Quintec

osu!gaming CTF 2024 Postmortem

2024-03-03T00:00:00+00:00

Hi everyone! It’s been a while. I’ve been busy with school and other hobbies (check out my anime piano YT) over the past year, not having much time to do CTF-related things. But that all changed this year, when me and a group of a few friends who were both CTF enthusiasts and osu! players decided to create osu!gaming CTF: a CTF themed around the popular rhythm game osu!. I was excited by the potential of this unique concept and quickly got on board—I don’t think there’s been any event I’ve put nearly as much effort into recently.

This CTF is very different than any other I’ve authored challenges for, given its unique themeing and therefore unique targeted audience. The primary goal (at least for me) was to get osu! players interested and excited about cybersecurity, while creating fun osu! themed challenges along the way. Getting CTF players interested in osu! was a bonus (and it seems like it did happen, according to the Discord!). This allowed for interesting and unique challenge ideas, some successful, others not as much. We also ended up giving a lot more hints this CTF than normal as a result, though we tried to keep it mostly to the challenges with more solves.

So I’m going to do something a little different this time: below you will find solutions to all my challenges, but also thoughts and reflections on how I created it in the context of this CTF.

Before I start, I just want to say we are reading all the survey responses and appreciate all the feedback that was given. Topics like the difficulty curve, amount of osu! theming, and beginner friendliness had differing opinions from many different people and we will work hard to balance it well if we host a next iteration of this event. My thoughts below are just a small portion of things we are taking into consideration.

crypto/base727

This challenge was mostly a joke that was literally “written” in the last 5 minutes. Both screenshots in the description are true. But it felt like a decent starting point for beginners—read some code and figure out how to reverse it to decrypt it.

Solution

Just reverse the encoding. The encoding function takes your string, and calculates a number from it treating it as base 256 using char codes, then converts it to base 727. All of these steps are reversible, and tbh you can probably ask ChatGPT to do it—here’s one solution:

import binascii

def decode_base_727(encoded_string):
    base = 727
    decoded_value = 0

    for char in encoded_string:
        decoded_value = decoded_value * base + ord(char)

    decoded_string = ""
    while decoded_value > 0:
        decoded_string = chr(decoded_value % 256) + decoded_string
        decoded_value //= 256

    return decoded_string

encoded_string = input("Enter the encoded string: ")
decoded_string = decode_base_727(binascii.unhexlify(encoded_string).decode())
print("Decoded string:", decoded_string)

web/mikufanpage

Honestly, I liked the concept of this challenge a lot. Besides the fact that, well, Miku, I thought it was a pretty good introduction to a basic web technique (LFI) that anyone could try and solve, since it essentially boiled down to understanding only 2 lines of code. And I did see (and help) many people go from nothing to figuring out how to solve this challenge, which makes me happy.

Solution

The website is a tribute to Miku, that, amid a bunch of rainbow flashing <marquee>s, has a slideshow of Miku pictures. Looking in the source code, the Miku pictures come from the /image endpoint:

app.get("/image", (req, res) => {
    if (req.query.path.split(".")[1] === "png" || req.query.path.split(".")[1] === "jpg") { // only allow images
        res.sendFile(path.resolve('./img/' + req.query.path));
    } else {
        res.status(403).send('Access Denied');
    }
});

Looking at this, we see we can read any file we want, but it seems to check if it has the extension png or jpg. There’s just one problem: the first index of a split is not necessarily the end of the string, if there are multiple periods. We can put this idea together with the fact that we can use relative directories (due to path.resolve) to solve with a URL such as https://mikufanpage.web.osugaming.lol/image?path=.png./../flag.txt.

crypto/korean-offline-mafia

Not too much to say about this one. I mostly made this challenge because I liked the description I wrote. But I also did try to keep it relatively accessible to beginners: the operations used are very simple and don’t rely on any external libraries.

Solution

This challenge implements a very basic form of ZKP that allows you to prove you know a secret number $a$ (or a list of them) given $a^2 \pmod{n}$, relying on the hardness of square root $\pmod{n}$. The scheme works perfectly fine if you do know the secrets: you give the server $x \equiv r^2 \pmod{n}$, then given a mask you give the server $r \cdot a_1\dots a_k \pmod{n}$, and the server checks that $(r \cdot a_1\dots a_k)^2 \equiv r^2 \cdot a_1^2 \dots a_k^2 \pmod{n}$. However, the problem is the mask, or “challenge” that the server generates with random.randbits to make you prove you know the secrets. Python’s random module uses the Mersenne Twister, a pseudorandom number generator that is reversible given enough inputs. So after enough tries, you can predict the mask that the server will give you. Why is this a problem? Well, the server verifies your number by squaring it and comparing it with a product of squares with a second number $x$ that you provide. So if you know a bit in the mask is 1, then you know the server will multiply by $a_i^2$, so you can negate that by multiplying $x$ by $\left(a_i^2\right)^{-1} \pmod{n}$ first, so you can achieve equality without ever knowing what $a_i$ is. Here’s a sample solution that uses randcrack (POW not included):

import secrets
from pwn import *
from randcrack import RandCrack
from Crypto.Util.number import *

rc = RandCrack()

sh = remote('chal.osugaming.lol', 7275)
print(sh.recvuntil(b'solution: '))
sh.sendline(input().encode())

sh.recvuntil(b'n = ')
n = int(sh.recvline().decode().strip())
sh.recvuntil(b'vs = ')
vs = [int(num) for num in sh.recvline().decode().strip()[1:-1].split(',')]

for _ in range(624):
	r = secrets.randbelow(n)
	x = pow(r, 2, n)

	sh.recvuntil(b': ')
	sh.sendline(str(x).encode())
	sh.recvuntil(b': ')
	mask = int(sh.recvline().decode().strip(), 2)
	rc.submit(mask)
	sh.recvuntil(b': ')
	sh.sendline(str(x).encode())

for _ in range(10):
	mask = '{:032b}'.format(rc.predict_getrandbits(32))
	#print('preddd', mask)
	y = secrets.randbelow(n)
	x = pow(y, 2, n)
	for i in range(32):
		if mask[i] == '1':
			x = (x * inverse(vs[i], n)) % n

	sh.recvuntil(b': ')
	sh.sendline(str(x).encode())
	sh.recvuntil(b': ')
	mask = sh.recvline().decode().strip()

	sh.recvuntil(b': ')
	sh.sendline(str(y).encode())
sh.interactive()

crypto/secret-map

This was supposed to be a simple osu! themed challenge on a basic CTF topic (xor). I’m not too sure why this got so few solves relative to korean-offline-mafia: maybe I should’ve provided more context for CTF players about how osu! beatmaps work, even if the information was all on the wiki.

Solution

All osu! beatmap .osz files are just .zip files: so we can unzip it and see that inside there is a flag.osu.enc file along with a enc.py file, in addition to the rest of a normal beatmap folder. We can see that the enc.py file was used to encrypt some flag.osu map:

import os

xor_key = os.urandom(16)

with open("flag.osu", 'rb') as f:
    plaintext = f.read()

encrypted_data = bytes([plaintext[i] ^ xor_key[i % len(xor_key)] for i in range(len(plaintext))])

with open("flag.osu.enc", 'wb') as f:
    f.write(encrypted_data)

This was encrypted with xor, which is a function that is reversible with the same key. However, not only that, if you know what parts of it decrypt to, you can get the key by xoring the plaintext with the ciphertext. If you check the osu!wiki, you can see that all .osu files begin with osu file format v14 (at least the current version of .osu files do). There is also another .osu file in the beatmap folder that begins with this header to show you this. Therefore we can decrypt the entire .osu file by using this known plaintext to recover the key, and from there it is just reading the flag from the map.

with open("flag.osu.enc", 'rb') as f:
    encrypted_data = f.read()

known_plaintext = b"osu file format "

xor_key = bytes([encrypted_data[i] ^ known_plaintext[i % len(known_plaintext)] for i in range(len(known_plaintext))])

decrypted_data = bytes([encrypted_data[i] ^ xor_key[i % len(xor_key)] for i in range(len(encrypted_data))])

with open("flag.osu", 'wb') as f:
    f.write(decrypted_data)

osu/sanity-check-3

This challenge took far longer to write than I expected. Following sanity-check-2, where editing replay metadata was sufficient to get the flag (and the win condition was much easier), I wanted to create a challenge where the replay data actually had to be accurate. However, this proved to be much more difficult than I originally thought due to a variety of quirks in how osu! gameplay is calculated. I’ll spare you all the details and share just one bit of unexpected information I found while creating this challenge: osu! sliderends are not judged at the time of the sliderend, but 36ms earlier (or at the middle of the slider, if the slider is less than 72ms long). This makes calculating sliderends very annoying, since you have to trace back 36 ms from the end of the slider, which means you actually have to calculate the full slider curve instead of just using the slider end position.

Anyways, challenge creation difficulty aside, I do think this is a point where the beginner experience could have been made better. We had countless tickets with people struggling with base64 encoding and proof of work, which could have been all avoided if we had just provided a website to submit the replay files on instead. But this is a double-edged sword: we do want competitors to get experience with concepts such as base64 encoding and CTF tools such as pwntools, which the website solution would bypass. Just some food for thought…

Solution

This challenge would be solvable using osu!’s Auto mod, after editing metadata to be correct, if not for one small problem: Auto actually sliderbreaks on the last slider. If we look in the editor, we can notice that this happens because the last circle in the map occurs exactly at the last slider’s reverse point. This sliderbreaks because osu!’s Auto tries to hit every object exactly as it’s timed, with 0 UR, but this means that it will guaranteed not be following the slider at the reverse tick, resulting in a sliderbreak. To fix this, note that you can hit the circle up to ~30ms earlier/later than it actually is timed and still get a 300, so if we hit the circle first and then return to the slider before the reverse slider tick, we can SS the map. A simple way to make this change is to edit the map by moving the last circle ~10ms, taking the Auto replay of that, and then changing the beatmap hash (since it changed due to changing the map).

osu/eat-healthy

This challenge was just intended to show something fun about osu!. To be honest it’s not great design, especially for a CTF, but I hope it was somewhat interesting at least. I think I will try to make less of these “osu! knowledge” challenges if we host a second iteration, or maybe hint them more explicitly so both osu! players and non osu! players can solve them.

Solution

The description and title hint towards the fact that it is not an osu! standard map at all—it’s actually an osu! CTB map. (The song choice also somewhat hints towards this, though not strictly necessary to know—a catch map of this song is included in one of the tutorial packs, and the most played map of this song is in CTB mode.) If you switch the gamemode to CTB in the editor, and then you play the map, you will see letters that spell out the flag.

crypto/roll

Ok, honestly, this challenge I do regret a bit. I didn’t realize that osu! IRC was not immediately available to new accounts, so you had to use the web chat, introducing quite a bit of variable latency. What’s more, for some people the web chat didn’t work at first either for some reason, and the rate-limiting I implemented didn’t work at first due to changes in the Rust IRC crate. I tried too hard to make the !roll gimmick realistic with the IRC bot, and it ended up just making the challenge unnecessarily annoying to solve for some people. So to those people I do apologize, and I hope some people were still able to enjoy this challenge.

Solution

As I stated above, the challenge is a osu! IRC bot that allows you to challenge it to a !roll game. But beating it isn’t enough to get the flag—reading the source code, you can see that you actually have to get exactly one higher than the bot roll (to “tilt” it), and you have to do it 5 times in a row. So how can we do this? Looking at the source code for the roll function:

fn get_roll() -> i32 {
    let seed = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs();
    let mut rng = SmallRng::seed_from_u64(seed);
    rng.gen_range(1..101)
}

The code seeds an PRNG with the current time in seconds. This means that for the most part we should be able to predict the output of any !roll command we send, so we can send a !roll command at the right time by searching through the next few timestamps until we find one with the right !roll we need. There will be delay with the server, but it should be fairly consistent (if you are connecting using IRC and not the website) and you should be able to calculate it based on the result of your rolls. Here’s a sample solution based on the bot code:

use futures::prelude::*;
use irc::client::prelude::*;
use log::{error, info, LevelFilter};
use rand::rngs::SmallRng;
use rand::{Rng, SeedableRng};
use simple_logger::SimpleLogger;
use std::time::{SystemTime, UNIX_EPOCH};
use std::sync::Arc;

fn get_seed_for_target(target: i32) -> u64 {
    let mut seed = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs() + 3;
    let mut rng = SmallRng::seed_from_u64(seed);
    while rng.gen_range(1..101) != target {
        seed += 1;
        rng = SmallRng::seed_from_u64(seed);
    }
    println!("Seed for {}: {}", target, seed);
    seed
}


struct Bot {
    client: Client,
    sender: Option<Arc<Sender>>,
}

impl Bot {
    async fn run(&mut self) -> irc::error::Result<()> {
        self.client.identify()?;
        let mut stream = self.client.stream()?;
        self.sender = Some(Arc::new(self.client.sender()));
        while let Some(message) = stream.next().await.transpose()? {
            let Some(target) = message.response_target() else {
                info!("Failed to find target for message: {:#?}", message);
                continue;
            };
            match &message.command {
                Command::QUIT(_) => continue,
                Command::PRIVMSG(_, msg) => {
                    info!("{:?} {:?}", message.prefix, message.command);

                    if msg.starts_with("I rolled") {
                        self.handle_roll(msg.to_string(), target);
                    }

                    if msg.starts_with("Bet") {
                        self.handle_roll(msg.to_string().split_whitespace().skip(6).map(|word| format!("{} ", word)).collect(), target);
                    }
                }
                _ => info!("{:?} {:?}", message.prefix, message.command),
            }
        }
        Ok(())
    }

    fn handle_roll(&mut self, msg: String, _target_user: &str) {
        let target = msg
            .split_whitespace()
            .nth(3).unwrap();
        let target = target[..target.len() - 1].parse::<i32>().unwrap();
        let seed = get_seed_for_target(target + 1);

        let sender = self.sender.as_ref().unwrap().clone();
        tokio::spawn(async move {
            let now = SystemTime::now()
                .duration_since(UNIX_EPOCH)
                .unwrap()
                .as_millis() as u64;
            let sleep_dur = seed * 1000 - now + 750;
            tokio::time::sleep(tokio::time::Duration::from_millis(sleep_dur)).await;
            sender.send_privmsg("QuintecX", format!("!roll {}", target));
        });
    }
}

#[tokio::main]
async fn main() -> irc::error::Result<()> {
    SimpleLogger::new()
        .with_level(LevelFilter::Info)
        .init()
        .unwrap();
    let mut bot = Bot {
        client: Client::new("config.toml").await?,
        sender: None,
    };

    match bot.run().await {
        Ok(_) => info!("Bot exited successfully"),
        Err(e) => error!("Bot exited with error: {}", e),
    }

    Ok(())
}

P.S. Learn Rust. Rust is cool. If you learned Rust to solve this challenge I consider that a massive win.

osu/futsuu

I also expected this challenge to get way more solves than it actually did. It is another combination of a basic encoding (morse) with osu! game mechanics, similar to crypto/secret-map, which seems to be a bad combination. This particular challenge does seem quite guessy without prior osu! knowledge. Trying to create challenges for osu! players that could be solved without too much security knowledge but still be interesting for CTF players is a hard balance.

Solution

The map provided is a taiko map. Given the fact that taiko maps use two types of drum sounds—don and kat—you might think to try some sort of two symbol encoding. What’s more, the song, Frums - Xnor Xnor Xnor, is a song famous for having hidden meaning in morse code throughout the song. This might lead you to try decrypting the taiko map as morse code, using the finishes as character separators, which gives you the flag.

Conclusion

Wow, this was a long post. Overall, I enjoyed hosting this CTF a lot and I hope that everyone who played was able to have fun and learn something new. :D It was fun to see osu! players get excited about cybersecurity. Well, that’s all from me for now. To quote osu! when you quit the game,

see you next time…

Let’s Play Osu!Mania

2022-10-08T00:00:00+00:00

Let’s Play Osu!Mania was a programming challenge in SekaiCTF 2022 where you were given an input file that represented an osu!mania beatmap and had to determine how many objects there were in the beatmap. Here’s a sample input file:

13
|-- -|
| #  |
| #- |
| #  |
| - -|
|-   |
| - -|
|    |
|  --|
|- # |
| -# |
|  # |
|  - |

As an avid osu! player and mapper as well as a (former) competitive programmer, this challenge seemed right up my alley. I quickly grasped and appreciated the intricacies of the problem - as a seasoned programmer, I knew the challenge was clearly too difficult to manually compute. I realized that the title, “Let’s PLAY Osu!Mania”, must be a hint - we can use osu! itself to do the calculation for us! I came up with a solution path:

Parse the input file and figure out where every object is
Write those objects in .osu beatmap format into a .osu beatmap file
Package the .osu beatmap file into an importable .osz
Open the .osz and have osu! process the beatmap
Read off the object count from osu!’s GUI

Let’s get started. Parsing the input file is easy:

n = int(input())
arr = []
for i in range(n):
    arr.append(list(input()))

Easy enough. Next we have to actually write the .osu beatmap file. The osu! wiki was very helpful here, telling us everything we need. With that in mind, I created a beatmap header and functions to create the actual objects.

beatmap = """osu file format v14

[General]
AudioFilename: audio.mp3
AudioLeadIn: 0
PreviewTime: -1
Countdown: 0
SampleSet: Normal
StackLeniency: 0.7
Mode: 3
LetterboxInBreaks: 0
SpecialStyle: 0
WidescreenStoryboard: 0

[Editor]
DistanceSpacing: 0.8
BeatDivisor: 4
GridSize: 8
TimelineZoom: 1

[Metadata]
Title:CTF
TitleUnicode:CTF
Artist:Sekai
ArtistUnicode:Sekai
Creator:QuintecX
Version:a
Source:
Tags:
BeatmapID:0
BeatmapSetID:-1

[Difficulty]
HPDrainRate:5
CircleSize:4
OverallDifficulty:5
ApproachRate:5
SliderMultiplier:1.4
SliderTickRate:1

[Events]
//Background and Video events
//Break Periods
//Storyboard Layer 0 (Background)
//Storyboard Layer 1 (Fail)
//Storyboard Layer 2 (Pass)
//Storyboard Layer 3 (Foreground)
//Storyboard Layer 4 (Overlay)
//Storyboard Sound Samples

[TimingPoints]
0,500,4,1,0,100,1,0

[HitObjects]
"""

def circle(beat, col):
    x = [64, 192, 320, 448][col - 1]
    return f"{x},192,{beat},1,0,0:0:0:0:\n"
    return hstr

def hold(beat, col, duration):
    x = [64, 192, 320, 448][col - 1]
    time = duration * 250
    return f"{x},192,{beat},128,0,{beat+time}:0:0:0:0:\n"

def time_cmp(obj1, obj2):
    t1, t2 = int(obj1.split(',')[2]), int(obj2.split(',')[2])
    if t1 < t2:
        return -1
    elif t1 == t2:
        return 0
    else:
        return 1

Now to actually parse the objects - just loop through the columns. In the end, since we went column by column instead of timestep by timestep, we’ll have to sort the objects in the right order:

def time_cmp(obj1, obj2):
    t1, t2 = int(obj1.split(',')[2]), int(obj2.split(',')[2])
    if t1 < t2:
        return -1
    elif t1 == t2:
        return 0
    else:
        return 1

def column(matrix, i):
    return [row[i] for row in matrix]

notes = []

for i in range(1, 5):
    col = column(arr, i)
    h = False
    c = False
    hold_len = 0
    beat = 0
    for char in col:
        if char == '-':
            if h:
                notes.append(hold(beat - 250 * (hold_len + 1), i, hold_len + 1))
                hold_len = 0
            else:
                c = True
            h = False
        elif char == '#':
            h = True
            c = False
            hold_len += 1
        elif c:
            c = False
            notes.append(circle(beat - 250, i))
        beat += 250
beatmap += ''.join(sorted(notes, key=cmp_to_key(time_cmp)))

Now we just have to package the beatmap with a random audio file lying around on my computer, and then we can open it in osu!

with open('Sekai - CTF (QuintecX) [a].osu', 'w') as f:
    f.write(beatmap)

zipObj = ZipFile('sekaictf.osz', 'w')
zipObj.write('audio.mp3') # every self respecting osu! player has an Freedom Dive audio.mp3 in every single folder
zipObj.write('Sekai - CTF (QuintecX) [a].osu')
zipObj.close()

At this point, if you open the sekaictf.osz file, you should get something that looks like this:

As you can see, osu! has done all the hard work of computing the answer, and we merely have to grab it from the top left corner of the screen. That’s easy enough - we just take a screen grab and use PyTesseract!

os.startfile('sekaictf.osz')  
time.sleep(15) #my computer is a potato

mon = {'top': 0, 'left': 0, 'width': 414, 'height': 180}
with mss.mss() as sct:
    im = numpy.asarray(sct.grab(mon))
    text = pytesseract.image_to_string(im)
    print(text.split("Objects: ")[1].split()[0])

Putting it all together with the test input file:

PS C:\Users\[redacted]\Downloads> cat .\1.in | py .\osumania.py
12

Beautiful. Unfortunately, for some odd reason, this solution did not work on the Online Judge server. Apparently it didn’t have osu! installed? I could not believe this large oversight on behalf of the organizers. My hard-earned CTF points vanished before my eyes, and all I have left is this writeup. You can find the final code below:

from functools import cmp_to_key
from zipfile import ZipFile
import os, cv2, pytesseract, mss, numpy, subprocess, time

pytesseract.pytesseract.tesseract_cmd = "C:\\Program Files\\Tesseract-OCR\\tesseract.exe"

beatmap = """osu file format v14

[General]
AudioFilename: audio.mp3
AudioLeadIn: 0
PreviewTime: -1
Countdown: 0
SampleSet: Normal
StackLeniency: 0.7
Mode: 3
LetterboxInBreaks: 0
SpecialStyle: 0
WidescreenStoryboard: 0

[Editor]
DistanceSpacing: 0.8
BeatDivisor: 4
GridSize: 8
TimelineZoom: 1

[Metadata]
Title:CTF
TitleUnicode:CTF
Artist:Sekai
ArtistUnicode:Sekai
Creator:QuintecX
Version:a
Source:
Tags:
BeatmapID:0
BeatmapSetID:-1

[Difficulty]
HPDrainRate:5
CircleSize:4
OverallDifficulty:5
ApproachRate:5
SliderMultiplier:1.4
SliderTickRate:1

[Events]
//Background and Video events
//Break Periods
//Storyboard Layer 0 (Background)
//Storyboard Layer 1 (Fail)
//Storyboard Layer 2 (Pass)
//Storyboard Layer 3 (Foreground)
//Storyboard Layer 4 (Overlay)
//Storyboard Sound Samples

[TimingPoints]
0,500,4,1,0,100,1,0

[HitObjects]
"""

def circle(beat, col):
    x = [64, 192, 320, 448][col - 1]
    return f"{x},192,{beat},1,0,0:0:0:0:\n"
    return hstr

def hold(beat, col, duration):
    x = [64, 192, 320, 448][col - 1]
    time = duration * 250
    return f"{x},192,{beat},128,0,{beat+time}:0:0:0:0:\n"

def time_cmp(obj1, obj2):
    t1, t2 = int(obj1.split(',')[2]), int(obj2.split(',')[2])
    if t1 < t2:
        return -1
    elif t1 == t2:
        return 0
    else:
        return 1


n = int(input())
arr = []
for i in range(n):
    arr.append(list(input()))

def column(matrix, i):
    return [row[i] for row in matrix]

notes = []

for i in range(1, 5):
    col = column(arr, i)
    h = False
    c = False
    hold_len = 0
    beat = 0
    for char in col:
        if char == '-':
            if h:
                notes.append(hold(beat - 250 * (hold_len + 1), i, hold_len + 1))
                hold_len = 0
            else:
                c = True
            h = False
        elif char == '#':
            h = True
            c = False
            hold_len += 1
        elif c:
            c = False
            notes.append(circle(beat - 250, i))
        beat += 250
beatmap += ''.join(sorted(notes, key=cmp_to_key(time_cmp)))

with open('Sekai - CTF (QuintecX) [a].osu', 'w') as f:
    f.write(beatmap)

zipObj = ZipFile('sekaictf.osz', 'w')
zipObj.write('audio.mp3') # every self respecting osu! player has an Freedom Dive audio.mp3 in every single folder
zipObj.write('Sekai - CTF (QuintecX) [a].osu')
zipObj.close()

os.startfile('sekaictf.osz')  
time.sleep(15) #my computer is a potato

mon = {'top': 0, 'left': 0, 'width': 414, 'height': 180}
with mss.mss() as sct:
    im = numpy.asarray(sct.grab(mon))
    text = pytesseract.image_to_string(im)
    print(text.split("Objects: ")[1].split()[0])

corCTF 2022

2022-08-31T00:00:00+00:00

Another year, another successful CTF :) with a rather impressive 36.96 / 37.380 rating on CTFTime.

Sadly, behind the scenes, this year was less successful for me specifically - besides the two challenges that ended up in the CTF, I had two harder crypto challenges that did not make it - one which I could not fit well into the CTF format, and one that I ended up not solving due to not having time during the summer. Maybe you’ll see them in the future :)

Enough regrets, here are writeups for my challenges in corCTF 2022:

hidE

hidE was a short and simple RSA challenge. The source looks like this:

#!/usr/local/bin/python
import random
import time
import math
import binascii
from Crypto.Util.number import *

p, q = getPrime(512), getPrime(512)
n = p * q
phi = (p - 1) * (q - 1)

flag = open('./flag.txt').read().encode()

random.seed(int(time.time()))

def encrypt(msg):
    e = random.randint(1, n)
    while math.gcd(e, phi) != 1:
        e = random.randint(1, n)
    pt = bytes_to_long(msg)
    ct = pow(pt, e, n)
    return binascii.hexlify(long_to_bytes(ct)).decode()


def main():
    print('Secure Encryption Service')
    print('Your modulus is:', n)
    while True:
        print('Options')
        print('-------')
        print('(1) Encrypt flag')
        print('(2) Encrypt message')
        print('(3) Quit')
        x = input('Choose an option: ')
        if x not in '123':
            print('Unrecognized option.')
            exit()
        elif x == '1':
            print('Here is your encrypted flag:', encrypt(flag))
        elif x == '2':
            msg = input('Enter your message in hex: ')
            print('Here is your encrypted message:', encrypt(binascii.unhexlify(msg)))
        elif x == '3':
            print('Bye')
            exit()

if __name__ == '__main__':
    main()

Taking a quick first glance through, this part should stand out:

random.seed(int(time.time()))

def encrypt(msg):
    e = random.randint(1, n)
    while math.gcd(e, phi) != 1:
        e = random.randint(1, n)
    pt = bytes_to_long(msg)
    ct = pow(pt, e, n)
    return binascii.hexlify(long_to_bytes(ct)).decode()

The random is seeded with the current time (in seconds) when we connect to the server, which means we should be able to easily recover any values that come from it. The random is used to generate $e$ values for RSA, after checking that they are compatible with the (not seeded) randomly generated $n$.

Due to server lag and us not knowing the value of phi, we can’t exactly replicate this process every time we connect, but we can solve this by trying multiple values of time.time() and pairs of random.randint().

Seeing that we can encrypt the flag multiple times with different $e$ values (that we are able to find) points towards a common modulus attack. The idea is as follows: encrypt the same message $m$ using multiple $e$ values to get multiple ciphertexts $c_i$, which gives you these equations:

\[\begin{align*} c_1 &\equiv m^{e_1} \pmod{n} \\ c_2 &\equiv m^{e_2} \pmod{n} \end{align*}\]

Now note that if $\text{gcd}(e_1, e_2) = 1$ (which happens most of the time due to how $e$ is selected), then by Bézout’s identity we know that there exists $a, b$ such that $ae_1 + be_2 \equiv 1 \pmod{n}$. We can find such a pair of $a, b$ using the Extended Euclidean algorithm. Once we have such a pair, note that

\[c_1^a \cdot c_2^b \equiv m^{ae_1} \cdot m^{be_2} \equiv m^{ae_1+be_2} \equiv m \pmod{n}\]

so we can recover the original message in this way. My solve script is below:

from pwn import *
from Crypto.Util.number import *
import random, binascii
from gmpy2 import gcdext, invert

sh = process(['python3', './main.py'])
random.seed(int(time.time()))

sh.recvuntil(': ')
n = int(sh.recvline())

sh.recvuntil(': ')
sh.sendline('1')
sh.recvuntil(': ')

enc1 = bytes_to_long(binascii.unhexlify(sh.recvline().strip().decode()))
print(enc1)

sh.recvuntil(': ')
sh.sendline('1')
sh.recvuntil(': ')

enc2 = bytes_to_long(binascii.unhexlify(sh.recvline().strip().decode()))
print(enc2)

es = []
for i in range(10):
	es.append(random.randint(1, n))

#ngl i have no idea where this script comes from but it was in my files
def common_modulus_attack(c1, c2, e1, e2, n):
	gcd, s1, s2 = gcdext(e1, e2)
	if s1 < 0:
	    s1 = -s1
	    c1 = invert(c1, n)
	if s2 < 0:
	    s2 = -s2
	    c2 = invert(c2, n)
	v = pow(c1, s1, n)
	w = pow(c2, s2, n)
	m = (v * w) % n
	return m


for i in range(10):
	for j in range(i, 10):
		if i == j:
			continue
		dec = long_to_bytes(common_modulus_attack(enc1, enc2, es[i], es[j], n))
		if b'cor' in dec:
			print(dec.strip().decode())

msfrogofwar

This was a very fun and admittedly slightly silly misc challenge where the goal was to exploit and beat Stockfish in a chess game. To make it more fun, we designed some frog themed chess pieces, which you can find here, and if you are insane, you can try playing with them on lichess by installing this theme. You can see what the challenge looked like here.

Taking a look at the source code, you can see a rather suspicious function in app.py:

@socketio.on('options')
def engine_options(options):
    game.get(request.sid).msfrog.configure(options)

which leads to a function in enemy.py:

def configure(self, options):
        try:
            if "Hash" in options and options["Hash"] > 128:
                return
            if "Threads" in options and options["Threads"] > 1:
                return
            if "Debug Log File" in options:
                return
            self.engine.update_engine_parameters(options)
        except Exception as e:
            print(e)
            self.emit("chat", {"name": "🐸", "msg": "Error configuring engine"})

Hmm, interesting, this is exposed through the socket so we can configure the engine any way we want (except for a few options that would kill the server). Let’s see what sort of options we can configure using the official Stockfish GitHub.

A few should jump out at you:

UCI_LimitStrength

Enable weaker play aiming for an Elo rating as set by UCI_Elo. This option overrides Skill Level.

UCI_Elo

If enabled by UCI_LimitStrength, aim for an engine strength of the given Elo. This Elo rating has been calibrated at a time control of 60s+0.6s and anchored to CCRL 40/4.

Skill Level

Lower the Skill Level in order to make Stockfish play weaker (see also UCI_LimitStrength). Internally, MultiPV is enabled, and with a certain probability depending on the Skill Level a weaker move will be played.

Configuring either the first two or the last option should lower the skill level of Stockfish significantly, enough to beat it by using Stockfish on your own in 30 moves or less, which gives you the flag. (The way I did it was to set Skill Level to 0, which you can do in the JS console with socket.emit("options", {"Skill Level": 0}).)

Quantum Engine

2022-05-19T00:00:00+00:00

Let’s take a look at the source code:

import socketserver
from secrets import flag
import signal
from qiskit import *
import itertools

class CircuitException(Exception):
    pass


class Circuit:

    def __init__(self, inputGates) -> None:
        self.a = 0
        self.b = 0
        self.c = 0
        self.inputGates = inputGates
    
    def append_HGate(self, qbit):
        qbit = int(qbit)
        if qbit in range(4):
            self.circuit.h(qbit)
        else:
            raise CircuitException('Non-valid qbit position given...')
    
    def append_TGate(self, qbit):
        qbit = int(qbit)
        if qbit in range(4):
            self.circuit.t(qbit)
        else:
            raise CircuitException('Non-valid qbit position given...')

    def append_TdgGate(self, qbit):
        qbit = int(qbit)
        if qbit in range(4):
            self.circuit.tdg(qbit)
        else:
            raise CircuitException('Non-valid qbit position given...')

    def append_CZGate(self, qbits):
        qbits = qbits.split(',')
        c_qubit = int(qbits[0])
        t_qubit = int(qbits[1])

        if c_qubit in range(4) and t_qubit in range(4):
            self.circuit.cz(c_qubit, t_qubit)
        else:
            raise CircuitException('Non-valid qbit position given...')


    def generate_Circuit(self):

        self.circuit = QuantumCircuit(4,3)

        if self.a == 1:
            self.circuit.x(0)
        if self.b == 1:
            self.circuit.x(1)
        if self.c == 1:
            self.circuit.x(2)
        
        for gate in self.inputGates:
            gate = gate.split(':')
            if gate[0] == 'H':
                self.append_HGate(gate[1])
            elif gate[0] == 'T':
                self.append_TGate(gate[1])
            elif gate[0] == 'TDG':
                self.append_TdgGate(gate[1])
            elif gate[0] == 'CZ':
                self.append_CZGate(gate[1])
            else:
                raise CircuitException('Non-valid gate given...')

        self.circuit.measure([0,2,3],[0,1,2])
        if self.circuit.depth() > 43:
            raise CircuitException('Circuit is too big...')
        
    def check_Circuit(self):
        inputs = list(itertools.product([0, 1], repeat=3))

        for input in inputs:
            self.a = input[0]
            self.b = input[1]
            self.c = input[2]

            self.generate_Circuit()

            simulator = Aer.get_backend('qasm_simulator')
            counts = execute(self.circuit,backend=simulator, shots = 1).result().get_counts()
            counts = next(iter(counts))[::-1]
            if (int(counts[0]) == self.a) and int(counts[1]) == self.c ^self.a ^ self.b and (int(counts[2]) == self.a&self.b|self.b&self.c|self.c&self.a):
                pass
            else:
                return False
        return True

        

def challenge(req):
    try:
        req.sendall(b'\lvert--------------------------------\lvert\n'+
                    b'\lvert Phalcon\'s Accelaration System \lvert\n'+
                    b'\lvert--------------------------------\lvert\n'+
                    b'\lvert > Send quantum circuit for the \lvert\n'+
                    b'\lvert system to analyze...           \lvert\n'+
                    b'\lvert--------------------------------\lvert\n'+
                    b'\n> '
                    )
        input = req.recv(4096).decode().strip().split(';')

        if len(input) < 0 or len(input) > 100:
            raise CircuitException('Non-valid circuit length...')
        
        quantumCircuit = Circuit(input)
        
        if quantumCircuit.check_Circuit():
            req.sendall(flag.encode()+b"\n")
            req.close()
            exit()
        else:
            req.sendall(b'The circuit failed to pass the test...\n')
            req.close()
            exit()


    except CircuitException as ce:
        try:
            req.sendall(ce.encode()+b'\n')
            req.close()
        except:
            pass
        exit()

    except Exception as e:
        try:
            req.sendall(b'Unexpected error.\n')
            req.close()
        except:
            pass
        exit()

class incoming(socketserver.BaseRequestHandler):
    def handle(self):
        signal.alarm(300)
        req = self.request
        print("starting server")
        while True:
            challenge(req)

class ReusableTCPServer(socketserver.ForkingMixIn, socketserver.TCPServer):
    pass

socketserver.TCPServer.allow_reuse_address = False
server = ReusableTCPServer(("0.0.0.0", 1337), incoming)
server.serve_forever()

Alright, so the main part of the challenge is in the Circuit class. It looks like we’re implementing a quantum circuit that satisfies this:

def check_Circuit(self):
        inputs = list(itertools.product([0, 1], repeat=3))

        for input in inputs:
            self.a = input[0]
            self.b = input[1]
            self.c = input[2]

            self.generate_Circuit()

            simulator = Aer.get_backend('qasm_simulator')
            counts = execute(self.circuit,backend=simulator, shots = 1).result().get_counts()
            counts = next(iter(counts))[::-1]
            if (int(counts[0]) == self.a) and int(counts[1]) == self.c ^self.a ^ self.b and (int(counts[2]) == self.a&self.b|self.b&self.c|self.c&self.a):
                pass
            else:
                return False
        return True

So given 3 inputs $a, b, c$ and 4 total qubits to work with, we need to set the outputs to be $a$, $a \oplus b \oplus c$, and $(a\&b)\lvert(b\&c)\lvert(c\&a)$. And it looks like the only gates that we are able to use are $H, T, TDG$, and $CZ$.

Initial Thoughts

Note the line self.circuit.measure([0,2,3],[0,1,2]) in the generate_Circuit function. This means that the outputs need to be on qubits $0, 2,$ and $3$ (and the inputs are on qubits $0, 1,$ and $2$ as shown in the beginning of the function).

The first output is simple by itself - just don’t do anything to the input! This is actually a bit tricky once we implement the others, as you soon will see.

The second output needs to be the XOR of all the inputs. It turns out this isn’t too hard either - a $CNOT$ (or $CX$) gate effectively performs XOR. (Remember that a $CNOT$ gate flips the second qubit (across the $x$ axis, hence the name $CX$) iff the first qubit is $\lvert1\rangle$.) That is, for classical bits, $\text{CNOT}(a, b)$ takes $(a, b)$ to $(a, a \oplus b)$. There’s just one small problem - we aren’t allowed $CNOT$ gates! But we are allowed $CZ$ gates, which flips the second qubit across the $z$ axis iff the first qubit is $\lvert1\rangle$. These two operations only differ by an axis, and it turns out that $HZH = X$ (and $HXH = Z$), so we can implement $CNOT$ gates in this way. Remembering that this output needs to be on qubit 2, we can simply apply $CNOT$s with control qubits 0 and 1 targeting qubit 2, which would take $(a, b, c)$ to $(a, b, a \oplus b \oplus c)$ as desired.

qc = QuantumCircuit(4, 3)
qc.h(2)
qc.cz(0, 2)
qc.cz(1, 2)
qc.h(2)
qc.draw()
"""
q_0: ──────■─────────
           │         
q_1: ──────┼──■──────
     ┌───┐ │  │ ┌───┐
q_2: ┤ H ├─■──■─┤ H ├
     └───┘      └───┘
q_3: ────────────────
                     
c: 3/════════════════   
"""

The third output is a bit trickier. $(a\&b)\lvert(b\&c)\lvert(c\&a)$ is a complicated expression. While it is possible to construct circuits that simulate AND and OR, the main problem is that to be able to use the value of each input twice, we would need multiple ancillary qubits so that the value of the inputs aren’t lost. Instead, it helps to think of the expression as a whole rather than the individual parts. What it’s really saying is “set the output bit to $\lvert1\rangle$ if at least 2 of the input bits are $\lvert1\rangle$”. Or, if you think about it, “set the output bit to the majority of the input bits”. What does this sound like? To me, error correction comes to mind.

The basic single-qubit bit flip error correction circuit looks like this:

                ░           ┌───┐
q_0: ──■────■───░───■────■──┤ X ├
     ┌─┴─┐  │   ░ ┌─┴─┐  │  └─┬─┘
q_1: ┤ X ├──┼───░─┤ X ├──┼────■──
     └───┘┌─┴─┐ ░ └───┘┌─┴─┐  │  
q_2: ─────┤ X ├─░──────┤ X ├──■──
          └───┘ ░      └───┘     

where $q_0$ is the qubit to be transmitted, and $q_1$ and $q_2$ are ancilla qubits which start in state $\lvert0 \rangle$. The first 2 $CNOT$ gates essentially serve to copy the value of $q_0$ into $q_1$ and $q_2$, and then $q_0$ is potentially flipped. After a few more gates, no matter the starting value of $q_0$ and no matter if it is flipped or not, in the end $q_0$ will have the same value it started with. The last gate is a $CCNOT$ gate, a double-controlled not gate, also known as a Toffoli gate, which flips the target ($q_0$) iff both inputs ($q_1$ and $q_2$) are $\lvert1 \rangle$. It basically acts like an AND gate.

Now it turns out if you disregard the first half of the circuit (copying $q_0$ into $q_1$ and $q_2$), this circuit does exactly what we want it to. Try it yourself for some random inputs if you’re not convinced - it will set $q_0$ to the majority bit. Now how do we implement this? I’ve already shown how to implement $CNOT$ gates above, and for the $CCNOT$ gate, you could either look it up, or use qiskit’s decompose function to decompose it into gates we know how to make.

qc = QuantumCircuit(3)
qc.ccx(0, 1, 2)
qc.decompose().draw()
"""
                                                       ┌───┐      
q_0: ───────────────────■─────────────────────■────■───┤ T ├───■──
                        │             ┌───┐   │  ┌─┴─┐┌┴───┴┐┌─┴─┐
q_1: ───────■───────────┼─────────■───┤ T ├───┼──┤ X ├┤ TDG ├┤ X ├
     ┌───┐┌─┴─┐┌─────┐┌─┴─┐┌───┐┌─┴─┐┌┴───┴┐┌─┴─┐├───┤└┬───┬┘└───┘
q_2: ┤ H ├┤ X ├┤ TDG ├┤ X ├┤ T ├┤ X ├┤ TDG ├┤ X ├┤ T ├─┤ H ├──────
     └───┘└───┘└─────┘└───┘└───┘└───┘└─────┘└───┘└───┘ └───┘      
"""

Putting it All Together

There are a few final issues to take care of. We have successfully calculated each output bit individually, but how to put it all together? First, note that our adapted error correction circuit has the potential to flip $q_1$ and $q_2$, so we need to track the original value of $q_0$ to see whether or not we need to re-flip $q_1$ and $q_2$ after performing the “error correction”. This is easy enough - since our extra 4th qubit $q_3$ is guaranteed to start at zero, performing a $CNOT$ to XOR the value of one of the qubits into the 4th qubit would copy it into the 4th qubit. We can actually then just run our adapted error correction circuit targeting this 4th qubit, since we want this output on $q_3$ in the end anyway. After that, since we have the original value of the qubit, we can reflip the other qubits if needed, and then use all 3 original inputs to calculate the other outputs, which is not hard. The final circuit looks like this:

from qiskit import *
from qiskit.extensions import *

qc = QuantumCircuit(4, 3)

#copy qubit 2 to qubit 3
qc.h(3)
qc.cz(2, 3)
qc.h(3)

#"error correct" (output 3): convert qubit 3 to majority of (0, 1, 3), using two CX and one CCX 
qc.h(0)
qc.cz(3, 0)
qc.h(0)
qc.h(1)
qc.cz(3, 1)
qc.h(1)

#CCX decomposed
qc.cz(1, 3)
qc.h(3)
qc.tdg(3)
qc.h(3)
qc.cz(0, 3)
qc.h(3)
qc.t(3)
qc.h(3)
qc.cz(1, 3)
qc.h(3)
qc.tdg(3)
qc.h(3)
qc.cz(0, 3)
qc.h(3)
qc.t(3)
qc.h(3)
qc.t(1)
qc.h(1)
qc.cz(0, 1)
qc.h(1)
qc.tdg(1)
qc.t(0)
qc.h(1)
qc.cz(0, 1)
qc.h(1)

#reflip 0 and 1 if necessary
qc.h(0)
qc.cz(2, 0)
qc.h(0)
qc.h(1)
qc.cz(2, 1)
qc.h(1)

#xor (output 2)
qc.h(2)
qc.cz(0, 2)
qc.cz(1, 2)
qc.h(2)

qc.measure([0,2,3],[0,1,2])

qc.draw()
"""
     ┌───┐           ┌───┐                    »
q_0: ┤ H ├─────────■─┤ H ├────────────────────»
     ├───┤         │ └───┘┌───┐               »
q_1: ┤ H ├─────────┼───■──┤ H ├─■─────────────»
     └───┘         │   │  └───┘ │             »
q_2: ──────■───────┼───┼────────┼─────────────»
     ┌───┐ │ ┌───┐ │   │        │ ┌───┐┌─────┐»
q_3: ┤ H ├─■─┤ H ├─■───■────────■─┤ H ├┤ TDG ├»
     └───┘   └───┘                └───┘└─────┘»
c: 3/═════════════════════════════════════════»
                                              »
«                                                »
«q_0: ──────■────────────────────────────────────»
«           │                   ┌───┐ ┌───┐      »
«q_1: ──────┼─────────────────■─┤ T ├─┤ H ├──────»
«           │                 │ └───┘ └───┘      »
«q_2: ──────┼─────────────────┼──────────────────»
«     ┌───┐ │ ┌───┐┌───┐┌───┐ │ ┌───┐┌─────┐┌───┐»
«q_3: ┤ H ├─■─┤ H ├┤ T ├┤ H ├─■─┤ H ├┤ TDG ├┤ H ├»
«     └───┘   └───┘└───┘└───┘   └───┘└─────┘└───┘»
«c: 3/═══════════════════════════════════════════»
«                                                »
«             ┌───┐               ┌───┐   ┌───┐»
«q_0: ─■───■──┤ T ├─────────────■─┤ H ├─■─┤ H ├»
«      │   │  ├───┤┌─────┐┌───┐ │ ├───┤ │ ├───┤»
«q_1: ─┼───■──┤ H ├┤ TDG ├┤ H ├─■─┤ H ├─┼─┤ H ├»
«      │      └───┘└─────┘└───┘   └───┘ │ └───┘»
«q_2: ─┼────────────────────────────────■──────»
«      │ ┌───┐┌───┐ ┌───┐  ┌─┐                 »
«q_3: ─■─┤ H ├┤ T ├─┤ H ├──┤M├─────────────────»
«        └───┘└───┘ └───┘  └╥┘                 »
«c: 3/══════════════════════╩══════════════════»
«                           2                  »
«                   ┌─┐        
«q_0: ─────────■────┤M├────────
«        ┌───┐ │    └╥┘        
«q_1: ─■─┤ H ├─┼──■──╫─────────
«      │ ├───┤ │  │  ║ ┌───┐┌─┐
«q_2: ─■─┤ H ├─■──■──╫─┤ H ├┤M├
«        └───┘       ║ └───┘└╥┘
«q_3: ───────────────╫───────╫─
«                    ║       ║ 
«c: 3/═══════════════╩═══════╩═
«                    0       1 
"""

Converting this to the input format given in the source code and submitting it to the server gives us the flag.

corCTF 2021

2021-08-27T00:00:00+00:00

Here are writeups for my challenges in corCTF 2021:

fibinary

fibinary was a simple encoding challenge where each character was encoded in “base Fibonacci” - a binary number where each successive place value represented the next Fibonacci number. For example, 110100 would represent 8 + 5 + 0 + 3 + 0 + 0 = 16. To decode, we simply do the reverse of encoding, and add together the Fibonacci numbers indicated by the 1s in the binary representation. Here was my solve script:

fib = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89][::-1]

with open('flag.enc', 'r') as f:
	toks = f.read().strip().split()

for tok in toks:
	n = 0
	for i in range(len(tok)):
		if tok[i] == '1':
			n += fib[i]
	print(chr(n), end='')
print()

supercomputer

supercomputer was a challenge about a seemingly impossible math computation involving taking powers of massive 2048 bit numbers, and then taking powers of those numbers. In the end, it reduced to finding the number of powers of p that divided into a massive final number t.

from Crypto.Util.number import getPrime, long_to_bytes
from pwn import *
import random, binascii

flag = open('flag.txt').read()

def v(p, k):
	ans = 0
	while k % p == 0:
		k /= p
		ans += 1
	return ans

p, q, r = getPrime(2048), getPrime(2048), getPrime(2048)
print(p, q, r)
n = pow(p, q) * r

a1 = random.randint(0, n)
a2 = n - a1
assert a1 % p != 0 and a2 % p != 0

t = pow(a1, n) + pow(a2, n)
print(binascii.hexlify(xor(flag, long_to_bytes(v(p, t)))))

There were many interesting ways to do this problem, but I’ll cover the most direct - the Lifting the Exponent (LTE) lemma. You can read a more detailed explanation on how it works and a proof of it (involving binomial expansions, another popular way to solve this challenge) in this PDF.

In summary, what this lemma says is, for our function $v_p$ (v with prime p),

\[v_p(x^n+y^n) = v_p(x + y) + v_p(n)\]

Using this on t, we get

\[\begin{align*} v_p(t) = v_p(a_1^n + a_2^n) &= v_p(a_1 + a_2) + v_p(n) \\ &= v_p(n) + v_p(n) \\ &= q + q \\ &= 2q\end{align*}\]

Therefore, v(p, t) is $2q$ and we can plug that into the xor to recover our flag.

bank

This was a challenge relating to a quantum money scheme, where you had to determine the value of 50 qubits that made up a dollar bill to get the flag. If you aren’t familiar with quantum computing or quantum money schemes and/or would like a quick overview, I recommend you check out my writeup here on a similar challenge I solved earlier this year and read the “The Basics” and “The Problem” sections.

Analysis

Looking at this problem, unlike the one linked above, there is no “probe” qubit to use, so how can we determine the value of a qubit? Taking a closer look at the source code, we notice this section:

elif op == '8':
    actual = bill[idx]
    if actual in '01':
        measured = qubits[idx].measure('01')
    else:
        measured = qubits[idx].measure('+-')
    if actual == measured:
        print('Qubit successfully verified.')
    else:
        print('Incorrect qubit!')

What notably doesn’t happen is the code exiting if the qubit is wrong. This means we can verify the qubit as many times as we want! Now this doesn’t solve the problem on its own, since we still don’t know what basis to pick, and picking the wrong one would destroy the information in the qubit. However, now we can use some properties of qubits to our advantage.

Solution

Pick any basic single qubit gate, such as the X gate. Note that the X gate has eigenstates $\vert+\rangle$ and $\vert-\rangle$, in other words, if you apply an X gate to a qubit currently in either of those 2 states, nothing happens. We can use this to our advantage since we know the qubits start in the correct, verified state.

For each qubit, we apply an X gate, and then try to verify it. If it still is successfully verified, we now know it is in the $+/-$ basis. Otherwise, the qubit did change (from $\vert0\rangle$ to $1\rangle$ or vice versa), and we know it is in the $0/1$ basis. Now that we know what basis it is in, we can simply measure it (keeping in mind we first applied an X gate). Do this for all 50 qubits and you’ll get the flag!

Here is a script my teammate qopruzjf wrote to testsolve my challenge: (I was too lazy to write my own)

from pwn import *
# r = remote('crypto.be.ax', 6005)
r = process(["python3", "server.py"])

mybill = list("?"*50)

def test_X(i):
	r.sendline(b'1')
	r.recvuntil(b'9. Back')
	r.sendline(b'8')
	r.recvline()
	re = r.recvline()[:-1]
	print(re)
	if re == b'> Incorrect qubit!': # qubit was not X-eigenvector, so in 0, 1
		r.recvuntil(b'9. Back')
		r.sendline(b'1')
		r.recvuntil(b'9. Back')
		r.sendline(b'6')
		r.recvuntil(b'The qubit measured as ')
		mybill[i] = r.recvline()[:-1].decode()
		r.recvuntil(b'9. Back')
		r.sendline(b'9')
	else: # qubit is in +- basis
		r.recvuntil(b'9. Back')
		r.sendline(b'7')
		r.recvuntil(b'The qubit measured as ')
		mybill[i] = r.recvline()[:-1].decode()
		r.recvuntil(b'9. Back')
		r.sendline(b'9')

def get_qubit(i):
	r.recvuntil(b'3. Quit')
	r.sendline(b'1')
	r.recvuntil(b'index of the qubit you wish to work with: ')
	r.sendline(str(i).encode())
	r.recvuntil(b'9. Back')
	test_X(i)

r.recvuntil(b'Would you like an account? (y/n) ')
r.sendline(b'y')

for i in range(50):
	get_qubit(i)

mybill = ''.join(mybill)
print(mybill)
r.recvuntil(b'3. Quit')
r.sendline(b'2')
r.recvuntil(b'Enter your bill: ')
r.sendline(mybill.encode())
r.interactive()

Mr. Radar

2021-06-27T00:00:00+00:00

We are given the location of a radar and several radar pulse returns of a satellite, and want to determine its orbital parameters. We first trace out the path of the satellite, using Skyfield to do the appropriate calculations. The functions latlon and from_altaz were particularly helpful to be able to convert the data given directly into ICRF coordinates.

from skyfield.api import *
from skyfield.units import *
from skyfield.positionlib import *

ts = load.timescale(builtin=True)

radar = wgs84.latlon(8.7256, 167.715)
radar.elevation = Distance(m=35)

with open('radar_data.txt', 'r') as f:
	dat = f.readlines()[1:]

path = []

xs = []
ys = []
zs = []

for d in dat:
	time, az, el, rng = d.split()
	t2 = time.split(':')
	mins = int(t2[1])
	secs = int(t2[2].split('.')[0])
	stamp = ts.utc(2021, 6, 27, 0, mins, secs)
	rp = radar.at(stamp)
	pos = rp.from_altaz(alt_degrees=float(el), az_degrees=float(az), distance=Distance(km=float(rng)))
	sat = pos.position.km + rp.position.km
	path.append(sat)
	xs.append(sat[0])
	ys.append(sat[1])
	zs.append(sat[2])

As a sanity check, we visualize the orbit with matplotlib.

from mpl_toolkits import mplot3d
import matplotlib.pyplot as plt
fig = plt.figure()
ax = plt.axes(projection='3d')
ax.set_xlim(4500, 5500)
ax.set_ylim(6700, 7700)
ax.set_zlim(-2000, -3000)
ax.scatter3D(xs, ys, zs)
plt.show()

We then use a least squares regression to fit an elliptical orbit to our calculated coordinates, using Skyfield’s Satrec to quickly trace out an orbit given the orbital parameters. We use this calculator to estimate initial parameters for the regression, using the first two data points to generate a position + velocity vector to convert into orbital parameters.

def cost(params, debug=False):
	M = 5.9722e24
	G = 6.6743015e-11
	a, e, i, Omega, omega, M0 = params
	P = np.sqrt(4*np.pi**2 / (G*M) * (1000*a)**3) / 60

	satrec = Satrec()
	satrec.sgp4init(
		WGS72,
		'i',
		1337,
		t0.tdb - 2433281.5,
		0.0, # drag
		0.0,
		0.0,
		e,
		np.radians(omega),
		np.radians(i),
		np.radians(M0),
		2*np.pi / P,
		np.radians(Omega),
	)
	sat = EarthSatellite.from_satrec(satrec, ts)
	if debug:
		return sat

	err = []
	for i in range(100):
		t = ts.utc(2021, 6, 27, 0, 8, 12+i)
		err += list(path[i] - sat.at(t).position.km)

	return err

# print(path[0])
# print((path[1] - path[0]))

#initial parameters
a = 20804.737560848476
e = 0.6610543599443122
i = 33.99839311086964
Omega = 78.00087926523055
omega = 271.65368202323253
M0 = 10.704246168858505
sol = least_squares(cost, np.array([a, e, i, Omega, omega, M0]))
print(sol)

params = [2.29939092e+04, 7.00821959e-01, 3.38773730e+01, 7.82120294e+01, 2.70127740e+02, 9.77239867e+00] #from solution
print(cost(params))
sat = cost(params, debug=True)
t = ts.utc(2021, 6, 27, 0, 9, 52)
#sanity checks
print(sat.at(t).position.km)
print(sat.at(t).velocity.km_per_s)

The regression gives us the orbital parameters that best fit our data, and submitting those to the server gives us the flag.

Real Mersenne

2021-06-06T00:00:00+00:00

Do you believe in games of luck? I hope you make your guesses real or you’ll be floating around.

nc crypto.zh3r0.cf 4444

Source Analysis

import random
from secret import flag
from fractions import Fraction

def score(a,b):
    if abs(a-b)<1/2**10:
        # capping score to 1024 so you dont get extra lucky
        return Fraction(2**10)
    return Fraction(2**53,int(2**53*a)-int(2**53*b))

total_score = 0
for _ in range(2000):
    try:
        x = random.random()
        y = float(input('enter your guess:\n'))
        round_score = score(x,y)
        total_score+=float(round_score)
        print('total score: {:0.2f}, round score: {}'.format(
            total_score,round_score))
        if total_score>10**6:
            print(flag)
            exit(0)
    except:
        print('Error, exiting')
        exit(1)
else:
    print('Maybe better luck next time')

We can see that we have to try to guess floats generated by random.random(), and we have 2000 attempts to get 1,000,000 score. The strategy is then to clone the state of the random with the first guesses, and then use at most 977 guesses in the end to get the required number of points.

Python’s Random

Python’s random module uses a Mersenne Twister inside, as hinted by the title of the challenge. So how does a Mersenne Twister work? The short answer is through a series of states, which each consist of 624 integers (in most cases, including this one, 32-bit). When you ask for random values, some of these 624 values are used up, and each value is used only once. For example, if you call random.getrandbits(32), exactly one 32-bit state value is used, after being tempered (slightly modified), to make it harder to reverse. Once all 624 values have been used, they are “twisted” to generate a set of 624 new values, and the cycle repeats. (The generator has a period of $2^{19937} - 1$, which is why we sometimes refer to it as MT19937.)

But how does that produce floats between 0 and 1? Well let’s take a look at some source code.

/* random_random is the function named genrand_res53 in the original code;
 * generates a random number on [0,1) with 53-bit resolution; note that
 * 9007199254740992 == 2**53; I assume they're spelling "/2**53" as
 * multiply-by-reciprocal in the (likely vain) hope that the compiler will
 * optimize the division away at compile-time.  67108864 is 2**26.  In
 * effect, a contains 27 random bits shifted left 26, and b fills in the
 * lower 26 bits of the 53-bit numerator.
 * The original code credited Isaku Wada for this algorithm, 2002/01/09.
 */

/*[clinic input]
_random.Random.random
  self: self(type="RandomObject *")
random() -> x in the interval [0, 1).
[clinic start generated code]*/

static PyObject *
_random_Random_random_impl(RandomObject *self)
/*[clinic end generated code: output=117ff99ee53d755c input=afb2a59cbbb00349]*/
{
    uint32_t a=genrand_uint32(self)>>5, b=genrand_uint32(self)>>6;
    return PyFloat_FromDouble((a*67108864.0+b)*(1.0/9007199254740992.0));
}

So we see that calling random.random() uses up 2 state values, discards some trailing bits from them, and combines them in the numerator of some fraction to generate a random float between 0 and 1. More specifically, 27 bits and 26 bits respectively of two states are combined and divided by $2^{53}$.

The Plan

There are still a lot of issues we will need to deal with, but a hazy plan can be formed at this point. We can pass in an easy value, such as 0, to the guess function, and use the round score to solve for the numerator of the fraction in the code above (since the score is conveniently given as a Fraction with values multiplied by $2^{53}$!). Each float recovers 2 state values, so repeating this 312 times should give us 624 state values, enough to clone the random state and predict the next values perfectly, with ~800 guesses to spare at the end.

Now there are a few main issues with this plan:

Truncation

Even after solving for the numerator using the round score, and splitting that integer into the upper 27 and lower 26 bits, we’re still missing a combined 11 bits of the 2 states! If we were to brute force those bits for all 312 guesses, that would take $2^{3432}$ attempts, clearly infeasible. The solution here is to solve for the state symbolically, since the 624 values in one state are related to each other mathematically, and this should be enough information to solve for the missing bits. To save time, a teammate remembered this repository, which was used to solve a related challenge from PlaidCTF. (Which I spent many hours of my life going down the wrong path on… but I digress.)

Precision

This one was a killer, and I honestly still have no idea why this happened. But even though int(2**53*a) should be precise due to how python stores floats, and that the default precision for floats is 53 bits, in my local testing the recovered range of values for b (the lower 26 bits in the numerator) were always a little off when compared to the actual value in the random state. However, this too had a relatively simple fix, had I not wasted many hours trying to fix the precision without knowing where the error was. I just had to take less bits of b for granted, and solve for all the rest. To mitigate the smaller amount of info, I used up 624 guesses (2 whole states) instead of 312, since we had 2000 total guesses.

After making these fixes, and waiting 30 minutes for the agonizingly slow server since I did not live in India, the flag finally popped out. The full lightly-commented source code of the solution is below.

#This class from https://github.com/icemonster/symbolic_mersenne_cracker
"""
MIT License

Copyright (c) 2021 icemonster

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
"""

from z3 import *
from random import Random
from itertools import count
import time
import logging

logging.basicConfig(format='STT> %(message)s')
logger = logging.getLogger()
logger.setLevel(logging.DEBUG)

SYMBOLIC_COUNTER = count()

class Untwister:
    def __init__(self):
        name = next(SYMBOLIC_COUNTER)
        self.MT = [BitVec(f'MT_{i}_{name}', 32) for i in range(624)]
        self.index = 0
        self.solver = Solver()

    #This particular method was adapted from https://www.schutzwerk.com/en/43/posts/attacking_a_random_number_generator/
    def symbolic_untamper(self, solver, y):
        name = next(SYMBOLIC_COUNTER)

        y1 = BitVec(f'y1_{name}', 32)
        y2 = BitVec(f'y2_{name}' , 32)
        y3 = BitVec(f'y3_{name}', 32)
        y4 = BitVec(f'y4_{name}', 32)

        equations = [
            y2 == y1 ^ (LShR(y1, 11)),
            y3 == y2 ^ ((y2 << 7) & 0x9D2C5680),
            y4 == y3 ^ ((y3 << 15) & 0xEFC60000),
            y == y4 ^ (LShR(y4, 18))
        ]

        solver.add(equations)
        return y1

    def symbolic_twist(self, MT, n=624, upper_mask=0x80000000, lower_mask=0x7FFFFFFF, a=0x9908B0DF, m=397):
        '''
            This method models MT19937 function as a Z3 program
        '''
        MT = [i for i in MT] #Just a shallow copy of the state

        for i in range(n):
            x = (MT[i] & upper_mask) + (MT[(i+1) % n] & lower_mask)
            xA = LShR(x, 1)
            xB = If(x & 1 == 0, xA, xA ^ a) #Possible Z3 optimization here by declaring auxiliary symbolic variables
            MT[i] = MT[(i + m) % n] ^ xB

        return MT

    def get_symbolic(self, guess):
        name = next(SYMBOLIC_COUNTER)
        ERROR = 'Must pass a string like "?1100???1001000??0?100?10??10010" where ? represents an unknown bit'

        assert type(guess) == str, ERROR
        assert all(map(lambda x: x in '01?', guess)), ERROR
        assert len(guess) <= 32, "One 32-bit number at a time please"
        guess = guess.zfill(32)

        self.symbolic_guess = BitVec(f'symbolic_guess_{name}', 32)
        guess = guess[::-1]

        for i, bit in enumerate(guess):
            if bit != '?':
                self.solver.add(Extract(i, i, self.symbolic_guess) == bit)

        return self.symbolic_guess


    def submit(self, guess):
        '''
            You need 624 numbers to completely clone the state.
                You can input less than that though and this will give you the best guess for the state
        '''
        if self.index >= 624:
            name = next(SYMBOLIC_COUNTER)
            next_mt = self.symbolic_twist(self.MT)
            self.MT = [BitVec(f'MT_{i}_{name}', 32) for i in range(624)]
            for i in range(624):
                self.solver.add(self.MT[i] == next_mt[i])
            self.index = 0

        symbolic_guess = self.get_symbolic(guess)
        symbolic_guess = self.symbolic_untamper(self.solver, symbolic_guess)
        self.solver.add(self.MT[self.index] == symbolic_guess)
        self.index += 1

    def get_random(self):
        '''
            This will give you a random.Random() instance with the cloned state.
        '''
        logger.debug('Solving...')
        start = time.time()
        print(self.solver.check())
        model = self.solver.model()
        end = time.time()
        logger.debug(f'Solved! (in {round(end-start,3)}s)')

        #Compute best guess for state
        state = list(map(lambda x: model[x].as_long(), self.MT))
        result_state = (3, tuple(state+[self.index]), None)
        r = Random()
        r.setstate(result_state)
        return r

#below code, the actual exploit, is mine
import gmpy2
from pwn import *

ut = Untwister()
sh = remote('crypto.zh3r0.cf', 4444)
for ii in range(624):
    print(ii)
    sh.recvline()
    sh.sendline(b'0')
    lin = sh.recvline()
    flag = False
    sc = lin.decode().strip().split('round score: ')[1]
    if '/' in sc:
        score = sc.split('/')
    else:
        score = sc
        flag = True
    if not flag:
        numer = int(score[0])
        denom = int(score[1])
        state_comb = gmpy2.c_div(gmpy2.mpz(9007199254740992) * gmpy2.mpz(denom), numer) + 1 # solve for state
        bits = bin(state_comb)[2:]
        bits = '0' * (53 - len(bits)) + bits
        a = bits[:27] #upper
        b = bits[27:] #lower
        assert len(a) == 27
        assert len(b) == 26
        ut.submit(a + '?' * 5) #a is truncated 5 bits
        ut.submit(b[:13] + '?' * 19) # b bits are imprecise, take only 13
    else:
        ut.submit('0' * 10 + '?' * 22) #we only know that the first 10 bits are 0 (1/1024)
        ut.submit('?' * 16 + '?' * 16)

rec = ut.get_random()

#score 1024!
while True:
    print(sh.recvline())
    sh.sendline(str(rec.random()))
    print(sh.recvline())

Wiesner's Quantum Bank

2021-03-14T00:00:00+00:00

We’re Wiesner’s Quantum Bank, the biggest name in quantum money storage. Check out our new remote service:

nc crypto.utctf.live 1234

First Steps

No source provided :( Let’s connect through netcat then:

<== Welcome to Wiesner's Quantum Bank! ==>

Due to totally legitimate reasons, we only have one Schroedinger Buck (SB) in the whole bank. Good thing nobody can copy it!

Each member of Wiesner's Quantum Bank also gets a free qubit with which they can do whatever they want. Surely this will not come back to bite us!

What would you like to do today?

    a) Work with a qubit from the Schroedinger Buck
    b) Submit a valid Schroedinger Buck in exchange for a flag (why do we sell flags???)
    c) Quit

Choice [a|b|c]:

Alright, they’re talking about quantum money, and we can work with qubits. Let’s find out what we can do:

Which qubit of the Schroedinger Buck would you like to work with? Enter a number between 0-29 (inclusive):
0
What operation would you like to perform?

    a) Apply X gate to my qubit
    b) Apply Y gate to my qubit
    c) Apply Z gate to my qubit
    d) Apply H (Hadamard) gate to my qubit
    e) Apply Rotation gate to my qubit
    f) Apply CNOT gate to my qubit and the SB qubit
    g) Apply CNOT-X gate to my qubit and the SB qubit
    h) Have the SB qubit verified (bank measures)
    i) Measure the SB qubit in the [0,1] basis
    j) Measure the SB qubit in the [+,-] basis
    k) Measure the control qubit (takes you to main menu after)
    l) Go back to the main menu (resets your qubit)

Choice [a|b|c|d|e|f|g|h|i|j|k|l]:

Okay, that’s a lot of operations. At this point I realized that I could not get through the challenge with zero knowledge of quantum mechanics, so I had to brush up on some reading.

The Basics

As mentioned before, this challenge is about a quantum money scheme, where each (well, the only) bill is a quantum state made up for 30 qubits. You might be wondering: what are qubits?

Disclaimer: this is not a complete or detailed explanation, it’s just enough to understand the challenge.

Qubits are quantum bits. A normal bit contains the value 0 or 1, simple as that. But a qubit is a superposition of both states, which are designated $\vert 0 \rangle$ and $\vert 1 \rangle$. However, this does not mean that a qubit contains a value between 0 and 1. It simply means that, when measured, the qubit will show 0 or 1 with some probability dependent on its quantum state.

$\vert 0 \rangle$ and $\vert 1 \rangle$ also have vector representations $\begin{bmatrix}1 \\ 0\end{bmatrix}$and $\begin{bmatrix}0 \\ 1\end{bmatrix}$ respectively. Linear algebra enthusiasts might note that this means they form an orthogonal basis - indeed, $[0, 1]$ is called the computational basis of qubits.

A general qubit could then be expressed as $\alpha\vert 0\rangle + \beta \vert 1\rangle$, where $\alpha$ and $\beta$ are real numbers. When measured in the computational basis, this qubit has probability $\vert \alpha\vert ^2$ to show $\vert 0 \rangle$ and $\vert \beta\vert ^2$ to show $\vert 1 \rangle$. (Just take my word for this one.) (Quick check: the qubits $\vert 0 \rangle$ and $\vert 1 \rangle$ indeed have 100% chance to measure as $\vert 0 \rangle$ and $\vert 1 \rangle$ respectively.)

But you could also measure the qubit in any other orthogonal basis, which would not show $\vert 0 \rangle$ and $\vert 1 \rangle$ but the vectors in that basis instead. For example, if we define $\vert + \rangle = \frac{1}{\sqrt{2}}\vert 0 \rangle + \frac{1}{\sqrt{2}}\vert 1 \rangle$ and $\vert - \rangle = \frac{1}{\sqrt{2}}\vert 0 \rangle - \frac{1}{\sqrt{2}}\vert 1 \rangle$, $[+, -]$ form another orthogonal basis, and if we measure any qubit $\alpha\vert 0\rangle + \beta \vert 1\rangle$ in this basis we would have different probabilities to show either $\vert + \rangle$ or $\vert - \rangle$ (which I can’t be bothered to write out).

The Problem

On to the challenge: we wish to forge our own valid Schrodinger Buck by measuring each qubit using the operations given to us. As shown by the title, the challenge is using Wiesner’s quantum money scheme. This means that each qubit has 4 possible values: $\vert 0 \rangle$, $\vert 1 \rangle$, and also two other states denoted as $\vert + \rangle$ and $\vert - \rangle$. $\vert + \rangle = \frac{1}{\sqrt{2}}\vert 0 \rangle + \frac{1}{\sqrt{2}}\vert 1 \rangle$ and $\vert - \rangle = \frac{1}{\sqrt{2}}\vert 0 \rangle - \frac{1}{\sqrt{2}}\vert 1 \rangle$. We already know that the $\vert 0 \rangle$ and $\vert 1 \rangle$ states always measure as 0 and 1, but these new states, $\vert + \rangle$ and $\vert - \rangle$, both have a $\frac{1}{2}$ chance of measuring as either $\vert 0 \rangle$ or $\vert 1 \rangle$, since $\vert \alpha\vert ^2 = \vert \beta\vert ^2 =\frac{1}{2}$.

You may be wondering at this point: why don’t we just measure each qubit? After all, the bank gives you the option to measure in both bases!* Well, there are two problems with this.

When you measure a qubit, it takes on the value it shows. So if you measure $\vert + \rangle$ in the $[0, 1]$ basis, it will become either $\vert 0 \rangle$ or $\vert 1 \rangle$, and you won’t be able to tell what it originally was.
Even if you were able to measure each qubit multiple times, there is an even $\frac{1}{2}$ chance that it would measure as either $\vert 0 \rangle$ or $\vert 1 \rangle$, so you still wouldn’t be able to tell what it was.

*Okay, it turns this was possible in the challenge, but it was an unintended bug. And way less cool than the actual solution.

The Solution

Doing a bit of research, I came across a paper that described a few ways to attack this specific quantum money scheme. One of them was named the “bomb-testing” attack, and it caught my notice especially because it used a “probe” qubit, which seemed to line up exactly with the “free qubit” the bank gave us for no apparent reason. I won’t go into the full details of the attack, but you can read the paper if you wish to know more. Essentially, the attack works like this:

We apply controlled not gates (CNOT, CNOT-X) to the free qubit and the SB qubit, which produce different results depending on the state of the SB qubit. A useful fact that enables this to work well is the fact that $\vert + \rangle$ and $\vert - \rangle$ both stay invariant (don’t change) under a CNOT gate.
One pass will allow us to determine if the SB qubit is $\vert + \rangle$ or not. A second pass will allow us to determine if the SB qubit is $\vert - \rangle$ or not. If it is neither, then we have eliminated the probabilistic possibilities of the qubit, and we can just straight up measure it in the computational basis $[0, 1]$ to get the 100% correct value.

We can repeat this attack 30 times, once for each qubit, to get all 30 qubits and successfully forge our bill.

Here is the script I wrote for this:

from pwn import *
import math

sh = remote('crypto.utctf.live', 1234)

rounds = 100
sigma = math.pi / (2 * rounds)

sb = ''

for i in range(30):
  print(i)
  sh.recvuntil('Choice [a|b|c]:')
  sh.recvline()
  sh.sendline('a'.encode())
  sh.recvline()
  sh.recvline()
  sh.sendline(str(i).encode())
  #test for +
  print('+ pass')
  for a in range(16):
    sh.recvline()
  for _ in range(rounds):
    sh.sendline('e'.encode())
    #print('end e')
    #print(sh.recvline())
    #print(sh.recvline())
    sh.sendline(str(sigma).encode())
    #print('send sigma')
    for b in range(4):
      sh.recvline()
    sh.sendline('f'.encode())
    for b in range(4):
      sh.recvline()
    sh.sendline('h'.encode())
    for b in range(4):
      sh.recvline()
  sh.sendline('k'.encode())
  sh.recvuntil('\nYour qubit measured as a ')
  mq = int(sh.recvline().decode()[0])
  print('my qubit', mq)
  if mq == 1:
    sb += '+'
    continue

  #test for -
  print('- pass')
  sh.recvuntil('Choice [a|b|c]:')
  sh.recvline()
  sh.sendline('a'.encode())
  sh.recvuntil('(inclusive):')
  sh.recvline()
  sh.sendline(str(i).encode())
  sh.recvuntil('[a|b|c|d|e|f|g|h|i|j|k|l]:')
  sh.recvline()
  for _ in range(rounds):
    sh.sendline('e'.encode())
    #print('end e')
    #print(sh.recvline())
    #print(sh.recvline())
    sh.sendline(str(sigma).encode())
    #print('send sigma')
    for b in range(4):
      sh.recvline()
    sh.sendline('g'.encode())
    for b in range(4):
      sh.recvline()
    sh.sendline('h'.encode())
    for b in range(4):
      sh.recvline()
  sh.recvuntil('[a|b|c|d|e|f|g|h|i|j|k|l]:')
  sh.recvline()
  sh.sendline('k'.encode())
  sh.recvuntil('Your qubit measured as a ')
  mq = int(sh.recvline().decode()[0])
  if mq == 1:
    sb += '-'
    continue

  #0, 1 pass
  print('01 pass')
  sh.recvuntil('Choice [a|b|c]:')
  sh.recvline()
  sh.sendline('a'.encode())
  sh.recvuntil('(inclusive):')
  sh.recvline()
  sh.sendline(str(i).encode())
  sh.recvuntil('[a|b|c|d|e|f|g|h|i|j|k|l]:')
  sh.recvline()
  #measure in [0, 1]
  sh.sendline('i'.encode())
  sh.recvuntil('The SB qubit measured as a ')
  cq = sh.recvline().decode()[0]
  sb += cq

sh.recvuntil('Choice [a|b|c]:')
sh.recvline()
sh.sendline('b'.encode())
sh.recvuntil('long:')
sh.recvline()
sh.sendline(sb.encode())
sh.interactive()