Bomb

解压之后还是解压。大概两百层。密码只存在某个文件里长度为 24。写个脚本筛选一下

import zipfile
import io
for i in range(100):

    password = open("Password.txt", "rb").read()
    print(password)
    zip_file = zipfile.ZipFile(io.BytesIO(open("nextlevel.zip","rb").read()))

    for file in zip_file.filelist:
        if file.compress_size == 24:
            zip_file.extract(file, pwd=password)
            
        if file.filename.endswith(".zip"):
            print(file.file_size)
            zip_file.extract(file, pwd=password)

        if file.filename == "flag.txt":
            zip_file.extract(file, pwd=password)
            print(open("flag.txt","r").read())
            exit(0)

Special Signal

信号的实部和虚部都是+-1/sqrt(2)。可能是 QPSK 编码？

确实是，用 complex64 加载出来，然后写个脚本变成00/01/11/10即可。赛后看了 wp 才知道有个 xor key。想不到啊。

import numpy as np

data = np.load("satelite.iq",np.complex64)
symbol_map = {
    (0, 0): 1/np.sqrt(2) + 1j/np.sqrt(2),  # e^(j * π/4)
    (0, 1): -1/np.sqrt(2) + 1j/np.sqrt(2), # e^(j * 3π/4)
    (1, 1): -1/np.sqrt(2) - 1j/np.sqrt(2), # e^(j * 5π/4)
    (1, 0): 1/np.sqrt(2) - 1j/np.sqrt(2)  # e^(j * 7π/4)
}

reverse_map = {v: k for k, v in symbol_map.items()}

def qpsk_decode(symbols):
    bits = []
    for symbol in symbols:
        closest_symbol = min(reverse_map.keys(), key=lambda x: abs(x - symbol))
        bits.extend(reverse_map[closest_symbol])
    return bits


data = qpsk_decode(data)

data = "".join(str(x) for x in data)
😅

？官方 wp 也是一坨

CAN

第一段和第二段直接 xor。

lines = open("candump.log").readlines()

lines = [line.split(" ") for line in lines]

data = [line[2].split("#")[-1].strip() for line in lines]

tt = open("tt.zip", "wb")
for i in range(2,40):
    r1 = bytes.fromhex(data[i])
    r2 = bytes.fromhex(data[i+40])
    r3 = bytes([rr ^ ss for rr, ss in zip(r1, r2)])
    tt.write(r3[3:])
    print(r3)

注意到前八个 log 的第二位是从 0-7。第三位是 byte，第四位开始是 zip。于是可以尝试把 zip 文件写出。

赛后看 wp。知道密码是第三位的八个 byte，变成 0-1 之后转置后取出的值。

就是密码了

lines = open("candump.log").readlines()

lines = [line.split(" ") for line in lines]

data = [line[2].split("#")[-1].strip() for line in lines]

tt = open("tt.zip", "wb")
for i in range(2,40):
    r1 = bytes.fromhex(data[i])
    r2 = bytes.fromhex(data[i+40])
    r3 = bytes([rr ^ ss for rr, ss in zip(r1, r2)])
    tt.write(r3[3:])
    
rs = [""]*8
for i in range(2,10):
    r1 = bytes.fromhex(data[i])
    r2 = bytes.fromhex(data[i+40])
    r3 = bytes([rr ^ ss for rr, ss in zip(r1, r2)])
    # tt.write(r3[3:])
    # print(r3[1:3])
    # print(bin(r3[2])[2:].zfill(8))
    for j in range(8):
        rs[j] += bin(r3[2])[2:].zfill(8)[j]
        
for i in rs:
    print(chr(int(i[::-1],2)),end="")
😅

什么脑洞题。

不会出 misc 少出点，这种让谁来想呢