Category: Misc

Points: 100

Description:

module normal(out, in);
    output [255:0] out;
    input [255:0] in;
    wire [255:0] w1, w2, w3, w4, w5, w6, w7, w8; 
 
    wire [255:0] c1, c2;
    assign c1 = 256'h44940e8301e14fb33ba0da63cd5d2739ad079d571d9f5b987a1c3db2b60c92a3;
    assign c2 = 256'hd208851a855f817d9b3744bd03fdacae61a70c9b953fca57f78e9d2379814c21;
    
    nor n1 [255:0] (w1, in, c1);
    nor n2 [255:0] (w2, in, w1);
    nor n3 [255:0] (w3, c1, w1);
    nor n4 [255:0] (w4, w2, w3);
    nor n5 [255:0] (w5, w4, w4);
    nor n6 [255:0] (w6, w5, c2);
    nor n7 [255:0] (w7, w5, w6);
    nor n8 [255:0] (w8, c2, w6);
    nor n9 [255:0] (out, w7, w8);
endmodule

module main;
    wire [255:0] flag = 256'h696374667b00000000000000000000000000000000000000000000000000007d;
    wire [255:0] wrong;

    normal flagchecker(wrong, flag);

    initial begin
        #10;
        if (wrong) begin
            $display("Incorrect flag...");
            $finish;
        end
        $display("Correct!");
    end
endmodule

I have never used verilog before so I had to learn about the syntax of verilog.

After going through the syntax of verilog it was taking our flag and passing through all the NOR gates and the final output was compared if it was Null. So I just brute forced the gates and got the flag.

I should have use boolean algebra or bit hacking to reduce the computation and redundant part of the code anyways here is my solution.

import string

def convert(l1):
  l2 = []
  j = 0
  for i in range(2, len(l1)+2, 2):
    l2.append(int(l1[j:i], 16))
    j = i
  return l2

def _not(x):
  y = ""
  for i in bin(x)[2:].rjust(8, "0"):
    if i == '0':
      y += '1'
    else:
      y += '0'
  return y

def nor(l1, l2):
  l3 = []
  for i in zip(l1, l2):
    l3.append(int(_not(i[0] | i[1]), 2))
  return l3

def process(flag):
  c1 = "d208851a855f817d9b3744bd03fdacae61a70c9b953fca57f78e9d2379814c21"
  c2 = "44940e8301e14fb33ba0da63cd5d2739ad079d571d9f5b987a1c3db2b60c92a3"
  flag = convert(flag)
  c1 = convert(c1)
  c2 = convert(c2)
  w1 = nor(flag, c1)
  w2 = nor(flag, w1)
  w3 = nor(c1, w1)
  w4 = nor(w2, w3)
  w5 = nor(w4, w4)
  w6 = nor(w5, c2)
  w7 = nor(w5, w6)
  w8 = nor(c2, w6)
  return nor(w7, w8)

def str_to_hex(s):
  h = ""
  for i in s:
    h += hex(ord(i))[2:]
  return h

def decode():
  #flag = "696374667b00000000000000000000000000000000000000000000000000007d"
  flag = "ictf{"
  for i in range(5, 32):
    print(flag)
    for j in string.printable:
      c = flag
      c += j
      if process(str_to_hex(c))[i] == 0:
        print(c)
        flag += j
        break
  print(flag)

decode()

flag:

flag: ictf{A11_ha!1_th3_n3w_n0rm_n0r!}