diff --git a/THCTT24_running_number/bruteforce.c b/THCTT24_running_number/bruteforce.c new file mode 100644 index 0000000..1d4d55c --- /dev/null +++ b/THCTT24_running_number/bruteforce.c @@ -0,0 +1,38 @@ +#include +#include + +// This is da bruteforce code to get the right random seed + +int main(void) { + int seed; + long sum; + int rand_var; + int i; + int md5_answer; + + for (seed = 0; seed <= 1000000000;seed++) { + srand(seed); + sum = 0; + for (i = 0xa07; i > 0x7e7; i--) { // 2567 2023 + if (i % 3 != 0) { + rand_var = rand(); + sum = sum + rand_var; + } + } + printf("%u\n", seed); + + if (sum == 0x5aad48bfa6) { // 389454282662 + printf("THCTT24{"); + for (i = 10; i < 0x4a; i++) { // 74 + if ((i & 1) == 0) { + rand_var = rand(); + md5_answer = rand_var % 0x10; // 16 + printf("%x", md5_answer); + } + } + puts("}\n"); + printf("Seed -> %d\n", seed); + break; + } + } +} \ No newline at end of file diff --git a/THCTT24_running_number/original/running_number b/THCTT24_running_number/original/running_number new file mode 100755 index 0000000..e091404 Binary files /dev/null and b/THCTT24_running_number/original/running_number differ diff --git a/THCTT24_running_number/rewrite/running_number_rewrite.c b/THCTT24_running_number/rewrite/running_number_rewrite.c new file mode 100644 index 0000000..1a55114 --- /dev/null +++ b/THCTT24_running_number/rewrite/running_number_rewrite.c @@ -0,0 +1,39 @@ +#include +#include + +// This is rewrite of 'running_number' with help from ghidra +// while ensuring the integrity of program flows and so on + +int main(void) { + int seed; + int rand_var; + int i; + int md5_answer; + + printf("Time: "); + scanf("%u", &seed); + srand(seed); + + long sum = 0; + + for (i = 0xa07; i > 0x7e7; i--) { // 2567 2023 + if (i % 3 != 0) { + rand_var = rand(); + sum = sum + rand_var; + } + } + + if (sum == 0x5aad48bfa6) { // 389454282662 + printf("THCTT24{"); + for (i = 10; i < 0x4a; i++) { // 74 + if ((i & 1) == 0) { + rand_var = rand(); + md5_answer = rand_var % 0x10; + printf("%x", md5_answer); // 16 + } + } + puts("}"); + } else { + puts("No Flag"); + } +} \ No newline at end of file