## rev/ooo writeup ### Overview The program defines many functions whose names are different Unicode "o" characters. It asks for a flag and then checks each adjacent character pair against a list of integers. The trick is that the index into the list always simplifies to the loop index, so the check reduces to a simple sum of adjacent character codes. ### Key observations - The functions are basic arithmetic: - `о(a,b)=a+b`, `ο(a,b)=a-b`, `օ(a,b)=a*b`, `ȯ(a,b)=a%b`, `ơ(a,b)=a^b` (xor), and `ὄ(a,b)=a`, `ὂ(a,b)=b`. - In the loop: - `ὄ(ό,ὃ)` returns `ord(guess[i])` and `ὂ(ό,ὃ)` returns `ord(guess[i+1])`. - The list index is `ơ(i, ȯ(օ(ό,ὃ), ό))` which is `i XOR ((ord[i]*ord[i+1]) % ord[i])`. - For any positive `x`, `(x*y) % x == 0`, so the index simplifies to `i XOR 0 == i`. - The check becomes `ord(guess[i]) + ord(guess[i+1]) == L[i]`. ### Solving Let `L` be the list in the script. We know the standard prefix `lactf{`, and it already satisfies the first 6 sums. That fixes the first character, and the rest follow deterministically: ``` chars[0] = ord('l') chars[i+1] = L[i] - chars[i] ``` ### Script ```python L = [205, 196, 215, 218, 225, 226, 1189, 2045, 2372, 9300, 8304, 660, 8243, 16057, 16113, 16057, 16004, 16007, 16006, 8561, 805, 346, 195, 201, 154, 146, 223] chars = [ord('l')] for i in range(len(L) - 1): chars.append(L[i] - chars[i]) flag = ''.join(chr(c) for c in chars) print(flag) ``` ### Flag (escaped) The resulting flag contains non-ASCII Unicode "o" letters. In escaped form: ``` lactf{g\u043e\u03bf\u0585\u1ecf\u01a1\u00f3\u1f40\u1f79\u1f78\u1f41\u1f43\u1f44\u1f42\u022f\u00f6d_j0b} ``` Final flag: ``` lactf{gоοօỏơóὀόὸὁὃὄὂȯöd_j0b} ``` To print the exact flag, run the script above (or decode the escapes).