prob 1#

1
ENC = 524288
2
SKIP = 9961472
3
STRIDE = SKIP + ENC
4
BUF = 1048576
5

6

7
def overwrite_pattern(f, offset, length):
8
    f.seek(offset)
9
    chunk = os.urandom(BUF)
10
    remaining = length
11
    while remaining > 0:
12
        n = min(BUF, remaining)
13
        f.write(chunk[:n])
14
        remaining -= n
15

16

17
def make_output_name(path):
18
    if not path.endswith(".records") and not path.endswith(".record_ids"):
19
        raise ValueError("not a .records or .record_ids file: " + path)
20
    return path + ".ENC"
21

22

23
def encrypt(path):
24
    out = make_output_name(path)
25
    shutil.copy2(path, out)
26
    size = os.path.getsize(out)
27

28
    with open(out, "r+b") as f:
29
        offset = 0
30
        while offset < size:
31
            offset += SKIP
32
            if offset >= size:
33
                break
34

35
            length = min(ENC, size - offset)
36
            overwrite_pattern(f, offset, length)
37
            offset += ENC
38

39
    return out

1
9961472 <= offset % 10485760 < 10485760

1
inode     : uint32
2
rec_len   : uint16
3
name_len  : uint8
4
file_type : uint8
5
name      : name_len 바이트

1
root
2
  home -> inode 16
3

4
home
5
  kyouki -> inode 121
6

7
home/kyouki
8
  .bash_logout
9
  .profile
10
  .bashrc
11
  .ssh
12
  .cache
13
  f -> inode 2548
14
  .sudo_as_admin_successful
15
  .bash_history

1
from __future__ import annotations
2

3
import re
4
import struct
5
import sys
6

7
from lzo1x_raw import decompress
8

9

10
SLOT = 0x4000
11
SECTOR = 0x200
12
SCAN_START = 0x6700000
13
SCAN_END = 0x6810000
14

15
ENC = 524288
16
SKIP = 9961472
17
STRIDE = 10485760
18

19

20
def corrupt(offset: int) -> bool:
21
    rel = offset % STRIDE
22
    return SKIP <= rel < SKIP + ENC
23

24

25
def align_sector(n: int) -> int:
26
    return (n + SECTOR - 1) & ~(SECTOR - 1)
27

28

29
def valid_name(name: bytes) -> bool:
30
    if not name or name in (b".", b".."):
31
        return True
32
    if b"\x00" in name or b"/" in name:
33
        return False
34
    return all(32 <= b < 127 for b in name)
35

36

37
def parse_dir_block(block: bytes):
38
    entries = []
39
    pos = 0
40

41
    while pos + 8 <= len(block):
42
        inode, rec_len, name_len, file_type = struct.unpack_from("<IHBB", block, pos)
43
        if rec_len < 8 or rec_len % 4 or pos + rec_len > len(block):
44
            return None
45

46
        if inode:
47
            if name_len > rec_len - 8 or file_type > 7:
48
                return None
49
            name = block[pos + 8 : pos + 8 + name_len]
50
            if not valid_name(name):
51
                return None
52
            entries.append((inode, file_type, name))
53
        else:
54
            if not (rec_len == 12 and name_len == 0 and file_type in (0, 0xDE)):
55
                return None
56

57
        pos += rec_len
58

59
    return entries if pos == len(block) else None
60

61

62
def collect_directories(records_path: str):
63
    dirs = {}
64

65
    with open(records_path, "rb") as f:
66
        slot = SCAN_START - (SCAN_START % SLOT)
67
        while slot < SCAN_END:
68
            if corrupt(slot):
69
                slot += SLOT
70
                continue
71

72
            f.seek(slot)
73
            buf = f.read(SLOT + 0x3000)
74
            rel = 4
75

76
            while rel < SLOT and rel + 16 <= len(buf):
77
                offset = slot + rel
78
                if (
79
                    offset < SCAN_START
80
                    or offset >= SCAN_END
81
                    or corrupt(offset)
82
                    or buf[rel : rel + 16].count(0) == 16
83
                ):
84
                    rel += SECTOR
85
                    continue
86

87
                try:
88
                    res = decompress(buf[rel:], max_out=8192)
89
                except Exception:
90
                    rel += SECTOR
91
                    continue
92

93
                if res.eof and len(res.output) == 8192:
94
                    for base in (0, 4096):
95
                        entries = parse_dir_block(res.output[base : base + 4096])
96
                        if (
97
                            not entries
98
                            or len(entries) < 2
99
                            or entries[0][2] != b"."
100
                            or entries[1][2] != b".."
101
                        ):
102
                            continue
103

104
                        inode = entries[0][0]
105
                        children = entries[2:]
106
                        if inode not in dirs or len(children) > len(dirs[inode]):
107
                            dirs[inode] = children
108

109
                    rel += align_sector(res.consumed + 4)
110
                else:
111
                    rel += SECTOR
112

113
            slot += SLOT
114

115
    return dirs
116

117

118
def find_child(dirs, parent: int, name: bytes) -> int:
119
    for inode, _file_type, child_name in dirs[parent]:
120
        if child_name == name:
121
            return inode
122
    raise RuntimeError(f"missing child {name!r}")
123

124

125
def recover_message(records_path: str) -> str:
126
    dirs = collect_directories(records_path)
127

128
    home = find_child(dirs, 2, b"home")
129
    user = find_child(dirs, home, b"kyouki")
130
    current = find_child(dirs, user, b"f")
131

132
    parts = ["f"]
133
    seen = set()
134

135
    while current not in seen:
136
        seen.add(current)
137
        children = dirs.get(current, [])
138
        if not children:
139
            break
140
        if len(children) != 1:
141
            raise RuntimeError(f"unexpected branch at inode {current}")
142

143
        current, _file_type, name = children[0]
144
        parts.append(name.decode("latin1"))
145

146
    return "".join(parts)
147

148

149
def main() -> int:
150
    message = recover_message(sys.argv[1])
151
    match = re.search(r"HS\{[^}]+\}", message)
152
    if not match:
153
        raise RuntimeError(f"flag not found in {message!r}")
154

155
    print(message)
156
    print(match.group(0))
157
    return 0
158

159

160
if __name__ == "__main__":
161
    raise SystemExit(main())

1
flag is HS{d0c0cb460720e6f21de1dccfeb34cab91d1c4990dbf3452f5a9a2095b9430fae}
2
HS{d0c0cb460720e6f21de1dccfeb34cab91d1c4990dbf3452f5a9a2095b9430fae}

1
HS{d0c0cb460720e6f21de1dccfeb34cab91d1c4990dbf3452f5a9a2095b9430fae}