NepCTF2025 Writeup

今年打娱乐局

游戏题给我打爽了

Misc

NepBotEvent

查了一下这是linux用evdev捕获的数据，写个脚本还原一下

import struct
from datetime import datetime

KEY_MAP = {
    2: ("1", "!"), 3: ("2", "@"), 4: ("3", "#"), 5: ("4", "$"), 6: ("5", "%"),
    7: ("6", "^"), 8: ("7", "&"), 9: ("8", "*"), 10: ("9", "("), 11: ("0", ")"),
    12: ("-", "_"), 13: ("=", "+"), 16: ("q", "Q"), 17: ("w", "W"), 18: ("e", "E"),
    19: ("r", "R"), 20: ("t", "T"), 21: ("y", "Y"), 22: ("u", "U"), 23: ("i", "I"),
    24: ("o", "O"), 25: ("p", "P"), 26: ("[", "{"), 27: ("]", "}"), 30: ("a", "A"),
    31: ("s", "S"), 32: ("d", "D"), 33: ("f", "F"), 34: ("g", "G"), 35: ("h", "H"),
    36: ("j", "J"), 37: ("k", "K"), 38: ("l", "L"), 39: (";", ":"), 40: ("'", '"'),
    41: ("`", "~"), 43: ("\\", "|"), 44: ("z", "Z"), 45: ("x", "X"), 46: ("c", "C"),
    47: ("v", "V"), 48: ("b", "B"), 49: ("n", "N"), 50: ("m", "M"), 51: (",", "<"),
    52: (".", ">"), 53: ("/", "?"), 57: (" ", " "), 28: ("\n", "\n")
}

MODIFIER_KEYS = {
    "SHIFT": [42, 54],
    "CAPSLOCK": [58]
}

def parse_keylog(file_path):
    with open(file_path, "rb") as f:
        data = f.read()

    record_size = 24
    records = []
    for i in range(0, len(data), record_size):
        chunk = data[i:i+record_size]
        if len(chunk) != record_size:
            continue
        ts_sec, ts_usec, type_, code, value = struct.unpack("qqHHI", chunk)
        timestamp = datetime.fromtimestamp(ts_sec + ts_usec / 1_000_000)
        records.append({
            "timestamp": timestamp,
            "type": type_,
            "code": code,
            "value": value
        })
    return records

def reconstruct_text(records):
    shift = False
    capslock = False
    output = []

    for r in records:
        if r["type"] != 1:
            continue

        code = r["code"]
        value = r["value"] 

        if code in MODIFIER_KEYS["SHIFT"]:
            shift = value == 1
        elif code in MODIFIER_KEYS["CAPSLOCK"] and value == 1:
            capslock = not capslock
        elif value == 1:
            if code in KEY_MAP:
                char_lower, char_upper = KEY_MAP[code]
                if char_lower.isalpha():
                    char = char_upper if shift ^ capslock else char_lower
                else:
                    char = char_upper if shift else char_lower
                output.append(char)
            elif code == 14: 
                if output:
                    output.pop()
    return ''.join(output)

if __name__ == "__main__":
    filepath = "NepBot_keylogger" 
    records = parse_keylog(filepath)
    result = reconstruct_text(records)
    print("还原的用户输入为：")
    print(result)

image-20250726133947252

NepCTF{NepCTF-20250725-114514}

SpeedMino

查壳的时候发现可以改成zip解压

image-20250726211121758

找到main.lua中有疑似flag的部分youwillget

require'Zenitha'

ZENITHA.setFirstScene('main')
-- ZENITHA.setMaxFPS(60)
ZENITHA.globalEvent.drawCursor=NULL
ZENITHA.globalEvent.clickFX=NULL

SFX.load{
    clear_1='sound/clear_1.ogg',
    clear_2='sound/clear_2.ogg',
    clear_3='sound/clear_3.ogg',
    clear_4='sound/clear_4.ogg',
    spin_0='sound/spin_0.ogg',
    spin_1='sound/spin_1.ogg',
    spin_2='sound/spin_2.ogg',
    spin_3='sound/spin_3.ogg',
    drop='sound/drop.ogg',
    hold='sound/hold.ogg',
    lock='sound/lock.ogg',
    pc='sound/pc.ogg',
    rotate='sound/rotate.ogg',
    rotatekick='sound/rotatekick.ogg',
    start='sound/key.ogg',
    win='sound/win.ogg',
    fail='sound/fail.ogg',
    ren_1='sound/ren_1.ogg',
    ren_2='sound/ren_2.ogg',
    ren_3='sound/ren_3.ogg',
    ren_4='sound/ren_4.ogg',
    ren_5='sound/ren_5.ogg',
    ren_6='sound/ren_6.ogg',
    ren_7='sound/ren_7.ogg',
    ren_8='sound/ren_8.ogg',
    ren_9='sound/ren_9.ogg',
    ren_10='sound/ren_10.ogg',
    ren_11='sound/ren_11.ogg',   
}
BGM.load{
    secret7th_old='sound/secret7th_old.ogg',
}
BGM.play('secret7th_old')

love.keyboard.setKeyRepeat(false)
local actionList={
    'moveLeft',
    'moveRight',
    'rotateCW',
    'rotateCCW',
    'rotate180',
    'hold',
    'softDrop',
    'hardDrop',
}
local keyConf={
    'left',
    'right',
    'x',
    'z',
    'c',
    'lshift',
    'down',
    'up',
}
local sysKey={
    r='restart',
    ['-']='das-',
    ['=']='das+',
    ['[']='arr-',
    [']']='arr+',
}
local das,arr=10,2
local dropDelay,lockDelay=30,40

local _=false
local pieceList={
    {
        {_,1,1},
        {1,1,_},
    },
    {
        {2,2,_},
        {_,2,2},
    },
    {
        {3,3,3},
        {3,_,_},
    },
    {
        {4,4,4},
        {_,_,4},
    },
    {
        {5,5,5},
        {_,5,_},
    },
    {
        {6,6},
        {6,6},
    },
    {
        {7,7,7,7},
    },
}
local centerList={
    {[0]={2,1},    {1,2},    {2,2},    {2,2}},
    {[0]={2,1},    {1,2},    {2,2},    {2,2}},
    {[0]={2,1},    {1,2},    {2,2},    {2,2}},
    {[0]={2,1},    {1,2},    {2,2},    {2,2}},
    {[0]={2,1},    {1,2},    {2,2},    {2,2}},
    {[0]={1.5,1.5},{1.5,1.5},{1.5,1.5},{1.5,1.5}},
    {[0]={2.5,0.5},{0.5,2.5},{2.5,1.5},{1.5,2.5}},
}
local srs={
    [1]={
        [01]={{0,0},{-1,0},{-1,1},{0,-2},{-1,-2}},
        [10]={{0,0},{1,0},{1,-1},{0,2},{1,2}},
        [03]={{0,0},{1,0},{1,1},{0,-2},{1,-2}},
        [30]={{0,0},{-1,0},{-1,-1},{0,2},{-1,2}},
        [12]={{0,0},{1,0},{1,-1},{0,2},{1,2}},
        [21]={{0,0},{-1,0},{-1,1},{0,-2},{-1,-2}},
        [32]={{0,0},{-1,0},{-1,-1},{0,2},{-1,2}},
        [23]={{0,0},{1,0},{1,1},{0,-2},{1,-2}},
        [02]={{0,0}},
        [20]={{0,0}},
        [13]={{0,0}},
        [31]={{0,0}},
    },
    [6]={
        [01]={{0,0}},
        [10]={{0,0}},
        [12]={{0,0}},
        [21]={{0,0}},
        [23]={{0,0}},
        [32]={{0,0}},
        [30]={{0,0}},
        [03]={{0,0}},
        [02]={{0,0}},
        [20]={{0,0}},
        [13]={{0,0}},
        [31]={{0,0}},
    },
    [7]={
        [01]={{0,0},{-2,0},{1,0},{-2,-1},{1,2}},
        [10]={{0,0},{2,0},{-1,0},{2,1},{-1,-2}},
        [12]={{0,0},{-1,0},{2,0},{-1,2},{2,-1}},
        [21]={{0,0},{1,0},{-2,0},{1,-2},{-2,1}},
        [23]={{0,0},{2,0},{-1,0},{2,1},{-1,-2}},
        [32]={{0,0},{-2,0},{1,0},{-2,-1},{1,2}},
        [30]={{0,0},{1,0},{-2,0},{1,-2},{-2,1}},
        [03]={{0,0},{-1,0},{2,0},{-1,2},{2,-1}},
        [02]={{0,0}},
        [20]={{0,0}},
        [13]={{0,0}},
        [31]={{0,0}},
    },
}
for i=2,5 do srs[i]=srs[1] end
local colors={
    COLOR.lR,
    COLOR.lG,
    COLOR.lB,
    COLOR.lO,
    COLOR.lM,
    COLOR.lY,
    COLOR.lC,
}
local keyState
local field
local nextQueue,holdSlot
local hand
local handX,handY
local dir,center
local dropTimer,lockTimer=dropDelay,lockDelay
local ghostY
local moveDir,moveCharge
local time,line,b2b,combo,speedcombo,speedcombotime,score,scoreBuffer,multi,multiGauge,lastSpike,lastAttack
local lastSpikeTime,lastSpikeEndTime,lastAttackTime
local playing
local bindingKey=false
local secretBox
local youwillget,trymore,scoremore
local multiColorTable = {
    [0] = {1.0,1.0,1.0,0.5} ,
    {1.0,0.0,0.0,0.626} ,
    {1.0,0.5,0.0,0.626} ,
    {1.0,1.0,0.0,0.626} ,
    {0.5,1.0,0.0,0.626} ,
    {0.0,1.0,0.0,0.626} ,
    {0.0,1.0,0.5,0.626} ,
    {0.0,1.0,1.0,0.626} ,
    {0.0,0.5,1.0,0.626} ,
    {0.0,0.0,1.0,0.626} ,
    {0.5,0.0,1.0,0.626} ,
    {1.0,0.0,1.0,0.626} ,
    {1.0,0.5,0.5,0.626} ,
    {1.0,1.0,1.0,0.626} ,
}

local function KSA()
    local key = "Speedmino Created By MrZ and modified by zxc"
    local key_len = #key
    local S = {}
    for i = 0, 255 do
        S[i] = i
    end
    local j = 0
    for i = 0, 255 do
        j = (j + S[i] + string.byte(key, i % key_len +1 , i % key_len +1)) % 256
        S[i], S[j] = S[j], S[i]
    end
    return S
end

local secret_i = 0
local secret_j = 0

local function tableToStr(text)
    local text_len = text[0]
    local outstring = ""
    local c
    for i = 1, text_len do
        c = text[i]
        if c < 32 or c >= 127 then
            outstring = outstring .. "#"
        else
            outstring = outstring .. string.char(c)
        end
    end
    return outstring
end

local function calcData(text_table)
    local K = {}
    local text_len = text_table[0]
    K[0] = text_len
    for n = 1, text_len do

        secret_i = (secret_i + 1) % 256
        secret_j = (secret_j + secretBox[secret_i]) % 256

        secretBox[secret_i], secretBox[secret_j] = secretBox[secret_j], secretBox[secret_i]
        K[n] = (text_table[n] + secretBox[(secretBox[secret_i] + secretBox[secret_j]) % 256]) % 256
    end
    return K
end

local function testPos(p,x,y)
    if x<1 or x+#p[1]>11 or y<1 then return false end
    for _y=1,#p do
        for _x=1,#p[1] do
            if p[_y][_x] and field[y+_y-1][x+_x-1] then return false end
        end
    end
    return true
end

local function freshGhost()
    ghostY=handY
    while testPos(hand, handX, ghostY-1) do
        ghostY=ghostY-1
    end
    lockTimer=lockDelay
end

local function supplyNext()
    if #nextQueue>=6 then return end
    local l={1,2,3,4,5,6,7}
    TABLE.shuffle(l)
    for i=1,#l do
        local newPiece=TABLE.copy(pieceList[l[i]])
        newPiece.id=l[i]
        table.insert(nextQueue, newPiece)
    end
end

local function freshPiecePos()
    handY=21
    handX=math.floor(6-#hand[1]/2)
    dropTimer,lockTimer=dropDelay,lockDelay
    dir=0
    center=centerList[hand.id][dir]
    freshGhost()
    if not testPos(hand, handX, handY) then
        playing=false
        if trymore >= 2600 then
            SFX.play('win')
        else
            SFX.play('fail')
        end
    end
end

local function popNext()
    hand=table.remove(nextQueue, 1)
    freshPiecePos()
    if #nextQueue<7 then supplyNext() end
end

local function rotate(rotDir)
    local newHand=TABLE.rotate(hand, rotDir); newHand.id=hand.id
    local newDir=(dir+(rotDir=='R' and 1 or rotDir=='L' and -1 or 2))%4
    local newX=handX+center[1]-centerList[hand.id][newDir][1]
    local newY=handY+center[2]-centerList[hand.id][newDir][2]
    local list=srs[hand.id][dir*10+newDir]
    local success=false
    for i=1,#list do
        if testPos(newHand, newX+list[i][1], newY+list[i][2]) then
            success=true
            hand=newHand
            handX,handY=newX+list[i][1],newY+list[i][2]
            dir,center=newDir,centerList[hand.id][newDir]
            freshGhost()
            break
        end
    end
    if success then
        if
            not (
                testPos(hand, handX, handY+1) or
                testPos(hand, handX, handY-1) or
                testPos(hand, handX+1, handY) or
                testPos(hand, handX-1, handY)
            )
        then
            SFX.play('rotatekick')
        else
            SFX.play('rotate')
        end
    end
end

local function dropPiece()
    if handY~=ghostY then
        SFX.play('drop')
    end
    handY=ghostY
    local spin=not (
        testPos(hand, handX, handY+1) or
        testPos(hand, handX, handY-1) or
        testPos(hand, handX+1, handY) or
        testPos(hand, handX-1, handY)
    )
    for _y=1,#hand do
        for _x=1,#hand[1] do
            if hand[_y][_x] then
                field[handY+_y-1][handX+_x-1]=hand[_y][_x]
            end
        end
    end
    local cnt=0
    for y=#field,1,-1 do
        if TABLE.count(field[y], false)==0 then
            table.remove(field, y)
            table.insert(field, TABLE.new(false, 10))
            cnt=cnt+1
        end
    end
    if cnt>0 then
        local tempb2b = 0;
        if spin then SFX.play('spin_'..math.min(cnt, 4)) end
        SFX.play('clear_'..math.min(cnt, 4))

        line=line+cnt
        if spin or cnt >= 4 then b2b = b2b + 1 else tempb2b = b2b;b2b = -1 end
        combo = combo + 1
        if speedcombotime >= time then
            speedcombo = speedcombo + 1
        else
            speedcombotime = time
            speedcombo = 1
        end
        speedcombotime = speedcombotime + (cnt + 2) / (0.75 + (speedcombo *0.5) ^ 2) + 0.1
        SFX.play('ren_'..math.min(math.max(combo - 1, speedcombo - 2,0),11))
        local attack = 0
        multiGauge = multiGauge + cnt + 0.1
        attack = attack + cnt - 1
        if spin or cnt >= 4 then 
            attack = attack + 1
            if spin then
                attack = attack + 1
            end
            if b2b >= 1 then
                attack = attack + 1
            end
        end
        attack = attack + ((speedcombo + combo * 2) ^ 0.5 ) - 1

        if TABLE.count(field[1], false)==10 then
            SFX.play('pc')
            attack = attack * 1.5 + 4
            if tempb2b > 0 then
                b2b = tempb2b
                tempb2b = 0
            end
            b2b = b2b + 4
        end

        if tempb2b >= 4 then
            multiGauge = multiGauge + tempb2b * 0.5
            attack = attack + tempb2b
        end

        multiGauge = multiGauge + attack
        while multiGauge >= multi * 3 do
            multiGauge = multiGauge - multi * 3
            multi = multi + 1
        end

        scoreBuffer = scoreBuffer + attack * multi *0.25 * 2 + 1
        lastSpike = lastSpike + attack
        if attack >= 1 then
            lastSpikeTime = time
            lastSpikeEndTime = time + 2.6
            lastAttack = attack
            lastAttackTime = time
        end


    else
        if spin then 
            SFX.play('spin_0') 
            b2b = b2b + 1
        end
        combo = -1;
    end

    popNext()
    SFX.play('lock')
end



local function newGame()
    collectgarbage("collect")
    field=TABLE.newMat(false, 40, 10)
    nextQueue,holdSlot={},false
    moveDir,moveCharge=0,0
    supplyNext()
    popNext()
    keyState={
        moveLeft=false,
        moveRight=false,
        rotateCW=false,
        rotateCCW=false,
        rotate180=false,
        hold=false,
        softDrop=false,
        hardDrop=false,
    }
    time,line=0,0
    b2b,combo=-1,-1
    speedcombo = 0
    speedcombotime = 0
    playing=true
    scoreBuffer = 0
    score = 0
    multi = 1
    multiGauge = 0
    lastSpike = 0
    lastAttack = 0
    lastAttackTime = -1
    lastSpikeTime = 0
    lastSpikeEndTime = 0
    secretBox = KSA()
    secret_i = 0
    secret_j = 0
    youwillget = {187,24,5,131,58,243,176,235,179,159,170,155,201,23,6,3,210,27,113,11,161,94,245,41,29,43,199,8,200,252,86,17,72,177,52,252,20,74,111,53,28,6,190,108,47,16,237,148,82,253,148,6}
    youwillget[0] = #youwillget
    trymore = 0
    scoremore = 0
    local pass = CLIPBOARD.get()
    if #pass > 0 and #pass <= 55 then
        -- MSG('info', pass)
    else
        pass = ""
    end
    pass = pass .. string.rep(" ",55 - string.len(pass))
    local passTable = {}
    passTable[0] = #pass
    for n = 1, #pass do
        passTable[n] = string.byte(pass, n,n)
    end
    local result_table = calcData(passTable)
    SFX.play('start')
    local verfiy = true
    local answer_table = {222,174,208,225,137,95,76,120,104,84,161,74,222,237,242,91,249,20,13,126,69,81,231,170,178,8,164,164,169,2,191,138,156,165,185,42,75,23,89,160,5,134,82,78,10,120,108,98,114,159,59,243,87,214,243,}    
    for n = 1, #pass do
        if result_table[n] ~= answer_table[n] then
            verfiy = false
            break
        end
    end
    if verfiy then
        MSG('warn',"Maybe you are right or not?")
    end
end



local actions={
    moveLeft=function()
        if testPos(hand, handX-1, handY) then
            handX=handX-1
        end
        moveDir=-1
        moveCharge=0
        freshGhost()
    end,
	teleLeft=function()
        while testPos(hand, handX-1, handY) do
            handX=handX-1
        end
        moveCharge=0
        freshGhost()
    end,
    moveRight=function()
        if testPos(hand, handX+1, handY) then
            handX=handX+1
        end
        moveDir=1
        moveCharge=0
        freshGhost()
    end,
	teleRight=function()
        while testPos(hand, handX+1, handY) do
            handX=handX+1
        end
        moveCharge=0
        freshGhost()
    end,
    rotateCW=function()
        rotate('R')
    end,
    rotateCCW=function()
        rotate('L')
    end,
    rotate180=function()
        rotate('F')
    end,
    hold=function()
        local id=hand.id
        hand=TABLE.copy(pieceList[hand.id])
        hand.id=id
        if holdSlot then
            hand,holdSlot=holdSlot,hand
            freshPiecePos()
        else
            holdSlot=hand
            popNext()
        end
    end,
    softDrop=function()
        handY=ghostY
        freshGhost()
    end,
    hardDrop=function()
        dropPiece()
    end,
}
local actionsRel={
    moveLeft=function()
        moveDir=keyState.moveRight and 1 or 0
        moveCharge=0
    end,
    moveRight=function()
        moveDir=keyState.moveLeft and -1 or 0
        moveCharge=0
    end,
}
---@type Zenitha.Scene
local scene={}

function scene.load()
    newGame()
end

function scene.keyDown(key)
    if bindingKey then
        keyConf[bindingKey]=key
        bindingKey=bindingKey+1
        if bindingKey>8 then
            bindingKey=false
        end
        return true
    else
        if key=='tab' then
            bindingKey=1
            return true
        end
        if sysKey[key] then
            if sysKey[key]=='restart' then
                newGame()
            elseif sysKey[key]=='das-' then
                das=math.max(1, das-1)
            elseif sysKey[key]=='das+' then
                das=das+1
            elseif sysKey[key]=='arr-' then
                arr=math.max(0, arr-1)
            elseif sysKey[key]=='arr+' then
                arr=arr+1
            end
            return true
        end
        if not playing then return true end
        local action=actionList[TABLE.find(keyConf, key)]
        if action then
            keyState[action]=true
            (actions[action] or NULL)()
        end
    end
    return true
end

function scene.keyUp(key)
    if not playing then return end
    local action=actionList[TABLE.find(keyConf, key)]
    if action then
        keyState[action]=false
        (actionsRel[action] or NULL)()
    end
end

function scene.update(dt)
    if not playing then return end
    time=time+dt
    multiGauge = multiGauge - 1 * (multi ^ 2 + multi) * dt / 60
    if multiGauge < 0 then
        if multi >= 2 then
            multi = multi - 1
            multiGauge = multiGauge + multi * 3
        else
            multiGauge = 0
        end
    end
    scoreBuffer = scoreBuffer + multi * dt * 1 * 0.25
    if speedcombotime < time then
        lastSpikeEndTime = lastSpikeEndTime - 1 * dt
    end
    if time > lastSpikeEndTime then
        lastSpike = 0
    end

    local scoreAdd = math.min(scoreBuffer / 30,1.000)
    score = score + scoreAdd
    scoreBuffer = scoreBuffer - scoreAdd

    if trymore < 2600 and score >= (scoremore + 1 * 1) then
        trymore = trymore + 1
        scoremore = math.floor(score)
        youwillget = calcData(youwillget)
    end

    if moveDir~=0 then
        moveCharge=moveCharge+1
        local chrg=moveCharge
        if arr==0 then
            if moveCharge>=das then
                (actions[moveDir==1 and 'teleRight' or 'teleLeft'] or NULL)()
            end
        else
            if moveCharge>=das and (moveCharge-das)%arr==0 then
                (actions[moveDir==1 and 'moveRight' or 'moveLeft'] or NULL)()
            end
        end
        moveCharge=chrg
    end
    if keyState.softDrop then
        handY=ghostY
    end
    if handY>ghostY then
        dropTimer=dropTimer-1
        if dropTimer<=0 then
            handY=handY-1
            dropTimer=dropDelay
        end
    else
        lockTimer=lockTimer-1
        if lockTimer<=0 then
            dropPiece()
        end
    end
end

local gc=love.graphics
local gc_translate=gc.translate
local gc_setColor,gc_setLineWidth=gc.setColor,gc.setLineWidth
local gc_mRect, gc_mDraw, gc_mDrawQ, gc_strokeDraw = GC.mRect, GC.mDraw, GC.mDrawQ, GC.strokeDraw
local gc_draw = gc.draw
local gc_blurCircle, gc_strokePrint = GC.blurCircle, GC.strokePrint
local gc_rectangle=gc.rectangle
local gc_print=gc.print

local height_text = GC.newText(FONT.get(30))
local number_text = GC.newText(FONT.get(30))
local chargeIcon = GC.load {
    w = 512, h = 512,
    { 'move',   256,  256 },
    { 'fCirc',  0,    0,  180, 4 },
    { 'rotate', .5236 },
    { 'fCirc',  0,    0,  180, 4 },
    { 'rotate', .5236 },
    { 'fCirc',  0,    0,  180, 4 },
}
function scene.draw()
    -- Texts
    gc_setColor(COLOR.L)
    FONT.set(20)
    gc_print('Speedmino Created By MrZ and modified by zxc', 10, 0)
    gc_print('DAS    '..das, 10, 30)
    gc_print('ARR    '..arr, 10, 50)
    gc_print('Press - + [ ] to set DAS/ARR', 10, 80)
    if bindingKey then
        gc_setColor(love.timer.getTime()%.26<.126 and COLOR.L or COLOR.Y)
        gc_setLineWidth(1)
        gc_rectangle('line', 5, 124+20*bindingKey, 226, 20)
    end
    for i=1,#actionList do
        gc_print(actionList[i], 10, 120+20*i)
        gc_print(keyConf[i], 150, 120+20*i)
    end
    gc_print('Press Tab to rebind keys', 10, 310)
    
    -- Background Text 
    gc_setColor(0.15,0.15,0.15,1)
    if trymore >= 2600 then
        gc_setColor(COLOR.Orange)
    end
    FONT.set(40)
    gc_print(tableToStr(youwillget), 30, 400)
    if not playing then 
        gc_setColor(COLOR.DarkLight)
        gc_print("PRESS R TO TRY AGAIN", 450, 500)
    end

    gc_translate(475, 850)
    gc_setLineWidth(8)

    -- Time
    gc_setColor(COLOR.L)
    FONT.set(30)
    gc_print(string.format('%.3f', time), -160, -40)

    -- Multi
    gc_setColor(multiColorTable[(multi-1) % #multiColorTable])
    gc_rectangle('line', -4, 48, 408, -32)
    FONT.set(30)
    gc_print(string.format('x%d', multi), 412, 16)
    gc_rectangle('fill', 0, 24, 396, 16)
    local multiProgress = multiGauge / (multi * 3)
    gc_setColor(multiColorTable[(multi) % #multiColorTable])
    gc_rectangle('fill', 0, 24, multiProgress * 396, 16)

    -- Score
    gc_setColor(COLOR.L)
    FONT.set(30)
    
    height_text:set(("%.2f"):format(score))
    local wid, hgt = height_text:getDimensions()
    gc_strokeDraw('corner', 1, height_text, 200, 30, 0, 0.8, 0.8, wid / 2, hgt / 2)


    if playing then
        -- Board
        gc_setColor(COLOR.dL)

        gc_rectangle("line", -4, 4, 408, -808)
        -- Field
        for y=1,40 do
            for x=1,10 do
                if field[y][x] then
                    gc_setColor(colors[field[y][x]])
                    gc_rectangle('fill', (x-1)*40, -(y)*40, 40, 40)
                end
            end
        end

        -- Ghost
        gc_setColor(1, 1, 1, .26)
        for y=1,#hand do
            for x=1,#hand[1] do
                if hand[y][x] then
                    gc_rectangle('fill', (handX+x-2)*40, -(ghostY+y-1)*40, 40, 40)
                end
            end
        end

        -- Hand Outline
        gc_setColor(1, 1, 1, (lockTimer/lockDelay)^2)
        for y=1,#hand do
            for x=1,#hand[1] do
                if hand[y][x] then
                    gc_rectangle('fill', (handX+x-2)*40-4, -(handY+y-1)*40-4, 40+8, 40+8)
                end
            end
        end

        -- Hand
        for y=1,#hand do
            for x=1,#hand[1] do
                if hand[y][x] then
                    gc_setColor(colors[hand[y][x]])
                    gc_rectangle('fill', (handX+x-2)*40, -(handY+y-1)*40, 40, 40)
                end
            end
        end

        -- Hold
        if holdSlot then
            for y=1,#holdSlot do
                for x=1,#holdSlot[1] do
                    if holdSlot[y][x] then
                        gc_setColor(colors[holdSlot[y][x]])
                        gc_rectangle('fill', (x-3.5-#holdSlot[1]/2)*40, -(y+18.5-#holdSlot/2)*40, 40, 40)
                    end
                end
            end
        end

        -- Next
        for i=1,6 do
            for y=1,#nextQueue[i] do
                for x=1,#nextQueue[i][1] do
                    if nextQueue[i][y][x] then
                        gc_setColor(colors[nextQueue[i][y][x]])
                        gc_rectangle('fill', (x+11.5-#nextQueue[i][1]/2)*40,
                            -(y+18.5-#nextQueue[i]/2-(i-1)*2.5)*
                            40, 40, 40)
                    end
                end
            end
        end
    end
    
    local pos_x,pos_y,lefttime,b2bAlpha,spikeAlpha
    --B2B
    if b2b >= 1 then
        pos_x = -70
        pos_y = -600
        b2bAlpha = math.min(b2b * 0.1 - 0.3,1)
        gc_setColor(COLOR.L)
        FONT.set(30)
        gc_print("B2B x", pos_x - 130, pos_y - 15)

        gc_setColor(0.626,0,0,b2bAlpha)
        if b2b >= 4 then
            gc_blurCircle(-.26, pos_x, pos_y ,100 * 1)
            gc_mDraw(chargeIcon, pos_x, pos_y, time * 2.6, .25)
        end
        number_text:set(("%d"):format(b2b))
        gc_setColor(COLOR.Y)
        gc_mDraw(number_text, pos_x, pos_y, 0, 1)
    end
    
    --COMBO
    if combo >= 1 then
        pos_x = -100
        pos_y = -550
        gc_setColor(COLOR.L)
        FONT.set(25)
        gc_print("Combo x", pos_x - 130, pos_y - 15)
        gc_setColor(COLOR.B)
        number_text:set(("%d"):format(combo))
        gc_mDraw(number_text, pos_x + 30, pos_y, 0, 1)
    end

    --SPEEDCOMBO
    if speedcombo >= 1 then
        pos_x = -100
        pos_y = -500
        gc_setColor(COLOR.L)
        FONT.set(25)
        gc_print("Speed x", pos_x - 130, pos_y - 15)
        gc_setColor(COLOR.P)
        
        number_text:set(("%d"):format(speedcombo))
        gc_mDraw(number_text, pos_x + 30, pos_y, 0, 1)
        lefttime = math.min(speedcombotime - time,10)
        if lefttime >= 0 then
            gc_rectangle('fill', pos_x - 25, pos_y + 20, lefttime * 10, 5)
        end
    end

    --LastAttack Spike
    if lastSpike >= 8 then
        pos_x = -100
        pos_y = -300
        spikeAlpha = math.max(math.min(lastSpikeEndTime - time,2.0) / 2,0)
        gc_setColor(1,1,1,spikeAlpha)
        if lastSpike >= 10 then
            gc_blurCircle(-.26, pos_x, pos_y ,100 * 1)
            gc_mDraw(chargeIcon, pos_x, pos_y, time * lastSpike / 10, .2 + lastSpike / 400)
        end
        gc_setColor(1.0,0.192,0.15,spikeAlpha)
        number_text:set(("%d"):format(lastSpike))
        gc_mDraw(number_text, pos_x, pos_y, 0, 1 + lastSpike / 50)
    end

    pos_x = -100
    pos_y = -200
    if time - lastAttackTime < 0.5 then
        attackAlpha = 1.0
    else
        attackAlpha = math.max(math.min((lastAttackTime + 1.0 - time) * 2,1.0),0)
    end
    number_text:set(("+%d"):format(lastAttack))
    gc_setColor(0.960,0.545,0,attackAlpha)
    gc_mDraw(number_text, pos_x, pos_y, 0, 1)



end

SCN.add('main', scene)

丢给AI写脚本还原出来

def KSA(key):
    key_length = len(key)
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + ord(key[i % key_length])) % 256
        S[i], S[j] = S[j], S[i]
    return S

def calcData_corrected(text_table, secretBox, secret_i, secret_j):
    text_len = text_table[0]
    K = [0] * (text_len + 1) 
    K[0] = text_len
    
    for n in range(1, text_len + 1):
        secret_i = (secret_i + 1) % 256
        secret_j = (secret_j + secretBox[secret_i]) % 256
        secretBox[secret_i], secretBox[secret_j] = secretBox[secret_j], secretBox[secret_i]
        k_index = (secretBox[secret_i] + secretBox[secret_j]) % 256
        stream_byte = secretBox[k_index]
        
        # 模256加法加密
        K[n] = (text_table[n] + stream_byte) % 256
    
    return K, secretBox, secret_i, secret_j

def tableToStr_corrected(text_table):
    text_len = text_table[0] 
    out_string = ""
    for i in range(1, text_len + 1): 
        c = text_table[i]
        # 仅显示可打印ASCII字符
        if 32 <= c <= 126:
            out_string += chr(c)
        else:
            out_string += "#"
    return out_string

key = "Speedmino Created By MrZ and modified by zxc"
secretBox = KSA(key)
secret_i = 0
secret_j = 0

pass_table = [55] + [32] * 55  # [长度=55] + 55个空格(ASCII 32)
_, secretBox, secret_i, secret_j = calcData_corrected(
    pass_table, secretBox, secret_i, secret_j
)

initial_youwillget = [
    52,  # 长度字段
    187, 24, 5, 131, 58, 243, 176, 235, 179, 159,
    170, 155, 201, 23, 6, 3, 210, 27, 113, 11,
    161, 94, 245, 41, 29, 43, 199, 8, 200, 252,
    86, 17, 72, 177, 52, 252, 20, 74, 111, 53,
    28, 6, 190, 108, 47, 16, 237, 148, 82, 253,
    148, 6
]

current_data = initial_youwillget
for _ in range(2600):
    current_data, secretBox, secret_i, secret_j = calcData_corrected(
        current_data, secretBox, secret_i, secret_j
    )
    
final_message = tableToStr_corrected(current_data)
print("胜利后的消息:", final_message)
#胜利后的消息: NepCTF{You_ARE_SpeedMino_GRAND-MASTER_ROUNDS!_TGLKZ}

MeowBle喵泡

我甚至开CE玩通关了一遍

大多数flag片段都能在文件中找到，包括一些hint

image-20250727111746336

image-20250727111802903

image-20250727111834582

这里的hint指的其实就是经典的作弊代码konami代码：上上下下左右左右BA

开始游戏以后在暂停的面板这么做就能进入一个GM Mode

help命令查看帮助后得知用getflag 7获取最后一段flag

image-20250727112156294

客服小美

一眼CS流量，给内存肯定是要dump beacon的进程

image-20250727153714802

接下来照这篇文章做就行

简单尝试后不难识别出这是cs4.x的流量。查看流量中的data，长度为68的这条大概就是密钥了

python3 cs-parse-traffic.py -k unknown DESKTOP.pcapng

image-20250727154049402

从进程中提取hmac key和aes key

image-20250727154432297

解密所有流量

python3 cs-parse-traffic.py -k 35d34ac8778482751682514436d71e09:a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7 DESKTOP.pcapng

image-20250727154605970

NepCTF{JohnDoe_192.168.27.132:12580_5c1eb2c4-0b85-491f-8d50-4e965b9d8a43}

Web

easyGooGooVVVY

查到一个CVE，把里面的脚本拿来一用: CVE-2015-1427

flag在环境变量里

image-20250727141302261

RevengeGooGooVVVY

虽然不懂，但是用上题的exp一样能拿到flag（？

image-20250727141625337

JavaSeri

shiro框架写脸上了

image-20250727142653460

shiro attack一把梭了

image-20250727142721702

image-20250727142754153