import pwn
import re

def get_rand(seed):
    state = [0] * 31
    v3 = seed if seed != 0 else 1
    state[0] = v3
    for i in range(1, 31):
        v9 = 16807 * (v3 % 127773) - 2836 * (v3 // 127773)
        v3 = v9 + (0x7FFFFFFF if v9 < 0 else 0)
        state[i] = v3

    fptr = 3
    rptr = 0

    def rand():
        nonlocal fptr, rptr, state
        val = (state[fptr] + state[rptr]) & 0xFFFFFFFF
        state[fptr] = val
        res = val >> 1
        fptr += 1
        if fptr >= 31: fptr = 0
        rptr += 1
        if rptr >= 31: rptr = 0
        return res

    for _ in range(310):
        rand()

    return rand

def solve_challenge(dt):
    # Connect
    conn = pwn.remote('135.235.195.203', 3000, level='error')
    
    # Wait for shell prompt
    conn.recvuntil(b"/ $ ")
    conn.sendline(b"/challenge/lock_app")
    
    # Read until "The current time is:"
    conn.recvuntil(b"The current time is: ")
    server_time = int(conn.recvline().strip())
    print(f"[+] Server Time: {server_time}, dt: {dt}")
    
    # Compute SBOX with server_time
    rand_init = get_rand(server_time)
    rand_init() # Discard
    rand_init() # Discard
    
    SBOX = list(range(256))
    for j in range(255, 0, -1):
        v2 = rand_init()
        swap_idx = v2 % (j + 1)
        SBOX[j], SBOX[swap_idx] = SBOX[swap_idx], SBOX[j]
        
    def time_math(val):
        return (SBOX[(val >> 24) & 0xFF] << 24) | \
               (SBOX[(val >> 16) & 0xFF] << 16) | \
               (SBOX[(val >> 8) & 0xFF] << 8) | \
               SBOX[val & 0xFF]
               
    # Wait for menu
    conn.recvuntil(b"Select option: ")
    
    # 2. Reset password
    conn.sendline(b"2")
    
    # Read challenge code
    # "Your challenge code is: XXXXXXX"
    conn.recvuntil(b"Your challenge code is: ")
    chal_code = int(conn.recvline().strip())
    print(f"[+] Challenge Code: {chal_code}")
    
    # Generate response based on guessed time
    rand_gen = get_rand(server_time + dt)
    v5 = rand_gen()
    v6 = rand_gen()
    
    v7 = time_math(v5)
    v8 = time_math(v6)
    
    v7 = time_math(v5)
    v8 = time_math(v6)
    
    # Both modulos are UNSIGNED 32-bit
    val1 = (31337 * v7 + v8) & 0xFFFFFFFF
    mod1 = val1 % 1000000
    urandom = chal_code ^ mod1
    
    val2 = (v7 ^ v8) & 0xFFFFFFFF
    mod2 = val2 % 1000000
    
    response = urandom ^ mod2
    
    print(f"[+] Predicted Response (dt={dt}): {response}")
    
    # Send response
    conn.recvuntil(b"Response code: ")
    conn.sendline(str(response).encode())
    
    res = conn.recvall(timeout=3).decode()
    conn.close()
    
    if "Nope" in res:
        print("[-] Failed.")
        return False
    elif "Here's a gift" in res or "SUCCESSFUL" in res:
        print("[*] SUCCESS!!!")
        print(res)
        return True
    return False

if __name__ == "__main__":
    for dt in range(0, 5):
        for _ in range(3): # try each dt 3 times
            try:
                if solve_challenge(dt):
                    import sys
                    sys.exit(0)
            except Exception as e:
                pass