Hello Navi

#!/usr/bin/env python3
"""Decrypt HTS app14's hard-coded password (port of Encrypt.ParseandDecrypt).

From the IL of app14.Encrypt::ParseandDecrypt: build a 128-entry shift table
where arr[i] = i - 3 for even i and arr[i] = i + 4 for odd i, then subtract
arr[j] (j cycling 0..127) from each character code.
"""
def make_table():
    arr = [0] * 128
    for i in range(128):
        if i % 2 == 0:
            arr[i] = i - 3
        else:
            arr[i] = i + 4
    return arr


def parse_and_decrypt(s):
    arr = make_table()
    out = []
    j = 0
    for ch in s:
        out.append(chr(ord(ch) - arr[j]))
        j += 1
        if j > 127:
            j = 0
    return "".join(out)


def parse_and_encrypt(s):
    arr = make_table()
    out = []
    j = 0
    for ch in s:
        out.append(chr(ord(ch) + arr[j]))
        j += 1
        if j > 127:
            j = 0
    return "".join(out)


if __name__ == "__main__":
    enc = "fm`{f}kpwrn"
    print("ciphertext      :", enc)
    print("password        :", parse_and_decrypt(enc))
    print("round-trip check:", parse_and_encrypt(parse_and_decrypt(enc)))

#!/usr/bin/env python3
"""Verify HTS app13 numbers with the documented timing side-channel.

The validator checks the four parts sequentially and calls _exit(0) as soon
as one part is wrong, so a longer runtime means more of the prefix passed.
Wrong parts exit early (~0.43s under wine), all four correct run longest.
"""
import subprocess
import time
import os
import statistics

WORKDIR = "<hts-workspace>/challenges/hts-app/app13"
EXE = "app13win.exe"
ENV = {**os.environ, "WINEDEBUG": "-all"}
CANDIDATE = [537, 314, 137, 616]


def measure(nums, reps=5):
    times = []
    for _ in range(reps):
        t0 = time.perf_counter()
        subprocess.run(["wine", EXE, *map(str, nums)], cwd=WORKDIR, env=ENV,
                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                       timeout=120)
        times.append(time.perf_counter() - t0)
    return statistics.median(times)


if __name__ == "__main__":
    print("baseline warm-up")
    measure([111, 222, 333, 444], reps=3)

    print("\nall four candidates that should differ by exactly one part:")
    for label, nums in [
        ("candidate        ", CANDIDATE),
        ("pt1 wrong (-1)   ", [536, 314, 137, 616]),
        ("pt2 wrong (-1)   ", [537, 313, 137, 616]),
        ("pt3 wrong (-1)   ", [537, 314, 136, 616]),
        ("pt4 wrong (-1)   ", [537, 314, 137, 615]),
        ("all wrong        ", [111, 222, 333, 444]),
    ]:
        print(f"  {label} {nums} -> {measure(nums):.4f}s")

    print("\nlocal peak scan around each correct part (rest fixed correct):")
    for pos in range(4):
        row = []
        for delta in (-2, -1, 0, 1, 2):
            nums = list(CANDIDATE)
            nums[pos] += delta
            row.append((nums[pos], measure(nums)))
        best = max(row, key=lambda x: x[1])
        cells = "  ".join(f"{v}:{t:.4f}" for v, t in row)
        print(f"  pt{pos+1}: {cells}   peak={best[0]}")

#!/usr/bin/env python3
"""Reimplement HTS app13's validator chain and check the checkpoint CRCs.

Recovered algorithm (see writeup):
  CRC(crc, sum):
      data = decimal-string of crc
      for each byte: data[i] = (data[i] + sum) % 0xFF
      return crc32(data)            # standard CRC-32

Main loop, 16 iterations, interleaving signal_A (data1_proc, +0) and
signal_B (data2_proc, +3); current_part is pt1..pt4.  Expected checkpoints:
  after iteration where dword_40F0BC == 4  -> 0x98F52A54  (pt2 becomes active)
  after iteration where dword_40F0BC == 8  -> 0x7023AE57  (pt3 becomes active)
  after iteration where dword_40F0BC == 12 -> 0x8986EE55  (pt4 becomes active)
  final (dword_40F0BC == 16)               -> 0xD9D9886E
"""
import zlib

EXPECT = {4: 0x98F52A54, 8: 0x7023AE57, 12: 0x8986EE55, 16: 0xD9D9886E}


def crc(crc_in, sum_):
    data = bytearray(str(crc_in & 0xFFFFFFFF).encode())
    for i in range(len(data)):
        data[i] = (data[i] + sum_) % 0xFF
    return zlib.crc32(bytes(data)) & 0xFFFFFFFF


def run(parts):
    crc_sum = 0
    a = b = bc = 1
    cp = parts[0]
    marks = {}
    for _ in range(17):
        # signal_B / data2_proc(current_part)
        crc_sum = crc((cp + crc_sum + 3) >> 1, b + 0xD)
        b += 1
        crc_sum = crc(crc_sum, bc + 7)
        # signal_A / data1_proc(current_part)
        crc_sum = crc((cp + crc_sum) >> 1, a)
        a += 1
        if bc in (4, 8, 12):
            if bc == 4:
                cp = parts[1]
            elif bc == 8:
                cp = parts[2]
            elif bc == 12:
                cp = parts[3]
            marks[bc] = crc_sum
        # signal_B again
        crc_sum = crc((cp + crc_sum + 3) >> 1, b + 0xD)
        b += 1
        if bc == 16:
            marks[16] = crc_sum
            break
        bc += 1
        # signal_A again
        crc_sum = crc((cp + crc_sum) >> 1, a)
        a += 1
    return marks


if __name__ == "__main__":
    for label, parts in [("candidate", [537, 314, 137, 616]),
                         ("wrong    ", [536, 314, 137, 616])]:
        marks = run(parts)
        print(f"{label} {parts}")
        ok = True
        for k in (4, 8, 12, 16):
            got = marks.get(k)
            exp = EXPECT[k]
            m = "OK" if got == exp else "MISMATCH"
            if got != exp:
                ok = False
            print(f"  bc={k:2d} got=0x{got:08X} expect=0x{exp:08X} {m}")
        print(f"  => {'ALL MATCH' if ok else 'FAILED'}\n")

"""Recover the HackThisSite App 12 (app12win.exe) password from its own check logic.

Everything below is reconstructed statically from the VB6 native binary; no
dynamic run is involved.  The relevant routine is the handler registered for
event 0x47 in the VB6 event table at VA 0x4062D8, decompiled by Ghidra as
FUN_00407410 ("final stage"):

    __vbaStrCopy(dst, &charset_literal)     ; copy the 30-char charset literal
    Ordinal_632(local_68, local_48, 3)         ; Mid(userpwd, 3, 1)
    uVar3 = __vbaStrVarVal(dst)                ; -> that 3rd character
    Ordinal_712(local_28, uVar3)               ; Replace(userpwd, that_char, ' ')
    Ordinal_528(local_48, local_638)           ; Upper(charset)
    Ordinal_632(local_68, local_48, 3)         ; Mid(Upper(charset), 3, 1)  = 'C'
    Ordinal_632(local_88, local_658, 0x12)     ; Mid(charset, 18, 1) = 'r'
    Ordinal_632(local_d8, local_698, 0x10)     ; Mid(charset, 16, 1) = 'p'
    Ordinal_632(local_118,local_6c8, 0x12)     ; Mid(charset, 18, 1) = 'r'
    __vbaVarCat x6 with three embedded ' ' literals  ; -> "Cr  p r"
    __vbaVarTstEq(target)                       ; compare built target vs user

The string literal used by __vbaStrCopy is the wide literal at VA 0x406720:
    "abcdefghijklmnopqrstuvwxyz.!:-"
and the "replacement" character is the single space at VA 0x40667c.

Because the edit-field key handler (FUN_00406d60) removes every space the user
types (Replace(text, " ", "") whenever the text matches the Like pattern "* *"),
the three spaces of the target "Cr  p r" must come from step 3:  positions
3, 4 and 6 of the entered password must all hold the same character C.  C must
not appear anywhere else in the password, and cannot be C/r/p (which are pinned
to positions 1/2/5/7), so the accepted passwords are CrXXpXr for X in the
charset.  The natural-language one is Creeper.
"""

import re

EXE = "app12/app12win.exe"
CHARSET_VA = 0x406720      # VA of the charset literal referenced by `mov edx,0x406720`
SPACE_VA = 0x40667C        # VA of the single-space literal
TEXT_BASE_VA = 0x401000    # .text virtual address
TEXT_BASE_OFF = 0x1000     # .text raw file offset


def va_to_offset(va):
    """Map a virtual address inside .text to a raw file offset."""
    return TEXT_BASE_OFF + (va - TEXT_BASE_VA)


def read_wide_string(path, va):
    """Read a NUL-terminated UTF-16LE string at a virtual address."""
    with open(path, "rb") as fh:
        fh.seek(va_to_offset(va))
        out = []
        while True:
            pair = fh.read(2)
            if len(pair) < 2 or pair == b"\x00\x00":
                break
            out.append(pair.decode("utf-16le"))
    return "".join(out)


def extract_charset(path):
    """Pull the charset and replacement char straight out of the binary."""
    charset = read_wide_string(path, CHARSET_VA)
    space = read_wide_string(path, SPACE_VA)
    return charset, space


def mid(charset, index):
    """VB6 Mid(s, n, 1) is 1-based."""
    return charset[index - 1]


def build_target(charset):
    """Reproduce the six VarCat calls that assemble the expected value."""
    upper = charset.upper()
    parts = [
        mid(upper, 0x3),    # 'C'
        mid(charset, 0x12),  # 'r'
        " ",
        " ",
        mid(charset, 0x10),  # 'p'
        " ",
        mid(charset, 0x12),  # 'r'
    ]
    return "".join(parts)


def check(user_password, charset):
    """Emulate FUN_00407410 up to __vbaVarTstEq; returns (matched, modified)."""
    if len(user_password) < 3:
        return False, user_password
    subst = user_password[2]                        # Mid(userpwd, 3, 1)
    modified = user_password.replace(subst, " ")    # Replace(user_password, subst, " ")
    return modified == build_target(charset), modified


def main():
    charset, space = extract_charset(EXE)
    target = build_target(charset)
    print("charset        :", repr(charset), "(%d chars)" % len(charset))
    print("replacement ch :", repr(space))
    print("Mid(UPPER,3)   :", repr(mid(charset.upper(), 0x3)))
    print("Mid(lower,0x12):", repr(mid(charset, 0x12)))
    print("Mid(lower,0x10):", repr(mid(charset, 0x10)))
    print("target string  :", repr(target))

    # Brute force every candidate of the accepted shape CrXXpXr.
    candidates = []
    for x in charset:
        cand = "Cr%s%sp%sr" % (x, x, x)
        if check(cand, charset)[0] and cand not in candidates:
            candidates.append(cand)

    print("accepted count :", len(candidates))
    for cand in candidates:
        mark = "   <-- real word" if cand == "Creeper" else ""
        print("  ", cand, mark)

    # show that a plain wrong attempt is rejected
    for probe in ("Creeper", "CreeperX", "Cr11p1r", "password"):
        ok, modified = check(probe, charset)
        print("check(%r) -> %s  (modified=%r)" % (probe, ok, modified))


if __name__ == "__main__":
    main()

"""Carve the two real JPEGs out of app11win.exe.

Marker walk shows:
  * JPEG A at 0x129E: SOI, JFIF, APP1 Exif(1710, embeds a 160-byte thumbnail),
    APP13 Photoshop(2920, embeds the whole of JPEG B), APP1 XMP, ... SOF0 233x58,
    SOS, scan data, EOI at 0x4B35.
  * JPEG B at 0x1ED6: complete 128x32 baseline JPEG living inside A's APP13.

The naive "first FF D9" carve truncates A at the Exif thumbnail's EOI, so we
locate SOS explicitly and take everything up to the first real EOI after it.
"""
import struct

data = open("app11win.exe", "rb").read()


def carve(soi):
    """Return (start, end) of a full JPEG beginning at `soi`."""
    p = soi + 2
    while p < len(data) - 1:
        while data[p] != 0xFF:
            p += 1
        m = data[p + 1]
        if m == 0xDA:  # SOS -> skip header, then scan for EOI
            ln = struct.unpack_from(">H", data, p + 2)[0]
            p = p + 2 + ln
            break
        if m in (0xD8, 0xD9) or 0xD0 <= m <= 0xD7:
            p += 2
            continue
        if m == 0xFF:
            p += 1
            continue
        ln = struct.unpack_from(">H", data, p + 2)[0]
        p = p + 2 + ln
    # scan entropy-coded data for EOI (FF D9)
    q = p
    while q < len(data) - 1:
        if data[q] == 0xFF and data[q + 1] == 0xD9:
            return soi, q + 2
        q += 1
    return soi, len(data)


for name, off in (("image_a.jpg", 0x129E), ("image_b.jpg", 0x1ED6)):
    s, e = carve(off)
    blob = data[s:e]
    open("extracted/" + name, "wb").write(blob)
    print(f"{name}: 0x{s:X}..0x{e:X} size={len(blob)}")

"""Recover the password embedded in HackThisSite App 10 (app10win.exe).

app10win.exe is a VB6 native-code program.  Its event dispatch table
(objdump address 0x404904) routes event 0x3B to the handler at 0x4049E0 -- an
event no control on the form ever fires ("mystery event").  That handler
builds a message box the hard way: every literal character is an immediate
`push 0xNN`, immediately converted into a one-character BSTR VARIANT by
rtcVarBstrFromAnsi (MSVBVM60.DLL ordinal 608, loaded into edi from the IAT
slot ds:0x40104c), and the whole batch is finally concatenated by
__vbaVarCat (IAT slot ds:0x401054) and handed to rtcMsgBox (MSVBVM60.DLL
ordinal 595, IAT slot ds:0x401018).

The run of immediates between the two IAT loads is 38 characters long, but it
is NOT a single string.  The handler contains no string literal at all -- its
only text immediate is the SEH frame pointer 0x4010C6 -- so both the body and
the caption of the box are built character by character.  The reference run of
the patched program shows

    MsgBox "The Password Is: HiddenSecrets", vbInformation, "Correct!"

so the first 30 immediates are the box body and the last 8 ("Correct!") are
its caption; only the 13 characters after the "The Password Is: " marker are
the password HTS wants.  Joining all 38 and stripping the marker yields the
tempting but wrong "HiddenSecretsCorrect!" (the site answers "invalid
password" for it).

Verified against: sha256 cb649beb0fd43fa83c534f58b7444c06b6fbce0db1e7322f2acb4ca9b039f300
"""

import re
import subprocess

EXE = "app10win.exe"
FUNC_START = 0x4049E0  # entry of the event 0x3B handler
FUNC_END = 0x405441    # its `ret`
RNT_FROM_ANSI = 0x40104C  # IAT slot -> MSVBVM60 ordinal 608 rtcVarBstrFromAnsi
VAR_CAT = 0x401054        # IAT slot -> __vbaVarCat
MSG_BOX = 0x401018        # IAT slot -> MSVBVM60 ordinal 595 rtcMsgBox
MARKER = "The Password Is: "
CAPTION = "Correct!"


def disassemble(path):
    """Return the objdump disassembly as a list of (address, mnemonic) pairs."""
    out = subprocess.run(
        ["objdump", "-d", "-M", "intel", path],
        capture_output=True,
        text=True,
        check=True,
    ).stdout
    insns = []
    for line in out.splitlines():
        m = re.match(r"\s*([0-9a-f]+):\t[0-9a-f ]+\t(\S.*)", line)
        if m:
            insns.append((int(m.group(1), 16), m.group(2).strip()))
    return insns


def find_message(insns):
    """Collect the immediate bytes pushed between the two IAT loads."""
    start = end = None
    for addr, text in insns:
        if not (FUNC_START <= addr <= FUNC_END):
            continue
        if start is None and re.search(r"mov\s+edi,DWORD PTR ds:0x%x" % RNT_FROM_ANSI, text):
            start = addr
        elif start is not None and re.search(r"mov\s+edi,DWORD PTR ds:0x%x" % VAR_CAT, text):
            end = addr
            break

    if start is None or end is None:
        raise SystemExit("character-building sequence not found")

    chars = []
    for addr, text in insns:
        if not (start < addr < end):
            continue
        m = re.fullmatch(r"push\s+0x([0-9a-f]+)", text)
        if m:
            chars.append(int(m.group(1), 16))
    return start, end, bytes(chars).decode("latin1")


def split_body_caption(chars):
    """Split the 38 embedded characters into message-box body and caption.

    Both halves are built by the same `push imm8` + rtcVarBstrFromAnsi chain;
    the boundary is the trailing literal caption ("Correct!"), so the body is
    everything before it.
    """
    if not chars.endswith(CAPTION):
        raise SystemExit("unexpected tail: %r" % chars[-len(CAPTION):])
    return chars[: -len(CAPTION)], CAPTION


def main():
    insns = disassemble(EXE)
    start, end, chars = find_message(insns)
    body, caption = split_body_caption(chars)
    print("char sequence   : 0x%x .. 0x%x" % (start, end))
    print("embedded chars  : %r" % chars)
    print("character count  : %d" % len(chars))
    print("msgbox caption  : %r" % caption)
    print("msgbox body     : %r" % body)
    if not body.startswith(MARKER):
        raise SystemExit("body does not start with the marker: %r" % body)
    print("password        : %s" % body[len(MARKER):])


if __name__ == "__main__":
    main()

import shutil

SRC = "app9/app9win.exe"
DST = "app9/app9win_patched.exe"

d = bytearray(open(SRC, "rb").read())


def patch(off, old, new):
    assert d[off:off + len(old)] == old, (hex(off), bytes(d[off:off + len(old)]))
    d[off:off + len(new)] = new
    print("patched file+%#06x: %r -> %r" % (off, old.decode("utf-16-le"), new.decode("utf-16-le")))


# 0x40522c/0x405238/0x405244 是 .text 里的字符串字面量数据，
# 文件偏移 = VA - 0x400000（.text RAW/VMA 都是 0x1000，所以两者相等）
patch(0x522C, "200".encode("utf-16-le"), "100".encode("utf-16-le"))
patch(0x5238, "600".encode("utf-16-le"), "500".encode("utf-16-le"))
patch(0x5244, "1100".encode("utf-16-le"), "1000".encode("utf-16-le"))

open(DST, "wb").write(bytes(d))
print("wrote", DST, len(d), "bytes")

"""Extract the rtcMidCharVar (Mid) index sequence used by HTS App 9's password builder."""
import re

ASM = "out/app9.asm"
LINE = re.compile(r"^\s*([0-9a-f]{6}):\t([0-9a-f ]+)\t(.*)$")

insns = []
for line in open(ASM, encoding="latin1"):
    m = LINE.match(line)
    if m:
        insns.append((int(m.group(1), 16), m.group(3).strip()))


def mid_indices(lo, hi):
    """For every 'call edi' (rtcMidCharVar) in [lo, hi], walk back to the nearest
    small 'push 0xNN' (the charset index) before hitting the previous call."""
    out = []
    for i, (addr, text) in enumerate(insns):
        if not (lo <= addr <= hi):
            continue
        if text.startswith("call") and text.endswith("edi"):
            for j in range(i - 1, -1, -1):
                _, t = insns[j]
                if t.startswith("call"):
                    break
                if t.startswith("push   0x") and "0x405" not in t:
                    v = int(t.split("0x")[1], 16)
                    if v < 0x100:
                        out.append(v)
                        break
    return out


def decode(idx):
    """1-based index into 'abcdefghijklmnopqrstuvwxyz'."""
    return "abcdefghijklmnopqrstuvwxyz"[idx - 1]


for lo, hi, name in ((0x405B9A, 0x405CE0, "label1"),
                     (0x405EAC, 0x4060ED, "label2"),
                     (0x40634D, 0x4064ED, "password")):
    idx = mid_indices(lo, hi)
    print(name, "indices:", " ".join(hex(v) for v in idx))
    print("      letters:", "".join(decode(v) for v in idx))

#!/usr/bin/env python3
"""Static recon script for app8win.exe (HTS Application Mission 8).

The sample is a Visual Basic 6 program compiled to native x86 code.  This
script parses the PE, lists MSVBVM60.DLL imports (name + ordinal), locates the
UTF-16 BSTR string literals VB6 stores in .text, and recovers the immediates
handed to the rtcMidCharVar calls (MSVBVM60.DLL ordinal 632, the runtime
implementation of VB6's Mid$()) inside the digit-check routine.

Run from the directory that holds app8/win/app8win.exe.
"""
import re
import struct

PATH = "app8/win/app8win.exe"
IMAGE_BASE = 0x400000
CHECK_FN = (0x406D40, 0x407740)  # the button/verification routine
RTC_MIDCHARVAR_IAT = 0x401040    # IAT slot, called as "call ebx"

def load():
    data = open(PATH, "rb").read()
    pe = struct.unpack_from("<I", data, 0x3C)[0]
    nsec = struct.unpack_from("<H", data, pe + 6)[0]
    opt_size = struct.unpack_from("<H", data, pe + 20)[0]
    secs = []
    for i in range(nsec):
        off = pe + 24 + opt_size + i * 40
        name = data[off:off + 8].rstrip(b"\0").decode()
        vsize, vaddr, rawsize, rawptr = struct.unpack_from("<IIII", data, off + 8)
        secs.append((name, vaddr, vsize, rawptr, rawsize))
    return data, pe, secs

def rva_of(secs, raw):
    for name, vaddr, vsize, rawptr, rawsize in secs:
        if rawptr <= raw < rawptr + rawsize:
            return vaddr + (raw - rawptr)
    raise ValueError(hex(raw))

def raw_of(secs, rva):
    for name, vaddr, vsize, rawptr, rawsize in secs:
        if vaddr <= rva < vaddr + max(vsize, rawsize):
            return rawptr + (rva - vaddr)
    raise ValueError(hex(rva))

def va_to_raw(secs, va):
    return raw_of(secs, va - IMAGE_BASE)

def imports(data, pe, opt_size):
    """Yield (dll, member, iat_va) for every import."""
    d = pe + 24
    imp_rva, imp_size = struct.unpack_from("<II", data, d + 96 + 8)
    i = 0
    while True:
        ent = raw_of(SECS, imp_rva) + i * 20
        oft, _ts, _fc, name_rva, first = struct.unpack_from("<IIIII", data, ent)
        if name_rva == 0:
            break
        noff = raw_of(SECS, name_rva)
        dll = data[noff:data.index(b"\0", noff)].decode()
        thunk_rva = oft or first
        j = 0
        while True:
            t = struct.unpack_from("<I", data, raw_of(SECS, thunk_rva + j * 4))[0]
            if t == 0:
                break
            if t & 0x80000000:  # by ordinal
                member = "ordinal %d" % (t & 0xFFFF)
            else:
                hint_rva = t & 0x7FFFFFFF
                hoff = raw_of(SECS, hint_rva)
                member = data[hoff + 2:data.index(b"\0", hoff + 2)].decode()
            yield dll, member, IMAGE_BASE + first + j * 4
            j += 1
        i += 1

def bstr(data, secs, va):
    """Read a VB6 string literal: dword length at va-4, UTF-16 data at va."""
    ln = struct.unpack_from("<I", data, va_to_raw(secs, va) - 4)[0]
    raw = va_to_raw(secs, va)
    return data[raw:raw + ln].decode("utf-16-le")

def mid_picks(data, secs):
    """Immediates of the 'push imm8 ; ... ; call ebx' sites where ebx holds the
    rtcMidCharVar (ordinal 632) import.  Returns [(call_va, imm, dest_ebp_offset)]
    in program order, together with the chain boundary (the VarCat concat block).
    """
    lo = va_to_raw(secs, CHECK_FN[0])
    hi = va_to_raw(secs, CHECK_FN[1])
    body = data[lo:hi]
    out = []
    # The compiler emits "lea eax,[ebp-..] ; push eax ; push <index>" at the head
    # of every Mid$() argument block, and the block ends in "call ebx" where ebx
    # was loaded from the rtcMidCharVar IAT slot.
    for m in re.finditer(b"\x50\x6a(.)", body):
        nxt = body.find(b"\xff\xd3", m.end())
        if nxt == -1 or nxt - m.end() > 0x60:
            continue
        if body.find(b"\x50\x6a", m.end()) not in (-1,) and body.find(b"\x50\x6a", m.end()) < nxt:
            continue
        out.append((CHECK_FN[0] + m.start(), m.group(1)[0]))
    return out

data, pe, SECS = load()
print("file %s: %d bytes, %d sections" % (PATH, len(data), len(SECS)))
for name, vaddr, vsize, rawptr, rawsize in SECS:
    print("  %-8s VA %#x vsize %#x raw %#x" % (name, vaddr, vsize, rawptr))
print("\nimports:")
for dll, member, iat in imports(data, pe, pe and 224):
    print("  %#x  %-14s %s" % (iat, dll, member))

LITERALS = {
    "keypad legend": 0x4055E0,
    "digit 1": 0x405608, "digit 2": 0x405610, "digit 3": 0x405618,
    "digit 4": 0x405620, "digit 5": 0x405628, "digit 6": 0x405630,
    "digit 7": 0x405638, "digit 8": 0x405640, "digit 9": 0x405648,
    "ok message": 0x405650, "ok title": 0x40569C, "separator": 0x405694,
    "label caption": 0x40557C,
}
print("\nBSTR literals:")
for what, va in LITERALS.items():
    print("  %#08x  %-14s %r" % (va, what, bstr(data, SECS, va)))

print("\nrtcMidCharVar (ordinal 632) call sites in the check routine:")
picks = mid_picks(data, SECS)
for va, idx in picks:
    print("  %#08x  push %d" % (va, idx))

# The routine builds two concatenations out of Mid$() picks: the first one is
# the value the user input is compared against, the second one feeds the
# "Correct! The Magic Number is: " message.  Split at the VarCat block.
CONCAT_START = 0x407088
chain1 = [i for va, i in picks if va < CONCAT_START]
chain2 = [i for va, i in picks if va > CONCAT_START]
print("\nMid$() picks compared against the input : %s" % chain1)
print("Mid$() picks used in the success message: %s" % chain2)

for src in ("123456789", "987654321"):
    def pick(seq):
        return "".join(src[n - 1] for n in seq)
    print("\nsource string %r" % src)
    print("  check value      %s" % pick(chain1))
    print("  success message  %s-%s" % (pick(chain2[:6]), pick(chain2[6:])))