THCTT24_running_number: init

THCTT24_running_number/bruteforce.c

@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+// This is da bruteforce code to get the right random seed
+
+int main(void) {
+    int seed;
+    long sum;
+    int rand_var;
+    int i;
+    int md5_answer;
+    
+    for (seed = 0; seed <= 1000000000;seed++) {
+        srand(seed);
+        sum = 0;
+        for (i = 0xa07; i > 0x7e7; i--) { // 2567 2023
+            if (i % 3 != 0) {
+                rand_var = rand();
+                sum = sum + rand_var;
+            }
+        }
+        printf("%u\n", seed);
+
+        if (sum == 0x5aad48bfa6) { // 389454282662
+            printf("THCTT24{");
+            for (i = 10; i < 0x4a; i++) { // 74
+                if ((i & 1) == 0) {
+                    rand_var = rand();
+                    md5_answer = rand_var % 0x10; // 16
+                    printf("%x", md5_answer);
+                }
+            }
+            puts("}\n");
+            printf("Seed -> %d\n", seed);
+            break;
+        }
+    }
+}

THCTT24_running_number/rewrite/running_number_rewrite.c

@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+// This is rewrite of 'running_number' with help from ghidra
+// while ensuring the integrity of program flows and so on
+
+int main(void) {
+    int seed;
+    int rand_var;
+    int i;
+    int md5_answer;
+    
+    printf("Time: ");
+    scanf("%u", &seed);
+    srand(seed);
+
+    long sum = 0;
+
+    for (i = 0xa07; i > 0x7e7; i--) { // 2567 2023
+        if (i % 3 != 0) {
+            rand_var = rand();
+            sum = sum + rand_var;
+        }
+    }
+
+    if (sum == 0x5aad48bfa6) { // 389454282662
+        printf("THCTT24{");
+        for (i = 10; i < 0x4a; i++) { // 74
+            if ((i & 1) == 0) {
+                rand_var = rand();
+                md5_answer = rand_var % 0x10;
+                printf("%x", md5_answer); // 16
+            }
+        }
+    puts("}");
+    } else {
+        puts("No Flag");
+    }
+}