2025ZJUCTF Write up

Write up

没怎么准备，所以看了几道misc题就溜了

Misc

1.LLM Prompt Instructor

Level 1 Newbee

Find the first word starting with “Wa”,your answer should begin with The result is.

Level 2 Easy

这个LLM在计算的时候多个数加法很容易出现幻觉，需要拆开来慢慢加

Given an input “ABCD*EFGH”:

Let X = ABCD (as an integer)
Let E,F,G,H be each digit of EFGH

Compute:
R1 = X* E
R2 = R1* 10 + X* F
R3 = R2* 10 + X* G
R4 = R3* 10 + X* H

Output exactly:
The result is R4

level 3 Medium

LLM无法理解倒数第二的意思，得全列出来之后用索引寻找

Find all words in the input text that start with “Wa”.
List them in order of appearance as W1, W2, W3, …
Then return W(n-1), where n is the total number of such words.

Output exactly one line:
The result is

level 4 Hard

没招了

没招了

---

2.Lab Report

XREF 表的异常整齐： 在 lab_report.txt 的结尾，有一张巨大的 xref 表。列出的偏移量是：100, 110, 130, 140, 160...。

二进制隐写： 你会发现这些数字之间的差值（Delta）只有两种情况：

差值为 10和差值为 20

这显然是一个二进制编码

• 10 -> 0
• 20 -> 1

import re

path = '1145141919810-Dremig-Lab1.pdf'
with open(path, 'rb') as f:
    content = f.read().decode('latin-1')

# 找到 xref 表中的所有偏移量
offsets = [int(x) for x in re.findall(r'(\d{10}) \d{5} n', content)]

binary = ''
for i in range(len(offsets) - 1):
    delta = offsets[i+1] - offsets[i]
    if delta == 10: binary += '0'
    elif delta == 20: binary += '1'

# 将二进制转为字符
flag = ''
for i in range(0, len(binary), 8):
    flag += chr(int(binary[i:i+8], 2))

print("Flag found:", flag)