finish 4.5; add 6.2.2

src/Others/4.5_z3/exp.py

@@ -0,0 +1,42 @@
+from z3 import *
+
+solver = Solver()
+
+serial = [Int("serial[%d]" % i) for i in range(20)]
+
+solver.add(serial[15] + serial[4]  == 10)
+solver.add(serial[1]  * serial[18] == 2 )
+solver.add(serial[15] / serial[9]  == 1)
+solver.add(serial[17] - serial[0]  == 4)
+solver.add(serial[5]  - serial[17] == -1)
+solver.add(serial[15] - serial[1]  == 5)
+solver.add(serial[1]  * serial[10] == 18)
+solver.add(serial[8]  + serial[13] == 14)
+solver.add(serial[18] * serial[8]  == 5)
+solver.add(serial[4]  * serial[11] == 0)
+solver.add(serial[8]  + serial[9]  == 12)
+solver.add(serial[12] - serial[19] == 1)
+solver.add(serial[9]  % serial[17] == 7)
+solver.add(serial[14] * serial[16] == 40)
+solver.add(serial[7]  - serial[4]  == 1)
+solver.add(serial[6]  + serial[0]  == 6)
+solver.add(serial[2]  - serial[16] == 0)
+solver.add(serial[4]  - serial[6]  == 1)
+solver.add(serial[0]  % serial[5]  == 4)
+solver.add(serial[5]  * serial[11] == 0)
+solver.add(serial[10] % serial[15] == 2)
+solver.add(serial[11] / serial[3]  == 0)    # serial[3] can't be 0
+solver.add(serial[14] - serial[13] == -4)
+solver.add(serial[18] + serial[19] == 3)
+
+for i in range(20):
+    solver.add(serial[i] >= 0, serial[i] < 10)
+
+solver.add(serial[3] != 0)
+
+if solver.check() == sat:
+    m = solver.model()
+    for d in m.decls():
+        print("%s = %s" % (d.name(), m[d]))
+
+    print("".join([str(m.eval(serial[i])) for i in range(20)]))

src/Others/4.5_z3/harder_serial.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python
+# Looks like the serial number verification for space ships is similar to that
+# of your robot. Try to find a serial that verifies for this space ship
+
+import sys
+print ("Please enter a valid serial number from your RoboCorpIntergalactic purchase")
+if len(sys.argv) < 2:
+  print ("Usage: %s [serial number]"%sys.argv[0])
+  exit()
+  
+print ("#>" + sys.argv[1] + "<#")
+
+def check_serial(serial):
+  if (not set(serial).issubset(set(map(str,range(10))))):
+    print ("only numbers allowed")
+    return False
+  if len(serial) != 20:
+    return False
+  if int(serial[15]) + int(serial[4]) != 10:
+    return False
+  if int(serial[1]) * int(serial[18]) != 2:
+    return False
+  if int(serial[15]) / int(serial[9]) != 1:
+    return False
+  if int(serial[17]) - int(serial[0]) != 4:
+    return False
+  if int(serial[5]) - int(serial[17]) != -1:
+    return False
+  if int(serial[15]) - int(serial[1]) != 5:
+    return False
+  if int(serial[1]) * int(serial[10]) != 18:
+    return False
+  if int(serial[8]) + int(serial[13]) != 14:
+    return False
+  if int(serial[18]) * int(serial[8]) != 5:
+    return False
+  if int(serial[4]) * int(serial[11]) != 0:
+    return False
+  if int(serial[8]) + int(serial[9]) != 12:
+    return False
+  if int(serial[12]) - int(serial[19]) != 1:
+    return False
+  if int(serial[9]) % int(serial[17]) != 7:
+    return False
+  if int(serial[14]) * int(serial[16]) != 40:
+    return False
+  if int(serial[7]) - int(serial[4]) != 1:
+    return False
+  if int(serial[6]) + int(serial[0]) != 6:
+    return False
+  if int(serial[2]) - int(serial[16]) != 0:
+    return False
+  if int(serial[4]) - int(serial[6]) != 1:
+    return False
+  if int(serial[0]) % int(serial[5]) != 4:
+    return False
+  if int(serial[5]) * int(serial[11]) != 0:
+    return False
+  if int(serial[10]) % int(serial[15]) != 2:
+    return False
+  if int(serial[11]) / int(serial[3]) != 0:
+    return False
+  if int(serial[14]) - int(serial[13]) != -4:
+    return False
+  if int(serial[18]) + int(serial[19]) != 3:
+    return False
+  return True
+
+if check_serial(sys.argv[1]):
+  print ("Thank you! Your product has been verified!")
+else:
+  print ("I'm sorry that is incorrect. Please use a valid RoboCorpIntergalactic serial number")

src/writeup/6.2.2_re_ectf2016_tayy/tayy.c

@@ -0,0 +1,79 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int num2 = 0;
+
+static char *option2 = 
+"=============================================================\n1. Ayy lmao, Tayy lmao.\n2. You are very cruel.\n3. Memes are lyf.\n4. Go away!.\n5. zzzz\n6. Cats > Dogs.\n7. Dogs > Cats.\n8. AI is overrated?.\n9. I dont like you.\n0. <exit to menu>\n> ";
+
+static char *option1 = 
+"=============================================================\n1. Talk to Tayy.\n2. Flag?\n0. Exit.\n> ";
+
+void print_random_tayy_response() {
+  const char *a[5];
+  a[0] = "Die, human!";
+  a[1] = "You are mean.";
+  a[2] = "I disagree.";
+  a[3] = "I agree.";
+  a[4] = "I dont understand.";
+  
+  srand(time(NULL));
+  int r = rand()%5;
+
+  printf("Tayy: %s\n\n", a[r]);
+}
+
+void giff_flag (char *flg, int num1) {
+  // ASCII printable range 48-125
+  int i;
+  for (i=0;i<37;i++) {
+    switch (num2%2) {
+      case 0: flg[i] = (char) ((int)flg[i] + (num1*i)%37);
+              break;
+      case 1: flg[i] = (char) ((int)flg[i] - (num1*i)%37);
+              break;
+    }
+  }
+  num2++;
+}
+
+int main() {
+  // printf("========================");
+  // printf("Welcome to the chat-bot");
+
+  // ECTF{41_1S_D3f1n1t3lY_N0T_TH3_FuTUR3}
+  // 5146183
+  char buff[37];
+  char *flag = buff;
+
+  strcpy(flag, "EEXL\x83\x19\x18#\x1C@N5&[\x03g,q2H7?09:G>4!O]iJ('\nV");
+  int opt1, opt2;
+
+  printf("=============================================================\n");
+  printf("Welcome to the future of AI, developed by NIA Research, Tayy!\n");
+  
+  printf("%s", option1);
+  scanf("%d", &opt1);
+  while(opt1!=0) {
+    switch(opt1) {
+      case 1: printf("%s", option2);
+              scanf("%d", &opt2);
+              if (opt2 == 0)
+                break;
+              giff_flag(flag, opt2);
+              print_random_tayy_response();
+              break;
+      case 2: printf("Flag: %s\n", flag);
+              break;
+      default: printf("Please enter a correct option.\n"); 
+    }
+    if (num2 == 8) {
+      printf("Tayy is getting real tired of your bullshit. Leave now!.\n");
+      break;
+    }
+    printf("%s", option1);
+    scanf("%d", &opt1);
+  }
+  return 0;
+}