exe_shellcode.py

#! /usr/bin/python
import subprocess,glob,time

def execute(cmd):
    print cmd
    p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    for _ in xrange(10):
        if p.poll() != None:
            stdout_data, stderr_data = p.communicate()
            return stdout_data
        time.sleep(0.1)
    try:
        p.kill()
    except:
        pass
    print "TLE" #無限ループしてる短歌があるみたい
    return ""

cnt = 0
for file in glob.glob("/tmp/ctf/*/*/*"):
    x = execute('./a.out ' + file)
    if x == "0609":
        print "ok" , file
        break
    cnt += 1
    if cnt % 100 == 0:
        print cnt

shellcode.c

// 64bitでコンパイルするとx86のアセンブラ短歌は動かない
// gcc shellcode.c -o a.out -m32

#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
	char *addr;
	size_t psize;

#ifdef BSD
	psize = getpagesize();
#else
	psize = sysconf(_SC_PAGESIZE);
#endif
	if((posix_memalign((void **)&addr, psize, psize)))
		err(1, "posix_memalign");
	if(mprotect((void*)addr, psize, PROT_READ | PROT_WRITE | PROT_EXEC))
		err(1, "mprotect");
	FILE *fp = fopen(argv[1],"rb");
	fread(addr, 1, psize, fp);
	fclose(fp);
	((void(*)(void))addr)();
	return 0;
}

tanka.cs

using System;
using System.Collections.Generic;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.IO.Compression;
using System.Linq;
using System.Windows.Forms;

namespace csharp {
    static class Program {
        static bool[] GetPixcels(Bitmap bmp, Rectangle rect)
        {
            bool[] ret = new bool[rect.Height * rect.Width];
            int cnt = 0;
            for (int h = rect.Top; h < rect.Bottom; h++) {
                for (int w = rect.Left; w < rect.Right; w++) {
                    Color c = bmp.GetPixel(w, h);
                    ret[cnt++] = c.R > 128;
                }
            }
            return ret;
        }

        static bool[] toBoolMap(Bitmap bmp, int h, int w, int k)
        {
            const int H = 20;
            const int W = 12;
            int ha = 10 + h * 22;
            int wa = 8 + w * 36 + k * 13;
            Rectangle r = new Rectangle(wa, ha, W, H);
            return GetPixcels(bmp, r);
        }

        static List<bool[]> _learned;
        static void Learning(ZipArchive zip)
        {
            _learned = new List<bool[]>();
            var f02 = zip.GetEntry("1/00/02/taka.jpg");
            using (var s = f02.Open()) {
                var bmp = new Bitmap(Image.FromStream(s));
                _learned.Add(toBoolMap(bmp, 0, 2, 0)); // 0
                _learned.Add(toBoolMap(bmp, 2, 1, 1)); // 1
                _learned.Add(toBoolMap(bmp, 0, 3, 1)); // 2
                _learned.Add(toBoolMap(bmp, 1, 1, 0)); // 3
                _learned.Add(toBoolMap(bmp, 1, 0, 0)); // 4
                _learned.Add(toBoolMap(bmp, 0, 0, 0)); // 5
                _learned.Add(toBoolMap(bmp, 0, 1, 0)); // 6
                _learned.Add(toBoolMap(bmp, 1, 1, 1)); // 7
                _learned.Add(toBoolMap(bmp, 0, 4, 1)); // 8
                _learned.Add(toBoolMap(bmp, 0, 3, 0)); // 9
                _learned.Add(toBoolMap(bmp, 0, 0, 1)); // a
                _learned.Add(toBoolMap(bmp, 4, 6, 1)); // b
                _learned.Add(toBoolMap(bmp, 1, 5, 1)); // c
                _learned.Add(toBoolMap(bmp, 0, 1, 1)); // d
                _learned.Add(toBoolMap(bmp, 0, 2, 1)); // e
                _learned.Add(toBoolMap(bmp, 1, 6, 0)); // f
            }
        }

        static int toHex(Bitmap bmp, int h, int w, int k)
        {
            bool[] map = toBoolMap(bmp, h, w, k);
            int ret = -1, dist = 1000000;
            for (int i = 0; i < 16; i++) {
                for (int dw = -1; dw <= 1; dw++) {
                    int cost = 0;
                    for (int j = 0; j < map.Length; j++) {
                        int dj = j + dw;
                        if (dj < 0 || dj >= map.Length) continue;
                        if (map[dj] != _learned[i][j]) cost++; //dj = -1,1の時、この部分でバグがあるが今回は問題にならなかった
                    }
                    if (dist > cost) {
                        dist = cost;
                        ret = i;
                    }
                }
            }
            return ret;
        }

        static byte[] toBin(Image im)
        {
            Bitmap bmp = new Bitmap(im);

            byte[] ret = new byte[31];
            int ret_add = 0;

            int[] _w = { 5, 7, 5, 7, 7 };
            for (int h = 0; h < 5; h++) {
                for (int w = 0; w < _w[h]; w++) {
                    int left = toHex(bmp, h, w, 0);
                    int right = toHex(bmp, h, w, 1);
                    ret[ret_add++] = (byte)(left * 16 + right);
                }
            }

            return ret;
        }

        [STAThread]
        static void Main()
        {
            if (File.Exists(@"C:\share\ctf\tanka5t-50000-decode.zip"))
                File.Delete(@"C:\share\ctf\tanka5t-50000-decode.zip");

            using (var zip = ZipFile.OpenRead(@"C:\share\ctf\tanka5t-50000.zip"))
            using (var dest_zip = ZipFile.Open(@"C:\share\ctf\tanka5t-50000-decode.zip", ZipArchiveMode.Create)) {
                Learning(zip);
                int cnt = 0;
                foreach (var entry in zip.Entries) {
                    using (var s = entry.Open()) {
                        cnt++;
                        var im = Image.FromStream(s);
                        var bin = toBin(im);
                        var dest_entry = dest_zip.CreateEntry(entry.FullName.Substring(0, 7));

                        using (var d = dest_entry.Open()) {
                            d.Write(bin, 0, bin.Length);
                        }
                    }
                    if (cnt % 100 == 0) {
                        Console.WriteLine(cnt);
                    }
                }
            }
        }
    }
}