# 判断节点图标是否重叠 defhas_overlapping_labels(pos, labels, threshold=0.03): for u, p1 in pos.items(): for v, p2 in pos.items(): if u != v and np.linalg.norm(np.array(p1) - np.array(p2)) < threshold: if labels[u] != labels[v]: returnTrue returnFalse
# 使用offset_text来避免标签在边缘被截断 for node, label in node_labels.items(): x, y = label_pos[node] plt.text(x, y, label, fontsize=10, ha='center', va='center', zorder=10)
asyncfunctiongetFlag(token) { // Generate the flag based on user's token let hash = CryptoJS.SHA256(`dEEper_@nd_d@rKer_${token}`).toString(); return`flag{T1t@n_${hash.slice(0, 32)}}`; }
with requests.Session() as session: session.cookies.set( "session", "<fill your cookie here>", ) messages = getMessages(session) deleteList = [] for i, m inenumerate(messages["messages"]): if"hack["in m["text"]: print(i, m["text"], m["delay"]) deleteList.append({"id": i, "delay": m["delay"]}) for i in deleteList: timer = threading.Timer(i["delay"], deleteMessage, args=(session, i["id"])) timer.start() timer.join() getFlag(session)
$ git reflog ea49f0c (HEAD -> main) HEAD@{0}: commit: Trim trailing spaces 15fd0a1 (origin/main, origin/HEAD) HEAD@{1}: reset: moving to HEAD~ 505e1a3 HEAD@{2}: commit: Trim trailing spaces 15fd0a1 (origin/main, origin/HEAD) HEAD@{3}: clone: from https://github.com/dair-ai/ML-Course-Notes.git $ git checkout --force 505e1a3 HEAD is now at 505e1a3 Trim trailing spaces $ grep -R flag . ./.git/hooks/fsmonitor-watchman.sample:# return the fast "everything is dirty" flag to git and do the ./README.md: <!-- flag{TheRe5_@lwAy5_a_R3GreT_pi1l_1n_G1t} -->
defsplit_string(s: str) -> list[str]: result = [] current = "" for c in s: if c.isalpha(): current += c else: if current: result.append(current) current = "" result.append(c) if current: result.append(current) return result
defexpand_consonants(s: str) -> list[str]: vowels = set("aeiou") result = [] for i, c inenumerate(s): if c notin vowels: new_s = s[: i + 1] + c + s[i + 1 :] result.append(new_s) ifnot s.endswith("e"): result.append(s + "e") return result
defis_alpha(s: str) -> bool: for c in s: ifnot c.isalpha(): returnFalse returnTrue
defexpand_code_dict(code_dict: str) -> list: splits = split_string(code_dict) expanded_code_dicts = [] for i, s inenumerate(splits): if is_alpha(s): for expanded in expand_consonants(s): expanded_code_dicts.append( "".join(splits[:i] + [expanded] + splits[i + 1:]) ) return expanded_code_dicts
all_expanded_code_dicts = [expand_code_dict(code_dict) for code_dict in code_dicts] iterated_code_dicts = itertools.product(*all_expanded_code_dicts)
defdecrypt_data(input_codes, code_dict): output_chars = [code_dict[c] for c in input_codes] return"".join(output_chars)
defiterate_code_dict(): for code_dicts in iterated_code_dicts: yield code_dicts
# Read the binary file as a numpy array buffer = np.fromfile(file, dtype=np.uint8)
# drop the last few bytes buffer = buffer[: (3 * frame_count * frame_width * frame_height)]
# Reshape the array to the original shape of the video frames buffer = buffer.reshape((frame_count, frame_height, frame_width, 3))
# Create a video writer object with the same properties as the original video vidwriter = cv2.VideoWriter( output, cv2.VideoWriter_fourcc(*codec), frame_rate, (frame_width, frame_height) )
# Write each frame to the output video file for i inrange(frame_count): vidwriter.write(buffer[i])
# Release the video writer object vidwriter.release()
sensor sw1 switch1 @enabled sensor sw2 switch2 @enabled sensor sw3 switch3 @enabled sensor sw4 switch4 @enabled sensor sw5 switch5 @enabled sensor sw6 switch6 @enabled sensor sw7 switch7 @enabled sensor sw8 switch8 @enabled op shl t sw1 7 set number t op shl t sw2 6 op add number number t op shl t sw3 5 op add number number t op shl t sw4 4 op add number number t op shl t sw5 3 op add number number t op shl t sw6 2 op add number number t op shl t sw7 1 op add number number t set t sw8 op add number number t set en 0 set i 0 jump 33 greaterThanEq i 16 op pow fl0 i 2 jump 31 notEqual fl0 number set en 1 jump 33 always x false op add i i 1 jump 26 always x false op equal fl1 0 sw1 op equal fl2 0 sw6 op or fl3 fl1 fl2 jump 38 equal fl3 0 set en 0 control enabled generator1 en 0 0 0 control enabled panel1 en 0 0 0 end
resp = s.get(f'{host}xcaptcha', headers=headers) e = etree.HTML(resp.text) labels = e.xpath('//form/div/label') questions = [x.text.replace(' 的结果是？', '') for x in labels]
data = {f'captcha{i+1}': Nonefor i inrange(3)} for i, question inenumerate(questions): question = map(int, question.split('+')) data[f'captcha{i+1}'] = sum(question)
$ exiftool travel-photo-2.jpg | grep -E 'Exif Version |Make |Camera Model Name |ISO |Create Date |Flash ' Make : Xiaomi Camera Model Name : sm6115 (juice) ISO : 84 Exif Version : 0231 Create Date : 2022:05:14 18:23:35 Flash : Off, Did not fire Create Date : 2022:05:14 18:23:35.220027+09:00
int games = 5; int win = 0; int lose = 0; char target[20]; char guess[2000]; for (int i = games; i > 0; i--) { int M = 0; int N = 400000; for (int j = 0; j < N; j++) { double x = rand01(); double y = rand01(); if (x * x + y * y < 1) M++; } double pi = (double)M / N * 4; sprintf(target, "%1.5f", pi); guess[7] = '\0'; printf("%1.5f,", pi); } printf("\n"); return0; }
编译后写一个 python 程序调用它生成最近时间作为种子的随机数，并输出到文件中。
1 2 3 4 5 6 7 8 9 10 11 12 13 14
import os import time defgetans(seed): ans = os.popen(f"./pwncarlo {seed}").read().strip()[:-1].split(",") return ans # list of 5 answers monte_carlo = [] time_stamp = int(time.time()) for seed inrange(time_stamp - 1000, time_stamp + 1500): print(seed) monte_carlo.append(getans(seed))
withopen("monte_carlo.txt", "w") as f: for i in monte_carlo: f.write(",".join(i) + "\n")
基于服务器给出的前两次结果，推测出后三次的结果，从而得到 flag。
惜字如金
HS384
先尝试补全被惜字如金化的代码，如果使用具有代码补全和错误检查功能的 IDE 会更方便。发现secret = b'ustc.edu.cn'和它的 sha384 被惜字如金化了。已知secret长度为 39。阅读惜字如金化规则，找出所有可能的secret，并计算它们的 sha384，生成类似于彩虹表的文件。
withopen('q2.txt', 'r') as f: q = f.read().splitlines() q = q[::-1] for i in q: if i == '0'or i == 'xx': print('0', end='') else: print('1', end='') print()
for input_tuple in itertools.product([0, 1], repeat=16): info = chal(16, True, input_tuple) print(input_tuple) if info['scrambled']: print("".join(map(str, input_tuple))) break
import os import requests import pwn tmp_dir = r'hackergame/tmp' conn = pwn.remote('202.38.93.111', 12400) # connect to the server defwipe(): for file in os.listdir(tmp_dir): os.remove(os.path.join(tmp_dir, file)) defrecv_and_print(line_num): for i inrange(line_num): text = conn.recvline().decode('utf-8').strip() print(text) defchoose_difficulty(difficulty): for i inrange(4): text = conn.recvline().decode('utf-8').strip() print(text) conn.sendline(str(difficulty).encode()) defchallenge(): urls = { '1': None, '2': None, } whileTrue: text = conn.recvline().decode('utf-8').strip() print(text) if text.startswith('1st binary'): urls['1'] = text.split(' ')[-1] elif text.startswith('2nd binary'): urls['2'] = text.split(' ')[-1] elif text.startswith('Please show me the address of that function'): break assert urls['1'] isnotNoneand urls['2'] isnotNone return urls
token = open('token', 'r').read() conn.sendlineafter('Please input your token: ', token.encode()) difficulty = 2 challenges = 100 choose_difficulty(difficulty) conn.sendlineafter( r'Do you want to perform dry run, so that you can see how many challenges you can answer correctly? (y/N)', b'N') recv_and_print(5) timestamp = input('Please input the timestamp: ') conn.sendlineafter('Please input the timestamp:', timestamp.encode()) recv_and_print(2) for i inrange(challenges): wipe() challenge_urls = challenge() for i, url in challenge_urls.items(): r = requests.get(url) withopen(os.path.join(tmp_dir, f'file{i}'), 'wb') as f: f.write(r.content) os.system(f"idat64.exe -B -P+ {os.path.join(tmp_dir, f'file{i}')}") address = input() # TODO conn.sendline(address.encode()) conn.interactive()
总结
比赛好卷，不懂 math 不懂 binary 卷不过但是上榜了（）
在做“蒙特卡罗轮盘赌”题目的时候，发现正好度过了时间Tue 25 October 2022 02:57:46 UTC，其时间戳为1666666666！
$ mkdir openpgpkey-WKD && cd openpgpkey-WKD $ mkdir -p .well-known/openpgpkey $ cd .well-known $ gpg --list-options show-only-fpr-mbox -k "@your.domain" | $(gpgconf --list-dirs libexecdir)/gpg-wks-client -v --install-key #如果需要，也可以替换为指定单个 Key $ cd ..
输出将会类似这样
1 2 3 4 5 6 7
gpg-wks-client: gpg: Total number processed: 1 gpg-wks-client: using key with user id 'Misaka <admin@apeiria.net>' gpg-wks-client: gpg: Total number processed: 1 gpg-wks-client: directory 'openpgpkey/apeiria.net' created gpg-wks-client: directory 'openpgpkey/apeiria.net/hu' created gpg-wks-client: policy file 'openpgpkey/apeiria.net/policy' created gpg-wks-client: key C4B71F9ED3515AEB8270D5D7189BB387CF3AD95F published for 'admin@apeiria.net'
站点目录结构将会类似这样
1 2 3 4 5 6 7
$ tree -a . `-- openpgpkey `-- apeiria.net |-- hu | `-- 4y36rkzdjnzmk3oxaekyi5biowgr5kcz `-- policy
我 blog 所有源文件基本都在 blog / about 公开。如果想发现我的 blog 有错误就可以直接 pr 帮我解决啦
交换友链可以在这里pr。
总之，要是发现 blog 有什么异常欢迎联系我反馈。(◍•ᴗ•◍)❤
参考链接：
Hexo Action on GitHub Marketplace
GitHub Actions Documentation
]]><p>最近把 hexo blog 修改成用 GitHub Actions 自动部署的了，发篇文章测试一下<s>水一水</s></p>将 HP 39gs 升级为 HP 48gIIhttps://blog.apeiria.net/2020/hp39gs-upgrade/2020-07-11T03:10:00.000Z2020-07-11T03:10:00.000ZHP 39gs 是 HP 于 2006 年发布的 HP-39 系列中的一个图形计算器
HP 39gs
信息
CPU
SAMSUNG S3C2410A ARM920T 75Mhz（可调至 203Mhz+）
RAM
256KB
屏幕
131×64 单色 LCD 可调对比度
通信
Mini USB / RS232 / IrDA
供电
4×AAA + CR2032
尺寸
9.4×3.1×18.7 cm
重量
248g
输入
线性 Algebraic
Aplet 语言
RPL
Program 语言
HP Basic
CAS
无
其他
有蜂鸣器
HP 39gs 售价非常低廉（通常低于 50 人民币/台），但它运算功能差，速度慢，不建议用于日常计算使用。如果想要购买建议先使用模拟器体验。
]]><p>受影响的大多是破解软件,因为 Apple 在新系统中删除了 TNT 的证书</p>欢迎使用 hexohttps://blog.apeiria.net/2020/create-my-blog/2020-02-12T17:02:52.000Z2020-02-12T17:02:52.000Z如果您看到这篇文章,表示您的 blog 已经安装成功.
