import re

import matplotlib.pyplot as plt

Y_SCALE = 100  # 纵轴放大倍数


def main() -> None:
    with open("flag", "r", encoding="utf-8", errors="ignore") as f:
        text = f.read()

    fig, ax = plt.subplots(figsize=(16, 4), dpi=400)

    # 正则提取所有 Dataline 坐标
    for x1, x2, y1, y2 in re.findall(
        r"Dataline\((\d+),(\d+),([0-9.]+),([0-9.]+),[0-9.]+,[0-9.]+\);", text
    ):
        ax.plot([int(x1), int(x2)], [float(y1) * Y_SCALE, float(y2) * Y_SCALE], "k-", lw=0.25)

    ax.axis("off")
    fig.savefig("yup_100.png", bbox_inches="tight", pad_inches=0)


if __name__ == "__main__":
    main()

import io
import re

import matplotlib.pyplot as plt
from PIL import Image

Y_SCALE = 100.0  # 纵轴放大倍数
Y_SQUISH = 0.1  # 垂直压缩系数


def main() -> None:
    with open("flag", "r", encoding="utf-8", errors="ignore") as f:
        text = f.read()

    segs = re.findall(
        r"Dataline\((\d+),(\d+),([0-9.]+),([0-9.]+),[0-9.]+,[0-9.]+\);", text
    )

    # 计算最大纵坐标，用于上下翻转图像
    max_y = max(max(float(y1), float(y2)) for _, _, y1, y2 in segs)

    fig, ax = plt.subplots(figsize=(16, 4), dpi=400)
    for x1, x2, y1, y2 in segs:
        ax.plot(
            [int(x1), int(x2)],
            [(max_y - float(y1)) * Y_SCALE, (max_y - float(y2)) * Y_SCALE],
            "k-",
            lw=0.25,
        )

    ax.axis("off")

    # 将图片保存到内存缓冲区
    buf = io.BytesIO()
    fig.savefig(buf, format="png", bbox_inches="tight", pad_inches=0)
    plt.close(fig)

    # 从内存区读取图片
    buf.seek(0)
    img = Image.open(buf)
    w, h = img.size

    # 垂直压缩图片
    img = img.resize((w, max(1, int(h * Y_SQUISH))), Image.Resampling.LANCZOS)
    img.save("inv_squish_10.png")


if __name__ == "__main__":
    main()

from __future__ import annotations

import math
import os
import random
import re
import sys
from collections import Counter
from typing import Dict, List

from wordfreq import zipf_frequency


PUNCT = ".,'\";:!?-"  # 标点符号集合
PLAINTEXT_ALPHABET = " " + "abcdefghijklmnopqrstuvwxyz" + PUNCT  # 明文字符集


def read_cipher(path: str) -> str:
    """读取密文文件"""
    return open(path, "r", encoding="utf-8").read()


def initial_mapping(cipher_alpha: str, plain_alpha: str, cipher: str) -> Dict[str, str]:
    """ 根据字符频率初始化映射表（模拟退火初始解）"""

    # 统计密文字符出现频率，从高到低排序
    cipher_counts = Counter(cipher)
    cipher_sorted = [c for c, _ in cipher_counts.most_common()]

    # 英文最高频字母顺序（用于初始映射）
    target_order = (
            [" "]
            + list("etaoinshrdlucmfwypvbgkjqxz")
            + list(".,'\";:!?-")
    )

    # 过滤掉不在明文字符集中的字符
    target_order = [c for c in target_order if c in plain_alpha]
    if len(target_order) != len(plain_alpha) or len(set(target_order)) != len(plain_alpha):
        target_order = list(plain_alpha)

    # 密文与明文字符集长度必须一致
    if len(cipher_alpha) != len(plain_alpha):
        raise ValueError(f"alphabet size mismatch: cipher={len(cipher_alpha)} plain={len(plain_alpha)}")

    # 拼接完整的目标映射顺序
    remaining = [c for c in plain_alpha if c not in target_order]
    perm = target_order + remaining
    perm = perm[: len(plain_alpha)]

    # 构建初始映射表
    mapping = {c: perm[idx] for idx, c in enumerate(cipher_sorted)}
    # 未匹配到的字符随机补充
    for c in cipher_alpha:
        mapping.setdefault(c, random.choice(plain_alpha))
    return mapping


# 正则表达式：提取连续的英文单词（至少两个字母）
WORD_RE = re.compile(r"[a-z]{2,}")


def score_plaintext(pt: str) -> float:
    """文本评分函数"""
    pt_low = pt.lower()
    words = WORD_RE.findall(pt_low)

    # 如果没有有效单词，直接返回极低分
    if not words:
        return -1e9

    s = 0.0
    # 根据英文真实词频加分，越常见的单词分数越高
    for w in words:
        z = zipf_frequency(w, "en")
        s += max(-5.0, min(7.0, z))

    # 惩罚：单词中间出现标点（不符合英文语法）
    inside_word = re.findall(rf"[a-z][{re.escape(PUNCT)}][a-z]", pt_low)
    s -= 25.0 * len(inside_word)

    # 惩罚：连续空格、重复符号
    s -= 5.0 * pt_low.count("  ")
    s -= 1.5 * pt_low.count("..")
    s -= 1.5 * pt_low.count(",,")
    s -= 1.0 * pt_low.count("''")
    s -= 1.0 * pt_low.count('""')
    s -= 1.0 * pt_low.count("--")
    s -= 2.0 * pt_low.count("?")

    # 加分：正常英文标点
    s += 1.0 * (pt_low.count(".") + pt_low.count(","))
    s += 0.5 * (pt_low.count("'") + pt_low.count("!"))

    # 强力加分：英文高频词组
    for tri in (" the ", " and ", " to ", " of "):
        s += 6.0 * pt_low.count(tri)

    return s


def decrypt_with_mapping(cipher: str, mapping: Dict[str, str]) -> str:
    """根据当前映射表，将密文转换为候选明文"""
    return "".join(mapping.get(ch, ch) for ch in cipher)


def anneal(
        cipher: str,
        cipher_alpha: str,
        plain_alpha: str,
        *,
        iters: int,
        seed: int,
) -> tuple[float, Dict[str, str], str]:
    """模拟退火主算法"""
    rnd = random.Random(seed)

    # 根据频率初始化映射排列
    plain_perm = [initial_mapping(cipher_alpha, plain_alpha, cipher)[c] for c in cipher_alpha]

    # 空格必须映射为空格，固定不变
    if " " in cipher_alpha and " " in plain_alpha:
        space_idx = cipher_alpha.index(" ")
        plain_perm[space_idx] = " "

    # 确保映射表无重复、无遗漏字符
    used = set()
    missing = [c for c in plain_alpha if c not in plain_perm]
    mi = 0
    for idx, ch in enumerate(plain_perm):
        if ch in used:
            plain_perm[idx] = missing[mi]
            mi += 1
        used.add(plain_perm[idx])

    # 将排列转为映射字典
    def perm_to_map(pp: List[str]) -> Dict[str, str]:
        return dict(zip(cipher_alpha, pp))

    # 初始化解密状态
    mapping = perm_to_map(plain_perm)
    cur_pt = decrypt_with_mapping(cipher, mapping)
    cur_score = score_plaintext(cur_pt)

    # 记录当前最优解
    best_score = cur_score
    best_perm = plain_perm[:]
    best_pt = cur_pt

    # 模拟退火温度参数，温度随迭代指数下降
    t0 = 5.0
    t1 = 0.05

    for step in range(1, iters + 1):
        # 计算当前温度
        frac = step / iters
        t = t0 * ((t1 / t0) ** frac)

        # 随机选择两个位置交换映射（跳过空格）
        a = rnd.randrange(len(plain_perm))
        b = rnd.randrange(len(plain_perm))
        if " " in cipher_alpha:
            fixed = cipher_alpha.index(" ")
            if a == fixed or b == fixed:
                continue
        if a == b:
            continue

        # 执行交换
        plain_perm[a], plain_perm[b] = plain_perm[b], plain_perm[a]
        mapping2 = perm_to_map(plain_perm)
        pt2 = decrypt_with_mapping(cipher, mapping2)
        sc2 = score_plaintext(pt2)

        # 计算分数差
        d = sc2 - cur_score
        # 模拟退火接受准则：更优 或 按概率接受
        accept = d >= 0 or rnd.random() < math.exp(d / max(1e-9, t))

        if accept:
            # 接受新解
            cur_score = sc2
            cur_pt = pt2
            if sc2 > best_score:
                best_score = sc2
                best_perm = plain_perm[:]
                best_pt = pt2
        else:
            # 不接受，撤销交换
            plain_perm[a], plain_perm[b] = plain_perm[b], plain_perm[a]

        # 定期重启，避免陷入局部最优
        if step % (iters // 5) == 0 and step != iters:
            plain_perm = best_perm[:]
            for _ in range(20):
                i = rnd.randrange(len(plain_perm))
                j = rnd.randrange(len(plain_perm))
                plain_perm[i], plain_perm[j] = plain_perm[j], plain_perm[i]
            mapping = perm_to_map(plain_perm)
            cur_pt = decrypt_with_mapping(cipher, mapping)
            cur_score = score_plaintext(cur_pt)

    return best_score, perm_to_map(best_perm), best_pt


def main() -> int:
    # 读取密文
    cipher_path = sys.argv[1] if len(sys.argv) > 1 else "ciphertext"
    cipher = read_cipher(cipher_path)

    # 构建密文字符集
    cipher_alpha = "".join(sorted(set(cipher)))
    if len(cipher_alpha) != len(PLAINTEXT_ALPHABET):
        print("[-] Cipher alphabet size:", len(cipher_alpha), "expected:", len(PLAINTEXT_ALPHABET))
        print("    cipher alphabet repr:", repr(cipher_alpha))
        return 2

    print("[*] Cipher length:", len(cipher), flush=True)
    print("[*] Alphabet:", repr(cipher_alpha), flush=True)

    # 多起点搜索，避免局部最优，共 12 轮
    best_score = float("-inf")
    best_map: Dict[str, str] = {}
    best_pt = ""
    starts = 12
    iters = 120_000

    for s in range(starts):
        seed = 1337 + s * 99991
        sc, mp, pt = anneal(cipher, cipher_alpha, PLAINTEXT_ALPHABET, iters=iters, seed=seed)
        if sc > best_score:
            best_score, best_map, best_pt = sc, mp, pt
            print(f"[+] New best score {best_score:.2f} at start {s}", flush=True)
            preview = pt[:300].replace("\n", " ")
            print("    preview:", preview, flush=True)

    # 保存最优明文
    out_txt = os.path.join(os.path.dirname(cipher_path) or ".", "decrypted_best.txt")
    with open(out_txt, "w", encoding="utf-8") as f:
        f.write(best_pt)

    # 保存最优替换表
    out_map = os.path.join(os.path.dirname(cipher_path) or ".", "mapping_best.txt")
    with open(out_map, "w", encoding="utf-8") as f:
        for c in cipher_alpha:
            f.write(f"{repr(c)} -> {repr(best_map[c])}\n")

    print("[*] Wrote:", out_txt, flush=True)
    print("[*] Wrote:", out_map, flush=True)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

sk_active = dump_dyn_array(sk.data())[: len(active_moduli) * N]
key = sha256(",".join(map(str, sk_active)).encode()).hexdigest()[:32]

import json
import re
from hashlib import sha256

from Crypto.Cipher import AES
from Crypto.Util.number import inverse
from Crypto.Util.Padding import unpad


def derive_key(active_sk_ntt):
    """从恢复出的私钥推导 AES 密钥"""
    # 将私钥数组转为逗号连接的字符串，再编码为字节
    blob = ",".join(map(str, active_sk_ntt)).encode()
    # SHA256 哈希后取前 32 个十六进制字符作为 AES 密钥
    return sha256(blob).hexdigest()[:32]


def parse_input(text: str):
    """解析题目输出文本：提取密文和 JSON 数据"""
    # 正则提取 ciphertext 后的十六进制密文
    ct_m = re.search(r"ciphertext:\s*([0-9a-fA-F]+)", text)
    # 正则提取 challenge data 后的 JSON 数据
    json_m = re.search(r"challenge data:\s*(\{.*\})", text, flags=re.S)
    if not (ct_m and json_m):
        raise ValueError("unexpected output format")
    return ct_m.group(1).strip(), json.loads(json_m.group(1))


def recover_active_secret_key(data: dict) -> list[int]:
    """
    核心：利用两组明密文对，联立二次方程，逐位求解私钥 s
    每个 (j, i) 对应一个模数 q_j 和一个系数位置 i
    """
    # 多项式阶 N
    N = int(data["poly_modulus_degree"])
    # 所有 RNS 模数 q_l
    moduli = [int(x) for x in data["active_moduli"]]
    L = len(moduli)
    total = L * N

    # 获取两组样本（同一私钥，不同随机数）
    s0, s1 = data["samples"]
    ct_0, dec_0 = s0["ct"], s0["dec"]
    ct_1, dec_1 = s1["ct"], s1["dec"]
    # 存储最终恢复的私钥系数
    recovered = [0] * total

    # 密文 ct 下标计算：分量 comp，模数 j，系数 i
    def ct_idx(comp, j, i):
        return comp * total + j * N + i

    # 明文 dec 下标计算：模数 j，系数 i
    def dec_idx(j, i):
        return j * N + i

    # 遍历每个模数、每个系数位置，求解 s
    for j, q in enumerate(moduli):
        for i in range(N):
            # 读取第一组样本 c0, c1, 2 和解密值 d0
            c00 = ct_0[ct_idx(0, j, i)] % q
            c01 = ct_0[ct_idx(1, j, i)] % q
            c02 = ct_0[ct_idx(2, j, i)] % q
            d0 = dec_0[dec_idx(j, i)] % q

            # 读取第二组样本 c0, c1, 2 和解密值 d1
            c10 = ct_1[ct_idx(0, j, i)] % q
            c11 = ct_1[ct_idx(1, j, i)] % q
            c12 = ct_1[ct_idx(2, j, i)] % q
            d1 = dec_1[dec_idx(j, i)] % q

            # 构造方程：C * s² + B * s + A = 0 mod q
            A0, B0, C0 = (c00 - d0) % q, c01, c02
            A1, B1, C1 = (c10 - d1) % q, c11, c12

            # 联立消元，直接解出 s
            # s = (A1 * C0 - A0 * C1) / (B0 * C1 - B1 * C0) mod q
            den = (B0 * C1 - B1 * C0) % q
            num = (A1 * C0 - A0 * C1) % q
            recovered[j * N + i] = num * inverse(den, q) % q

    return recovered


def main():
    # 读取远程输出文件
    with open("output.txt", "r", encoding="utf-8", errors="ignore") as f:
        text = f.read()

    # 解析出 AES 密文和题目参数
    ciphertext_hex, data = parse_input(text)

    # 核心：恢复私钥
    sk_active = recover_active_secret_key(data)

    # 用恢复的私钥推导 AES 密钥
    key = derive_key(sk_active)

    # AES-ECB 解密 flag
    aes = AES.new(bytes.fromhex(key), AES.MODE_ECB)
    flag = unpad(aes.decrypt(bytes.fromhex(ciphertext_hex)), AES.block_size)
    print(flag.decode(errors="replace"))


if __name__ == "__main__":
    main()

def buggy_measurement(..., ct_flag, row, g1, g2):
  pt_row = encode_vector(..., row, ct_flag.scale, ct_flag.parms_id())
  ev.multiply_plain(ct_flag, pt_row, ct_mul)
  ct_sum = slot_sum(ev, galois_keys, ct_mul, nslots)

  pt_g1 = encode_vector(..., [g1], ct_sum.scale, ct_sum.parms_id())
  ev.multiply_plain(ct_sum, pt_g1, ct_tmp)
  ev.rescale_to_next_inplace(ct_tmp)
  ct_tmp.scale = float(delta)         # BUG 1

  pt_g2 = encode_vector(..., [g2], ct_tmp.scale, ct_tmp.parms_id())
  ev.multiply_plain(ct_tmp, pt_g2, ct_out)
  ev.rescale_to_next_inplace(ct_out)
  ct_out.scale = float(delta)         # BUG 2

  decoded = decrypt_first_slot(dec, encoder, ct_out)
  return int(round(decoded / report_scale))

row = random_sparse_row(rng_py, len(flag_vec), ROW_WEIGHT)   # ROW_WEIGHT = 7
g1 = 1.0 + rng_py.randint(-80, 80) / (2 ** 12)
g2 = 1.0 + rng_py.randint(-80, 80) / (2 ** 12)
raw_answer = buggy_measurement(...)
e = rng_py.randint(-ERROR_BOUND, ERROR_BOUND)
answer = centered_mod(raw_answer + e, LWE_MODULUS)

import json
import re
import socket


def main():
    host, port = "127.0.0.1", xxxxx
    out_path = "instance.json"

    with socket.create_connection((host, port), timeout=5.0) as s:
        buf = b""
        while True:
            d = s.recv(65536)
            if not d:
                break
            buf += d

    txt = buf.decode(errors="replace")

    m = re.search(r"\[\+\] challenge data: (\{.*\})", txt, re.S)
    if not m:
        raise SystemExit("[-] could not find challenge JSON in response")

    obj = json.loads(m.group(1))
    with open(out_path, "w", encoding="utf-8") as f:
        json.dump(obj, f)

    print(f"[+] saved {out_path}")


if __name__ == "__main__":
    main()

import json
import re
from typing import List

from z3 import ArithRef, Int, IntVal, Or, Solver, Sum, sat

CHAR_MIN = 32
CHAR_MAX = 126

NOISE_SLACK = 256


def centered_mod(x: int, mod: int) -> int:
    """中心模运算：把结果映射到 [-mod/2, mod/2) 区间"""
    x %= mod
    return x - mod if x > mod // 2 else x


def mod_dist(a: int, b: int, mod: int) -> int:
    """计算模 p 下的中心距离"""
    d = (a - b) % mod
    return abs(d - mod) if d > mod // 2 else abs(d)


def parse_instance(text: str) -> dict:
    """从题目输出文本中解析 JSON 格式的挑战数据"""
    m = re.search(r"\[\+\]\s*challenge data:\s*(\{.*\})", text, re.S)
    if not m:
        raise ValueError("challenge JSON not found")
    return json.loads(m.group(1))


def scale_factor(inst: dict) -> float:
    """
    核心：计算题目 BUG 造成的固定放大系数 H
    H = delta⁴ / (q_{n-1} * q_{n-2} * report_scale)
    """
    delta = inst["delta"]
    report_scale = inst["report_scale"]
    # 取模数链最后两个素数（两次 rescale 丢弃的模数）
    q_last, q_prev = inst["active_coeff_moduli"][-1], inst["active_coeff_moduli"][-2]
    return (delta ** 4) / (q_last * q_prev * report_scale)


def candidate_dots(inst: dict) -> List[List[int]]:
    """
    对每条查询，枚举出合法的内积 s
    s = row · flag
    满足：观测答案 ≈ round(H * g1 * g2 * s) + e
    """
    p = inst["lwe_modulus"]
    # 总误差界 = 题目给定误差 + 额外余量
    err = inst["error_bound"] + NOISE_SLACK
    base = scale_factor(inst)

    all_cands: List[List[int]] = []
    # 遍历每一条查询
    for row, g1, g2, ans in zip(inst["rows"], inst["g1"], inst["g2"], inst["answers"]):
        # 本次查询的整体系数：H * g1 * g2
        coef = base * g1 * g2
        # s 的理论最大绝对值
        bound = CHAR_MAX * sum(abs(x) for x in row)
        # 枚举所有可能 s，筛选出距离足够近的候选
        cands = [
            s
            for s in range(-bound, bound + 1)
            if mod_dist(centered_mod(round(coef * s), p), ans, p) <= err
        ]
        if not cands:
            raise ValueError(f"empty candidate set at query {len(all_cands)}")
        all_cands.append(cands)
    return all_cands


def recover_flag(inst: dict) -> str:
    """
    用 Z3 求解器：
    给定 50 条稀疏线性约束 row·flag = s
    求唯一满足所有约束的 ASCII 字节数组 flag
    """
    n = inst["num_slots_used"]
    # 获取每条查询的候选内积集合
    cands = candidate_dots(inst)

    # 定义 Z3 变量：flag 的每个字节 c_0 ... c_n
    chars: List[ArithRef] = [Int(f"c_{i}") for i in range(n)]
    solver = Solver()

    # 约束 1：每个字节必须是可打印 ASCII
    for c in chars:
        solver.add(c >= CHAR_MIN, c <= CHAR_MAX)

    # 约束 2：每条查询的内积必须落在候选集合里
    for row, cand in zip(inst["rows"], cands):
        lin = Sum([IntVal(row[j]) * chars[j] for j in range(n)])
        solver.add(Or(*(lin == IntVal(v) for v in cand)))

    # 求解
    if solver.check() != sat:
        raise RuntimeError("Z3 UNSAT")

    # 把解转为字符串
    model = solver.model()
    return "".join(chr(model[c].as_long()) for c in chars)


def main():
    with open("instance.json", "r", encoding="utf-8") as f:
        inst = json.load(f)
    print(recover_flag(inst))


if __name__ == "__main__":
    main()

p, q = mpz(getPrime(1024)), mpz(getPrime(1024))
n = p * q
m = mpz(int.from_bytes(flag + urandom(120 - len(flag)), byteorder="big"))
c = powmod(m, 2147483647, n)

for i in range(50):
    a = mpz(input())
    sp, sq = Sqrt(a, p), Sqrt(a, q)
    if sp is None or sq is None:
        print(f"there does not exist an integer x such that x * x % n == {int(a)}")
    else:
        x = min(CRT(sp, sq), CRT(sp, -sq), CRT(-sp, sq), CRT(-sp, -sq))
        print(f"the least non-negative integer x such that x * x % n == {int(a)} is {int(x)}")

import random
import re
import socket

from Crypto.Util.number import GCD, inverse, isPrime, long_to_bytes

# 目标服务端地址
HOST = "127.0.0.1"
PORT = xxxxx


def recv_until(sock: socket.socket, marker: bytes, limit: int = 200_000) -> bytes:
    """辅助函数：从 socket 接收数据直到遇到指定标记"""
    data = b""
    # 循环读取数据，直到找到标记或超出长度限制
    while marker not in data and len(data) < limit:
        chunk = sock.recv(4096)
        if not chunk:
            break
        data += chunk
    return data


def recv_line(sock: socket.socket) -> bytes:
    """辅助函数：读取一行数据"""
    data = b""
    while b"\n" not in data:
        chunk = sock.recv(4096)
        if not chunk:
            break
        data += chunk
    # 按换行符分割，返回第一行
    return data.split(b"\n", 1)[0]


def query_sqrt(sock: socket.socket, a: int) -> int | None:
    """核心交互函数：向服务端发送数字 a，请求其平方根"""
    # 发送请求
    sock.sendall(f"{a}\n".encode())
    # 读取返回结果
    line = recv_line(sock)
    # 正则提取结果中的平方根
    m = re.search(rb"is (\d+)$", line)
    return int(m.group(1)) if m else None


def factor_with_oracle(sock: socket.socket, n: int) -> tuple[int, int]:
    """核心算法：利用平方根预言机构造碰撞，分解模数 n"""
    # 生成 2-100 之间的素数列表，用于尝试构造三元组
    primes = [i for i in range(2, 100) if isPrime(i)]
    random.shuffle(primes)

    # 每条链格式：[(素数 p, [p 与链内其他素数乘积的平方根...]), ...]
    chains: list[list[tuple[int, list[int]]]] = [[], [], []]

    # 遍历小素数，开始构造链
    for p in primes:
        # 如果 p 本身是二次剩余，跳过（我们需要非剩余）
        if query_sqrt(sock, p) is not None:
            continue

        # 尝试将当前素数 p 加入某一条链
        for chain in chains:
            # 如果链为空，将 p 作为这条链的起点
            if not chain:
                chain.append((p, []))
                break

            # 查询 (链首素数 * p) 的平方根
            root = query_sqrt(sock, chain[0][0] * p)
            # 如果结果不是剩余（无平方根），换一条链尝试
            if root is None:
                continue

            # 找到了！(链首素数 * p) 是剩余，将 p 加入链
            chain.append((p, [root]))

            # 遍历链中已有的素数，组合生成新的平方根
            for k in range(1, len(chain) - 1):
                # 查询 p 和链中第 k 个素数的乘积的平方根
                root_k = query_sqrt(sock, p * chain[k][0])
                chain[-1][1].append(root_k)

                # 关键：组合三个平方根，构造碰撞
                for u in range(k):
                    # 计算 x = sqrt(p * pk) * sqrt(p * pu) * sqrt(pk * pu)
                    x = chain[-1][1][k] * chain[-1][1][u] * chain[k][1][u] % n
                    # 计算 y = p * pk * pu
                    y = chain[-1][0] * chain[k][0] * chain[u][0]

                    # 此时 x ^ 2 ≡ y ^ 2 (mod n)，利用 gcd 分解 n
                    for diff in (x - y, x + y):
                        g = GCD(diff % n, n)
                        # 找到一个有效的因子
                        if 1 < g < n:
                            return g, n // g
            # 一条链处理成功，跳出循环
            break

    raise RuntimeError("failed to factor within query budget")


# 辅助函数：从解密后的明文中提取 flag 字符串
def extract_flag(m_int: int, n: int) -> bytes:
    k = (n.bit_length() + 7) // 8
    # 将大整数转为原始字节
    blob = long_to_bytes(m_int, k)
    # 查找 flag 特征前缀并截取
    start = blob.find(b"W4terCTF{")
    if start == -1:
        return blob
    end = blob.find(b"}", start)
    return blob[start: end + 1] if end != -1 else blob[start:]


def main():
    # 连接远程服务
    sock = socket.create_connection((HOST, PORT), timeout=10)
    sock.settimeout(10)

    # 接收欢迎信息，提取 RSA 公钥 n 和密文 c
    banner = recv_until(sock, b"Feel free")
    ns = re.search(rb"n = (\d+)", banner)
    cs = re.search(rb"c = (\d+)", banner)
    if not ns or not cs:
        raise RuntimeError("failed to parse n/c")
    n, c = int(ns.group(1)), int(cs.group(1))

    # 核心：调用函数，利用 Oracle 分解 n 得到 p, q
    p, q = factor_with_oracle(sock, n)
    if p > q:
        p, q = q, p

    # 标准 RSA 解密流程
    e = 2147483647  # 题目给定的公钥指数 e = 2 ^ 31 - 1
    phi = (p - 1) * (q - 1)
    d = inverse(e, phi)  # 计算私钥 d
    m = pow(c, d, n)  # 解密密文得到明文 m

    # 提取并打印 flag
    print(extract_flag(m, n).decode(errors="replace"))


if __name__ == "__main__":
    main()