Pinaka: The Impossible Bow

PINAKA{the_bow_answers_only_to_dharma_not_to_brute_force}

POST /bow/string   {"draw":"<48 hex chars>"}

uint32_t s = seed;
for (int i = 0; i < 256; i++) {
    uint32_t e = s;
    e = (e << 13) ^ s;
    e ^= e >> 17;
    s = (e << 5) ^ e;
    key[i] = s & 0xff;
}

S[i] = blob[0x28 + i] ^ key[i];

op = blob[pc]     ^ (state        & 0xff);
a  = blob[pc + 1] ^ ((state >> 8)  & 0xff);
b  = blob[pc + 2] ^ ((state >> 16) & 0xff);
c  = blob[pc + 3];
d  = u32(blob + pc + 4) ^ state;

state = (op
       + state * 0x1000193
       + 0x9E3779B1
       + a
       + b
       + (((state >> 24) ^ c) & 0xff)
       + (d & 0xff)) & 0xffffffff;

F(input)[i] == target[i]   for all i = 0..23

2a 45 56 1f c6 8a 1a db 9f 3e c8 b9 de f0 9c 4f fa f0 61 0d 66 9c a8 df

mem[:24] = targets
for op, a, b, d in reversed(ops):
    if   op == 1: mem[a] = invS[mem[a]]
    elif op == 2: mem[a] = (mem[a] - (d & 0xff)) & 0xff
    elif op == 3: mem[a] ^= mem[b]

7a56e835fc372462249b2c08fe6349ce8f8699d3599a02f8

$ ./pinaka_bow 7a56e835fc372462249b2c08fe6349ce8f8699d3599a02f8
ACCEPT
$ echo $?
0

$ ./pinaka_bow 0056e835fc372462249b2c08fe6349ce8f8699d3599a02f8
REJECT
$ echo $?
1

$ curl -sS -X POST 'https://pinaka-m03-cyber-xo-x.vercel.app/bow/string' \
    -H 'Content-Type: application/json' \
    --data '{"draw":"7a56e835fc372462249b2c08fe6349ce8f8699d3599a02f8"}'
{"flag":"PINAKA{one_true_draw_bends_shivas_bow_and_rama_wins_mithila}",
 "proclamation":"The bow bends, the string sings, Pinaka is strung.",
 "result":"accepted"}

7a56e835fc372462249b2c08fe6349ce8f8699d3599a02f8

PINAKA{one_true_draw_bends_shivas_bow_and_rama_wins_mithila}

#!/usr/bin/env python3
"""Recover the 24-byte input accepted by pinaka_bow."""
import struct

blob = open("bow.vmx", "rb").read()
u32 = lambda o: struct.unpack_from("<I", blob, o)[0]

seed     = u32(0x14)   # PRNG seed / initial decode state
in_len   = u32(0x0c)   # 24
mem_size = u32(0x10)   # 32
pc       = u32(0x18)   # entry point
max_cnt  = u32(0x1c)   # instruction budget
check_i  = u32(0x20)   # 24 (accumulator byte)

# --- 1. Recover the substitution table S ---
K = bytearray(256)
st = seed
for i in range(256):
    e = st
    e = ((e << 13) & 0xffffffff) ^ st
    e ^= e >> 17
    st = (((e << 5) & 0xffffffff) ^ e) & 0xffffffff
    K[i] = st & 0xff
S = bytes(blob[0x28 + i] ^ K[i] for i in range(256))     # a permutation
invS = [0] * 256
for i, v in enumerate(S):
    invS[v] = i

# --- 2. Decode the instruction stream, following jumps ---
ops = []
state = seed
while len(ops) < max_cnt:
    op = blob[pc]      ^ (state         & 0xff)
    a  = blob[pc + 1]  ^ ((state >> 8)  & 0xff)
    b  = blob[pc + 2]  ^ ((state >> 16) & 0xff)
    c  = blob[pc + 3]
    d  = u32(pc + 4)   ^  state
    ops.append((op, a, b, d))
    if op == 0:                       # HALT: accept iff mem[check_i] == 0
        break
    state = (op + state * 0x1000193 + 0x9E3779B1 +
             a + b + (((state >> 24) ^ c) & 0xff) + (d & 0xff)) & 0xffffffff
    pc = d if op == 7 else pc + 8     # opcode 7 = unconditional jump

# --- 3. Required final bytes, read from the 24 opcode-6 checks ---
expected = [0] * in_len
for op, a, b, d in ops:
    if op == 6 and a < in_len:
        expected[a] = d & 0xff

# --- 4. Invert the (bijective) pipeline ---
mem = bytearray(32)
mem[:in_len] = expected
for op, a, b, d in reversed(ops):
    if op == 1:
        mem[a] = invS[mem[a]]
    elif op == 2:
        mem[a] = (mem[a] - (d & 0xff)) & 0xff
    elif op == 3:
        mem[a] ^= mem[b]

print(bytes(mem[:in_len]).hex())

7a56e835fc372462249b2c08fe6349ce8f8699d3599a02f8