import os
import numpy as np
import png
from PIL import Image

MOD = 257


def preprocessing(path):
    img = Image.open(path)
    data = np.asarray(img)
    return data.flatten(), data.shape


def read_text_chunk(src_png, index=1):
    reader = png.Reader(filename=src_png)
    chunks = reader.chunks()
    chunk_list = list(chunks)
    img_extra = chunk_list[index][1].decode()
    img_extra = eval(img_extra)
    return img_extra


def restore_share(path):
    flat, shape = preprocessing(path)
    flat = flat.astype(np.int64)
    idx = read_text_chunk(path)
    if idx:
        flat[idx] = 256
    return flat, shape


def lagrange_coeffs_at_zero(xs):
    xs = list(xs)
    n = len(xs)
    coeffs = []
    for i in range(n):
        xi = xs[i]
        num = 1
        den = 1
        for j in range(n):
            if j == i:
                continue
            xj = xs[j]
            num = (num * (0 - xj)) % MOD
            den = (den * (xi - xj)) % MOD
        inv_den = pow(den, -1, MOD)
        coeffs.append((num * inv_den) % MOD)
    return coeffs


def reconstruct_secret_image(prefix="secret_", n=6, output_path="secret.png"):
    shares = []
    shape = None
    for i in range(1, n + 1):
        fname = f"{prefix}{i}.png"
        if not os.path.exists(fname):
            raise FileNotFoundError(f"缺少 share 文件: {fname}")
        flat, shape = restore_share(fname)
        shares.append(flat)

    # shares: list of (N,) -> (n, N)
    shares_arr = np.stack(shares, axis=0)  # [n, N]

    # 计算在 x=0 处的拉格朗日系数（评估点是 1..n）
    xs = list(range(1, n + 1))
    coeffs = lagrange_coeffs_at_zero(xs)
    coeffs_arr = np.array(coeffs, dtype=np.int64).reshape(n, 1)  # [n, 1]

    # P(0) = sum_i coeffs[i] * P(xs[i]) (mod 257)
    secret_flat = (coeffs_arr * shares_arr).sum(axis=0) % MOD

    # 原始像素来自 PNG，范围应为 0..255
    secret_flat = secret_flat.astype(np.uint8)
    secret_img = secret_flat.reshape(shape)

    Image.fromarray(secret_img).save(output_path)
    print(f"[+] 重构完成，已保存为: {output_path}")
    return output_path


if __name__ == "__main__":
    reconstruct_secret_image()

import os
import sys
import torch
import numpy as np
from PIL import Image
import torchvision.transforms as T

# 把 Steg 目录加入 import 路径
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
STEG_DIR = os.path.join(BASE_DIR, "Steg")
if STEG_DIR not in sys.path:
    sys.path.append(STEG_DIR)

# 现在可以像 main.py 一样直接 import
from model import Model
from utils import DWT, IWT, bits_to_bytearray, bytearray_to_text
from block import INV_block

device = torch.device("cuda:0" if torch.cuda.is_available() else "cpu")

transform_test = T.Compose([
    T.ToTensor(),
])

def load_stego_tensor(path):
    img = Image.open(path).convert("RGB")
    img = img.resize((600, 450))
    tensor = transform_test(img).unsqueeze(0).to(device)
    return tensor

def load_encoder_model(weights_path=os.path.join(STEG_DIR, "misuha.taki")):
    if not os.path.exists(weights_path):
        raise FileNotFoundError(f"权重文件不存在: {weights_path}")

    simple_net = Model(cuda=torch.cuda.is_available())
    simple_net.eval()

    state_dicts = torch.load(weights_path, map_location=device)
    raw_net_state = state_dicts["net"]

    net_state = {}
    for k, v in raw_net_state.items():
        if "tmp_var" in k:
            continue
        if k.startswith("model."):
            new_k = k[len("model.") :]
        else:
            new_k = k
        net_state[new_k] = v

    simple_net.model.load_state_dict(net_state)
    simple_net.to(device)
    return simple_net

def inverse_block(block: INV_block, y):
    c4 = block.channels * 4
    y1 = y[:, :c4, :, :]
    y2 = y[:, c4:, :, :]

    s1 = block.r(y1)
    t1 = block.y(y1)
    e_s1 = block.e(s1)
    x2 = (y2 - t1) / e_s1
    t2 = block.f(x2)
    x1 = y1 - t2

    return torch.cat([x1, x2], dim=1)

def inverse_simple_net(model: Model, y):
    net = model.model
    x = y
    for inv in [net.inv8, net.inv7, net.inv6, net.inv5,
                net.inv4, net.inv3, net.inv2, net.inv1]:
        x = inverse_block(inv, x)
    return x

def decode_from_stego(stego_path: str):
    print(f"[+] 使用图片解码: {stego_path}")
    stego = load_stego_tensor(stego_path)

    dwt = DWT().to(device)
    iwt = IWT().to(device)

    simple_net = load_encoder_model()

    with torch.no_grad():
        steg_dwt = dwt(stego)
        print(f"[+] DWT 结果形状: {steg_dwt.shape}")

        zeros = torch.zeros_like(steg_dwt)
        y = torch.cat([steg_dwt, zeros], dim=1)
        print(f"[+] 构造的网络输出 y 形状: {y.shape}")

        x = inverse_simple_net(simple_net, y)
        cover_dwt = x[:, :12, :, :]
        payload_dwt = x[:, 12:, :, :]
        print(f"[+] 逆向结果 x 形状: {x.shape}, payload_dwt 形状: {payload_dwt.shape}")

        payload_img = iwt(payload_dwt)
        payload_save = payload_img.clamp(0, 1)
        payload_save = payload_save.squeeze(0).cpu()
        payload_save = T.ToPILImage()(payload_save)
        payload_path = "payload_visual.png"
        payload_save.save(payload_path)
        print(f"[+] 已将 payload 图像保存为: {payload_path}")

        payload_np = payload_img.cpu().numpy().reshape(-1)

        thresholds = [0.5, 0.4, 0.6, 0.3, 0.7]
        bits_raw_list = []
        for th in thresholds:
            br = (payload_np > th).astype(np.uint8)
            bits_raw_list.append((th, br))
        print(f"[+] 提取到的比特数: {len(bits_raw_list[0][1])}（多阈值共 {len(thresholds)} 组）")

        for th, bits in bits_raw_list:
            ba = bits_to_bytearray(bits)
            text = bytearray_to_text(ba)
            if text:
                print(f"[+] 直接解码成功（阈值 {th}），得到文本：")
                print(text)
                return text

        print("[-] 直接解码全部失败，尝试利用重复 payload 做多数表决纠错...")

        best_text = None
        N = bits_raw_list[0][1].size

        for th, bits in bits_raw_list:
            bits_np = np.array(bits, dtype=np.uint8)
            for L in range(128, 5000):
                k = N // L
                if k < 2:
                    continue
                use_N = L * k
                buf = bits_np[:use_N].reshape(k, L)
                maj = (buf.sum(axis=0) > (k / 2)).astype(np.uint8)

                for candidate in (maj, 1 - maj):
                    ba_try = bits_to_bytearray(candidate)
                    text_try = bytearray_to_text(ba_try)
                    if text_try:
                        print(f"[+] 多数表决成功：阈值 {th}, k={k}, L={L}, 取反={candidate is not maj}")
                        print(text_try)
                        best_text = text_try
                        break
                if best_text:
                    break
            if best_text:
                break

        if not best_text:
            print("[-] 解码仍失败，可能噪声过大或模型逆推误差过大。")
        return best_text

if __name__ == "__main__":
    if len(sys.argv) < 2:
        stego_path = "secret.png"
        print(f"[+] 未指定路径，默认使用当前目录下的 {stego_path}")
    else:
        stego_path = sys.argv[1]

    if not os.path.exists(stego_path):
        print(f"文件不存在: {stego_path}")
        sys.exit(1)

    decode_from_stego(stego_path)

b = b'blueshark'
c_hex = '53591611155a51405e'
c = bytes.fromhex(c_hex)

a = bytes([x ^ y for x, y in zip(c, b)])
print(a)

import os

# # 使用 %USERPROFILE% 获取用户主目录
# user_profile = os.getenv("USERPROFILE")

# 处理 ChsPinyinUDL.dat
with open(f"ChsPinyinUDL.dat", "rb") as f:
    data = f.read()[9216:]

with open("1.txt", "w", encoding="utf-16") as output1:
    i = 60
    n = 1
    results = []
    while True:
        chunk = n * i
        if chunk >= len(data):
            break
        chunk_len = data[chunk + 12:chunk + 12 + 48]
        decoded_str = chunk_len.decode("utf-16")
        if decoded_str:  # 只写入非空字符串
            results.append(decoded_str)
        n += 1
    output1.write("\n".join(results) + "\n")

# # 处理 ChsPinyinIH.dat
# with open(f"{user_profile}\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs\\ChsPinyinIH.dat", "rb") as f:
#     data = f.read()[5120:]

# with open("2.txt", "w", encoding="utf-16") as output2:
#     i = 60
#     n = 1
#     results = []
#     while True:
#         chunk = n * i
#         if chunk + 12 >= len(data):
#             break
#         unicode_chunk_length = data[chunk] * 2
        
#         if unicode_chunk_length > 0 and chunk + 12 + unicode_chunk_length <= len(data):
#             unicode_chunk = data[chunk + 12:chunk + 12 + unicode_chunk_length]
#             if unicode_chunk:
#                 results.append(unicode_chunk.decode("utf-16"))
        
#         n += 1
#     output2.write("\n".join(results) + "\n")

from PIL import Image
import numpy as np

def zigzag_indices(h, w):
    """
    生成 h×w 矩阵的 zigzag 顺序索引列表：
    返回 [(r0,c0), (r1,c1), ...]
    """
    result = []
    for s in range(h + w - 1):
        # s = r + c
        if s % 2 == 0:
            # 从下往上
            r_start = min(s, h - 1)
            r_end = max(0, s - (w - 1))
            for r in range(r_start, r_end - 1, -1):
                c = s - r
                if 0 <= c < w:
                    result.append((r, c))
        else:
            # 从上往下
            r_start = max(0, s - (w - 1))
            r_end = min(s, h - 1)
            for r in range(r_start, r_end + 1):
                c = s - r
                if 0 <= c < w:
                    result.append((r, c))
    return result

def main():
    img = Image.open("enc.png").convert("L")  # 灰度
    arr = np.array(img)
    h, w = arr.shape
    print("size:", h, w)

    idx = zigzag_indices(h, w)  # 长度应为 h*w
    flat = arr.flatten()

    # 情况1：原图按行flatten，写入 zigzag 位置
    out1 = np.zeros_like(arr)
    for k, (r, c) in enumerate(idx):
        out1[r, c] = flat[k]
    Image.fromarray(out1).save("dec_zigzag1.png")

    # 情况2：原图按 zigzag 读取，再按行写回
    out2 = np.zeros_like(arr)
    for k, (r, c) in enumerate(idx):
        out2.flat[k] = arr[r, c]
    Image.fromarray(out2).save("dec_zigzag2.png")

if __name__ == "__main__":
    main()

from Crypto.Util.number import *
import gmpy2

c = 7551149944252504900886507115675974911138392174398403084481505554211619110839551091782778656892126244444160100583088287091700792873342921044046712035923917
n = 7644027341241571414254539033581025821232019860861753472899980529695625198016019462879314488666454640621660011189097660092595699889727595925351737140047609
e = 65537
 
def factor(n):
    a = gmpy2.iroot(n, 2)[0]
    while 1:
        B2 = pow(a, 2) - n
        if gmpy2.is_square(B2):
            b = gmpy2.iroot(B2, 2)[0]
            p = a + b
            q = a - b
            return p, q
        a += 1
 
p,q=factor(n)
f = (p - 1) * (q - 1)
d = gmpy2.invert(e, f)
m = pow(c, d, n)

print(long_to_bytes(m))

if(!extension_loaded('openssl'))
	{
		$t="base64_"."decode";
		$post=$t($post."");
		
		for($i=0;$i<strlen($post);$i++) {
    			 $post[$i] = $post[$i]^$key[$i+1&15]; 
    			}
	}

# hint: flag is in /flag

UPLOAD_DIR = 'uploads'
os.makedirs(UPLOAD_DIR, exist_ok=True)
MAX_FILE_SIZE = 1 * 1024 * 1024  # 1MB

BLACKLIST = ["b","c","d","e","h","i","j","k","m","n","o","p","q","r","s","t","u","v","w","x","y","z","%",";",",","<",">",":","?"]
# afgl 刚好留了一个flag
def contains_blacklist(content):
    """检查内容是否包含黑名单中的关键词（不区分大小写）"""
    content = content.lower()
    return any(black_word in content for black_word in BLACKLIST)

def safe_extract_zip(zip_path, extract_dir):
    """安全解压ZIP文件（防止路径遍历攻击）"""
    with zipfile.ZipFile(zip_path, 'r') as zf:
        for member in zf.infolist():
            member_path = os.path.realpath(os.path.join(extract_dir, member.filename))  #解析符号链接，允许路径遍历
            if not member_path.startswith(os.path.realpath(extract_dir)):  #前缀校验，将解析后的路径和原来路径前缀比对，因此避免了路径遍历攻击
                raise ValueError("非法文件路径: 路径遍历攻击检测")
            
            zf.extract(member, extract_dir)

@route('/view/<dir_hash>/<filename:path>')
def view_file(dir_hash, filename):
    file_path = os.path.join(UPLOAD_DIR, dir_hash, filename)
    
    if not os.path.exists(file_path):
        return "文件不存在"
    
    if not os.path.isfile(file_path):
        return "请求的路径不是文件"
    
    real_path = os.path.realpath(file_path)
    if not real_path.startswith(os.path.realpath(UPLOAD_DIR)):
        return "非法访问尝试"
    
    try:
        with open(file_path, 'r', encoding='utf-8') as f:
            content = f.read()
    except:
        try:
            with open(file_path, 'r', encoding='latin-1') as f:
                content = f.read()
        except:
            return "无法读取文件内容（可能是二进制文件）"
    
    if contains_blacklist(content):
        return "文件内容包含不允许的关键词"
    
    try:
        return template(content)
    except Exception as e:
        return f"渲染错误: {str(e)}"

@app.route('/operate',methods=['GET'])
def operate():
    username=request.args.get('username')
    password=request.args.get('password')
    confirm_password=request.args.get('confirm_password')
    if username in globals() and "old" not in password:
        Username=globals()[username]
        try:
            pydash.set_(Username,password,confirm_password)
            return "oprate success"
        except:
            return "oprate failed"
    else:
        return "oprate failed"

@app.route('/impression',methods=['GET'])
def impression():
    point=request.args.get('point')
    if len(point) > 5:
        return "Invalid request"
    List=["{","}",".","%","<",">","_"]
    for i in point:
        if i in List:
            return "Invalid request"
    return render_template(point)

username=request.args.get('username')
password=request.args.get('password')
confirm_password=request.args.get('confirm_password')

if username in globals() and "old" not in password:
    Username=globals()[username]
    try:
        pydash.set_(Username,password,confirm_password)
        return "oprate success"
    except:
        return "oprate failed"
else:
    return "oprate failed"

from hashlib import md5

i = 0
while True:
    h = md5(str(i).encode()).hexdigest()
    hh = md5(h.encode()).hexdigest()
    if hh.startswith('666'):
        print(i, hh)
        break
    i += 1