CyBRICS Capture The Flag 2021 writeup

# 概要 / About

[CyBRICS Capture The Flag 2021](https://cybrics.net/) (2021/07/24 19:00 ～ 2021/07/25 19:00 (JST)) ([CTFtime.org](https://ctftime.org/event/1306)) に1人チームで参加した。
474点を獲得し、正の点数を獲得した482チーム中82位だった。

I participated in [CyBRICS Capture The Flag 2021](https://cybrics.net/) (July 24, 2021 19:00 - July 25, 2021 19:00 (JST: UTC+9)) ([CTFtime.org](https://ctftime.org/event/1306)) as an one-person team.
I earned 474 points and ranked 82nd among 482 teams that earned positive score.

解けた問題と解いた時刻は以下の通りである。

Here is a list of tasks I solved and times I solved them on.

|Task|Category|Value|Time (JST)|
|---|---|--:|---|
|Scanner|rebyC|50|2021/07/24 23:16|
|Listing|Reverse|72|2021/07/25 00:06|
|Ad Network|Web|50|2021/07/25 00:53|
|ASCII Terminal|Network|116|2021/07/25 02:13|
|Mic Check|Cyber|50|2021/07/25 03:37|
|Kernel Reverse|Reverse|136|2021/07/25 14:26|

![Score over Time](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/16c7db24-46ca-6bf4-a7ad-4fec27be4f4b.png)

# 解けた問題 / Tasks I solved

## Mic Check (Cyber)

[ルールのページ](https://cybrics.net/rules)へのリンクが張られており、そのルールのページにflagが書かれていた。
素直にflagを取らせない工夫をしていたが開始10分で解除した、というようなことが問題文に書かれていたが、詳細は不明。

A link to [the page about rules](https://cybrics.net/rules) was provided and the flag was in the rule page.
The task description said that there was a trick to prevent direct capturing of the flag and that the trick was disabled 10 minutes after the start of the competition, but I don't know about the details of this.

```
cybrics{Th1S_i5_T3h_R34l_m1C_ch3CK_f1A6}
```

## Scanner (rebyC)

WebページのURLが与えられた。
このWebページは、狭い視界を絵が通っていくGIFアニメが表示され、それが何かを答えさせるものだった。

An URL of a Web page was given.
This Web page showed an animated GIF in which a picture passes in a narrow sight, and asked what the picture is.

まず、以下のプログラムでGIFアニメの各フレームを抽出し、観察した。

Firstly, I extracted each frames of the animated GIF via this program and observed.

<details><summary>get_frames.py</summary><div>

```get_frames.py
import cv2
import sys

if len(sys.argv) < 3:
	sys.stderr.writeline("Usage: get_frames.py input_file output_dir")
	sys.exit(1)

video = cv2.VideoCapture(sys.argv[1])
if not video.isOpened():
	sys.stderr.writeline("failed to open input")

count = 1
while True:
	ret, frame = video.read()
	if not ret:
		break
	cv2.imwrite("%s/%03d.png" % (sys.argv[2], count), frame)
	count += 1
```

</div></details>

その結果、絵は2フレームでだいたい視界の幅分動いていることがわかった。
これを踏まえ、絵を復元する以下のプログラムを書いた。

As a result, I found that the picture is moving by about the width of the sight each 2 frames.
Based on this, I created this program to recover the picture:

<details><summary>concat_frames.py</summary><div>

```concat_frames.py
import cv2
import sys

if len(sys.argv) < 3:
	sys.stderr.writeline("Usage: concat_frames.py input_file output_file [start_pos [end_pos]]")
	sys.exit(1)

start_y = int(sys.argv[3]) if len(sys.argv) > 3 else 496
end_y = int(sys.argv[4]) if len(sys.argv) > 4 else 518

video = cv2.VideoCapture(sys.argv[1])
if not video.isOpened():
	sys.stderr.writeline("failed to open input")

images = []

while True:
	# skip one frame
	ret, frame = video.read()
	if not ret:
		break
	ret, frame = video.read()
	if not ret:
		break
	images.append(frame[start_y:end_y,:])

cv2.imwrite(sys.argv[2], cv2.vconcat(images))
```

</div></details>

各ステージの復元結果と答えは以下のようになった。
Level #1 は答えを4個の中から選ぶ形式、他は答えを自由入力させる形式だった。

The results of recovery and answer for each level are below.
I asked to choose the answer from 4 choice in Level #1 and to type the answer in the other levels.

|Level #1|Level #2|Level #3|Level #4|Level #5|
|:-:|:-:|:-:|:-:|:-:|
|house|bone|moon|apple|?|
|![Level #1](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/f54ac046-e0a1-ff59-4fc0-603bec8a7971.png)|![Level #2](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/e70bf66f-ef00-7bc0-c52e-57fe436a4840.png)|![level #3](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/bc59e60d-6379-112d-dda3-a3a1c68e7605.png)|![Level #4](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/3bdb0498-3690-8178-0321-a58436e91e21.png)|![Level #5](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/99656/79a9cc7e-675d-7855-52e4-ba294116409c.png)|

Level #5 の復元結果を[CyberChefで処理する][cyberchef-scanner-1]ことで、flagが得られた。

I obtained the flag by [processing what is recovered in Level #5 via CyberChef.][cyberchef-scanner-1]

[cyberchef-scanner-1]: https://gchq.github.io/CyberChef/#recipe=Parse%5FQR%5FCode%28false%29

```
cybrics{N0w_Y0u_4r3_4_c4sh13r_LOL}
```

## Kernel Reverse (Reverse)

SSHサーバの接続情報が与えられた。
[Tera Term](https://ttssh2.osdn.jp/)でサーバに接続し、とりあえず`ls`を実行すると、`ioctl.ko`というファイルが置かれていた。
`file`コマンドを実行すると、以下の出力がされた。

Information to connect to a SSH server was given.
Connecting to the server via [Tera Term](https://ttssh2.osdn.jp/index.html.en) and executing`ls` command, I found there was a file`ioctl.ko`.
Executing `file` command, it showed this output:

```
$ file ioctl.ko
ioctl.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=df785cb97d70de2ae5493fa26595d8bd0d1e50a6, with debug_info, not stripped
```

この`ioctl.ko`をSCPでダウンロードして[Ghidra][kr-ghidra]で逆コンパイルした。
`ioctl_d_interface_ioctl`関数を見ると、`param_2`が`0x5702`であり、かつ`extraout_RDX`が指す場所の値が
[`ktime_get_real_ts64`関数][kr-ktime]で取得した値のうち最初のものと`vall`の値をxorしたものになっているとき、
[`copy_user_generic_unrolled`関数][kr-copy]を用いて`extraout_RDX`が指す場所に`flag`をコピーするようになっていた。
`vall`の値は、`vall`をGhidraでダブルクリックすると表示された。

I downloaded this `ioctl.ko` via SCP and decompiled via [Ghidra][kr-ghidra].
Reading the `ioctl_d_interface_ioctl` function, I found it copying `flag` to where `extraout_RDX` points at via [`copy_user_generic_unrolled` function][kr-copy] if `param_2` is `0x5702` and what `extraout_RDX` points at is the first value obtained via [`ktime_get_real_ts64` function][kr-ktime] exclusive-ored with `vall`.
The value of `vall` was shown after double-clicking `vall` on Ghidra.

[kr-ghidra]: https://ghidra-sre.org/
[kr-ktime]: https://www.kernel.org/doc/html/latest/core-api/timekeeping.html
[kr-copy]: https://docs.huihoo.com/doxygen/linux/kernel/3.7/x86_2include_2asm_2uaccess__64_8h.html

関数名から、この処理は[`ioctl()`](https://linuxjm.osdn.jp/html/LDP_man-pages/man2/ioctl.2.html)に関係していそうだと考えた。
`ioctl()`は、デバイスファイルに対して操作を行うAPIである。
`init_module`関数を見ると、`ioctl_d_interface_name`を用いて`alloc_chrdev_region`関数を呼び出し、
その結果に基づいて`ioctl_d_interface_major`を設定していた。
`ioctl_d_interface_name`の値をGhidraで調べると、`s_ioctl_d_001004cc`となっており、
さらにこれは`"ioctl_d"`となっていた。

Seeing the function name, I thought this function is related to [`ioctl()`](https://man7.org/linux/man-pages/man2/ioctl.2.html).
`ioctl()` is an API to manipulate device files.
Reading the `init_module` function, it was calling `alloc_chrdev_region` function with `ioctl_d_interface_name` and setting the value of `ioctl_d_interface_major` based on its result.
Looking up for the value of `ioctl_d_interface_name` with Ghidra, the value was `s_ioctl_d_001004cc` and it meant `"ioctl_d"`.

[Linux Kernelの簡単なCharacter Deviceを作成する方法(Linked List APIの使用方法サンプル)](https://debimate.jp/2019/06/23/linux-kernel%E3%81%AE%E7%B0%A1%E5%8D%98%E3%81%AAcharacter-device%E3%82%92%E4%BD%9C%E6%88%90%E3%81%99%E3%82%8B%E6%96%B9%E6%B3%95linked-list-api%E3%81%AE%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95%E3%82%B5/)
より、デバイスのメジャー番号は`cat /proc/devices`コマンドで調べることができることがわかった。
実際に実行すると、Character devices の242が`ioctl_d`となっていた。
さらに、`ls -l /dev`コマンドを実行すると、以下の行があった。

We can found the major device numbers via `cat /proc/devices` command.
Executing this command, I found `ioctl_d` as no. 242 in "Character devices".
Also, I executed `ls -l /dev` command, finding this line:

```
crwxrwxrwx 1 root root    242,   0 Jul 24 07:13 ioctl
```

このことから、`/dev/ioctl`を通じて`ioctl_d_interface_ioctl`関数を呼び出せそうだと推理した。
これに基づき、以下のプログラムを作成した。
さらに、これをSCPでアップロードし、`make prog`コマンドでコンパイルした。

From this results, I thought that the `ioctl_d_interface_ioctl` function can be called via `/dev/ioctl`.
Based on this, I created following program.
Then, I uploaded this via SCP and compiled via `make prog` command.

<details><summary>prog.c</summary><div>

```prog.c
#include <stdio.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <string.h>
#include <time.h>

int main(void) {
	unsigned int magic = 0x13373389;
	time_t t;
	char hoge[1024] = "";
	int fd = open("/dev/ioctl", O_RDWR);
	int ret;
	if (fd < 0) {
		puts("open error");
		return 1;
	}
	t = time(NULL);
	magic ^= (unsigned int)t;
	memcpy(hoge, &magic, sizeof(magic));
	errno = 0;
	ret = ioctl(fd, 0x5702, hoge);
	if (errno != 0) perror("ioctl");
	printf("ret = %d, errno = %d\n", ret, errno);
	puts(hoge);
	return 0;
}
```

</div></details>

コンパイルしたバイナリを実行することで、flagが得られた。

I obtained the flag by executing the compiled binary.

```
Cybrics{R3V3R5_DR1V3R5}
```

## ASCII Terminal (Network)

TCPサーバの接続情報と、以下のファイル`id.txt`が与えられた。

Information to connect to a TCP server and a file `id.txt` (shown below) were given.

<details><summary>id.txt</summary><div>

```id.txt
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
...........................+:.............,,..............................................
...........................#+............;$@,.............................................
...........................*:..............$,.............................................
...........................................$,.............................................
........................,+++:........,*?*:.$,.............................................
........................,**%+.......;#+;+$+$,.............................................
...........................*+......,#,....%@,.............................................
...........................*+......?+.....,@,.............................................
...........................*+......%,......#,.............................................
...........................*+......%:......#,.............................................
...........................*+......+*.....:@,.............................................
...........................*+......,$;...,$#,.............................................
.......................,$######$,...,$%?%$:$#*............................................
......................................:;:.................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
..........................................................................................
.
```

</div></details>

[Tera Term](https://ttssh2.osdn.jp/)でサーバに接続すると、以下の出力がされた。

Connecting to the server via [Tera Term](https://ttssh2.osdn.jp/index.html.en), it gave me following output:

<details><summary>サーバの出力 / Output from the server</summary><div>

```
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
...........................................................@................................................................................
......%@,.............................%@,...............:%#@#?,.............................................................................
......%@,.............................%@,..............;@@@@@@$.............................................................................
......%@,.............................%@,..............$@?:@:$@+............................................................................
......%@,.............................%@,..............@#..@.:@%............................................................................
......%@,?@@%:....;%#@@$+....*#@@$;...%@,*#@$;.........#@,.@................................................................................
......%@%@@@@@:..;@@@@@@@;..?@@@@@@;..%@%@@@@@:........?@#+@................................................................................
......%@@+,:$@%..$@+,.:?@%.,@#:,,+@$..%@@+,:$@?........,%@@@%+..............................................................................
......%@+...,@@,.......,@$.,@#;.......%@+...:@$..........:%@@@$,............................................................................
......%@,....%@;...:+*%#@$..$@@@$*,...%@:....@$............@+$@%............................................................................
......%@.....?@;.:$@@@@@@$..,%@@@@@+..%@,....@$............@.,#@,...........................................................................
......%@,....%@:.#@#?*;:@$....,+%#@@,.%@,....@$............@..%@:...........................................................................
......%@;...,@@,;@$....+@$........$@:.%@,....@$.......:@%..@..#@,...........................................................................
......%@@;,:$@%.:@#:,,*@@$.:@$:,,;#@,.%@,....@$........#@?,@:%@$............................................................................
......%@%@@@@#,..$@@@@@@@@..%@@@@@@?..%@,....@$........;@@@@@@@:............................................................................
......%@,%@@%,...,%#@#%;$@:.,*#@@$+...%@,....@$.........;%@@@%:.............................................................................
...........................................................@................................................................................
...........................................................@................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
............................................................................................................................................
```

</div></details>

サーバに`id.txt`の内容を送信すると、以下の出力がされた。

Sending the contents of `id.txt` to the server, it gave me following output:

<details><summary>サーバの出力 / Output from the server</summary><div>

```
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'...........................+:.............,,..............................................\n'
'...........................#+............;$@,.............................................\n'
'...........................*:..............$,.............................................\n'
'...........................................$,.............................................\n'
'........................,+++:........,*?*:.$,.............................................\n'
'........................,**%+.......;#+;+$+$,.............................................\n'
'...........................*+......,#,....%@,.............................................\n'
'...........................*+......?+.....,@,.............................................\n'
'...........................*+......%,......#,.............................................\n'
'...........................*+......%:......#,.............................................\n'
'...........................*+......+*.....:@,.............................................\n'
'...........................*+......,$;...,$#,.............................................\n'
'.......................,$######$,...,$%?%$:$#*............................................\n'
'......................................:;:.................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'..........................................................................................\n'
'.\n'
Recog 31
Executing command 'id

'
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.................%@,.......,@%..................,@*.....,*#@#*.....,*#@#*.....,*#@#*.....................%@,.......,@%...............,*#@#*.......%%................................::...*$.....................................................................................,*#@#*.......%%................................::...*$......................................................................................................................................................................................................................................................................................................................................................................................
.................%@,.......,@%.................,$@*.....%@@@@@%....%@@@@@%....%@@@@@%....................%@,.......,@%...............%@@@@@%.....;@:...............................;@+...,@*....................................................................................%@@@@@%.....;@:...............................;@+...,@*.....................................................................................................................................................................................................................................................................................................................................................................................
...........................,@%................,$@@*....;@#;,;#@;..;@#;,;#@;..;@#;,;#@;.............................,@%..............;@#;,;#@;...,#?................................+@+....*@,..................................................................................;@#;,;#@;...,#?................................+@+....*@,....................................................................................................................................................................................................................................................................................................................................................................................
...........................,@%...............+@@$@*....%@;...;@%..%@;...;@%..%@;...;@%.............................,@%..............%@;...;@%...+@:................................+@+....,@?..................................................................................%@;...;@%...+@:................................+@+....,@?....................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,..:%@@?,@%...............##;;@*....@@.....@@..@@.....@@..@@.....@@.........:%@@%,#$..%@,..:%@@?,@%..............@@.....@@...##....%#:#@%..,?#@#?,....,?#@#?,..%@@@@:...%@,.........:%@@%,#$..%#:#@%..,?#@#?,...$@,...,@%..%@,?@@%:....*#@@$;...............@@.....@@...##....%#:#@%..,?#@#?,....,?#@#?,..%@@@@:...%@,...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,.:@@@@@%@%..#@@@@@@@@?...;..;@*...,@$.....$@,,@$.....$@,,@$.....$@,.......:@@@@@$#$..%@,.:@@@@@%@%..#@@@@@@@@?.,@$.....$@,.:@?....%##@@?.,#@@@@@#:..,#@@@@@#:.%@@@@:...+@+........:@@@@@$#$..%##@@?.,#@@@@@#:..$@,...,@%..%@%@@@@@:..?@@@@@@;..#@@@@@@@@?.,@$.....$@,.:@?....%##@@?.,#@@@@@#:..,#@@@@@#:.%@@@@:...+@+...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,.%@%:,+@@%..#@@@@@@@@?......;@*...,@%.....%@:,@%.....%@:,@%.....%@:.......%@$:,+@@$..%@,.%@%:,+@@%..#@@@@@@@@?.,@%.....%@:.*@;....%@#:...%@$:,:$@$..%@$:,:$@$..+@+.....:@?........%@$:,+@@$..%@#:...%@$:,:$@$..$@,...,@%..%@@+,:$@%.,@#:,,+@$..#@@@@@@@@?.,@%.....%@:.*@;....%@#:...%@$:,:$@$..%@$:,:$@$..+@+.....:@?...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,,@#,...+@%..................;@*...:@%.....%@::@%.....%@::@%.....%@:......,@#,...+@$..%@,,@#,...+@%.............:@%.....%@:.%@:....%@+...,@@,...,#@:,@@,...,#@:.+@+.....,@$.......,@#,...+@$..%@+...,@@,...,#@:.$@,...,@%..%@*...,#@,,@#;..................:@%.....%@:.%@:....%@+...,@@,...,#@:,@@,...,#@:.+@+.....,@$...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,;@?....,@%..................;@*...:@%.....%@,:@%.....%@,:@%.....%@,......;@?.....@$..%@,;@?....,@%.............:@%.....%@,.%@,....%@:...;@?.....?@;;@?.....?@;.+@+......@#.......;@?.....@$..%@:...;@?.....?@;.$@,...,@%..%@,....?@;.$@@@$*,..............:@%.....%@,.%@,....%@:...;@?.....?@;;@?.....?@;.+@+......@#...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...,@%..%@,;@?.....@%..#@@@@@@@@?......;@*...,@$.....$@,,@$.....$@,,@$.....$@,......+@*.....#$..%@,;@?.....@%..#@@@@@@@@?.,@$.....$@,.$@,....%@,...;@*.....*@+;@*.....*@+.+@+......#@.......+@*.....#$..%@,...;@*.....*@+.$@,...,@%..%@.....*@;.,%@@@@@+..#@@@@@@@@?.,@$.....$@,.$@,....%@,...;@*.....*@+;@*.....*@+.+@+......#@...................................................................................................................................................................................................................................................................................................................................................................................
......$@,...:@%..%@,;@%....,@%..#@@@@@@@@?......;@*....@@.....@@..@@.....@@..@@.....@@.......;@?.....@$..%@,;@%....,@%..#@@@@@@@@?..@@.....@@..%@,....%@,...;@?.....?@;;@?.....?@;.+@+......@#.......;@?.....@$..%@,...;@?.....?@;.$@,...:@%..%@,....%@;...,+%#@@,.#@@@@@@@@?..@@.....@@..%@,....%@,...;@?.....?@;;@?.....?@;.+@+......@#...................................................................................................................................................................................................................................................................................................................................................................................
......%@:...+@%..%@,,@@,...+@%..................;@*....%@;...;@%..%@;...;@%..%@;...;@%.......,@#,...+@$..%@,,@@,...+@%..............%@;...;@%..?@:....%@,...,@@,...,#@,,@@,...,#@,.+@+.....,@$.......,@#,...+@$..%@,...,@@,...,#@,.%@:...+@%..%@+...,#@,.......$@:.............%@;...;@%..?@:....%@,...,@@,...,#@,,@@,...,#@,.+@+.....,@$...................................................................................................................................................................................................................................................................................................................................................................................
......?@$:,+@@%..%@,.%@$:,+@@%..................;@*....;@#;,;#@;..;@#;,;#@;..;@#;,;#@;........$@%:,+@@$..%@,.%@$:,+@@%..............;@#;,;#@;..*@+....%@,....%@$:,:$@$..%@$:,:$@$..+@?.....:@?........$@%:,+@@$..%@,....%@$:,:$@$..?@$:,+@@%..%@@+,:$@%.:@$:,,;#@,.............;@#;,;#@;..*@+....%@,....%@$:,:$@$..%@$:,:$@$..+@?.....:@?...................................................................................................................................................................................................................................................................................................................................................................................
......:@@@@@?#%..%@,.,#@@@@%@%..................;@*.....%@@@@@%....%@@@@@%....%@@@@@%.........:@@@@@@@$..%@,.,#@@@@%@%...............%@@@@@%...:@?....%@,....:#@@@@@@:..:#@@@@@@:..;@@@:...*@+........:@@@@@@@$..%@,....:#@@@@@@:..:@@@@@?#%..%@$@@@@#,..%@@@@@@?...............%@@@@@%...:@?....%@,....:#@@@@@@:..:#@@@@@@:..;@@@:...*@+...................................................................................................................................................................................................................................................................................................................................................................................
.......;$@#*.#%..%@,..,%@@%,@%..................;@*.....,*#@#*,....,*#@#*,....,*#@#*,..........:%@@$;@$..%@,..,%@@%,@%...............,*#@#*,....##....%@,.....,?#@#?,....,?#@#?,....?@@;...%@,.........:%@@$;@$..%@,.....,?#@#?,....;$@#*.#%..%@:%@#?,...,*#@@$+................,*#@#*,....##....%@,.....,?#@#?,....,?#@#?,....?@@;...%@,...................................................................................................................................................................................................................................................................................................................................................................................
....................................................................................................:@%.........................................+@;.......................................,@?...............:@%...............................%@,..........................................+@;.......................................,@?....................................................................................................................................................................................................................................................................................................................................................................................
..............................................................................................@@;,,:$@+..........................................#%.......................................*@,.........@@;,,:$@+...............................%@,...........................................#%.......................................*@,....................................................................................................................................................................................................................................................................................................................................................................................
..............................................................................................?@@@@@@$...........................................+@:.....................................,@*..........?@@@@@@$................................%@,...........................................+@:.....................................,@*.....................................................................................................................................................................................................................................................................................................................................................................................
...............................................................................................*$@@#*,............................................%%.....................................?$............*$@@#*,................................%@,............................................%%.....................................?$......................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

</div></details>

どうやら、文字で表された画像に対してOCRをかけ、その結果をコマンドとして実行し、
その出力を文字で表された画像で返すようである。

It looks like the server performs OCR to the image expressed as strings, and executes the result as a command, and returns the output of the command as an image expressed as strings.

とりあえず`id.txt`を使わずに`id`を表す文字列を作成し、サーバに送信してみたが、
空文字列として認識され、`id`を実行することはできなかった。
そのため、サーバ上で使われているフォントを使わないとうまく認識されなそうだと考え、
実行したいコマンドに使う文字を集める作戦を練ることにした。

I created a string to express `id` without using `id.txt` and sent that to the server, but it was recognized as an empty string and `id` was not executed.
Seeing this, I thought that the recognition won't work well unless I use the font used on the server, and decided to correct characters to use in the commands to execute.

<details><summary>作成した`id`を表す文字列 / The string I created to express `id`</summary><div>

```
..................................................................
..................................................................
..................................................................
..................................................................
...............$$$....................................$$..........
...............$$$....................................$$..........
...............$$$....................................$$..........
......................................................$$..........
......................................................$$..........
......................................................$$..........
......................................................$$..........
...............$$$...........................$$$$$$...$$..........
...............$$$.........................$$$$...$$$$$$..........
...............$$$.........................$$.......$$$$..........
...............$$$........................$$$........$$$..........
...............$$$........................$$.........$$$..........
...............$$$.......................$$$..........$$..........
...............$$$.......................$$...........$$..........
...............$$$.......................$$...........$$..........
...............$$$.......................$$...........$$..........
...............$$$.......................$$$..........$$..........
...............$$$.......................$$$.........$$$..........
...............$$$........................$$.........$$$..........
...............$$$........................$$$.......$$$$..........
...............$$$.........................$$$.....$$$$$..........
...............$$$..........................$$$$$$$$...$..........
...............................................$$$................
..................................................................
..................................................................
..................................................................
..................................................................
..................................................................
..................................................................
..................................................................
.
```

</div></details>

現在得られているのは、以下の文字列である。

Now I have following strings:

```
bash$
id
uid=1000 gid=0(root) groups=0(root)
```

まず、`shasum`コマンドを表す文字列を作成し、実行に成功した。
`shas`の部分は`bash`から作成でき、`u`は`groups`に含まれる。`m`は得られている文字列に含まれないが、`u`から作成できた。
文字の切り貼りには、[サクラエディタ](https://sakura-editor.github.io/)の矩形範囲選択機能と[罫子][keiko]が便利だった。

Firstly, I created a string to express the command `shasum` and succeeded to execute.
`shas` can be created from `bash` and `u` is in `groups`. `m` is not in the strings currently available, but I created it from `u`.
[罫子][keiko] and the column selection function of [SAKURA](https://sakura-editor.github.io/index.en.html) were useful for copy-and-pasting characters.

[keiko]: https://www.vector.co.jp/soft/win95/writing/se068390.html

<details><summary>作成した`shasum`を表す文字列 / A string to express `shasum` created</summary><div>

```
................................................................................
................................................................................
..............%@,...............................................................
..............%@,...............................................................
..............%@,...............................................................
..............%@,...............................................................
.....*#@@$;...%@,*#@$;....;%#@@$+......*#@@$;...$@,...,@%...%#.*#@$;..*#@$;.....
....?@@@@@@;..%@%@@@@@:..;@@@@@@@;....?@@@@@@;..$@,...,@%...%#?@@@@@:?@@@@@:....
...,@#:,,+@$..%@@+,:$@?..$@+,.:?@%...,@#:,,+@$..$@,...,@%...%@@+,:$@?@+,:$@?....
...,@#;.......%@+...:@$........,@$...,@#;.......$@,...,@%...%@+...:@%+...:@%....
....$@@@$*,...%@:....@$....:+*%#@$....$@@@$*,...$@,...,@%...%@:...,@$:...,@$....
....,%@@@@@+..%@,....@$..:$@@@@@@$....,%@@@@@+..$@,...,@%...%@,...,@$,...,@$....
......,+%#@@,.%@,....@$..#@#?*;:@$......,+%#@@,.$@,...:@%...%@,...,@$,...,@$....
..........$@:.%@,....@$.;@$....+@$..........$@:.%@:...+@%...%@,...,@$,...,@$....
...:@$:,,;#@,.%@,....@$.:@#:,,*@@$...:@$:,,;#@,.?@$:,+@@%...%@,...,@$,...,@$....
....%@@@@@@?..%@,....@$..$@@@@@@@@....%@@@@@@?..:@@@@@?#%...%@,...,@$,...,@$....
....,*#@@$+...%@,....@$..,%#@#%;$@....,*#@@$+....;$@#*.#%...%@,...,@$,...,@$....
................................................................................
................................................................................
.
```

</div></details>

<details><summary>サーバの応答 / The response from the server</summary><div>

```
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..........,@*................,?@@#*.....:%#@@%:...............,?@@#*...............,?@@#*......+$@@%:....,*#@#*.....?@@@@@@%...,*#@#*........,@*................,*#@#*.....................,@%..............,?@@#*...,@@@@@@@@@;..,?#@#?,...%@,.......................?@;....?@@@@@@%..............:%#@@%:........?@;........?@;....:%#@@%:....,*#@#*..........,@%.............:%#@@%:...............?@@@@@@%...,?@@#*.....+#@#:%@,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................
.........,$@*...............,#@@@@@%...:@@@@@@@:.............,#@@@@@%.............,#@@@@@%....?@@@@@#,...%@@@@@%....$@@@@@@%...%@@@@@%......,$@*................%@@@@@%....................,@%.............,#@@@@@%..,@@@@@@@@@:..$@@@@@$...%@,......................:@@;....$@@@@@@%.............:@@@@@@@:......:@@;.......:@@;...:@@@@@@@:...%@@@@@%.........,@%............:@@@@@@@:..............$@@@@@@%..,#@@@@@%...,@@@@,%@,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................
........,$@@*...............*@%:,;@@;..%@%:,:$@%.............*@%:,;@@;............*@%:,;@@;..:@@+,:%@?..;@#;,;#@;...@#........;@#;,;#@;....,$@@*...............;@#;,;#@;...................,@%.............*@%:,;@@;........*@?..+@#;,;#@+..%@,.....................,#@@;....@#...................%@%:,:$@%.....,#@@;......,#@@;...%@%:,:$@%..;@#;,;#@;........,@%............%@%:,:$@%..............@#........*@%:,;@@;..;@$,,.%@,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................
.......+@@$@*...............#@,...+@*..@#....,@@.............#@,...+@*............#@,...+@*..%@;...,@#..%@;...;@%..,@%........%@;...;@%...+@@$@*...............%@;...;@%...................,@%.............#@,...+@*.......:@$...?@;...;@%..%@,.....................*@$@;...,@%...................@#....,@@.....*@$@;......*@$@;...@#....,@@..%@;...;@%........,@%............@#....,@@.............,@%........#@,...+@*..;@*...%@,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................
.......##;;@*.....,?#@#?,.........*@+.........$@...,?#@#?,.........*@+...,?#@#*.........*@+..@$.........@@.....@@..;@*........@@.....@@...##;;@*.....;%#@@$+...@@.....@@...,?#@#?,....:%@@?,@%...,?#@#?,.........*@+.......$@;...?@;...;@?..%@,?@@%:....,?#@#*.....:@??@;...;@*.........;%#@@$+..........$@....:@??@;.....:@??@;..........$@..@@.....@@...:%@@?,@%...,?#@#*..........$@...,?#@#?,...;@*..............*@+.#@@@@?.%@,?@@%:....;%#@@$+.........................................................................................................................................................................................................................................................................................................................................................................................................................................
.......;..;@*....,#@@@@@#,......,+@#,........,@#..,#@@@@@#,......,+@#,..,#@@@@@?......,+@#,.,@?:%@@%:..,@$.....$@,.*@*%@@%:..,@$.....$@,..;..;@*....;@@@@@@@;.,@$.....$@,.,#@@@@@#,..:@@@@@%@%..,#@@@@@#,......,+@#,......+@%....:@#;,:#@;..%@%@@@@@:..,#@@@@@?....$#,?@;...*@*%@@%:...;@@@@@@@;........,@#....$#,?@;.....$#,?@;.........,@#.,@$.....$@,.:@@@@@%@%..,#@@@@@?........,@#..,#@@@@@#,..*@*%@@%:.......,+@#,.#@@@@?.%@%@@@@@:..;@@@@@@@;........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*....?@%:,:?@%.....?@@#:.........?@+..?@%:,:?@%.....?@@#:...?@$;,;#@:....?@@#:..:@$@@@@@@:.,@%.....%@:.?@@@@@@@:.,@%.....%@:.....;@*....$@+,.:?@%.,@%.....%@:.?@%:,:?@%..%@%:,+@@%..?@%:,:?@%.....?@@#:.......#@:.....;#@@@@+...%@@+,:$@%..?@$;,;#@:..*@;.?@;...?@@@@@@@:..$@+,.:?@%........?@+...*@;.?@;....*@;.?@;.........?@+.,@%.....%@:.%@%:,+@@%..?@$;,;#@:.......?@+..?@%:,:?@%..?@@@@@@@:.....?@@#:...;@*...%@@+,:$@%..$@+,.:?@%........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*...,@#.....$@,....?#@@#:.......*@$..,@#.....$@,....?#@@#:..@@,...;@*....?#@@#:.;@@#;,:$@%.:@%.....%@:.$@*,,:$@#.:@%.....%@:.....;@*..........,@$.:@%.....%@:,@#.....$@,,@#,...+@%.,@#.....$@,....?#@@#:.....;@%.....,?@@@@@?...%@+...,@@,.@@,...;@*.:@%..?@;...$@*,,:$@#........,@$.......*@$...:@%..?@;...:@%..?@;........*@$..:@%.....%@:,@#,...+@%..@@,...;@*......*@$..,@#.....$@,.$@*,,:$@#.....?#@@#:..;@*...%@+...,@@,.......,@$........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*...:@@@@@@@@@:......,?@$......*@$,..:@@@@@@@@@:......,?@$.:@$.............,?@$.;@@:...,#@,:@%.....%@,.......,#@::@%.....%@,.....;@*......:+*%#@$.:@%.....%@,:@@@@@@@@@:;@?....,@%.:@@@@@@@@@:......,?@$.....%@;.....?@$:,:%@?..%@,....%@;:@$........$#,..?@;.........,#@:...:+*%#@$......*@$,...$#,..?@;...$#,..?@;.......*@$,..:@%.....%@,;@?....,@%.:@$............*@$,..:@@@@@@@@@:.......,#@:......,?@$..;@*...%@,....%@;...:+*%#@$........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*...;@@@@@@@@@;........#@,....?@$,...;@@@@@@@@@;........#@,:@%...............#@,:@#.....%@:,@$.....$@,........%@;,@$.....$@,.....;@*....:$@@@@@@$.,@$.....$@,;@@@@@@@@@;;@?.....@%.;@@@@@@@@@;........#@,...,@#.....,@#,....#@,.%@.....?@;:@%.......*@;...?@;..........%@;.:$@@@@@@$.....?@$,...*@;...?@;..*@;...?@;......?@$,...,@$.....$@,;@?.....@%.:@%...........?@$,...;@@@@@@@@@;........%@;........#@,.;@*...%@.....?@;.:$@@@@@@$.............+@@@@@,....................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*...:@%................$@:..,%@?.....:@%................$@::@$...............$@:,@#.....%@:.@@.....@@.........%@;.@@.....@@......;@*....#@#?*;:@$..@@.....@@.:@%........;@%....,@%.:@%................$@:...;@?.....:@%.....?@:.%@,....%@::@$.......$@@@@@@@@@:........%@;.#@#?*;:@$...,%@?.....$@@@@@@@@@:$@@@@@@@@@:..,%@?......@@.....@@.;@%....,@%.:@$.........,%@?.....:@%................%@;........$@:.;@*...%@,....%@:.#@#?*;:@$.............+@@@@@,....................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*...,@@,.......,@#....,@@,..$@*......,@@,.......,@#....,@@,.@@,...,@%,@#....,@@,.$@;...,@@..%@;...;@%.,@#....,@@,.%@;...;@%......;@*...;@$....+@$..%@;...;@%.,@@,.......,@@,...+@%.,@@,.......,@#....,@@,...?@;.....,@#,....#@:.%@;...,@@,.@@,...,@%$@@@@@@@@@:,@#....,@@,;@$....+@$...$@*......$@@@@@@@@@:$@@@@@@@@@:..$@*.......%@;...;@%.,@@,...+@%..@@,...,@%..$@*......,@@,.......,@#....,@@,,@#....,@@,.;@*...%@;...,@@,;@$....+@$........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*....%@$;,,+@@,.$@%:,;$@%..?@*........%@$;,,+@@,.$@%:,;$@%..%@$:,:$@+.$@%:,;$@%..+@#;,:$@?..;@#;,;#@;..$@%:,;$@%..;@#;,;#@;......;@*...:@#:,,*@@$..;@#;,;#@;..%@$;,,+@@,.%@$:,+@@%..%@$;,,+@@,.$@%:,;$@%....$@,......$@$:,:%@#..%@@;,:$@%..%@$:,:$@+......?@;...$@%:,;$@%.:@#:,,*@@$..?@*.............?@;........?@;...?@*........;@#;,;#@;..%@$:,+@@%..%@$:,:$@+.?@*........%@$;,,+@@,.$@%:,;$@%..$@%:,;$@%..;@*...%@@;,:$@%.:@#:,,*@@$........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*....,#@@@@@@+..:@@@@@@#,.,@@@@@@@@@,.,#@@@@@@+..:@@@@@@#,..,#@@@@@%..:@@@@@@#,...%@@@@@#,...%@@@@@%...:@@@@@@#,...%@@@@@%.......;@*....$@@@@@@@@...%@@@@@%...,#@@@@@@+..,#@@@@%@%..,#@@@@@@+..:@@@@@@#,....@@.......:@@@@@@@:..%@%@@@@#,..,#@@@@@%.......?@;...:@@@@@@#,..$@@@@@@@@.,@@@@@@@@@,......?@;........?@;..,@@@@@@@@@,..%@@@@@%...,#@@@@%@%..,#@@@@@%.,@@@@@@@@@,.,#@@@@@@+..:@@@@@@#,..:@@@@@@#,..;@*...%@%@@@@#,..$@@@@@@@@........................................................................................................................................................................................................................................................................................................................................................................................................................................
..........;@*.....,?#@@$;....:%@@#?,..;@@@@@@@@@,..,?#@@$;....:%@@#?,....,?#@#?,...:%@@#?,.....*#@#?,....,*#@#*,....:%@@#?,....,*#@#*,.......;@*....,%#@#%;$@:..,*#@#*,....,?#@@$;....,%@@%,@%...,?#@@$;....:%@@#?,.....@#........,%#@@%:...%@,%@@%,....,?#@#?,.......?@;....:%@@#?,...,%#@#%;$@:;@@@@@@@@@,......?@;........?@;..;@@@@@@@@@,..,*#@#*,....,%@@%,@%...,?#@#?,.;@@@@@@@@@,..,?#@@$;....:%@@#?,....:%@@#?,...;@*...%@,%@@%,...,%#@#%;$@:.......................................................................................................................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

(一部の`.`のみの行は省略した / Some `.`-only lines are omitted)

</div></details>

この応答から、文字`012345678abcdef`を得ることができた。 (`9`は含まれていなかった)

From this response, I succeeded to collect characters `012345678abcdef`. (`9` was not in the response)

次に、`ls`を作るのに`load`に含まれる`l`を使うことを狙い、`uptime`コマンドを表す文字列を作成して実行させた。

Then, to use `l` in `load` to create `ls`, I created a string to express `uptime` and had the server execute the command.

<details><summary>`uptime`を表す文字列 / A string to express `uptime`</summary><div>

```
..................................................................................
..................................................................................
..............................::........%@........................................
.............................;@+........%@........................................
.............................+@+..................................................
.............................+@+..................................................
..$@,...,@%...%@,?@@%:......%@@@@:......%@......%#.*#@$;..*#@$;.....,?#@#?,.......
..$@,...,@%...%@%@@@@@:.....%@@@@:......%@......%#?@@@@@:?@@@@@:...,#@@@@@#,......
..$@,...,@%...%@@+,:$@%......+@+........%@......%@@+,:$@?@+,:$@?...?@%:,:?@%......
..$@,...,@%...%@*...,#@,.....+@+........%@......%@+...:@%+...:@%..,@#.....$@,.....
..$@,...,@%...%@,....?@;.....+@+........%@......%@:...,@$:...,@$..:@@@@@@@@@:.....
..$@,...,@%...%@.....*@;.....+@+........%@......%@,...,@$,...,@$..;@@@@@@@@@;.....
..$@,...:@%...%@,....%@;.....+@+........%@......%@,...,@$,...,@$..:@%.............
..%@:...+@%...%@+...,#@,.....+@+........%@......%@,...,@$,...,@$..,@@,............
..?@$:,+@@%...%@@+,:$@%......+@?........%@......%@,...,@$,...,@$...%@$;,,+@@,.....
..:@@@@@?#%...%@$@@@@#,......;@@@:......%@......%@,...,@$,...,@$...,#@@@@@@+......
...;$@#*.#%...%@:%@#?,........?@@;......%@......%@,...,@$,...,@$....,?#@@$;.......
..............%@,.................................................................
..............%@,.................................................................
..............%@,.................................................................
..............%@,.................................................................
..................................................................................
..................................................................................
.
```

</div></details>

<details><summary>サーバの応答 / The response from the server</summary><div>

```
....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................,@*......+$@@%:..............?@;....,*#@#*..............,@*.........?@;......................................:%#@@%:...............,@%....................................................:%#@@%:..............?@;.......,@*.......................,*#@#*.............................................................................$@,.............................,@%.............................................................................................:%#@@%:..........:%#@@%:....:%#@@%:................:%#@@%:..........:%#@@%:....,?#@#?,................:%#@@%:.............,@*.....?@@@@@@%....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...............,$@*.....?@@@@@#,............:@@;....%@@@@@%............,$@*........:@@;.....................................:@@@@@@@:..............,@%...................................................:@@@@@@@:............:@@;......,$@*.......................%@@@@@%............................................................................$@,.............................,@%............................................................................................:@@@@@@@:........:@@@@@@@:..:@@@@@@@:..............:@@@@@@@:........:@@@@@@@:...$@@@@@$...............:@@@@@@@:...........,$@*.....$@@@@@@%....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..............,$@@*....:@@+,:%@?...........,#@@;...;@#;,;#@;..........,$@@*.......,#@@;.....................................%@%:,:$@%..............,@%...................................................%@%:,:$@%...........,#@@;.....,$@@*......................;@#;,;#@;...........................................................................$@,.............................,@%............................................................................................%@%:,:$@%........%@%:,:$@%..%@%:,:$@%..............%@%:,:$@%........%@%:,:$@%..+@#;,;#@+..............%@%:,:$@%..........,$@@*.....@#..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.............+@@$@*....%@;...,@#...........*@$@;...%@;...;@%.........+@@$@*.......*@$@;.....................................@#....,@@..............,@%...................................................@#....,@@...........*@$@;....+@@$@*......................%@;...;@%...........................................................................$@,.............................,@%............................................................................................@#....,@@........@#....,@@..@#....,@@..............@#....,@@........@#....,@@..?@;...;@%..............@#....,@@.........+@@$@*....,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.............##;;@*....@$.........:@#.....:@??@;...@@.....@@..:@#....##;;@*......:@??@;.........$@,...,@%..%@,?@@%:................$@.........:%@@?,@%...;%#@@$+..*@+....,@%..*#@@$;............................$@..:@#.....:@??@;....##;;@*......................@@.....@@........$@,...,@%...*#@@$;....,?#@#?,...%#:#@%..*#@@$;.....................$@,..,?#@#?,....;%#@@$+....:%@@?,@%.........;%#@@$+..?@;....;@?..,?#@#?,...%#:#@%..;%#@@$+....:%@@%,#$...,?#@#?,...:@#................$@...............$@.........$@.....................$@...............$@..?@;...;@?.....................$@.........##;;@*....;@*..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.............;..;@*...,@?:%@@%:...:@#.....$#,?@;..,@$.....$@,.:@#....;..;@*......$#,?@;.........$@,...,@%..%@%@@@@@:..............,@#........:@@@@@%@%..;@@@@@@@;.,@$....*@;.?@@@@@@;..........................,@#..:@#.....$#,?@;....;..;@*.....................,@$.....$@,.......$@,...,@%..?@@@@@@;..,#@@@@@#,..%##@@?.?@@@@@@;....................$@,.,#@@@@@#:..;@@@@@@@;..:@@@@@%@%........;@@@@@@@;.:@%....?@;.,#@@@@@#,..%##@@?.;@@@@@@@;..:@@@@@$#$..,#@@@@@#,..:@#...............,@#..............,@#........,@#....................,@#..............,@#..:@#;,:#@;....................,@#.........;..;@*....*@*%@@%:.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*...:@$@@@@@@:.........*@;.?@;..,@%.....%@:...........;@*.....*@;.?@;.........$@,...,@%..%@@+,:$@%..............?@+........%@%:,+@@%..$@+,.:?@%..$@,...$@.,@#:,,+@$..........................?@+.........*@;.?@;.......;@*.....................,@%.....%@:.......$@,...,@%.,@#:,,+@$..?@%:,:?@%..%@#:..,@#:,,+@$....................$@,.%@$:,:$@$..$@+,.:?@%..%@%:,+@@%........$@+,.:?@%..#@,...##..?@%:,:?@%..%@#:...$@+,.:?@%..%@$:,+@@$..?@%:,:?@%....................?@+..............?@+........?@+....................?@+..............?@+...;#@@@@+.....................?@+............;@*....?@@@@@@@:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*...;@@#;,:$@%........:@%..?@;..:@%.....%@:...........;@*....:@%..?@;.........$@,...,@%..%@*...,#@,............*@$........,@#,...+@%........,@$..+@*..,@?.,@#;..............................*@$.........:@%..?@;.......;@*.....................:@%.....%@:.......$@,...,@%.,@#;......,@#.....$@,.%@+...,@#;.........................$@,,@@,...,#@:.......,@$.,@#,...+@%..............,@$..*@;..;@?.,@#.....$@,.%@+..........,@$.,@#,...+@$.,@#.....$@,..................*@$..............*@$........*@$....................*@$..............*@$...,?@@@@@?....................*@$.............;@*....$@*,,:$@#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*...;@@:...,#@,.......$#,..?@;..:@%.....%@,...........;@*....$#,..?@;.........$@,...,@%..%@,....?@;...........*@$,........;@?....,@%....:+*%#@$..,@#..*@;..$@@@$*,.........................*@$,.........$#,..?@;.......;@*.....................:@%.....%@,.......$@,...,@%..$@@@$*,..:@@@@@@@@@:.%@:....$@@@$*,.....................$@,;@?.....?@;...:+*%#@$.;@?....,@%..........:+*%#@$..:@%..?@:.:@@@@@@@@@:.%@:......:+*%#@$.;@?.....@$.:@@@@@@@@@:.................*@$,.............*@$,.......*@$,...................*@$,.............*@$,...?@$:,:%@?..................*@$,.............;@*..........,#@:...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*...:@#.....%@:......*@;...?@;..,@$.....$@,...........;@*...*@;...?@;.........$@,...,@%..%@.....*@;..........?@$,.........;@?.....@%..:$@@@@@@$...%@:.$#...,%@@@@@+.......................?@$,.........*@;...?@;.......;@*.....................,@$.....$@,.......$@,...,@%..,%@@@@@+.;@@@@@@@@@;.%@,....,%@@@@@+....................$@,;@*.....*@+.:$@@@@@@$.;@?.....@%........:$@@@@@@$...$@,.@$..;@@@@@@@@@;.%@,....:$@@@@@@$.+@*.....#$.;@@@@@@@@@;................?@$,.............?@$,.......?@$,...................?@$,.............?@$,...,@#,....#@,................?@$,..............;@*...........%@;...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*...,@#.....%@:......$@@@@@@@@@:.@@.....@@............;@*...$@@@@@@@@@:.......$@,...:@%..%@,....%@;........,%@?...........;@%....,@%..#@#?*;:@$...;@*,@?.....,+%#@@,....................,%@?...........$@@@@@@@@@:.....;@*......................@@.....@@........$@,...:@%....,+%#@@,:@%.........%@,......,+%#@@,...................$@,;@?.....?@;.#@#?*;:@$.;@%....,@%........#@#?*;:@$...*@;;@*..:@%.........%@,....#@#?*;:@$.;@?.....@$.:@%......................,%@?.............,%@?.......,%@?...................,%@?.............,%@?.....:@%.....?@:..............,%@?................;@*...........%@;...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*....$@;...,@@.......$@@@@@@@@@:.%@;...;@%............;@*...$@@@@@@@@@:.......%@:...+@%..%@+...,#@,........$@*............,@@,...+@%.;@$....+@$....##*@:.........$@:....................$@*............$@@@@@@@@@:.....;@*......................%@;...;@%........%@:...+@%........$@:,@@,........%@,..........$@:...................$@,,@@,...,#@,;@$....+@$.,@@,...+@%.......;@$....+@$...,@%?@,..,@@,........%@,...;@$....+@$.,@#,...+@$.,@@,.....................$@*..............$@*........$@*....................$@*..............$@*......,@#,....#@:..............$@*.................;@*...,@#....,@@,...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*....+@#;,:$@?.............?@;...;@#;,;#@;............;@*.........?@;.........?@$:,+@@%..%@@+,:$@%........?@*..............%@$:,+@@%.:@#:,,*@@$....*@@#...:@$:,,;#@,...................?@*...................?@;.......;@*......................;@#;,;#@;........?@$:,+@@%.:@$:,,;#@,.%@$;,,+@@,.%@,...:@$:,,;#@,...................$@,.%@$:,:$@$.:@#:,,*@@$..%@$:,+@@%.......:@#:,,*@@$....%@@$....%@$;,,+@@,.%@,...:@#:,,*@@$..$@%:,+@@$..%@$;,,+@@,.............?@*..............?@*........?@*....................?@*..............?@*........$@$:,:%@#..............?@*..................;@*....$@%:,;$@%....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*.....%@@@@@#,..:@#........?@;....%@@@@@%...:@#.......;@*.........?@;.........:@@@@@?#%..%@$@@@@#,.......,@@@@@@@@@,.......,#@@@@%@%..$@@@@@@@@....,@@*....%@@@@@@?..;@$..............,@@@@@@@@@,.:@#........?@;.......;@*....;@$................%@@@@@%.........:@@@@@?#%..%@@@@@@?..,#@@@@@@+..%@,....%@@@@@@?..;@$...............$@,.:#@@@@@@:..$@@@@@@@@..,#@@@@%@%........$@@@@@@@@....+@@+....,#@@@@@@+..%@,....$@@@@@@@@..:@@@@@@@$..,#@@@@@@+..:@#........,@@@@@@@@@,.:@#..,@@@@@@@@@,,@@@@@@@@@,.;@$........,@@@@@@@@@,.:@#..,@@@@@@@@@,.:@@@@@@@:..;@$........,@@@@@@@@@,.:@#.......;@*....:@@@@@@#,....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
................;@*......*#@#?,...:@#........?@;....,*#@#*,...:@#.......;@*.........?@;..........;$@#*.#%..%@:%@#?,........;@@@@@@@@@,........,%@@%,@%..,%#@#%;$@:....#@:....,*#@@$+...;@$..............;@@@@@@@@@,.:@#........?@;.......;@*....;@$................,*#@#*,..........;$@#*.#%..,*#@@$+....,?#@@$;...%@,....,*#@@$+...;@$...............$@,..,?#@#?,...,%#@#%;$@:..,%@@%,@%........,%#@#%;$@:...,@@,.....,?#@@$;...%@,....,%#@#%;$@:..:%@@$;@$...,?#@@$;...:@#........;@@@@@@@@@,.:@#..;@@@@@@@@@,;@@@@@@@@@,.;@$........;@@@@@@@@@,.:@#..;@@@@@@@@@,..,%#@@%:...;@$........;@@@@@@@@@,.:@#.......;@*.....:%@@#?,.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...........................................................................................................%@,.......................................................,@$................;$.......................................................;$..................................................................................;$..................................................................................................................:@%.................................................................;$.................................................;$..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...........................................................................................................%@,.....................................................,,%@+...............,%?......................................................,%?.................................................................................,%?............................................................................................................@@;,,:$@+................................................................,%?................................................,%?..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...........................................................................................................%@,.....................................................#@@#................,$,......................................................,$,.................................................................................,$,............................................................................................................?@@@@@@$.................................................................,$,................................................,$,..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...........................................................................................................%@,.....................................................%@$,.............................................................................................................................................................................................................................................................................*$@@#*,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

(一部の`.`のみの行は省略した / Some `.`-only lines are omitted)

</div></details>

得られた`l`を用いて`ls`を表す文字列を作り、送信したが、なぜか空文字列として認識されてしまい、実行できなかった。
そこで、[San Diego CTF 2021 の No flag for you][noflagforyou]の解法を参考に、
`echo *`によってファイルの一覧を得ることにした。

I created a string to express `ls` using the `l` obtained and sent that to the server, but It was recognized as an empty string for some reason and it couldn't be executed.
Seeing this, I decided to obtain the list of files using `echo *`, inspired from the solution for ["No flag for you" in San Diego CTF 2021][noflagforyou].

[noflagforyou]: https://github.com/DimaIvanovskiy/ctf-write-ups/tree/main/SanDiegoCTF2021/NoFlagForYou

`echo *`を実行するには、`*`が必要である。
これは、`help`コマンドを実行し、出力のうち以下の行から得ることができた。

`*` is required to execute `echo *`.
This could be obtained from this line in the output of `help` command.

> A star (*) next to a name means that the command is disabled.

<details><summary>`help`を表す文字列 / A string to express `help`</summary><div>

```
..........................................................
..........................................................
......%@,...........................$@....................
......%@,...........................$@....................
......%@,...........................$@....................
......%@,...........................$@....................
......%@,*#@$;........,?#@#?,.......$@......%@,?@@%:......
......%@%@@@@@:......,#@@@@@#,......$@......%@%@@@@@:.....
......%@@+,:$@?......?@%:,:?@%......$@......%@@+,:$@%.....
......%@+...:@$.....,@#.....$@,.....$@......%@*...,#@,....
......%@:....@$.....:@@@@@@@@@:.....$@......%@,....?@;....
......%@,....@$.....;@@@@@@@@@;.....$@......%@.....*@;....
......%@,....@$.....:@%.............$@......%@,....%@;....
......%@,....@$.....,@@,............$@......%@+...,#@,....
......%@,....@$......%@$;,,+@@,.....$@......%@@+,:$@%.....
......%@,....@$......,#@@@@@@+......$@......%@$@@@@#,.....
......%@,....@$.......,?#@@$;.......$@......%@:%@#?,......
............................................%@,...........
............................................%@,...........
............................................%@,...........
............................................%@,...........
..........................................................
..........................................................
.
```

</div></details>

<details><summary>`help`コマンドの出力のうち該当部分 / The corresponding part of the output of the `help` command</summary><div>

```
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..........$@$.......................::..............................%%....#?....*$............................................::..........::................................................................................................................................................................::...%@,....................::..........::...%@,............................................................................................................,@%........%@,.......................,@%..%@,......................%@,........$@,..................,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.........,@@@,.....................;@+.............................;@:..;.$*,;..,@*..........................................;@+.........;@+...............................................................................................................................................................;@+...%@,...................;@+.........;@+...%@,............................................................................................................,@%........%@,.......................,@%..%@,......................%@,........$@,..................,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.........*@$@*.....................+@+............................,#?..;@##$@@...*@,.........................................+@+.........+@+...............................................................................................................................................................+@+...%@,...................+@+.........+@+...%@,............................................................................................................,@%..................................,@%...........................%@,........$@,..................,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.........#@:@#.....................+@+............................+@:...:?@@+:...,@?.........................................+@+.........+@+...............................................................................................................................................................+@+...%@,...................+@+.........+@+...%@,............................................................................................................,@%..................................,@%...........................%@,........$@,..................,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
........:@$.$@;...........*#@@$;..%@@@@:..;%#@@$+...%#:#@%........##....,#?#%.....%@,........%@:%@@$;....,?#@#?,..;@#,...$@;%@@@@:......%@@@@:..,?#@#?,..........;%#@@$+.........%@:%@@$;....;%#@@$+...%#,?@@%,.*#@$:....,?#@#?,.........%#,?@@%,.*#@$:....,?#@#?,....;%#@@$+...%@:%@@$;....*#@@$;........%@@@@:.%@,*#@$;....;%#@@$+..%@@@@:......%@@@@:.%@,*#@$;....,?#@#?,..........,?#@#*....,?#@#?,...%#,?@@%,.*#@$:...%#,?@@%,.*#@$:....;%#@@$+...%@:%@@$;....:%@@?,@%........%@,..*#@@$;..........:%@@?,@%..%@,..*#@@$;....;%#@@$+...%@,?@@%:...$@,..,?#@#?,....:%@@?,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
........?@*.+@%..........?@@@@@@;.%@@@@:.;@@@@@@@;..%##@@?.......:@?....;$,;$,....+@+........%@@@@@@@:..,#@@@@@#,..?@*..+@?.%@@@@:......%@@@@:.,#@@@@@#:........;@@@@@@@;........%@@@@@@@:..;@@@@@@@;..%#%@@@@?*@@@@#,..,#@@@@@#,........%#%@@@@?*@@@@#,..,#@@@@@#,..;@@@@@@@;..%@@@@@@@:..?@@@@@@;.......%@@@@:.%@%@@@@@:..;@@@@@@@;.%@@@@:......%@@@@:.%@%@@@@@:..,#@@@@@#,........,#@@@@@?..,#@@@@@#:..%#%@@@@?*@@@@#,..%#%@@@@?*@@@@#,..;@@@@@@@;..%@@@@@@@:..:@@@@@%@%........%@,.?@@@@@@;........:@@@@@%@%..%@,.?@@@@@@;..;@@@@@@@;..%@%@@@@@:..$@,.,#@@@@@#,..:@@@@@%@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
........@@,.,@@,........,@#:,,+@$..+@+...$@+,.:?@%..%@#:.........*@;..............:@?........%@@+,:$@?..?@%:,:?@%..,#@,,@#,..+@+.........+@+...%@$:,:$@$........$@+,.:?@%........%@@+,:$@?..$@+,.:?@%..%@@;,;@@@+,:#@;..?@%:,:?@%........%@@;,;@@@+,:#@;..?@%:,:?@%..$@+,.:?@%..%@@+,:$@?.,@#:,,+@$........+@+...%@@+,:$@?..$@+,.:?@%..+@+.........+@+...%@@+,:$@?..?@%:,:?@%........?@$;,;#@:.%@$:,:$@$..%@@;,;@@@+,:#@;..%@@;,;@@@+,:#@;..$@+,.:?@%..%@@+,:$@?..%@%:,+@@%........%@,,@#:,,+@$........%@%:,+@@%..%@,,@#:,,+@$..$@+,.:?@%..%@@+,:$@%..$@,.?@%:,:?@%..%@%:,+@@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.......;@%...%@*........,@#;.......+@+.........,@$..%@+..........%@:..............,@$........%@+...:@$.,@#.....$@,..;@%$@;...+@+.........+@+..,@@,...,#@:.............,@$........%@+...:@$........,@$..%@+...%@?...*@+.,@#.....$@,.......%@+...%@?...*@+.,@#.....$@,.......,@$..%@+...:@$.,@#;.............+@+...%@+...:@$........,@$..+@+.........+@+...%@+...:@$.,@#.....$@,.......@@,...;@*,@@,...,#@:.%@+...%@?...*@+..%@+...%@?...*@+........,@$..%@+...:@$.,@#,...+@%........%@,,@#;............,@#,...+@%..%@,,@#;.............,@$..%@+...,@@,.$@,,@#.....$@,,@#,...+@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.......%@;...;@#.........$@@@$*,...+@+.....:+*%#@$..%@:..........%@,...............@#........%@:...,@$.:@@@@@@@@@:...?@@?....+@+.........+@+..;@?.....?@;.........:+*%#@$........%@:...,@$....:+*%#@$..%@:...?@;...+@+.:@@@@@@@@@:.......%@:...?@;...+@+.:@@@@@@@@@:...:+*%#@$..%@:...,@$..$@@@$*,.........+@+...%@:....@$....:+*%#@$..+@+.........+@+...%@:....@$.:@@@@@@@@@:......:@$.......;@?.....?@;.%@:...?@;...+@+..%@:...?@;...+@+....:+*%#@$..%@:...,@$.;@?....,@%........%@,.$@@@$*,........;@?....,@%..%@,.$@@@$*,.....:+*%#@$..%@,....%@;.$@,:@@@@@@@@@:;@?....,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
......,@@@@@@@@@;........,%@@@@@+..+@+...:$@@@@@@$..%@,..........$@,...............#@........%@,....@$.;@@@@@@@@@;...;@@;....+@+.........+@+..;@*.....*@+.......:$@@@@@@$........%@,....@$..:$@@@@@@$..%@,...?@;...+@+.;@@@@@@@@@;.......%@,...?@;...+@+.;@@@@@@@@@;.:$@@@@@@$..%@,....@$..,%@@@@@+........+@+...%@,....@$..:$@@@@@@$..+@+.........+@+...%@,....@$.;@@@@@@@@@;......:@%.......;@*.....*@+.%@,...?@;...+@+..%@,...?@;...+@+..:$@@@@@@$..%@,....@$.;@?.....@%........%@,.,%@@@@@+.......;@?.....@%..%@,.,%@@@@@+..:$@@@@@@$..%@.....?@;.$@,;@@@@@@@@@;;@?.....@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
......+@@@@@@@@@%..........,+%#@@,.+@+...#@#?*;:@$..%@,..........%@,...............@#........%@,....@$.:@%..........,#@@#,...+@+.........+@+..;@?.....?@;.......#@#?*;:@$........%@,....@$..#@#?*;:@$..%@,...?@;...+@+.:@%...............%@,...?@;...+@+.:@%.........#@#?*;:@$..%@,....@$....,+%#@@,.......+@+...%@,....@$..#@#?*;:@$..+@+.........+@+...%@,....@$.:@%..............:@$.......;@?.....?@;.%@,...?@;...+@+..%@,...?@;...+@+..#@#?*;:@$..%@,....@$.;@%....,@%........%@,...,+%#@@,......;@%....,@%..%@,...,+%#@@,.#@#?*;:@$..%@,....%@:.$@,:@%........;@%....,@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
......$@+.....;@@,.............$@:.+@+..;@$....+@$..%@,..........?@:..............,@$........%@,....@$.,@@,.........?@?%@?...+@+.........+@+..,@@,...,#@,......;@$....+@$........%@,....@$.;@$....+@$..%@,...?@;...+@+.,@@,..............%@,...?@;...+@+.,@@,.......;@$....+@$..%@,....@$........$@:.......+@+...%@,....@$.;@$....+@$..+@+.........+@+...%@,....@$.,@@,..............@@,...,@%,@@,...,#@,.%@,...?@;...+@+..%@,...?@;...+@+.;@$....+@$..%@,....@$.,@@,...+@%........%@,.......$@:......,@@,...+@%..%@,.......$@:;@$....+@$..%@;...,@@,.$@,,@@,.......,@@,...+@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.....:@@,......#@+......:@$:,,;#@,.+@?..:@#:,,*@@$..%@,..........*@+..............:@?........%@,....@$..%@$;,,+@@,.:@#,,#@;..+@?.........+@?...%@$:,:$@$.......:@#:,,*@@$........%@,....@$.:@#:,,*@@$..%@,...?@;...+@+..%@$;,,+@@,.......%@,...?@;...+@+..%@$;,,+@@,:@#:,,*@@$..%@,....@$.:@$:,,;#@,.......+@?...%@,....@$.:@#:,,*@@$..+@?.........+@?...%@,....@$..%@$;,,+@@,.......%@$:,:$@+.%@$:,:$@$..%@,...?@;...+@+..%@,...?@;...+@+.:@#:,,*@@$..%@,....@$..%@$:,+@@%........%@,:@$:,,;#@,.......%@$:,+@@%..%@,:@$:,,;#@,:@#:,,*@@$..%@@;,:$@%..$@,.%@$;,,+@@,.%@$:,+@@%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.....*@?.......+@$.......%@@@@@@?..;@@@:.$@@@@@@@@..%@,..........:@?..............*@+........%@,....@$..,#@@@@@@+.,#@;..;@#,.;@@@:.......;@@@:.:#@@@@@@:........$@@@@@@@@........%@,....@$..$@@@@@@@@..%@,...?@;...+@+..,#@@@@@@+........%@,...?@;...+@+..,#@@@@@@+..$@@@@@@@@..%@,....@$..%@@@@@@?........;@@@:.%@,....@$..$@@@@@@@@..;@@@:.......;@@@:.%@,....@$..,#@@@@@@+........,#@@@@@%..:#@@@@@@:..%@,...?@;...+@+..%@,...?@;...+@+..$@@@@@@@@..%@,....@$..,#@@@@%@%........%@,.%@@@@@@?........,#@@@@%@%..%@,.%@@@@@@?..$@@@@@@@@..%@%@@@@#,..$@,.,#@@@@@@+..,#@@@@%@%..:@#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
.....#@:.......,@@:......,*#@@$+....?@@;.,%#@#%;$@:.%@,...........##..............%@,........%@,....@$...,?#@@$;..?@%....%@?..?@@;........?@@;..,?#@#?,.........,%#@#%;$@:.......%@,....@$..,%#@#%;$@:.%@,...?@;...+@+...,?#@@$;.........%@,...?@;...+@+...,?#@@$;...,%#@#%;$@:.%@,....@$..,*#@@$+..........?@@;.%@,....@$..,%#@#%;$@:..?@@;........?@@;.%@,....@$...,?#@@$;..........,?#@#?,...,?#@#?,...%@,...?@;...+@+..%@,...?@;...+@+..,%#@#%;$@:.%@,....@$...,%@@%,@%........%@,.,*#@@$+..........,%@@%,@%..%@,.,*#@@$+...,%#@#%;$@:.%@,%@@%,...$@,..,?#@@$;....,%@@%,@%..:@#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..................................................................+@;............,@?....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...................................................................#%............*@,....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
...................................................................+@:..........,@*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
....................................................................%%..........?$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

</div></details>

得られた`*`を用いて`echo *`を表す文字列を作成し、コマンドを実行した。

I created a string to express `echo *` using the `*` obtained and executed the command.

<details><summary>`echo *`を表す文字列 / A string to express `echo *`</summary><div>

```
................................................................
................................................................
................................................................
.........................%@,.............................#?.....
.........................%@,...........................;.$*,;...
.........................%@,..........................;@##$@@...
.........................%@,...........................:?@@+:...
.....,?#@#?,....,?#@#*...%@,*#@$;....,?#@#?,...........,#?#%....
....,#@@@@@#,..,#@@@@@?..%@%@@@@@:..,#@@@@@#:..........;$,;$,...
....?@%:,:?@%..?@$;,;#@:.%@@+,:$@?..%@$:,:$@$...................
...,@#.....$@,.@@,...;@*.%@+...:@$.,@@,...,#@:..................
...:@@@@@@@@@::@$........%@:....@$.;@?.....?@;..................
...;@@@@@@@@@;:@%........%@,....@$.;@*.....*@+..................
...:@%........:@$........%@,....@$.;@?.....?@;..................
...,@@,........@@,...,@%.%@,....@$.,@@,...,#@,..................
....%@$;,,+@@,.%@$:,:$@+.%@,....@$..%@$:,:$@$...................
....,#@@@@@@+..,#@@@@@%..%@,....@$..:#@@@@@@:...................
.....,?#@@$;....,?#@#?,..%@,....@$...,?#@#?,....................
................................................................
................................................................
................................................................
.
```

</div></details>

<details><summary>サーバの応答 / The response from the server</summary><div>

```
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..........$@$.............%@,............$@,........::....::....+#@#:.......+#@#:$@,..............................::..............::..........::.......................................:%#@@%:..............................................................................................................................................................................................................................................................................................................................................................
.........,@@@,............%@,............$@,.......;@+...;@+...,@@@@,......,@@@@,$@,.............................;@+.............;@+.........;@+......................................:@@@@@@@:.............................................................................................................................................................................................................................................................................................................................................................
.........*@$@*...........................$@,.......+@+...+@+...;@$,,.......;@$,,.$@,.............................+@+.............+@+.........+@+......................................%@%:,:$@%.............................................................................................................................................................................................................................................................................................................................................................
.........#@:@#...........................$@,.......+@+...+@+...;@*.........;@*...$@,.............................+@+.............+@+.........+@+......................................@#....,@@.............................................................................................................................................................................................................................................................................................................................................................
........:@$.$@;....%#:#@%.%@,..;%#@@$+...$@,......%@@@@:%@@@@:#@@@@?......#@@@@?.$@,..;%#@@$+....:%@@%,#$.......%@@@@:;@#,...$@;%@@@@:......%@@@@:..,?#@#?,...%#:#@%.%#,?@@%,.*#@$:..........$@........%@,?@@%:..*@+....,@%.................................................................................................................................................................................................................................................................................................................................
........?@*.+@%....%##@@?.%@,.;@@@@@@@;..$@,......%@@@@:%@@@@:#@@@@?......#@@@@?.$@,.;@@@@@@@;..:@@@@@$#$.......%@@@@:.?@*..+@?.%@@@@:......%@@@@:.,#@@@@@#,..%##@@?.%#%@@@@?*@@@@#,........,@#........%@%@@@@@:.,@$....*@;.................................................................................................................................................................................................................................................................................................................................
........@@,.,@@,...%@#:...%@,.$@+,.:?@%..$@,.......+@+...+@+...;@*.........;@*...$@,.$@+,.:?@%..%@$:,+@@$........+@+...,#@,,@#,..+@+.........+@+...?@%:,:?@%..%@#:...%@@;,;@@@+,:#@;........?@+........%@@+,:$@%..$@,...$@..................................................................................................................................................................................................................................................................................................................................
.......;@%...%@*...%@+....%@,.......,@$..$@,.......+@+...+@+...;@*.........;@*...$@,.......,@$.,@#,...+@$........+@+....;@%$@;...+@+.........+@+..,@#.....$@,.%@+....%@+...%@?...*@+.......*@$.........%@*...,#@,.+@*..,@?..................................................................................................................................................................................................................................................................................................................................
.......%@;...;@#...%@:....%@,...:+*%#@$..$@,.......+@+...+@+...;@*.........;@*...$@,...:+*%#@$.;@?.....@$........+@+.....?@@?....+@+.........+@+..:@@@@@@@@@:.%@:....%@:...?@;...+@+......*@$,.........%@,....?@;.,@#..*@;..................................................................................................................................................................................................................................................................................................................................
......,@@@@@@@@@;..%@,....%@,.:$@@@@@@$..$@,.......+@+...+@+...;@*.........;@*...$@,.:$@@@@@@$.+@*.....#$........+@+.....;@@;....+@+.........+@+..;@@@@@@@@@;.%@,....%@,...?@;...+@+.....?@$,..........%@.....*@;..%@:.$#...................................................................................................................................................................................................................................................................................................................................
......+@@@@@@@@@%..%@,....%@,.#@#?*;:@$..$@,.......+@+...+@+...;@*.........;@*...$@,.#@#?*;:@$.;@?.....@$........+@+....,#@@#,...+@+.........+@+..:@%.........%@,....%@,...?@;...+@+...,%@?............%@,....%@;..;@*,@?...................................................................................................................................................................................................................................................................................................................................
......$@+.....;@@,.%@,....%@,;@$....+@$..$@,.......+@+...+@+...;@*.........;@*...$@,;@$....+@$.,@#,...+@$........+@+....?@?%@?...+@+.........+@+..,@@,........%@,....%@,...?@;...+@+...$@*.............%@+...,#@,...##*@:...................................................................................................................................................................................................................................................................................................................................
.....:@@,......#@+.%@,....%@,:@#:,,*@@$..$@,.......+@?...+@?...;@*.........;@*...$@,:@#:,,*@@$..$@%:,+@@$........+@?...:@#,,#@;..+@?.........+@?...%@$;,,+@@,.%@,....%@,...?@;...+@+..?@*..............%@@+,:$@%....*@@#....................................................................................................................................................................................................................................................................................................................................
.....*@?.......+@$.%@,....%@,.$@@@@@@@@..$@,.:@#...;@@@:.;@@@:.;@*.........;@*...$@,.$@@@@@@@@..:@@@@@@@$..:@#...;@@@:,#@;..;@#,.;@@@:.......;@@@:.,#@@@@@@+..%@,....%@,...?@;...+@+.,@@@@@@@@@,.:@#...%@$@@@@#,....,@@*....................................................................................................................................................................................................................................................................................................................................
.....#@:.......,@@:%@,....%@,.,%#@#%;$@:.$@,.:@#....?@@;..?@@;.;@*.........;@*...$@,.,%#@#%;$@:..:%@@$;@$..:@#....?@@;?@%....%@?..?@@;........?@@;..,?#@@$;...%@,....%@,...?@;...+@+.;@@@@@@@@@,.:@#...%@:%@#?,......#@:....................................................................................................................................................................................................................................................................................................................................
......................................................................................................:@%..............................................................................................%@,..........,@$.....................................................................................................................................................................................................................................................................................................................................
................................................................................................@@;,,:$@+..............................................................................................%@,........,,%@+.....................................................................................................................................................................................................................................................................................................................................
................................................................................................?@@@@@@$...............................................................................................%@,........#@@#......................................................................................................................................................................................................................................................................................................................................
.................................................................................................*$@@#*,...............................................................................................%@,........%@$,......................................................................................................................................................................................................................................................................................................................................
............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

(一部の`.`のみの行は省略した / Some `.`-only lines are omitted)

</div></details>

`flag.txt`があることがわかったので、文字列のこの部分をコピペし、`cat flag.txt`コマンドにより出力させた。

I found that there is `flag.txt`, so I copy-and-pasted this part of the string and had the server print the contents via `cat flag.txt` command.

<details><summary>`cat flag.txt`を表す文字列 / A string to express `cat flag.txt`</summary><div>

```
................................................................................................................
................................................................................................................
................................::................+#@#:$@,..............................::..............::......
...............................;@+...............,@@@@,$@,.............................;@+.............;@+......
...............................+@+...............;@$,,.$@,.............................+@+.............+@+......
...............................+@+...............;@*...$@,.............................+@+.............+@+......
....,?#@#*........;%#@@$+.....%@@@@:............#@@@@?.$@,..;%#@@$+....:%@@%,#$.......%@@@@:;@#,...$@;%@@@@:....
...,#@@@@@?......;@@@@@@@;....%@@@@:............#@@@@?.$@,.;@@@@@@@;..:@@@@@$#$.......%@@@@:.?@*..+@?.%@@@@:....
...?@$;,;#@:.....$@+,.:?@%.....+@+...............;@*...$@,.$@+,.:?@%..%@$:,+@@$........+@+...,#@,,@#,..+@+......
...@@,...;@*...........,@$.....+@+...............;@*...$@,.......,@$.,@#,...+@$........+@+....;@%$@;...+@+......
..:@$..............:+*%#@$.....+@+...............;@*...$@,...:+*%#@$.;@?.....@$........+@+.....?@@?....+@+......
..:@%............:$@@@@@@$.....+@+...............;@*...$@,.:$@@@@@@$.+@*.....#$........+@+.....;@@;....+@+......
..:@$............#@#?*;:@$.....+@+...............;@*...$@,.#@#?*;:@$.;@?.....@$........+@+....,#@@#,...+@+......
...@@,...,@%....;@$....+@$.....+@+...............;@*...$@,;@$....+@$.,@#,...+@$........+@+....?@?%@?...+@+......
...%@$:,:$@+....:@#:,,*@@$.....+@?...............;@*...$@,:@#:,,*@@$..$@%:,+@@$........+@?...:@#,,#@;..+@?......
...,#@@@@@%......$@@@@@@@@.....;@@@:.............;@*...$@,.$@@@@@@@@..:@@@@@@@$..:@#...;@@@:,#@;..;@#,.;@@@:....
....,?#@#?,......,%#@#%;$@:.....?@@;.............;@*...$@,.,%#@#%;$@:..:%@@$;@$..:@#....?@@;?@%....%@?..?@@;....
............................................................................:@%.................................
......................................................................@@;,,:$@+.................................
......................................................................?@@@@@@$..................................
.......................................................................*$@@#*,..................................
................................................................................................................
................................................................................................................
.
```

</div></details>

<details><summary>サーバの応答 / The response from the server</summary><div>

```
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
..........................%@,...............%@,.......................+#@;?@@@@@@@@@@#..,?@@#*.....?@@@@@@%...?@@@@@@%...,?@@#*....*@@@@@@@#%:........?@;......:?#@@$+...,@@@@@@@@@;................,@*.....?@@@@@@%................:*$@@#%;......,*#@#*.....,*#@#*....*@@@@@@#?:...?@$:................................................................................................................................................................................................................................................
..........................%@,...............%@,......................,@@@;?@@@@@@@@@@#.,#@@@@@%....$@@@@@@%...$@@@@@@%..,#@@@@@%...*@@@@@@@@@@:......:@@;.....?@@@@@@@%..,@@@@@@@@@:...............,$@*.....$@@@@@@%...............+@@@@@@@@?.....%@@@@@%....%@@@@@%...*@@@@@@@@@;..?@@$................................................................................................................................................................................................................................................
..........................%@,........................................+@?,......#@,.....*@%:,;@@;...@#.........@#........*@%:,;@@;..*@*....,;$@$.....,#@@;....*@@*:,,+@@?........*@?...............,$@@*.....@#....................;@@%;,,:*@@+...;@#;,;#@;..;@#;,;#@;..*@*...,:%@@:..,#@................................................................................................................................................................................................................................................
..........................%@,........................................*@;.......#@,.....#@,...+@*..,@%........,@%........#@,...+@*..*@*......,@@.....*@$@;...:@@;.....:@@,......:@$...............+@@$@*....,@%...................,@@*......;@$...%@;...;@%..%@;...;@%..*@*......%@%...?@,...............................................................................................................................................................................................................................................
.......,?#@#*..*@+....,@%.%@,?@@%:...%#:#@%.%@,..,?#@#*....*#@@$;....*@;.......#@,...........*@+..;@*........;@*..............*@+..*@*......,@@....:@??@;...?@?.......?%:......$@;...............##;;@*....;@*...................+@$........?*...@@.....@@..@@.....@@..*@*......,@@...?@,...............................................................................................................................................................................................................................................
......,#@@@@@?.,@$....*@;.%@%@@@@@:..%##@@?.%@,.,#@@@@@?..?@@@@@@;...*@:.......#@,.........,+@#,..*@*%@@%:...*@*%@@%:.......,+@#,..*@*....,;$@%....$#,?@;...$@:...............+@%................;..;@*....*@*%@@%:..............%@+............,@$.....$@,,@$.....$@,.*@*.......$@:..?@:...............................................................................................................................................................................................................................................
......?@$;,;#@:.$@,...$@..%@@+,:$@%..%@#:...%@,.?@$;,;#@:,@#:,,+@$...?@:.......#@,........?@@#:...?@@@@@@@:..?@@@@@@@:.....?@@#:...*@@@@@@@@@@:...*@;.?@;...@@,...............#@:...................;@*....?@@@@@@@:.............#@,............,@%.....%@:,@%.....%@:.*@*.......%@;..*@;...............................................................................................................................................................................................................................................
......@@,...;@*.+@*..,@?..%@+...,@@,.%@+....%@,.@@,...;@*,@#;.......;@#........#@,........?#@@#:..$@*,,:$@#..$@*,,:$@#.....?#@@#:..*@@@@@@@#?:...:@%..?@;...@@...............;@%....................;@*....$@*,,:$@#.............@@,....$@@@@@;.:@%.....%@::@%.....%@:.*@*.......?@+..:@$:..............................................................................................................................................................................................................................................
.....:@$........,@#..*@;..%@,....%@;.%@:....%@,:@$........$@@@$*,..*@#:........#@,..........,?@$........,#@:.......,#@:......,?@$..*@*..,?@%,....$#,..?@;...#@,..............%@;....................;@*..........,#@:............#@,....$@@@@@;.:@%.....%@,:@%.....%@,.*@*.......%@;...+@@,.............................................................................................................................................................................................................................................
.....:@%.........%@:.$#...%@.....?@;.%@,....%@,:@%........,%@@@@@+.*@$:........#@,............#@,........%@;........%@;........#@,.*@*....?@%...*@;...?@;...$@;.......:;,...,@#.....................;@*...........%@;............$@;........?@;.,@$.....$@,,@$.....$@,.*@*.......#@:...+@@,.............................................................................................................................................................................................................................................
.....:@$.........;@*,@?...%@,....%@:.%@,....%@,:@$..........,+%#@@,.;@$........#@,............$@:........%@;........%@;........$@:.*@*....,#@*..$@@@@@@@@@:.*@?.......?@*...;@?.....................;@*...........%@;............+@%........?@;..@@.....@@..@@.....@@..*@*......,@@...,@#:..............................................................................................................................................................................................................................................
......@@,...,@%...##*@:...%@;...,@@,.%@,....%@,.@@,...,@%.......$@:..%@,.......#@,....,@#....,@@,,@#....,@@,,@#....,@@,,@#....,@@,.*@*.....;@@:.$@@@@@@@@@:.:@@:.....;@@:...?@;.....................;@*...,@#....,@@,............,@@*.......%@;..%@;...;@%..%@;...;@%..*@*......%@?...+@;...............................................................................................................................................................................................................................................
......%@$:,:$@+...*@@#....%@@;,:$@%..%@,....%@,.%@$:,:$@+:@$:,,;#@,..*@:.......#@,.....$@%:,;$@%..$@%:,;$@%..$@%:,;$@%..$@%:,;$@%..*@*......%@%.......?@;....?@@*:,:*@@?....$@,.....................;@*....$@%:,;$@%..............;@@%;,,:+#@@;..;@#;,;#@;..;@#;,;#@;..*@*...,;%@@:...?@:...............................................................................................................................................................................................................................................
......,#@@@@@%....,@@*....%@%@@@@#,..%@,....%@,.,#@@@@@%..%@@@@@@?...*@;.......#@,.....:@@@@@@#,..:@@@@@@#,..:@@@@@@#,..:@@@@@@#,..*@*......,@@;......?@;.....%@@@@@@@%,....@@......................;@*....:@@@@@@#,...............+@@@@@@@@#;....%@@@@@%....%@@@@@%...*@@@@@@@@@;....?@,...............................................................................................................................................................................................................................................
.......,?#@#?,.....#@:....%@,%@@%,...%@,....%@,..,?#@#?,..,*#@@$+....*@;.......#@,......:%@@#?,....:%@@#?,....:%@@#?,....:%@@#?,...*@*.......*@#,.....?@;......;%#@@$+......@#......................;@*.....:%@@#?,.................,*$@@#%+......,*#@#*,....,*#@#*,...*@@@@@@#?:.....?@,...............................................................................................................................................................................................................................................
..................,@$................................................+@;..............................................................................................................................................................................................................?@,...............................................................................................................................................................................................................................................
................,,%@+................................................;@?,............................................................................................................................................................................................................,#@................................................................................................................................................................................................................................................
................#@@#.................................................,@@@;.........................................................................................................;@@@@@@@@@@@+....................;@@@@@@@@@@@+...................................................?@@%................................................................................................................................................................................................................................................
................%@$,..................................................+#@;.........................................................................................................;@@@@@@@@@@@+....................;@@@@@@@@@@@+...................................................?@$,................................................................................................................................................................................................................................................
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
```

(一部の`.`のみの行は省略した / Some `.`-only lines are omitted)

</div></details>

flagが得られた。

I obtained the flag.

```
cybrics{T3553R4C7_15_G00D}
```

## Listing (Reverse)

x86-64アセンブリのソースコード`listing.asm`が与えられた。
また、問題文より`[rdi]`に入れる入力データが求められていることがわかる。

An x86-64 assembly source code `listing.asm` was given.
Also the task description said that we should answer what should be put to `[rdi]`.

`listing.asm`は、以下の処理をしていた。

1. `VPXOR`を用いて、入力に8バイトのデータの繰り返しをxorする
2. `VPSHUFB`と8バイトのデータ4個を用いて、1で得られたデータを加工する
3. `VPCMPEQQ`を用いて、2で得られたデータと決められたデータを比較する
4. 3の比較の結果、全部一致していれば1、そうでなければ0を返す

This process is performed in `listing.asm`:

1. Calculate exclusive-or of the input data and repeated 8-byte data via `VPXOR`.
2. Manipulate data from 1 via `VPSHUFB` and four 8-byte data.
3. Compare data from 2 and defined data via `VPCMPEQQ`.
4. If the data are all same, return 1. Otherwise, return 0.

まず、`VPSHUFB`によってデータがどう変化するかを調べるため、以下のプログラムを実行した。

Firstly, to determine how `VPSHUFB` manipulates data, I executed this program:

<details><summary>vpshufb_test.c</summary><div>

```vpshufb_test.c
#include <stdio.h>
#include <inttypes.h>

int main(void) {
	char data[32] = "0123456789abcdefghijklmnopqrstuv";
	char data_out[32] = "";
	uint64_t data_place[4] = {
		UINT64_C(0x19181b1a1c1d1f1e),
		UINT64_C(0x1110131215141716),
		UINT64_C(0x09080b0a0c0d0f0e),
		UINT64_C(0x0100030205040706),
	};
	__asm__ __volatile__ (
		"vmovdqu %1, %%ymm0\n\t"
		"vmovdqu %2, %%ymm1\n\t"
		"vpshufb %%ymm1, %%ymm0, %%ymm2\n\t"
		"vmovdqu %%ymm2, %0\n\t"
	: "=m"(data_out) : "m"(data), "m"(data_place) : "memory");
	printf("%.32s\n", data_out);
	return 0;
}
```

</div></details>

実験の結果、今回の`VPSHUFB`は、
`0123456789abcdefghijklmnopqrstuv` を `efdcab8967452301uvtsqropmnklijgh` に変換することがわかった。
さらに、[CyberChefで比較対象の「決められたデータ」を1バイトずつの列に変換した。][listing-cyberchef-1]
この「決められたデータ」のバイト列は以下のものである。

As a result, it is revealed that `VPSHUFB` used here
converts `0123456789abcdefghijklmnopqrstuv` to `efdcab8967452301uvtsqropmnklijgh`.
Also, [I extracted each bytes of the "defined data" to compare via CyberChef.][listing-cyberchef-1]
This is the bytes of the "defined data":

[listing-cyberchef-1]: https://gchq.github.io/CyberChef/#recipe=Find_/_Replace%28%7B%27option%27:%27Simple%20string%27,%27string%27:%270x%27%7D,%27%27,true,false,true,false%29From_Hex%28%27Auto%27%29Reverse%28%27Character%27%29To_Hex%28%27Space%27,0%29&input=MHhkMWQzNzYyMzM1NjE5YWFiCjB4ZDVkNTIzMjczNTY1ODNmOAoweGM5ZDM2MTI3MzM2Yzg1YjkKMHhkNWQ2MjI3MTMxNjFjYmY4Cg

```
f8 cb 61 31 71 22 d6 d5 b9 85 6c 33 27 61 d3 c9 f8 83 65 35 27 23 d5 d5 ab 9a 61 35 23 76 d3 d1
```

これに基づき、`VPSHUFB`で加工をする前のデータを手動で求めた。
変換結果はほぼ2バイトずつ順番を保っているが、`cd`ではなく`dc`、`st`ではなく`ts`を含むことに注意すると吉である。
結果は以下である。

Based on this, I manually determined the input data for `VPSHUFB`.
The order of most of each 2 bytes are preserved, but it is worth noting that the conversion result contains `dc`, not `cd`, and `ts`, not `st`.
This is the input data:

```
d3 c9 27 61 6c 33 b9 85 d6 d5 71 22 31 61 f8 cb d3 d1 23 76 61 35 ab 9a d5 d5 27 23 35 65 f8 83
```

最後に、このデータに最初の`VPXOR`の効果を打ち消すための[xorをCyberChefでかけた。][listing-cyberchef-2]
x86-64はリトルエンディアンであり、数値表記とバイト列は逆になるため、
入力を一旦反転させてからxorをかけ、また反転させる方法をとった。
その結果、flagが得られた。

Finally, [I applied exclusive-or to this data via CyberChef][listing-cyberchef-2] to cancel the effect of the first `VPXOR`.
Little-endian is used on x86-64 and the order of byte sequence is reversed from the number notation,
so I firstly reversed the input data, then applied exclusive-or, then reversed the result again.
The flag is obtained as a result.

[listing-cyberchef-2]: https://gchq.github.io/CyberChef/#recipe=From_Hex%28%27Auto%27%29Reverse%28%27Character%27%29XOR%28%7B%27option%27:%27Hex%27,%27string%27:%27feca50051345b0b0%27%7D,%27Standard%27,false%29Reverse%28%27Character%27%29To_Hex%28%27Space%27,0/disabled%29&input=ZDMgYzkgMjcgNjEgNmMgMzMgYjkgODUgZDYgZDUgNzEgMjIgMzEgNjEgZjggY2IgZDMgZDEgMjMgNzYgNjEgMzUgYWIgOWEgZDUgZDUgMjcgMjMgMzUgNjUgZjggODMK

```
cybrics{fe414125cafedeadeeb0052}
```

## Ad Network (Web)

WebページのURLが与えられた。
ソースを表示して読むと、以下の怪しい部分が見つかった。

An URL of a Web page was given.
Viewing the source, I found this suspicious part:

```html
				<a href="/adnetwork" target="_top" onClick="loadurl(this.href);return false"><img
							width="440" height="40" border="1" ismap alt="LinkExchange"
							src="assets/img/adnetwork.gif"></a>
```

Firefoxでリンク先のURL `http://adnetwork-cybrics2021.ctf.su/adnetwork` にアクセスしてみると、
アドレスバー上のURLが変化し、「ページの自動転送設定が正しくありません」というエラーが表示された。

Accessing the linked URL `http://adnetwork-cybrics2021.ctf.su/adnetwork` via Firefox,
the URL in the address bar changed an an error "The page isn't redirecting properly" was shown.

新しいURLへのアクセスも、同様のエラーになった。
20回以上繰り返したが、同様のエラーが出続けた。

I accessed the new URL, seeing the same error.
I repeated this over 20 times, and the error showed up again and again.

そこで、HTTPのリダイレクト先をたどる以下のプログラムを用意し、実行した。

Seeing this, I created this program to follow HTTP redirections and executed that.

<details><summary>request.pl</summary><div>

```request.pl
#!/usr/bin/perl

use strict;
use warnings;

use IO::Socket;

sub get_url {
	my $url = $_[0];
	unless ($url =~ /http:\/\/(.*?@)?(.*?)(:.*?)?(\/.*)$/) { return ""; }
	my $host = $2;
	my $port = $3;
	my $path = $4;
	my $req_host;
	if (defined($port)) {
		$port = int(substr($port, 1));
		$req_host = "$host:$port";
	} else {
		$port = 80;
		$req_host = $host;
	}
	my $sock = new IO::Socket::INET(PeerAddr=>$host, PeerPort=>$port, Proto=>"tcp");
	unless ($sock) { die "socket error: $!\n"; }
	binmode($sock);
	print $sock "GET $path HTTP/1.1\r\n";
	print $sock "User-Agent: Perl\r\n";
	print $sock "Host: $req_host\r\n";
	print $sock "Connection: close\r\n";
	print $sock "\r\n";
	my $res = "";
	while (<$sock>) {
		if ($_ =~ /Location: *(.*)\r\n/i) {
			$res = $1;
		}
	}
	close($sock);
	return $res;
}

my $cur_url = "http://adnetwork-cybrics2021.ctf.su/adnetwork";

$| = 1;
print "$cur_url\n";
for (;;) {
	$cur_url = &get_url($cur_url);
	if ($cur_url ne "") {
		print "$cur_url\n";
	} else {
		last;
	}
}
```

</div></details>

約15分後、実行が完了した。出力の最終行は以下のURLになった。

The execution completed after about 15 minutes. This is the last line of its output:

```
http://tend.adnetwork-cybrics2021.ctf.su/military-front-low/learn-fill-though-factor-line/hear-hundred-subject-wind/enough-lot-tree-will-color
```

FirefoxでこのURLにアクセスすることで、flagが得られた。

I obtained the flag by accessing this URL via Firefox.

```
cybrics{f0lL0w_RUl3Z_F0ll0W_r3d1r3C7z}
```