hackergame misc writeup

猫咪电路

mc的红石电路,逆推过程,输入的二进制01就是flag

flag{0110101000111100101111111111111111111010}

猫咪和键盘

纵向随机切割

with open("typed_printf.cpp","r") as f:
    lines=f.readlines()
    #print(lines)
    for line in lines:
        seg1=line[0:1]
        seg2=line[1:7]
        seg3=line[8:20]
        seg4=line[20:22]
        seg5=line[22:32]
        seg6=line[32:39]
        seg7=line[39:-1]
        print((seg1+seg6+seg2+seg4+seg3+seg5+seg7).strip())

/*
* name: typed_printf.cpp
* compile: g++ -std=c++17 typed_printf.cpp
* title: type safe printf
* author: nicekingwei
* url: aHR0cHM6Ly96anUtbGFtYmRhLnRlY2gvY3BwZHQtcHJpbnRmLw==
* related knowledge:
*  - value and type
*      value->value: function
*      type->value: parametric polymorphism
*      type->type: generic
*      value->type: dependent type
*  - auto
*  - if constexpr
*/
#include <iostream>
#include <functional>
#include <type_traits>

using namespace std;

template<const char*format>
static auto println() {
if constexpr (format[0]=='%') {
if constexpr (format[1]=='d') {
return [](int x){cout<<x<<endl;};
} else if constexpr (format[1]=='s') {
return [](const char* x){cout<<x<<endl;};
} else {
return "error";
}
} else {
return "error";
}
}

struct unit_t {char x;};

template<typename T,typename R>
constexpr auto get_arg(R (*f)(T)){
return T{};
}

template<typename T>
constexpr bool cont_takes_no_arg(T cont){
using cont_t = decay_t<T>;
using arg_type = decay_t<decltype(get_arg(cont))>;
return is_same<unit_t,arg_type>::value;
}


template<typename T,typename R,typename X,R (*cont)(X)>
auto print_var(T x){
cout<<x;
return cont;
}

template<typename T,typename R,typename X,R (*cont)(void)>
auto print_var(T x){
cout<<x;
return cont();
}

template<char c,typename R,typename X,R (*cont)(X)>
auto print_const(X x){
cout<<c;
return cont(x);
}

template<char c,typename R,typename X,R (*cont)(void)>
auto print_const(){
cout<<c;
return cont();
}


template<typename R,typename X>
constexpr auto cont_ret_type(R (*cont)(X)){
return R{};
}

template<typename R>
constexpr auto cont_ret_type(R (*cont)()){
return R{};
}

template<typename R,typename X>
constexpr auto cont_arg_type(R (*cont)(X)){
return X{};
}

template<typename R>
constexpr auto cont_arg_type(R (*cont)()){
return unit_t{};
}

unit_t print_nothing(){return unit_t{};}

#define cont_ret_t decay_t<decltype(cont_ret_type(cont))>
#define cont_arg_t decay_t<decltype(cont_arg_type(cont))>

template<const char*format,int i>
constexpr auto _typed_printf(){
if constexpr (format[i]=='%' && format[i+1] == 'd') {
constexpr auto cont = _typed_printf<format,i+2>();
return print_var<int,cont_ret_t,cont_arg_t,cont>;
} else if constexpr (format[i]=='%' && format[i+1] == 's') {
constexpr auto cont = _typed_printf<format,i+2>();
return print_var<const char*,cont_ret_t,cont_arg_t,cont>;
} else if constexpr (format[i]!='\0') {
constexpr auto cont = _typed_printf<format,i+1>();
return print_const<format[i],cont_ret_t,cont_arg_t,cont>;
} else {
return print_nothing;
}
}

#define def_typed_printf(f,str) constexpr static const char str_fmt##f[] = str; auto f = _typed_printf<str_fmt##f,0>();

#define ABC "FfQ47if9Zxw9jXE68VtGA"
#define BAC "JDk6Y6Xc88UrUtpK3iF8p"
#define CAB "7BMs4y2gzdG8Ao2gv6aiJ"

int main(){
def_typed_printf(f_l_x_g_1, "%s%s%s%s");
f_l_x_g_1("fl")("a")("g")("{");
def_typed_printf(a_a_a_a_a_a_a_a_a, "%s%s%s%s%s%s%d");
a_a_a_a_a_a_a_a_a(ABC)("")(BAC)("")(CAB)("")('}');
def_typed_printf(def_typed_printf_, "%s%d%s");
def_typed_printf_("typed_printf")('_')("}");
return 0;
}

c++17运行得flag

白与夜

lsb隐写

游园会的集章卡片

用 montage和gaps拼图,我不会用这个东西,拼歪了只能硬着把flag弄出来了

montage *png -tile 5x5 -geometry 125x125+0+0 flag.png
gaps --image=flag.png --generations=50 --population=25 --size=125

flag{H4PPY_1M4GE_PR0CE551NG}

猫咪遥控器

把txt内容处理成图像

from PIL import  Image

image= Image.new("RGB",(1000,1000))

f= open('seq.txt','r').read()
x=0
y=0

for i in f:
    if(i=='D'):
        y+=1
    elif(i=='L'):
        x-=1
    elif(i=='R'):
        x+=1
    elif(i=="U"):
        y-=1
    print(x,y)
    image.putpixel((x,y),(255,255,255))
image.show()

她的诗

uuencode隐写类似base64隐写

exp

def is_line_contain_flag(line):
    left = line[0] - 32
    return left * 4 % 3


def get_hidden_bits(line):
    left = is_line_contain_flag(line)
    assert (left != 0)
    if left == 1:
        return (line[-3] - 32) & 0b1111
    else:
        return (((line[-2] - 32) & 0b11) << 2) | (((line[-1] - 32) & 0b1100) >> 2)  # 提取隐藏的flag bits


if __name__ == '__main__':
    fin = open("poem.txt", "r")
    fout = open("flag.txt", "w")

    enc_lines = fin.read().splitlines()
    enc_lines = list(
        map(lambda x: bytes(x, encoding='ascii'), enc_lines))
    lines_contain_flag = []
    flag = ''
    for i in enc_lines:
        if is_line_contain_flag(i):
            lines_contain_flag.append(i)
        else:
            continue
    for i in range(len(lines_contain_flag)):
        if i % 2 == 0:  # ????
            flag_chr = (get_hidden_bits(lines_contain_flag[i]) << 4) | (get_hidden_bits(lines_contain_flag[i + 1]))
            flag += chr(flag_chr)
    fout.write(flag)
    fin.close()
    fout.close()

Word 文档

binwalk那个doc文件,会出一个flag.txt然后python处理

三教奇妙夜

import cv2
from matplotlib import pyplot as plt

file = cv2.VideoCapture("output.mp4")
ret, preframe = file.read()

while True:
    ret, frame = file.read()
    if ret == 0:
        break
    diff = cv2.absdiff(preframe, frame).sum()
    if diff > 10000:
        print("diff: {}".format(diff))
        plt.imshow(frame)
        plt.show()
        preframe = frame