# MathGenMe

> I generated a license key for my password using my program:\
> 04b2fc467e104c0c610e3bf0a009a9f3621905df1997ce0b6cd6a3ea68af4d4deaaf024906f7b259ba32035ac4dad586.
>
> However, I forgot my password! Can you recover it?
>
> Author: xenocidewiki ([tìm hiểu thêm](https://github.com/ViRb3/pwnEd-ctf/tree/master/mathgenme))

Dưới đây là lời giải bằng z3py:

{% code overflow="wrap" %}

```python
from z3 import *

solver = Solver()

s = [BitVec(f"flag_{i:02}", 8) for i in range(0, 48)] # tạo 1 vector int 48 pt
v6 = [BitVec(f"key_{i:02}", 8) for i in range(0, 48)]
v5 = 0

for i in range(0, 12): # điều kiện của bài
    solver.add(v6[v5] == (33 * s[v5 + 3] + 89 * s[v5 + 2] + 103 * s[v5 + 1] + 66 * s[v5]))
    solver.add(v6[v5 + 1] == (73 * s[v5] + -125 * s[v5 + 1] + -103 * s[v5 + 2] + 51 * s[v5 + 3]))
    solver.add(v6[v5 + 2] == (113 * s[v5 + 1] + s[v5 + 3] + 54 * s[v5] + 8 * s[v5 + 2]))
    solver.add(v6[v5 + 3] == (25 * s[v5 + 2] + 23 * s[v5 + 3] + 119 * s[v5] + 3 * s[v5 + 1]))
    v5 += 4

key = "04b2fc467e104c0c610e3bf0a009a9f3621905df1997ce0b6cd6a3ea68af4d4deaaf024906f7b259ba32035ac4dad586" #key họ cho
key = [int(x) for x in bytearray.fromhex(key)] # chuyển key thành mảng int từ hex
for i in range(0, len(key)):
    solver.add(v6[i] == key[i])
    # multiple solutions, limit flag to ascii range
    solver.add(s[i] >= 32) # giới hạn cho flag
    solver.add(s[i] <= 126)

if not solver.check(): #kiểm tra sat trước khi in
    print("No solution")
    exit(0)
m = solver.model()

# sorted để tạo thành list sắp xếp gồm tên và giá trị)
solution = sorted([(d, m[d]) for d in m], key=lambda x: str(x[0])) 
# lấy giá trị của của pt bắt đầu "flag"
filtered_solution = [x for x in solution if str(x[0]).startswith("flag")]
# lấy giá trị của x[1]
flag = ''.join(map(lambda x: chr(int(str(x[1]), 10)), filtered_solution))

# print(solution)
print(flag)
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://viettaliii.gitbook.io/home/ctf/cheatsheet/python/z3py/vi-du-z3-su-dung-trong-ctf/mathgenme.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.