Challenge

Server: nc 34.92.185.118 10003
File: task.py

Solution

Like babyprng, command operation has change, the output condition become strict.

1
2
3
4
5
6
7

\x00: out.append(pop())
\x01: if stack[-1] == 1 then pc++
\x02: stack[-1] &= stack[-2]
\x03: stack[-1] |= stack[-2]
\x04: stack[-1] ^= stack[-2]
\x06: pop()
\x30 ~ \x50: jmp to pc - command + 0x30

This time, the target is make the output contain over 0.3*SIZE bits and halfs of 0,1 (delta=0.002)

First loop (Ensure last two bits are [01 or 11] )

‘\x03\x01\x06\x01\x34’

Second loop (transfer the last 2 bits [01 or 11] into [01 or 10] then pop out)

‘\x03\x04\x00\x00\x39’

payload : ‘03010601340304000039’

*ctf{e48af588d4b80ade5ad44a8b5c90d222}

solve.py