[26] != s[33] != s[54] != s[68] != s[60] != s[59] != s[65] != s[80] != s[73] != s[23] != s[50] != s[56] != s[48] != s[67] != s[44] != s[36] != s[38] != s[3] != s[10] != s[75] != s[73] != s[25] != s[80] != s[59] != s[23]
"""

for i in range(81):
    solver.add(s[i] >= 0, s[i] <= 9) # s[i]は1桁の数字
constraints = parse_constraint(input, s)
for c in constraints:
    solver.add(c)

if solver.check() == sat:
    model = solver.model()
    solution = [model.evaluate(s[i]).as_long() for i in range(81)]
    num_str = "".join(map(str, solution))
    print(num_str)
else:
    print("No solution found")

これを実行すると,224945891227236799775446158763132236157152174561681439614389755963829948537883684が得られた.

$ nc ~
input: 224945891227236799775446158763132236157152174561681439614389755963829948537883684
UMDCTF{has_operator_chaining_gone_too_far}

UMDCTF{has_operator_chaining_gone_too_far}

SecurityProgrammingCTFwriteupumd

しゅたるく (Stark)

目次

忘れられないの/サカナクション ギターコード

picoGym memo

comments powered by Disqus