Flare-on 2025 Writeup

def GenerateFlagText(sum):
   key = sum >> 8
   encoded = "\xd0\xc7\xdf\xdb\xd4\xd0\xd4\xdc\xe3\xdb\xd1\xcd\x9f\xb5\xa7\xa7\xa0\xac\xa3\xb4\x88\xaf\xa6\xaa\xbe\xa8\xe3\xa0\xbe\xff\xb1\xbc\xb9"
   plaintext = []
   for i in range(0, len(encoded)):
       plaintext.append(chr(ord(encoded[i]) ^ (key+i)))
   return ''.join(plaintext)

if player.hitBear():
               player.drill.retract()
               bear_sum *= player.x
               bear_mode = True

if bear_mode:
  screen.blit(bearimage, (player.rect.x, screen_height - tile_size))
  if current_level == len(LevelNames) - 1 and not victory_mode:
    victory_mode = True
    flag_text = GenerateFlagText(bear_sum)
    print("Your Flag: " + flag_text)

## copy paste from src code
def GenerateFlagText(sum_value):
   key = sum_value >> 8
   encoded = "\xd0\xc7\xdf\xdb\xd4\xd0\xd4\xdc\xe3\xdb\xd1\xcd\x9f\xb5\xa7\xa7\xa0\xac\xa3\xb4\x88\xaf\xa6\xaa\xbe\xa8\xe3\xa0\xbe\xff\xb1\xbc\xb9"
   plaintext = []
   for i in range(len(encoded)):
       plaintext.append(chr(ord(encoded[i]) ^ (key + i)))
   return "".join(plaintext)

bear_sum = 1

for name in ["California", "Ohio", "Death Valley", "Mexico", "The Grand Canyon"]:
   bear_sum *= len(name)

print(GenerateFlagText(bear_sum))

import zlib
import marshal

# These are my encrypted instructions for the Sequencer.
encrypted_sequencer_data = b'x\....'

print(f"Booting up {f"Project Chimera"} from Dr. Khem's journal...")
# Activate the Genetic Sequencer. From here, the process is automated.
sequencer_code = zlib.decompress(encrypted_sequencer_data)

### (EXTRACT sequencer_code)
### print(sequencer_code)

exec(marshal.loads(sequencer_code))

(HEADER)
b"\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00...

(BYTE CODE)
c$|e+O>7&-6`m!Rzak~llE|2<;!(^*VQn#qEH||......

(LOAD_CONST)
--- Calibrating Genetic Sequencer ---....

(METADATA)

--- Calibrating Genetic Sequencer ---
z\x1fDecoding catalyst DNA strand...
z\x1eSynthesizing Catalyst Serum...)
\x0f\xda\x06base64
\xda\x04zlib
\xda\x07marshal
\xda\x05types
\xda\x17encoded_catalyst_strand
\xda\x05print
\xda\tb85decode
\xda\x13compressed_catalyst
\xda\ndecompress
\xda\x17marshalled_genetic_code
\xda\x05loads
\xda\x14catalyst_code_object
\xda\x0cFunctionType
\xda\x07globals
\xda\x1bcatalyst_injection_function\xa9\x00\xf3\x00\x00\x00\x00\xfa\x13<genetic_sequencer>\xda\x08<module>

import base64
import zlib
import marshal

encoded = "c$|e+O>7....Hooz%"
decoded = base64.b85decode(encoded)
decompressed = zlib.decompress(decoded)
code = marshal.loads(decompressed)
# print(decompressed) --> 基本上這個丟到GPT就可以三秒解完了
dis.dis(code)

16           6 LOAD_CONST               1 (b'm\x1b@I\x1dAoe@\x07ZF[BL\rN\n\x0cS')
             8 STORE_FAST               0 (LEAD_RESEARCHER_SIGNATURE)

17          10 LOAD_CONST               2 (b'r2b-\r\x9e\xf2\x1fp\x185\x82\xcf\xfc\x90\x14\xf1O\xad#]\xf3\xe2\xc0L\xd0\xc1e\x0c\xea\xec\xae\x11b\xa7\x8c\xaa!\xa1\x9d\xc2\x90')
            12 STORE_FAST               1 (ENCRYPTED_CHIMERA_FORMULA)

25         126 LOAD_GLOBAL              9 (NULL + bytes)
           136 LOAD_CONST               5 (<code object <genexpr> at 0x000002A0BC7A4830, file "<catalyst_core>", line 25>)
           138 MAKE_FUNCTION            0
           140 LOAD_GLOBAL             11 (NULL + enumerate)
           150 LOAD_FAST                2 (current_user)
           152 CALL                     1
           160 GET_ITER
           162 CALL                     0
           170 CALL                     1
           178 STORE_FAST               3 (user_signature)

20 LOAD_FAST                2 (c)
22 LOAD_FAST                1 (i)
24 LOAD_CONST               0 (42)
26 BINARY_OP                0 (+)
30 BINARY_OP               12 (^)

37         354 LOAD_GLOBAL             21 (NULL + ARC4)
           364 LOAD_FAST                2 (current_user)
           366 CALL                     1
           374 STORE_FAST               5 (arc4_decipher)

from arc4 import ARC4

LEAD_RESEARCHER_SIGNATURE = b"m\x1b@I\x1dAoe@\x07ZF[BL\rN\n\x0cS"
ENCRYPTED_CHIMERA_FORMULA = b"r2b-\r\x9e\xf2\x1fp\x185\x82\xcf\xfc\x90\x14\xf1O\xad#]\xf3\xe2\xc0L\xd0\xc1e\x0c\xea\xec\xae\x11b\xa7\x8c\xaa!\xa1\x9d\xc2\x90"

## XOR current user
username = bytes(c ^ (i + 42) for i, c in enumerate(LEAD_RESEARCHER_SIGNATURE))
print(username)
print(ARC4(username).decrypt(ENCRYPTED_CHIMERA_FORMULA))

 0           BINARY_OP                0 (+)
             POP_JUMP_IF_TRUE         1 (to L1)
             LOAD_FROM_DICT_OR_GLOBALS 0 (base64)

 3   L1:     POP_JUMP_IF_TRUE         0 (to L2)
     L2:     STORE_ATTR               1 (zlib)
             LOAD_FROM_DICT_OR_GLOBALS 2 (marshal)

 5           POP_JUMP_IF_TRUE         0 (to L3)
     L3:     STORE_ATTR               3 (types)
             RAISE_VARARGS            5
             POP_JUMP_IF_TRUE         3 (to L4)
...

%PDF-2.0
%SNDHNRO0
RE~^
% Hey there! Welcome to this source...
% Tested under the following browsers:
% Chrome, Safari, PDFjs (Firefox)
1       0       obj     <<
% N0t_a_flag_but_just_a_line_comment
/Pages  2       0       R/Type/Catalog/Extensions       <</ADBE <</BaseVersion/1.7/ExtensionLevel       8>>>>>>endobj
% 2 0 obj
% <<>>
% endobj
3 0 obj
 /Contents 4 0 R
 /Parent 2 0 R
 /Resources 6 0 R
 /Type /Page
 /MediaBox [0 0 612 130]
endobj
2 0 obj
 /Count 1
 /Kids [
   3 0 R
 /Type /Pages
endobj
% 2 0 obj
% <<>>
% endobj
4 0 obj
<</Length 320/Filter /FlateDecode>>stream
...

%PDF-2.0
%QDF-1.0
%% Original object ID: 1 0
1 0 obj
<SNIP>
2 0 obj
<SNIP>
3 0 obj
<SNIP>
4 0 obj
<SINP>
ffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0000b080001002501011100ffc40017000100030000000000000000000000000006040708ffc400241000000209050100000000000000000000000702050608353776b6b7030436747577ffda0008010100003f00c54d3401dcbbfb9c38db8a7dd265a2159e9d945a086407383aabd52e5034c274e57179ef3bcdfca50f0af80aff00e986c64568c7ffd9
<SNIP>
(Flare-On!)'
endstream
<SNIP>
%%EOF

Encoding Process                : Baseline DCT, Huffman coding
Image Size                      : 37x1

from PIL import Image

img = Image.open('extracted.jpg')
pixels = list(img.getdata())

### print(pixels)
## [80, 117, 122, 122, 108, 49, 110, 103, 45, 68, 51, 118, 105, 108, 105, 115, 104, 45, 70, 48, 114, 109, 97, 116, 64, 102, 108, 97, 114, 101, 45, 111, 110, 46, 99, 111, 109]

ascii_str = ''.join(chr(p) for p in pixels)
print(ascii_str)

┌──(kali㉿kali)-[/media/sf_SHARED_FILE/flareon/04/origional]
└─$ tail -c 2000 ../UnholyDragon-150.exe | strings
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity
     type="win32"
     processorArchitecture="*"
     name="My_twinBASIC_Application"
     version="1.0.0.0"
  />
</assembly>

D:\a\_work\1\s\binaries\amd64ret\inc\optional
D:\a\_work\1\s\src\vctools\crt\vcruntime\src\eh\std_type_info.cpp
D:\a\_work\1\s\src\vctools\crt\vcruntime\src\internal\per_thread_data.cpp
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp
minkernel\crts\ucrt\src\appcrt\stdio\_file.cpp
https://www.youtube.com/watch?v=dQw4w9WgXcQ&list=RDdQw4w9WgXcQ
C:\\Users\\flare\\Desktop\\challenge\\main.pdb

0x14000ca2f: cmp  qword [rsp+0x58d38], 0x1629c          ; state vs upper bound (90780)
0x14000ca3b: ja   default
0x14000ca41: lea  rax, [rip - 0xca48]                   ; rax = 0x140000000 (image base)
0x14000ca50: mov  ecx, dword [rax + rcx*4 + 0xc687b8]   ; table @ base+0xc687b8, 4-byte entries
0x14000ca57: add  rcx, rax                              ; handler = entry + base (relative offset)
0x14000ca5a: jmp  rcx

Python>si = idaapi.get_switch_info(0x14000CA5A)
Python>print(si)
<ida_nalt.switch_info_t; proxy of <Swig Object of type 'switch_info_t *' at 0x0000022736ECA520> >
Python>idaapi.calc_switch_cases(0x14000CA5A, si)
<ida_xref.cases_and_targets_t; proxy of <Swig Object of type 'cases_and_targets_t *' at 0x0000022736EACCC0> >

## case 數量(這邊有坑 不應該是65535(0xffff))
Python>si.ncases
0xffff
Python>si.jumps
0x140c687b8
Python>si.get_jtable_element_size()
0x4
Python>si.elbase
0x140000000

#   Handler pattern:
#       rdtsc spin-loop  (anti-timing, skipped)
#       movzx eax, [rsp+0x30]              ; load input char
#       cmp   [rsp+tmp], <CHAR>            ; compare
#       je    <target>                     ; -> mov [rsp+0x58d30], <NEXT_STATE>
#       ...
#       jmp   <fail/dispatch>              ; end of cmp chain


def parse_handler(rva):
    try:
        file_off = pe.get_offset_from_rva(rva)
    except Exception:
        return {}

    code     = pe.__data__[file_off : file_off + 0x400]
    # read a reasonable chunk of code
    # 400-1000 bytes should be enough to cover the whole cmp chain
    insns    = list(md.disasm(code, BASE + rva))
    addr_map = {ins.address: ins for ins in insns}

    transitions, prev = {}, None
    for ins in insns:
        if ins.mnemonic == "jmp":      # 結束條件
            break

        if ins.mnemonic in ("je", "jz") and prev and prev.mnemonic == "cmp":
        #  pattern = je/jz，而且前一行是 cmp
            ops = prev.operands
            if len(ops) >= 2 and ops[1].type == X86_OP_IMM:
                cv = ops[1].imm & 0xFF
                if 0x20 <= cv <= 0x7E:                 # check printable ASCII
                    tgt = ins.operands[0].imm       # de-ref je/jz target addr
                    mov = addr_map.get(tgt)            # je lands on the state-store mov
                    if mov and mov.mnemonic == "mov" and len(mov.operands) >= 2:
                        ns = mov.operands[1].imm & 0xFFFFFFFF  # save state value
                        transitions[chr(cv)] = ns
        prev = ins

    return transitions

def build_graph(jmp_tbl):
    graph, visited, queue = {}, set(), deque([0])
    while queue:
        sid = queue.popleft()

        if sid in visited:
            continue
        visited.add(sid)

        rva = jmp_tbl[sid] if sid < len(jmp_tbl) else 0
        trans = parse_handler(rva) if rva else {}
        graph[sid] = trans

        for ns in trans.values():
            if ns not in visited and ns < len(jmp_tbl):   # only enqueue real states
                queue.append(ns)

    nonempty = sum(1 for v in graph.values() if v)
    print("[*] graph built: %d reachable states, %d with transitions" % (len(graph), nonempty))
    return graph

{
  "0": {
    "J": 2,
    "U": 3,
    "i": 1
  },
  "2": {
    "Y": 6
  },
  "3": {
    "P": 7,
    "Z": 8
  },
  "1": {
    "L": 4,
    "q": 5
  }
  }

def solve(graph, depth=FLAG_LEN):
    queue = deque([(0, "")])
    while queue:
        state, path = queue.popleft()
        if len(path) == depth: # len = 16
            return path
        for ch, ns in graph.get(state, {}).items():
            queue.append((ns, path + ch))

#!/usr/bin/env python3
"""
uv run --with pefile --with capstone python solve_ntfsm.py
"""
import pefile, struct, json
import os
from capstone import *
from capstone.x86 import X86_OP_IMM
from collections import deque

# ── Config ────────────────────────────────────────────────────────────────────
BINARY    = "ntfsm.exe"
BASE      = 0x140000000      # PE ImageBase
JTABLE_VA = 0x140C687B8      # switch jump table (from IDA: jmp rcx @ 0x14000CA5A)
NCASES    = 90781            # switch case count
FLAG_LEN  = 16               # password length (trie depth)
MAP_JSON  = "map.json"

pe = pefile.PE(BINARY)
md = Cs(CS_ARCH_X86, CS_MODE_64)
md.detail = True


# ── 1. Load the 90781-entry jump table (4-byte relative offsets) ───────────────
def load_jump_table():
    off = pe.get_offset_from_rva(JTABLE_VA - BASE)
    tbl = [struct.unpack_from("<I", pe.__data__, off + i * 4)[0] for i in range(NCASES)]
    print("[*] jump table loaded: %d entries (handler[0] @ rva 0x%x)" % (len(tbl), tbl[0]))
    return tbl


# ── 2. Parse one handler -> {char: next_state} ─────────────────────────────────
#   Handler pattern:
#       rdtsc spin-loop  (anti-timing, skipped)
#       movzx eax, [rsp+0x30]              ; load input char
#       cmp   [rsp+tmp], <CHAR>            ; compare
#       je    <target>                     ; -> mov [rsp+0x58d30], <NEXT_STATE>
#       ...
#       jmp   <fail/dispatch>              ; end of cmp chain
def parse_handler(rva):
    try:
        file_off = pe.get_offset_from_rva(rva)
    except Exception:
        return {}

    code     = pe.__data__[file_off : file_off + 0x800] # read a reasonable chunk of code 400-1000 bytes should be enough to cover the whole cmp chain
    insns    = list(md.disasm(code, BASE + rva))
    addr_map = {ins.address: ins for ins in insns}

    transitions, prev = {}, None
    for ins in insns:
        if ins.mnemonic == "jmp":      # unconditional jump = end of cmp chain
            break

        if ins.mnemonic in ("je", "jz") and prev and prev.mnemonic == "cmp":
            ops = prev.operands
            if len(ops) >= 2 and ops[1].type == X86_OP_IMM:
                cv = ops[1].imm & 0xFF
                if 0x20 <= cv <= 0x7E:                 # printable ASCII
                    tgt = ins.operands[0].imm
                    mov = addr_map.get(tgt)            # je lands on the state-store mov
                    if mov and mov.mnemonic == "mov" and len(mov.operands) >= 2:
                        ns = mov.operands[1].imm & 0xFFFFFFFF
                        transitions[chr(cv)] = ns
        prev = ins

    return transitions


# ── 3. BFS-build the reachable state graph ─────────────────────────────────────
def build_graph(jmp_tbl):
    graph, visited, queue = {}, set(), deque([0])
    while queue:
        sid = queue.popleft()
        if sid in visited:
            continue
        visited.add(sid)

        rva = jmp_tbl[sid] if sid < len(jmp_tbl) else 0
        trans = parse_handler(rva) if rva else {}
        graph[sid] = trans

        for ns in trans.values():
            if ns not in visited and ns < len(jmp_tbl):   # only enqueue real states
                queue.append(ns)

    nonempty = sum(1 for v in graph.values() if v)
    print("[*] graph built: %d reachable states, %d with transitions" % (len(graph), nonempty))
    return graph


# ── 4. BFS for the exact-length path ───────────────────────────────────────────
def solve(graph, depth=FLAG_LEN):
    queue = deque([(0, "")])
    while queue:
        state, path = queue.popleft()
        if len(path) == depth:
            return path
        for ch, ns in graph.get(state, {}).items():
            queue.append((ns, path + ch))
    return None


# ── Main ────────────────────────────────────────────────────────────────────────
if __name__ == "__main__":
    # map exist
    if os.path.exists(MAP_JSON):
        print("[*] Json exist, loading %s" % MAP_JSON)
        with open(MAP_JSON, "r") as f:
            raw_map = json.load(f)
            graph = {int(k): v for k, v in raw_map.items()}
        print("[+] Loaded！include %d reachable state。" % len(graph))
    else:
        print("[*] Guilding Graph")
        jmp_tbl = load_jump_table()
        graph   = build_graph(jmp_tbl)

        with open(MAP_JSON, "w") as f:
            json.dump({str(k): v for k, v in graph.items()}, f, indent=2)
        print("[*] FSM map saved -> %s" % MAP_JSON)

    print("[+] ===BFS...===")
    pw = solve(graph)

    print("=" * 64)
    if pw:
        print("[+] PASSWORD (%d chars): %s" % (len(pw), pw))
    else:
        print("[!] no %d-char path found" % FLAG_LEN)
    print("=" * 64)

## 把 LCG 部署到 blockchain
self.deployed_contract = SmartContracts.deploy_contract(...)

## 呼叫 smart contract 計算下一個 LCG 值
self.state = self.deployed_contract.functions.nextVal(...).call()

ciphertext = self.deployed_contract.functions.encrypt(prime_from_lcg, conversation_time, plaintext_bytes).call()

def _get_system_artifact_hash(self):
  artifact = platform.node().encode('utf-8')
  hash_val = hashlib.sha256(artifact).digest()
  seed_hash = int.from_bytes(hash_val, 'little')
  print(f'[SETUP]  - Generated Seed {seed_hash}...')
  return seed_hash

def _generate_primes_from_hash(self, seed_hash):
  primes = []
  current_hash_byte_length = (seed_hash.bit_length() + 7) // 8
  current_hash = seed_hash.to_bytes(current_hash_byte_length, 'little')
  print('[SETUP] Generating LCG parameters from system artifact...')
  iteration_limit = 10000
  iterations = 0
  while len(primes) < 3 and iterations < iteration_limit:
    current_hash = hashlib.sha256(current_hash).digest()
    candidate = int.from_bytes(current_hash, 'little')
    iterations += 1
    if candidate.bit_length() == 256 and isPrime(candidate):
      primes.append(candidate)
      print(f'[SETUP]  - Found parameter {len(primes)}: {str(candidate)[:20]}...')
  if len(primes) < 3:
    error_msg = '[!] Error: Could not find 3 primes within iteration limit.'
    print('Current Primes: ', primes)
    print(error_msg)
    exit()
  return (primes[0], primes[1], primes[2])

[
  {
    "conversation_time": 0,
    "mode": "LCG-XOR",
    "plaintext": "Hello",
    "ciphertext": "e934b27119f12318fe16e8cd1c1678fd3b0a752eca163a7261a7e2510184bbe9"
  },
  <SNIP 6 other LCG-XOR cipher>
  {
    "conversation_time": 242,
    "mode": "RSA",
    "plaintext": "[ENCRYPTED]",
    "ciphertext": "680a65364a498aa87cf17c934ab308b2aee0014aee5b0b7d289b5108677c7ad1eb3bcfbcad7582f87cb3f242391bea7e70e8c01f3ad53ac69488713daea76bb3a524bd2a4bbbc2cfb487477e9d91783f103bd6729b15a4ae99cb93f0db22a467ce12f8d56acaef5d1652c54f495db7bc88aa423bc1c2b60a6ecaede2f4273f6dce265f6c664ec583d7bd75d2fb849d77fa11d05de891b5a706eb103b7dbdb4e5a4a2e72445b61b83fd931cae34e5eaab931037db72ba14e41a70de94472e949ca3cf2135c2ccef0e9b6fa7dd3aaf29a946d165f6ca452466168c32c43c91f159928efb3624e56430b14a0728c52f2668ab26f837120d7af36baf48192ceb3002"
  },
  {
    "conversation_time": 249,
    "mode": "RSA",
    "plaintext": "[ENCRYPTED]",
    "ciphertext": "6f70034472ce115fc82a08560bd22f0e7f373e6ef27bca6e4c8f67fedf4031be23bf50311b4720fe74836b352b34c42db46341cac60298f2fa768f775a9c3da0c6705e0ce11d19b3cbdcf51309c22744e96a19576a8de0e1195f2dab21a3f1b0ef5086afcffa2e086e7738e5032cb5503df39e4bf4bdf620af7aa0f752dac942be50e7fec9a82b63f5c8faf07306e2a2e605bb93df09951c8ad46e5a2572e333484cae16be41929523c83c0d4ca317ef72ea9cde1d5630ebf6c244803d2dc1da0a1eefaafa82339bf0e6cf4bf41b1a2a90f7b2e25313a021eafa6234643acb9d5c9c22674d7bc793f1822743b48227a814a7a6604694296f33c2c59e743f4106"
  }
]

 if self.super_safe_mode and self.rsa_key:
  plaintext_bytes = plaintext.encode('utf-8')
  plaintext_enc = bytes_to_long(plaintext_bytes)
  _enc = pow(plaintext_enc, self.rsa_key.e, self.rsa_key.n)
  ciphertext = _enc.to_bytes(self.rsa_key.n.bit_length(), 'little').rstrip(b'\x00')
  encryption_mode = 'RSA'
  plaintext = '[ENCRYPTED]'

import json, math
from sympy import isprime
from functools import reduce

data = json.load(open("chat_client_extracted/chat_log.json"))

# 1. ciphertext = primeFromLcg XOR conversationTime XOR plaintext_word
states = []
for e in data:
    if e["mode"] != "LCG-XOR":
        continue
    ct = int(e["ciphertext"], 16)
    pt_word = int.from_bytes(e["plaintext"].encode().ljust(32, b"\x00"), "big")
    states.append(ct ^ e["conversation_time"] ^ pt_word)

# 2. Crack LCG
diffs  = [b - a for a, b in zip(states, states[1:])]
zeroes = [t2*t0 - t1*t1 for t0, t1, t2 in zip(diffs, diffs[1:], diffs[2:])]
N = reduce(math.gcd, zeroes)
M = (states[2]-states[1]) * pow(states[1]-states[0], -1, N) % N
C = (states[1] - M*states[0]) % N
assert all((M*states[i]+C) % N == states[i+1] for i in range(len(states)-1))

# 3. Extend the stream and collect 256-bit primes (RSA factors)
cands = list(states)
while sum(isprime(p) and p.bit_length() == 256 for p in cands) < 8 and len(cands) < 200:
    cands.append((M*cands[-1] + C) % N)
primes = [p for p in cands if isprime(p) and p.bit_length() == 256][:8]

n = math.prod(primes)
phi = math.prod(p-1 for p in primes)
d = pow(65537, -1, phi)

for ent in data:
    if ent["mode"] != "RSA":
        continue
    c = int.from_bytes(bytes.fromhex(ent["ciphertext"]), "little")  # stored little-endian
    m = pow(c, d, n)
    print(m.to_bytes((m.bit_length()+7)//8, "big"))