from pwn import *

def print_hex(s):
    h = ' '.join(s[i:i+2] for i in range(0, len(s), 2))
    print('{}: {}\n'.format(len(s)//2,h))
    return h
    
r = remote('prob05.geekgame.pku.edu.cn',10005)
print(r.recv(4096))

token = b'{your token}'
print('> ', token)
r.sendline(token)
d = r.recv(4096)
print_hex(d.hex())

payload  = bytes.fromhex('2a2a184230313030303030303633663639340a0a')
print('> ',payload)
r.send(payload)
d = r.recv(4096)
print_hex(d.hex())

#                         2a2a184230393030303030303030613837630a0a
payload  = bytes.fromhex('2a2a184230393030303030303030613837630a0a')
print('> ',payload)
r.send(payload)
d = r.recv(4096)
print_hex(d.hex())

print(d) # flag

from pwn import *

context.log_level = 'debug'
p = listen(7777)

with open('stream', 'r') as f:
    a = f.read()
    b = a.splitlines()

for i in b:
    if i == "":
        print(p.read(1024))
    else:
        p.send(unhex(i))
p.shutdown()
p.close()

from PIL import Image
from pathlib import Path
import binascii

threshold = 60
folder = "Videos/Captures/p/"

def calc(image, points):
    """
    return red glowing
    """
    result = 0
    for p in points:
        x,y = p
        r,g,b = image.getpixel((x,y))
        print(f"{x},{y}({r},{g},{b})",end=" ")
        if r > threshold:
            result += 1
    
    return result

# 要检查的点的坐标(x, y), 每个字符取了多个位置
checkp = [
    [(268,  690),(273,711)], # 0
    [(367,  690),(373,711)], # 1
    [(467,  690),(471,712)], # 2
    [(567,  690),(568,709)], # 3
    [(666,  690),(672,724)], # 4
    [(767,  696),(767,745)], # 5
    [(865,  677),(866,714)], # 6
    [(967,  680),(960,737)], # 7
    [(1065, 698),(1065,715)], # 8
    [(1165, 698),(1164,721)], # 9
    [(1264, 695),(1262,722)], # a
    [(1364, 695),(1361,722)], # b
    [(1464, 695),(1457,717)], # c
    [(1564, 695),(1555,736)], # d
    [(1663, 695),(1655,716)], # e
    [(1762, 698),(1756,724)], # f
]

hexb = [] # 二进制字节的十六进制数字字符
  
for n in range(9,3451): # 图片数量
    filename = Path(folder, '{}.bmp'.format(n))
    image = Image.open(filename)
    print(f"open {filename.name}")

    light = '' # light chars
    for i, points in enumerate(checkp):
        h = hex(i)[-1]
        result = calc(image, points)
        if result > 0:
            light += h
            print(f"{h} <{result}>")
        else:
            print(f"{h}")

    # every frame only get one light
    # one of two light must be previous one
    if len(light) == 0:
        print('[empty]')
    elif len(light) == 1:
        pass
    elif len(light) > 1:
        try:
            preb = hexb[-1]
        except IndexError:
            preb = ''
        print("light:{} preb:{}".format(light, preb))
        # 这一行依旧亮光，可能是上一个信号还未完全关闭，
        # 如果和上一个信号相同则去掉
        light = ''.join(set(light) - set(preb))

    # after clean lights left behind
    if len(light) == 1:
        hexb.append(light)
        print(f'choose: {light}')
    else:
        # 有一些异常发光的像素点需要去手动检查来调整坐标
        print('[break] pixel need check!!!', light)
        break
    print('\n')

  
# write result
png = ''.join(hexb)
print("PNG:{}: {}".format(len(png),png))
# 直接二进制写入图片得到
byte_array = binascii.a2b_hex(png)
with open('flag.png', 'wb') as f:
    f.write(byte_array)

import requests
import base64
import random
import re

X = '👚💈🐞👽💍🐜💉🐕💊👊🐒👠💂👾👰👔🐸🐘🐬👣👐🐺🐩💏👿👓🐲👇👉🐷👳💄🐧🐛💅👋💀🐥👱🐡👵🐽🐗🐓🐰👷👒👦🐚💎🐱🐝👅🐿👲🐦👫👜🐖👑🐶💃🐪🐻🐵🐾👏👁🐨👈🐤👘💌👝👧👼👞👭👛👺👖👎👃👻👍👸👀🐐💆💋👤🐭🐫👆🐮👩👗🐳👬🐼👹🐔🐹👯🐠👶🐴👌🐟🐯💁👴👡💇👟👪👨👕👥👄👢🐑👙🐙🐣👮🐢👂'

wordle = {
    '🟩': ['◽']*64,
    '🟨': set(),
    '🟥': set(),
    'session': 'x.aW5pdA==.x'
}

URL = "https://prob14.geekgame.pku.edu.cn/level3"
INTI_EMOJI = X[0:64]

def session_data(payload):
    return base64.b64decode(payload+'==').decode()

def print_wordle(w):
    print('🟨:{}{}'.format(''.join(w['🟨']), len(w['🟨'])))
    print('🟥:{}{}'.format(''.join(w['🟥']), len(w['🟥'])))
    print('🟩:{}{}'.format(''.join(w['🟩']), 64-w['🟩'].count('◽')))
    # print('JWT: ', session_data(w['session'].split('.')[1]))

def gen_wordle(placehold: list) -> list:
    x = set(X) - wordle['🟥']
    # x = x | wordle['🟨']
    # print("choice 1/{} {}".format(len(x),''.join(x)))
    for i, e in enumerate(wordle['🟩']):
        if e == '◽':
            if len(wordle['🟨']) == 0:
                placehold[i] = random.choice(list(x))
            else:
                placehold[i] = random.choice(list(x | wordle['🟨']))
        else:
            placehold[i] = e
    return placehold

def find_result(content) -> str or None:
    pattern = r'results.push\("(.*?)"'
    match = re.search(pattern, content)
    if match:
        return match.group(1)
    else:
        return None

def find_times(content):
    pattern = r'Number of guesses remaining: (\d+)'
    match = re.search(pattern, content)
    if match:
        return match.group(0)
    else:
        return None

def find_flag(content):
    pattern = r'flag{.+}'
    match = re.search(pattern, content)
    if match:
        return match.group(0)
    else:
        return None

# guess Emoji
for i in range(1000):
    print("try {}:".format(i+1))
    print_wordle(wordle)
    emoji = gen_wordle(list(INTI_EMOJI))
    print('🧠:{}'.format(''.join(emoji)))
    params = {'guess': ''.join(emoji)}
    cookies = dict(PLAY_SESSION=wordle['session'])
    r = requests.get(URL, params=params, cookies=cookies, timeout=10)
    if wordle['session'] == 'x.aW5pdA==.x' :
        wordle['session'] = r.cookies['PLAY_SESSION']    # update session!
    # get result
    result = find_result(r.text)
    if result == None:
        print(r.headers)
        print(r.text)
        exit()
    print('🌐:{}'.format(result))
    # get flag
    flag = find_flag(r.text)
    if flag:
        print(flag)
        exit()
    # Number of guesses remaining
    # print(find_times(r.text))

    # time.sleep(0.2)

    for i in range(64):
        n = result[i]
        e = emoji[i]
        if n == '🟩':
            wordle['🟩'][i] = e
        elif n == '🟨':
            wordle['🟨'].add(e)
        elif n == '🟥':
            wordle['🟥'].add(e)
        else:
            pass

print(r.cookies['PLAY_SESSION'])

def permutation(S: str) -> list[str]:
    # https://leetcode.cn/problems/permutation-ii-lcci/solutions/207054/python-3-bu-yong-setqu-zhong-zui-jian-dan-dai-ma-b/
    n=len(S)
    if n==0:
        return [""]
    res=[]
    for i in range(n):
        if S[i] in S[:i]:   #只需判断S[i]是否在S[:i]中出现过即可
            continue
        for s1 in permutation(S[:i]+S[i+1:]):
            res.append(S[i]+s1)
    return res

def calc(flag, target='1'):
    # print(flag, target)
    h = 1337
    for f in flag:
        if f == 'A':
            h = h*13337+11
        if f == 'E':
            h = h*13337+22
        if f == 'I':
            h = h*13337+33
        if f == 'O':
            h = h*13337+44
        if f == 'U':
            h = h*13337+55
        if f == '}':
            h = h*13337+66
    h = h % 19260817
    if h == target:
        print('\nget!!!!! ',flag, target)
    # else:
    #     # print(flag, end="")
    return h
if __name__ == '__main__': 
    chars = ['A']*6 + ['E']*3 + ['I'] + ['O']*6
    target = 7748521
    for p in permutation(chars):
        flag = ''.join(p)+'}'
        calc(flag, target)