mirror of
https://github.com/ljagiello/ctf-skills.git
synced 2026-09-14 14:17:37 +08:00
Yuzu Octopus
61c2efe0e8
* chore: ignore local planning artifacts and fix pyproject version for uv - .gitignore: add .superpowers/, plans/, docs/superpowers/ for upstream PR hygiene - pyproject.toml: add version 0.1.0 to fix uv parse (was missing required field) - uv.lock: generated by uv run (tracked for reproducibility) * feat(tools): add Coppersmith fpylll primary and PAT on-demand clone - PIP_PACKAGES: keep sympy==1.14.0 gmpy2==2.3.0 fpylll==0.6.4 pycryptodome==3.23.0 pinned, add ecdsa note, document no reliable PyPI coppersmith (404) + jvdsn/crypto-attacks clone path - install_pat(): PAT_DIR ~/.ctf-tools/PayloadsAllTheThings → WEB_PAT_DIR ctf-web/payloads/PayloadsAllTheThings, --depth 1 clone + ln -sfn fallback direct clone, --dry-run/--verify/--force, SUCCEEDED tracking - print_manual(): Sage optional, crypto-attacks + PAT clone notes * docs(web): PAT on-demand integration + field-notes cross-ref - ctf-web/pat-reference.md: 12.7K index pinned 3ac2790 MIT, table local→PAT paths, 2-3 exemplar payloads per cat, install bash scripts/install_ctf_tools.sh pat + lazy clone snippet - ctf-web/SKILL.md: Prerequisites PAT bullet (auto via install or lazy clone), Additional Resources pat-reference.md link, Bulk payloads on-demand subsection Glob+Grep graceful degrade - ctf-web/field-notes.md: footer See pat-reference.md for bulk payloads - README/CONTRIBUTING: pat mode web-only, all includes pat, payloads external bulk note + testing uv run pytest/verify docs * feat(crypto): modernize Sage→fpylll/sympy + B comprehensive AES/ECC/RSA/Lattice/PQC/PRNG - Sage fallback: all 23 from sage imports inside <details> (outside_details=0), pure-Python primary fpylll IntegerMatrix/LLL/BKZ/CVP, sympy Poly/GF, math.isqrt/pow - Fix C1-3: poly_gcd_mod_n monic Euclidean, hg_matrix fpylll lattice with X explicit, Hensel Newton O(1), taps exclude 0, isqrt math - B lattice-PQC 001: hg_matrix→LLL, NTRU [[qI 0],[H I]] negacyclic, GGH λ sweep, Mersenne AJPS 6×6, BDD predicate, ML-KEM q=3329; new post-quantum.md - B ECC 002: invalid-curve 5 variants table (Codegate/CUHK/ISCTF/Montgomery), MOV k≤6, twist, GLV, SIDH Castryck-Decru + CSIDH volcano, HNP cross-link - B RSA 003: Boneh-Durfee N^0.292, partial-d, Williams p+1+ECM, LSB binary, stereotyped single-n, small-CRT dp, implicit factoring, Bleichenbacher 0x00 0x02 + Marvin - B AES/AEAD 004: ChaCha-Poly1305 2^130-5 galois CTR cancel + forge (picoCTF 2025), partitioning-oracle, Keccak/Ascon/Gimli/Sparkle, Trivium 1152 cube; new modern-ciphers-4.md - B PRNG/stream 005: PCG XSH-RR 64-branch, xoroshiro table, BBS parity, Henon+Arnold inverse, Spritz/VMPC/RC4A, Trivium/Grain/Mickey - SKILL.md: prerequisites sympy primary, Coppersmith fpylll, technique bullets small_roots/BSGS→fpylll * test(crypto): add 18 known-answer snippets + 364-fence verifier - tests/test_crypto_snippets.py 11→18: Wiener, Fermat, Hastad, Coppersmith demo, BSGS, Pohlig-Hellman, LLL HNP tiny, BM x2, ECDSA reuse, Boneh-Durfee hg_matrix, biased HNP 8sig, Poly1305 (galois skip), NTRU q3329 N7, Mersenne n521, LSB oracle, stereotyped single-n; pytest.importorskip fpylll/cysignals, deterministic - scripts/verify_crypto_examples.py: stdlib FENCE_RE, ast+py_compile, --strict/--json, sage fallback/oracle skipped; Checked 364 fences: 355 syntax OK - verifies: fpylll 0.6.4 + sympy 1.14.0 + gmpy2 smoke, 74 passed 1 skipped (galois) * chore: ignore uv.lock - local uv artifact not for upstream * feat(reverse): add Unicorn CPU emulation guide - raw binary + assembly - New ctf-reverse/unicorn-emulation.md 620L (20K): when unicorn beats GDB/angr/qiling, setup scaffold mem_map/write/reg_write/emu_start timeout, hook cookbook CODE/MEM_READ/WRITE/INTR/BLOCK, ARM/MIPS/THUMB UC_ARCH_/UC_MODE_, mixed-mode 64→32 retf with XMM+EFLAGS copy, firmware MMIO MEM hooks, Keystone+Unicorn trace inversion MeePwn 2017 try_byte loop, shellcode unpack Multi-Stage, custom VM opcode dispatch, qiling vs unicorn decision table (Uc raw vs Qiling rootfs syscalls), pitfalls (Thumb LSB, UC_ERR_FETCH_UNMAPPED, hook re-entrance), 2 worked 2024 examples - Context7 verified: Uc, UC_ARCH_X86/ARM/MIPS, UC_MODE_32/64/THUMB, mem_map/write, reg_write/read, emu_start, hook_add, UC_ERR, x86/arm/mips const, capstone/keystone pairing - ctf-reverse/SKILL.md: Additional Resources bullet unicorn-emulation.md cross-links tools.md/field-notes/anti-analysis-ctf - Pinned unicorn==2.1.2 already, no new pip, every fence <!-- audit-ok --> for shellcode.bin, 19 fences syntax OK, unicorn+capstone smoke ok, auditor ctf-reverse PASS * feat(reverse): harden Unicorn guide to elite robustness - snapshots, MMIO, GDB stub - Expand 620L→1313L: Snapshot & Fork (context_save/restore, mem snapshot, copy-on-write brute-force), Coverage/Counting/Timeout tuning (BLOCK vs CODE, AFL++ edge, timeout 2M vs count), Threading & SMC (write to code page detection), MMIO Robust GPIO/timer/interrupt controller state dict + side-effect read + filtering READ_UNMAPPED vs WRITE_PROT, GDB Stub integration (unicorn as GDB backend, GEF/pwndbg without ptrace), Performance (0x1000 map, filtered hook_add, batch mem_read), Emulator Comparison Unicorn vs Qiling vs QEMU vs angr vs Triton concrete vs symbolic, Worked Ex 3 elite firmware timer+UART+nested VM - Context7 verified: context_save/restore, mem_protect, UC_HOOK_CODE/BLOCK/INTR, errno, arch regs - Cross-links tools-emulation.md qiling + tools-advanced.md VMProtect/LLVM IR, auditor ctf-reverse PASS, 116 unicorn hits, 33 fences syntax OK, smoke ok * feat(web): wire httpx for async intruder toolkit * feat(web): add Python requests intruder toolkit - sync + ThreadPool + httpx async * feat(web): add async_fuzz.py ThreadPool+httpx CLI * test(web): add 6-8 mocked intruder/payload deploy tests * fix(reverse): correct cross-ref anchor for custom VM LLVM IR - tools-advanced.md heading is custom-vm-bytecode-lifting-to-llvm-ir-google-ctf-2017 not base * fix(web): suppress audit for verify=False CTF self-signed - ctf-web/scripts/async_fuzz.py:52 add <!-- audit-ok --> marker so skill_security_auditor skips SSL verification disabled HIGH for proxy self-signed CTF case * feat(pwn): pin pwntools 4.15.0 + uv docs + qemu-user cross-arch note * feat(pwn): add 5 runnable pwntools 4.15.0 scripts with yield generators * feat(pwn): patch heap/kernel 2024 gaps - largebin, tcache 2.39, io_uring CVE, CET, House of Tangerine * test(pwn): add 5-6 mocked pwntools script tests with yield generators * feat(misc): pin pwntools+segno and document libzbar0 for QR * feat(misc): add audit-hook trampoline, filter'd, NFKC table, modern filter trio to pyjails * feat(misc): patch encodings xor/gzip polyglot, BF dual, bash BASH_ENV * test(misc): add NFKC/xor/audit-hook mocked tests * fix(crypto): replace invalid CVP.babai with GSO.Mat.babai and fix GGH target * fix(crypto): implement negacyclic matrix generation in flatten_mlkem * fix(crypto): fix MOV embedding degree, Hensel modular inverse, integer nthroot, and clean imports * fix(crypto): fix Poly1305 Horner evaluation and polynomial root recovery * fix(pwn): set frame.rax to SYS_execve, fix trigger gadget, and use 64-bit r12 in ORW generator * fix(pwn): correct setcontext registers, x64 corefile read size, and CET constants * fix(reverse): fix mu.errno, UC_MEM constants, XMM0-15 registers, and patch slice * fix(fringe): standardize vol CLI, update Vol3/dissect APIs, fix PyTorch 2.6 weights_only, wire AI-ML * fix(misc): fix audit hook closure, staticmethod getitem, auto_decode bytes, and Selenium 4 * fix(web): fix blind SQLi feed loop, async_fuzz double-encoding, JWT byte length, and Go SSTI * docs: rewrite README with fork declaration, skills.sh badge, and ctf-skills group installation * chore: lower requires-python to >=3.10 and remove redundant pin file * fix(crypto): add classic DH confinement Lim-Lee and X25519 low-order probes * fix(crypto): verify GHASH vs real AES-GCM, sympy sqrt primary, hard-size tests * refactor(crypto): prefer pycryptodome/sympy helpers in symmetric docs * refactor(crypto): prefer sympy/gmpy2/pycryptodome helpers in RSA docs * refactor(crypto): prefer sympy/gmpy2 helpers in ECC/DH docs * fix(crypto): revert sympy discrete_log, hand Pohlig verified correct * fix(pr86): address review - Poly1305 p130, upstream-neutral README/config