3st stage MetaRed CTF 2023 - Maths (rev, z3)

?

  • [? solves / ? points]

Solve

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
from z3 import *

s = Solver()
a = [BitVec(f"a{i:02}",16) for i in range(26)]

for i in range(26):
# s.add(a[i]>=40 and a[i]<=126) # not working
s.add(And(a[i]>=40, a[i]<=126))

s.add(a[0] + a[1] == 210 and a[1] | (a[0] == (a[1] | a[0])))
s.add(a[1] * a[2] == 10476)
s.add(a[1] + a[0] + a[2] == 307)
s.add(a[3] - a[2] == 6)
s.add(a[4] != If(a[5] == 15, BitVecVal(1, 16), BitVecVal(0, 16)))
s.add(a[7] * a[4] == 6273)
s.add((a[5] | If(a[11] == 119, BitVecVal(1, 16), BitVecVal(0, 16) )) != 0)
s.add(a[6] - a[17] == 53)
s.add(a[6] + a[5] + a[7] == 271)
s.add(a[8] - a[9] == 13)
s.add(a[8] + a[9] - a[10] == 125)
s.add(a[9] - a[11] == 31)
s.add(a[10] - a[11] == 1)
s.add(a[13] * a[12] == 10260)
s.add(a[13] + a[14] == 177)
s.add(And(If(a[17] == 69, a[16] != 1, a[16] != 0), ((a[17] | a[16]) & 1) != 0))
s.add(a[16] + a[18] == 219)
s.add(a[17] + a[16] + a[23] == 220)
s.add(a[14] - a[15] == 31)
s.add(a[14] + a[12] + a[15] == 241 and (a[14] ^ a[12]) != (a[12] == a[14]) )
s.add(a[17] - a[18] == -50)
s.add(a[19] + a[18] + a[20] == 316)
s.add(a[22] + a[21] + a[23] == 248)
s.add(a[22] - a[23] == 64)
s.add(a[24] + a[25] == 207)
s.add(a[24] - a[20] == -32)
s.add(a[25] - a[21] == 43)
s.add(a[0] + a[3] == 205)
s.add(a[13] + a[12] + a[14] == 285)


flag_list = []
result = set()

while s.check() == sat:
model = s.model()
flag = "".join([chr(model[a[i]].as_long()) for i in range(26)])

if flag not in result:
result.add(flag)

s.add(Or([a[i] != model[a[i]].as_long() for i in range(26)]))

for flag in result:
print(flag)

flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
flag{jr3_R43l_R3l=o[rRs3R}
flag{zb3_R43l_R3|-_krRs3R}
flag3.f{_R43l_R3x1cgrRs3R}
flag3,h{_R43l_R3v3eerRs3R}
flag{pl3_R43l_R3r7iarRs3R}
flag31c{_R43l_R3{.`jrRs3R}
flag{kq3_R43l_R3m<n\rRs3R}
flag33a{_R43l_R3},^lrRs3R}
flag{_}3_R43l_R3aHzPrRs3R}
flag{lp3_R43l_R3n;m]rRs3R}
flag32b{_R43l_R3|-_krRs3R}
flag3-g{_R43l_R3w2dfrRs3R}
flag{`|3_R43l_R3bGyQrRs3R}
flag{we3_R43l_R3y0bhrRs3R}
flag{qk3_R43l_R3s6hbrRs3R}
flag{xd3_R43l_R3z/airRs3R}
flag3+i{_R43l_R3u4fdrRs3R}
flag{ht3_R43l_R3j?qYrRs3R}
flag{|`3_R43l_R3~+]mrRs3R}
flag{om3_R43l_R3q8j`rRs3R}
flag{si3_R43l_R3u4fdrRs3R}
flag3)k{_R43l_R3s6hbrRs3R}
flag3(l{_R43l_R3r7iarRs3R}
flag{mo3_R43l_R3o:l^rRs3R}
flag34`{_R43l_R3~+]mrRs3R}
flag{gu3_R43l_R3i@rXrRs3R}
flag{bz3_R43l_R3dEwSrRs3R}
flag30d{_R43l_R3z/airRs3R}
flag{nn3_R43l_R3p9k_rRs3R}
flag3*j{_R43l_R3t5gcrRs3R}
flag{vf3_R43l_R3x1cgrRs3R}
flag3/e{_R43l_R3y0bhrRs3R}
flag{th3_R43l_R3v3eerRs3R}
flag{^~3_R43l_R3`I{OrRs3R}
flag{ug3_R43l_R3w2dfrRs3R}
flag{dx3_R43l_R3fCuUrRs3R}
flag{rj3_R43l_R3t5gcrRs3R}
flag{is3_R43l_R3k>pZrRs3R}
flag{a{3_R43l_R3cFxRrRs3R}
flag{fv3_R43l_R3hAsWrRs3R}
flag{{a3_R43l_R3},^lrRs3R}
flag{cy3_R43l_R3eDvTrRs3R}
flag{yc3_R43l_R3{.`jrRs3R}
flag{ew3_R43l_R3gBtVrRs3R}