<!DOCTYPE html> <html lang="en"> <head> <meta...

Question

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Bio-Auth Verification</title> <style> body { background-color: #ffffff; color: #000; font-family: "Courier New", Courier, monospace; text-align: center; } canvas { border: 2px solid #b0d1f3; cursor: crosshair; background: #000; box-shadow: 0 0 20px rgba(106, 169, 252, 0.5); } #status { margin-top: 20px; font-size: 1.2em; min-height: 1.5em; font-weight: bold; } .container { display: flex; flex-direction: column; align-items: center; justify-content: center; min-height: 100vh; padding: 20px; } h1 { font-size: 1.5rem; max-width: 800px; margin-bottom: 10px; } h2 { font-size: 1.2rem; color: #555; margin-bottom: 20px; } .story-text { font-size: 1.5rem; color: #bd0f0f; max-width: 700px; margin-bottom: 30px; line-height: 1.6; } button { margin-top: 20px; padding: 12px 24px; background: #000; color: #fff; border: 2px solid #7499ff; cursor: pointer; font-family: inherit; font-size: 1rem; transition: all 0.3s ease; } button:hover { background: #7499ff; color: #000; } button:disabled { opacity: 0.5; cursor: not-allowed; } </style> </head> <body> <div class="container"> <div class="story-text"> 我们截获了一个代号为"奶龙"的古老生物识别模组。<br> 传闻它被设计用于抵御AI机器人渗透人类最后一座机密数据库——<br> 它不辨识指纹，不验证虹膜，只直视你的"灵魂"。<br><br> <strong>任务：</strong>证明你仍是活着的人类，绕过"灵魂验证"，夺取最后的 Flag ，延续人类的火种！ </div>

text
    <h2>Draw a complex continuous shape to verify biological signature.</h2>
    
    <canvas id="pad" width="600" height="400"></canvas>
    <div id="status">Waiting for input...</div>
    <button id="verifyBtn" onclick="window.checkTrace()">VERIFY IDENTITY</button>
</div>

<script>
    var Module = {
        onRuntimeInitialized: function() {
            const statusEl = document.getElementById('status');
            if(statusEl) {
                statusEl.innerText = "System Ready. Waiting for input...";
                statusEl.style.color = "green";
            }
            console.log("Wasm Runtime Initialized!");
        }
    };
</script>
<script src="verify.js"></script>
<script>
    document.addEventListener('DOMContentLoaded', () => {
        const canvas = document.getElementById('pad');
        const ctx = canvas.getContext('2d');
        const statusEl = document.getElementById('status');
        const btn = document.getElementById('verifyBtn');
        
        let isDrawing = false;
        let points = { x: [], y: [] };

        ctx.lineWidth = 2;
        ctx.lineCap = 'round';
        ctx.lineJoin = 'round';

        canvas.addEventListener('mousedown', e => {
            isDrawing = true;
            points = { x: [], y: [] };
            ctx.clearRect(0, 0, canvas.width, canvas.height);
            ctx.beginPath();
            ctx.moveTo(e.offsetX, e.offsetY);
            statusEl.innerText = "Recording bio-metrics...";
            statusEl.style.color = "#000";
        });

        canvas.addEventListener('mousemove', e => {
            if (!isDrawing) return;
            ctx.lineTo(e.offsetX, e.offsetY);
            ctx.strokeStyle = '#ff0000'; 
            ctx.stroke();
            points.x.push(e.offsetX);
            points.y.push(e.offsetY);
        });

        canvas.addEventListener('mouseup', () => { isDrawing = false; });
        canvas.addEventListener('mouseleave', () => { isDrawing = false; });

        window.runWasmCheck = function() {
            try {
                const len = points.x.length;
                const bytesPerElement = 4;

                const xPtr = Module._malloc(len * bytesPerElement);
                const yPtr = Module._malloc(len * bytesPerElement);
                for (let i = 0; i < len; i++) {
                    Module.setValue(xPtr + (i * 4), points.x[i], 'i32');
                    Module.setValue(yPtr + (i * 4), points.y[i], 'i32');
                }
                const resultPtr = Module.ccall(
                    'verify_human', 
                    'number',       
                    ['number', 'number', 'number'], 
                    [xPtr, yPtr, len]
                );
                const resultStr = Module.UTF8ToString(resultPtr);
                statusEl.innerText = resultStr;
                
                if (resultStr.startsWith("UniCTF")) {
                    statusEl.style.color = "green";
                } else {
                    statusEl.style.color = "red";
                }
                Module._free(xPtr);
                Module._free(yPtr);

            } catch (e) {
                console.error(e);
                statusEl.innerText = "System Error: " + e.message;
            } finally {
                btn.disabled = false;
            }
        };

        window.checkTrace = function() {
            if (typeof Module === 'undefined' || !Module.ccall) {
                statusEl.innerText = "Error: Wasm Module not loaded.";
                statusEl.style.color = "red";
                return;
            }
            
            if (points.x.length < 50) {
                statusEl.innerText = "Error: Trace too short.";
                statusEl.style.color = "red";
                return;
            }

            statusEl.innerText = "Analyzing neural micro-tremors...";
            btn.disabled = true;

            setTimeout(window.runWasmCheck, 50);
        };
    });
</script>

</body> </html>

本题最终 flag 为验证正确时的字符串加上逆向分析得到的所有生物特征值之和的 md5 (小写)。
比如，验证通过后显示的字符串为UniCTF{abcd}，分析得到的正确生物特征值为速度 11、抖动 33，生物特征值之和为 44，注意生物特征值通常不会太大，则最终的 flag 就是
tips：

题目描述更新为UniCTF{md5(UniCTF{abcd}44）}

以下是js文件
// include: shell.js
// include: minimum_runtime_check.js
// end include: minimum_runtime_check.js
// The Module object: Our interface to the outside world. We import
// and export values on it. There are various ways Module can be used:
// 1. Not defined. We create it here
// 2. A function parameter, function(moduleArg) => Promise<Module>
// 3. pre-run appended it, var Module = {}; ..generated code..
// 4. External script tag defines var Module.
// We need to check if Module already exists (e.g. case 3 above).
// Substitution will be replaced with actual code on later stage of the build,
// this way Closure Compiler will not mangle it (e.g. case 4. above).
// Note that if you want to run closure, and also to use Module
// after the generated code, you will need to define var Module = {};
// before the code. Then that object will be used in the code, and you
// can continue to use Module afterwards as well.
var Module = typeof Module != 'undefined' ? Module : {};

// Determine the runtime environment we are in. You can customize this by
// setting the ENVIRONMENT setting at compile time (see settings.js).

// Attempt to auto-detect the environment
var ENVIRONMENT_IS_WEB = !!globalThis.window;
var ENVIRONMENT_IS_WORKER = !!globalThis.WorkerGlobalScope;
// N.b. Electron.js environment is simultaneously a NODE-environment, but
// also a web environment.
var ENVIRONMENT_IS_NODE = globalThis.process?.versions?.node && globalThis.process?.type != 'renderer';
var ENVIRONMENT_IS_SHELL = !ENVIRONMENT_IS_WEB && !ENVIRONMENT_IS_NODE && !ENVIRONMENT_IS_WORKER;

// --pre-jses are emitted after the Module integration code, so that they can
// refer to Module (if they choose; they can also define Module)

var arguments_ = [];
var thisProgram = './this.program';
var quit_ = (status, toThrow) => {
throw toThrow;
};

// In MODULARIZE mode _scriptName needs to be captured already at the very top of the page immediately when the page is parsed, so it is generated there
// before the page load. In non-MODULARIZE modes generate it here.
var _scriptName = globalThis.document?.currentScript?.src;

if (typeof __filename != 'undefined') { // Node
_scriptName = __filename;
} else
if (ENVIRONMENT_IS_WORKER) {
_scriptName = self.location.href;
}

// / should be present at the end if scriptDirectory is not empty
var scriptDirectory = '';
function locateFile(path) {
if (Module['locateFile']) {
return Module['locateFile'](path, scriptDirectory);
}
return scriptDirectory + path;
}

// Hooks that are implemented differently in different runtime environments.
var readAsync, readBinary;

if (ENVIRONMENT_IS_NODE) {

// These modules will usually be used on Node.js. Load them eagerly to avoid
// the complexity of lazy-loading.
var fs = require('fs');

scriptDirectory = __dirname + '/';

// include: node_shell_read.js
readBinary = (filename) => {
// We need to re-wrap file:// strings to URLs.
filename = isFileURI(filename) ? new URL(filename) : filename;
var ret = fs.readFileSync(filename);
return ret;
};

readAsync = async (filename, binary = true) => {
// See the comment in the readBinary function.
filename = isFileURI(filename) ? new URL(filename) : filename;
var ret = fs.readFileSync(filename, binary ? undefined : 'utf8');
return ret;
};
// end include: node_shell_read.js
if (process.argv.length > 1) {
thisProgram = process.argv[1].replace(/\/g, '/');
}

arguments_ = process.argv.slice(2);

// MODULARIZE will export the module in the proper place outside, we don't need to export here
if (typeof module != 'undefined') {
module['exports'] = Module;
}

quit_ = (status, toThrow) => {
process.exitCode = status;
throw toThrow;
};

} else

// Note that this includes Node.js workers when relevant (pthreads is enabled).
// Node.js workers are detected as a combination of ENVIRONMENT_IS_WORKER and
// ENVIRONMENT_IS_NODE.
if (ENVIRONMENT_IS_WEB || ENVIRONMENT_IS_WORKER) {
try {
scriptDirectory = new URL('.', _scriptName).href; // includes trailing slash
} catch {
// Must be a blob: or data: URL (e.g. blob:http://site.com/etc/etc), we cannot
// infer anything from them.
}

{
// include: web_or_worker_shell_read.js
if (ENVIRONMENT_IS_WORKER) {
readBinary = (url) => {
var xhr = new XMLHttpRequest();
xhr.open('GET', url, false);
xhr.responseType = 'arraybuffer';
xhr.send(null);
return new Uint8Array(/** @type{!ArrayBuffer} */(xhr.response));
};
}

readAsync = async (url) => {
// Fetch has some additional restrictions over XHR, like it can't be used on a file:// url.
// See https://github.com/github/fetch/pull/92#issuecomment-140665932
// Cordova or Electron apps are typically loaded from a file:// url.
// So use XHR on webview if URL is a file URL.
if (isFileURI(url)) {
return new Promise((resolve, reject) => {
var xhr = new XMLHttpRequest();
xhr.open('GET', url, true);
xhr.responseType = 'arraybuffer';
xhr.onload = () => {
if (xhr.status == 200 || (xhr.status == 0 && xhr.response)) { // file URLs can return 0
resolve(xhr.response);
return;
}
reject(xhr.status);
};
xhr.onerror = reject;
xhr.send(null);
});
}
var response = await fetch(url, { credentials: 'same-origin' });
if (response.ok) {
return response.arrayBuffer();
}
throw new Error(response.status + ' : ' + response.url);
};
// end include: web_or_worker_shell_read.js
}
} else
{
}

var out = console.log.bind(console);
var err = console.error.bind(console);

// end include: shell.js

// include: preamble.js
// === Preamble library stuff ===

// Documentation for the public APIs defined in this file must be updated in:
// site/source/docs/api_reference/preamble.js.rst
// A prebuilt local version of the documentation is available at:
// site/build/text/docs/api_reference/preamble.js.txt
// You can also build docs locally as HTML or other formats in site/
// An online HTML version (which may be of a different version of Emscripten)
// is up at http://kripken.github.io/emscripten-site/docs/api_reference/preamble.js.html

var wasmBinary;

// Wasm globals

//========================================
// Runtime essentials
//========================================

// whether we are quitting the application. no code should run after this.
// set in exit() and abort()
var ABORT = false;

// set by exit() and abort(). Passed to 'onExit' handler.
// NOTE: This is also used as the process return code in shell environments
// but only when noExitRuntime is false.
var EXITSTATUS;

// In STRICT mode, we only define assert() when ASSERTIONS is set. i.e. we
// don't define it at all in release modes. This matches the behaviour of
// MINIMAL_RUNTIME.
// TODO(sbc): Make this the default even without STRICT enabled.
/** @type {function(*, string=)} */
function assert(condition, text) {
if (!condition) {
// This build was created without ASSERTIONS defined. assert() should not
// ever be called in this configuration but in case there are callers in
// the wild leave this simple abort() implementation here for now.
abort(text);
}
}

/**

Indicates whether filename is delivered via file protocol (as opposed to http/https)
@noinline
*/
var isFileURI = (filename) => filename.startsWith('file://');

// include: runtime_common.js
// include: runtime_stack_check.js
// end include: runtime_stack_check.js
// include: runtime_exceptions.js
// end include: runtime_exceptions.js
// include: runtime_debug.js
// end include: runtime_debug.js
// Memory management
var
/** @type {!Int8Array} /
HEAP8,
/* @type {!Uint8Array} /
HEAPU8,
/* @type {!Int16Array} /
HEAP16,
/* @type {!Uint16Array} /
HEAPU16,
/* @type {!Int32Array} /
HEAP32,
/* @type {!Uint32Array} /
HEAPU32,
/* @type {!Float32Array} /
HEAPF32,
/* @type {!Float64Array} */
HEAPF64;

// BigInt64Array type is not correctly defined in closure
var
/** not-@type {!BigInt64Array} /
HEAP64,
/ BigUint64Array type is not correctly defined in closure
/** not-@type {!BigUint64Array} */
HEAPU64;

var runtimeInitialized = false;

function updateMemoryViews() {
var b = wasmMemory.buffer;
HEAP8 = new Int8Array(b);
HEAP16 = new Int16Array(b);
HEAPU8 = new Uint8Array(b);
HEAPU16 = new Uint16Array(b);
HEAP32 = new Int32Array(b);
HEAPU32 = new Uint32Array(b);
HEAPF32 = new Float32Array(b);
HEAPF64 = new Float64Array(b);
HEAP64 = new BigInt64Array(b);
HEAPU64 = new BigUint64Array(b);
}

// include: memoryprofiler.js
// end include: memoryprofiler.js
// end include: runtime_common.js
function preRun() {
if (Module['preRun']) {
if (typeof Module['preRun'] == 'function') Module['preRun'] = [Module['preRun']];
while (Module['preRun'].length) {
addOnPreRun(Module['preRun'].shift());
}
}
// Begin ATPRERUNS hooks
callRuntimeCallbacks(onPreRuns);
// End ATPRERUNS hooks
}

function initRuntime() {
runtimeInitialized = true;

// No ATINITS hooks

wasmExports'__wasm_call_ctors';

// No ATPOSTCTORS hooks
}

function postRun() {
// PThreads reuse the runtime from the main thread.

if (Module['postRun']) {
if (typeof Module['postRun'] == 'function') Module['postRun'] = [Module['postRun']];
while (Module['postRun'].length) {
addOnPostRun(Module['postRun'].shift());
}
}

// Begin ATPOSTRUNS hooks
callRuntimeCallbacks(onPostRuns);
// End ATPOSTRUNS hooks
}

/** @param {string|number=} what */
function abort(what) {
Module['onAbort']?.(what);

what = 'Aborted(' + what + ')';
// TODO(sbc): Should we remove printing and leave it up to whoever
// catches the exception?
err(what);

ABORT = true;

what += '. Build with -sASSERTIONS for more info.';

// Use a wasm runtime error, because a JS error might be seen as a foreign
// exception, which means we'd run destructors on it. We need the error to
// simply make the program stop.
// FIXME This approach does not work in Wasm EH because it currently does not assume
// all RuntimeErrors are from traps; it decides whether a RuntimeError is from
// a trap or not based on a hidden field within the object. So at the moment
// we don't have a way of throwing a wasm trap from JS. TODO Make a JS API that
// allows this in the wasm spec.

// Suppress closure compiler warning here. Closure compiler's builtin extern
// definition for WebAssembly.RuntimeError claims it takes no arguments even
// though it can.
// TODO(https://github.com/google/closure-compiler/pull/3913): Remove if/when upstream closure gets fixed.
/** @suppress {checkTypes} */
var e = new WebAssembly.RuntimeError(what);

// Throw the error whether or not MODULARIZE is set because abort is used
// in code paths apart from instantiation where an exception is expected
// to be thrown when abort is called.
throw e;
}

var wasmBinaryFile;

function findWasmBinary() {
return locateFile('verify.wasm');
}

async function getWasmBinary(binaryFile) {
// If we don't have the binary yet, load it asynchronously using readAsync.
if (!wasmBinary) {
// Fetch the binary using readAsync
try {
var response = await readAsync(binaryFile);
return new Uint8Array(response);
} catch {
// Fall back to getBinarySync below;
}
}

// Otherwise, getBinarySync should be able to get it synchronously
return getBinarySync(binaryFile);
}

async function instantiateArrayBuffer(binaryFile, imports) {
try {
var binary = await getWasmBinary(binaryFile);
var instance = await WebAssembly.instantiate(binary, imports);
return instance;
} catch (reason) {
err(failed to asynchronously prepare wasm: ${reason});

abort(reason);

}
}

async function instantiateAsync(binary, binaryFile, imports) {
if (!binary
// Don't use streaming for file:// delivered objects in a webview, fetch them synchronously.
&& !isFileURI(binaryFile)
// Avoid instantiateStreaming() on Node.js environment for now, as while
// Node.js v18.1.0 implements it, it does not have a full fetch()
// implementation yet.
//
// Reference:
// https://github.com/emscripten-core/emscripten/pull/16917
&& !ENVIRONMENT_IS_NODE
) {
try {
var response = fetch(binaryFile, { credentials: 'same-origin' });
var instantiationResult = await WebAssembly.instantiateStreaming(response, imports);
return instantiationResult;
} catch (reason) {
// We expect the most common failure cause to be a bad MIME type for the binary,
// in which case falling back to ArrayBuffer instantiation should work.
err(wasm streaming compile failed: ${reason});
err('falling back to ArrayBuffer instantiation');
// fall back of instantiateArrayBuffer below
};
}
return instantiateArrayBuffer(binaryFile, imports);
}

function getWasmImports() {
// prepare imports
var imports = {
'env': wasmImports,
'wasi_snapshot_preview1': wasmImports,
};
return imports;
}

// Create the wasm instance.
// Receives the wasm imports, returns the exports.
async function createWasm() {
// Load the wasm module and create an instance of using native support in the JS engine.
// handle a generated wasm instance, receiving its exports and
// performing other necessary setup
/** @param {WebAssembly.Module=} module*/
function receiveInstance(instance, module) {
wasmExports = instance.exports;

text
assignWasmExports(wasmExports);

updateMemoryViews();

removeRunDependency('wasm-instantiate');
return wasmExports;

}
addRunDependency('wasm-instantiate');

// Prefer streaming instantiation if available.
function receiveInstantiationResult(result) {
// 'result' is a ResultObject object which has both the module and instance.
// receiveInstance() will swap in the exports (to Module.asm) so they can be called
// TODO: Due to Closure regression https://github.com/google/closure-compiler/issues/3193, the above line no longer optimizes out down to the following line.
// When the regression is fixed, can restore the above PTHREADS-enabled path.
return receiveInstance(result['instance']);
}

var info = getWasmImports();

// User shell pages can write their own Module.instantiateWasm = function(imports, successCallback) callback
// to manually instantiate the Wasm module themselves. This allows pages to
// run the instantiation parallel to any other async startup actions they are
// performing.
// Also pthreads and wasm workers initialize the wasm instance through this
// path.
if (Module['instantiateWasm']) {
return new Promise((resolve, reject) => {
Module['instantiateWasm'](info, (inst, mod) => {
resolve(receiveInstance(inst, mod));
});
});
}

wasmBinaryFile ??= findWasmBinary();
var result = await instantiateAsync(wasmBinary, wasmBinaryFile, info);
var exports = receiveInstantiationResult(result);
return exports;
}

// end include: preamble.js

// Begin JS library code

class ExitStatus {
name = 'ExitStatus';
constructor(status) {
this.message = Program terminated with exit(${status});
this.status = status;
}
}

var callRuntimeCallbacks = (callbacks) => {
while (callbacks.length > 0) {
// Pass the module as the first argument.
callbacks.shift()(Module);
}
};
var onPostRuns = [];
var addOnPostRun = (cb) => onPostRuns.push(cb);

var onPreRuns = [];
var addOnPreRun = (cb) => onPreRuns.push(cb);

var runDependencies = 0;

var dependenciesFulfilled = null;
var removeRunDependency = (id) => {
runDependencies--;

text
  Module['monitorRunDependencies']?.(runDependencies);

  if (runDependencies == 0) {
    if (dependenciesFulfilled) {
      var callback = dependenciesFulfilled;
      dependenciesFulfilled = null;
      callback(); // can add another dependenciesFulfilled
    }
  }
};

var addRunDependency = (id) => {
runDependencies++;

text
  Module['monitorRunDependencies']?.(runDependencies);

};



/**
 * @param {number} ptr
 * @param {string} type
 */

var noExitRuntime = true;

text
/**
 * @param {number} ptr
 * @param {number} value
 * @param {string} type
 */

var stackRestore = (val) => __emscripten_stack_restore(val);

var stackSave = () => _emscripten_stack_get_current();

var abortOnCannotGrowMemory = (requestedSize) => {
abort('OOM');
};
var _emscripten_resize_heap = (requestedSize) => {
var oldSize = HEAPU8.length;
// With CAN_ADDRESS_2GB or MEMORY64, pointers are already unsigned.
requestedSize >>>= 0;
abortOnCannotGrowMemory(requestedSize);
};

var getCFunc = (ident) => {
var func = Module['_' + ident]; // closure exported function
return func;
};

var writeArrayToMemory = (array, buffer) => {
HEAP8.set(array, buffer);
};

var lengthBytesUTF8 = (str) => {
var len = 0;
for (var i = 0; i < str.length; ++i) {
// Gotcha: charCodeAt returns a 16-bit word that is a UTF-16 encoded code
// unit, not a Unicode code point of the character! So decode
// UTF16->UTF32->UTF8.
// See http://unicode.org/faq/utf_bom.html#utf16-3
var c = str.charCodeAt(i); // possibly a lead surrogate
if (c <= 0x7F) {
len++;
} else if (c <= 0x7FF) {
len += 2;
} else if (c >= 0xD800 && c <= 0xDFFF) {
len += 4; ++i;
} else {
len += 3;
}
}
return len;
};

var stringToUTF8Array = (str, heap, outIdx, maxBytesToWrite) => {
// Parameter maxBytesToWrite is not optional. Negative values, 0, null,
// undefined and false each don't write out any bytes.
if (!(maxBytesToWrite > 0))
return 0;

text
  var startIdx = outIdx;
  var endIdx = outIdx + maxBytesToWrite - 1; // -1 for string null terminator.
  for (var i = 0; i < str.length; ++i) {
    // For UTF8 byte structure, see http://en.wikipedia.org/wiki/UTF-8#Description
    // and https://www.ietf.org/rfc/rfc2279.txt
    // and https://tools.ietf.org/html/rfc3629
    var u = str.codePointAt(i);
    if (u <= 0x7F) {
      if (outIdx >= endIdx) break;
      heap[outIdx++] = u;
    } else if (u <= 0x7FF) {
      if (outIdx + 1 >= endIdx) break;
      heap[outIdx++] = 0xC0 | (u >> 6);
      heap[outIdx++] = 0x80 | (u & 63);
    } else if (u <= 0xFFFF) {
      if (outIdx + 2 >= endIdx) break;
      heap[outIdx++] = 0xE0 | (u >> 12);
      heap[outIdx++] = 0x80 | ((u >> 6) & 63);
      heap[outIdx++] = 0x80 | (u & 63);
    } else {
      if (outIdx + 3 >= endIdx) break;
      heap[outIdx++] = 0xF0 | (u >> 18);
      heap[outIdx++] = 0x80 | ((u >> 12) & 63);
      heap[outIdx++] = 0x80 | ((u >> 6) & 63);
      heap[outIdx++] = 0x80 | (u & 63);
      // Gotcha: if codePoint is over 0xFFFF, it is represented as a surrogate pair in UTF-16.
      // We need to manually skip over the second code unit for correct iteration.
      i++;
    }
  }
  // Null-terminate the pointer to the buffer.
  heap[outIdx] = 0;
  return outIdx - startIdx;
};

var stringToUTF8 = (str, outPtr, maxBytesToWrite) => {
return stringToUTF8Array(str, HEAPU8, outPtr, maxBytesToWrite);
};

var stackAlloc = (sz) => __emscripten_stack_alloc(sz);
var stringToUTF8OnStack = (str) => {
var size = lengthBytesUTF8(str) + 1;
var ret = stackAlloc(size);
stringToUTF8(str, ret, size);
return ret;
};

var UTF8Decoder = globalThis.TextDecoder && new TextDecoder();

var findStringEnd = (heapOrArray, idx, maxBytesToRead, ignoreNul) => {
var maxIdx = idx + maxBytesToRead;
if (ignoreNul) return maxIdx;
// TextDecoder needs to know the byte length in advance, it doesn't stop on
// null terminator by itself.
// As a tiny code save trick, compare idx against maxIdx using a negation,
// so that maxBytesToRead=undefined/NaN means Infinity.
while (heapOrArray[idx] && !(idx >= maxIdx)) ++idx;
return idx;
};

text
/**
 * Given a pointer 'idx' to a null-terminated UTF8-encoded string in the given
 * array that contains uint8 values, returns a copy of that string as a
 * Javascript String object.
 * heapOrArray is either a regular array, or a JavaScript typed array view.
 * @param {number=} idx
 * @param {number=} maxBytesToRead
 * @param {boolean=} ignoreNul - If true, the function will not stop on a NUL character.
 * @return {string}
 */

var UTF8ArrayToString = (heapOrArray, idx = 0, maxBytesToRead, ignoreNul) => {

text
  var endPtr = findStringEnd(heapOrArray, idx, maxBytesToRead, ignoreNul);

  // When using conditional TextDecoder, skip it for short strings as the overhead of the native call is not worth it.
  if (endPtr - idx > 16 && heapOrArray.buffer && UTF8Decoder) {
    return UTF8Decoder.decode(heapOrArray.subarray(idx, endPtr));
  }
  var str = '';
  while (idx < endPtr) {
    // For UTF8 byte structure, see:
    // http://en.wikipedia.org/wiki/UTF-8#Description
    // https://www.ietf.org/rfc/rfc2279.txt
    // https://tools.ietf.org/html/rfc3629
    var u0 = heapOrArray[idx++];
    if (!(u0 & 0x80)) { str += String.fromCharCode(u0); continue; }
    var u1 = heapOrArray[idx++] & 63;
    if ((u0 & 0xE0) == 0xC0) { str += String.fromCharCode(((u0 & 31) << 6) | u1); continue; }
    var u2 = heapOrArray[idx++] & 63;
    if ((u0 & 0xF0) == 0xE0) {
      u0 = ((u0 & 15) << 12) | (u1 << 6) | u2;
    } else {
      u0 = ((u0 & 7) << 18) | (u1 << 12) | (u2 << 6) | (heapOrArray[idx++] & 63);
    }

    if (u0 < 0x10000) {
      str += String.fromCharCode(u0);
    } else {
      var ch = u0 - 0x10000;
      str += String.fromCharCode(0xD800 | (ch >> 10), 0xDC00 | (ch & 0x3FF));
    }
  }
  return str;
};

/**
 * Given a pointer 'ptr' to a null-terminated UTF8-encoded string in the
 * emscripten HEAP, returns a copy of that string as a Javascript String object.
 *
 * @param {number} ptr
 * @param {number=} maxBytesToRead - An optional length that specifies the
 *   maximum number of bytes to read. You can omit this parameter to scan the
 *   string until the first 0 byte. If maxBytesToRead is passed, and the string
 *   at [ptr, ptr+maxBytesToReadr[ contains a null byte in the middle, then the
 *   string will cut short at that byte index.
 * @param {boolean=} ignoreNul - If true, the function will not stop on a NUL character.
 * @return {string}
 */

var UTF8ToString = (ptr, maxBytesToRead, ignoreNul) => {
return ptr ? UTF8ArrayToString(HEAPU8, ptr, maxBytesToRead, ignoreNul) : '';
};

text
/**
 * @param {string|null=} returnType
 * @param {Array=} argTypes
 * @param {Array=} args
 * @param {Object=} opts
 */

text
  function convertReturnValue(ret) {
    if (returnType === 'string') {
      return UTF8ToString(ret);
    }
    if (returnType === 'boolean') return Boolean(ret);
    return ret;
  }

  var func = getCFunc(ident);
  var cArgs = [];
  var stack = 0;
  if (args) {
    for (var i = 0; i < args.length; i++) {
      var converter = toC[argTypes[i]];
      if (converter) {
        if (stack === 0) stack = stackSave();
        cArgs[i] = converter(args[i]);
      } else {
        cArgs[i] = args[i];
      }
    }
  }
  var ret = func(...cArgs);
  function onDone(ret) {
    if (stack !== 0) stackRestore(stack);
    return convertReturnValue(ret);
  }

  ret = onDone(ret);
  return ret;
};



/**
 * @param {string=} returnType
 * @param {Array=} argTypes
 * @param {Object=} opts
 */

var cwrap = (ident, returnType, argTypes, opts) => {
// When the function takes numbers and returns a number, we can just return
// the original function
var numericArgs = !argTypes || argTypes.every((type) => type === 'number' || type === 'boolean');
var numericRet = returnType !== 'string';
if (numericRet && numericArgs && !opts) {
return getCFunc(ident);
}
return (...args) => ccall(ident, returnType, argTypes, args, opts);
};

// End JS library code

// include: postlibrary.js
// This file is included after the automatically-generated JS library code
// but before the wasm module is created.

{

// Begin ATMODULES hooks
if (Module['noExitRuntime']) noExitRuntime = Module['noExitRuntime'];
if (Module['print']) out = Module['print'];
if (Module['printErr']) err = Module['printErr'];
if (Module['wasmBinary']) wasmBinary = Module['wasmBinary'];
// End ATMODULES hooks

if (Module['arguments']) arguments_ = Module['arguments'];
if (Module['thisProgram']) thisProgram = Module['thisProgram'];

if (Module['preInit']) {
if (typeof Module['preInit'] == 'function') Module['preInit'] = [Module['preInit']];
while (Module['preInit'].length > 0) {
Module['preInit'].shift()();
}
}
}

// Begin runtime exports
Module['ccall'] = ccall;
Module['cwrap'] = cwrap;
Module['setValue'] = setValue;
Module['UTF8ToString'] = UTF8ToString;
// End runtime exports
// Begin JS library exports
// End JS library exports

// end include: postlibrary.js

// Imports from the Wasm binary.
var _verify_human,
_malloc,
_free,
__emscripten_stack_restore,
__emscripten_stack_alloc,
_emscripten_stack_get_current,
memory,
__indirect_function_table,
wasmMemory;

function assignWasmExports(wasmExports) {
_verify_human = Module['_verify_human'] = wasmExports['verify_human'];
_malloc = Module['_malloc'] = wasmExports['malloc'];
_free = Module['_free'] = wasmExports['free'];
__emscripten_stack_restore = wasmExports['_emscripten_stack_restore'];
__emscripten_stack_alloc = wasmExports['_emscripten_stack_alloc'];
_emscripten_stack_get_current = wasmExports['emscripten_stack_get_current'];
memory = wasmMemory = wasmExports['memory'];
__indirect_function_table = wasmExports['__indirect_function_table'];
}

var wasmImports = {
/** @export */
emscripten_resize_heap: _emscripten_resize_heap
};

// include: postamble.js
// === Auto-generated postamble setup entry stuff ===

function run() {

if (runDependencies > 0) {
dependenciesFulfilled = run;
return;
}

preRun();

// a preRun added a dependency, run will be called later
if (runDependencies > 0) {
dependenciesFulfilled = run;
return;
}

function doRun() {
// run may have just been called through dependencies being fulfilled just in this very frame,
// or while the async setStatus time below was happening
Module['calledRun'] = true;

text
if (ABORT) return;

initRuntime();

Module['onRuntimeInitialized']?.();

postRun();

}

if (Module['setStatus']) {
Module'setStatus';
setTimeout(() => {
setTimeout(() => Module'setStatus', 1);
doRun();
}, 1);
} else
{
doRun();
}
}

var wasmExports;

// With async instantation wasmExports is assigned asynchronously when the
// instance is received.
createWasm();

run();

// end include: postamble.js

以下是wasm反编译的wat文件的核心部分：

local.get 15
local.get 2
f64.convert_i32_u
local.tee 11
f64.div
i64.trunc_sat_f64_u
i64.const 32
i64.shl
i64.const 281470681743360
i64.and
local.get 11
f64.const 0x1.47ae147ae147bp-3 (;=0.16;)
f64.mul
i64.trunc_sat_f64_u
i64.const 48
i64.shl
i64.or
local.get 14
local.get 11
f64.div
local.tee 12
local.get 12
f64.add
i64.trunc_sat_f64_u
i64.const 16
i64.shl
i64.const 4294901760
i64.and
i64.or
local.get 13
local.get 11
f64.div
local.tee 11
local.get 11
f64.add
i64.trunc_sat_f64_u
i64.const 65535
i64.and
i64.or
local.set 16
i32.const 0
local.set 3
loop ;; label = @2
local.get 3
local.tee 3
local.get 3
i32.load8_u offset=1024
local.get 16
i64.const 6364136223846793005
i64.mul
i64.const 1442695040888963407
i64.add
local.tee 16
i64.const 56
i64.shr_u
i32.wrap_i64
i32.xor
i32.store8 offset=1104
local.get 16
local.set 16
local.get 3
i32.const 1
i32.add
local.tee 1
local.set 3
local.get 1
i32.const 46
i32.ne
br_if 0 (;@2;)
end
i32.const 0
i32.const 0
i32.store8 offset=1150
i32.const 1104
local.set 3
end
我已经把 verify_human 的核心逻辑抽出来了：它用你的轨迹点（x/y i32 数组 + 长度）算出一个 64-bit seed，然后用这个 seed 跑 LCG 去 XOR 解密内置密文，解出来的明文如果以 UniCTF 开头就算拿到 flag。
先帮我写个脚本得到特征值

Answer 1

下面给你一个最省事的方案：** 不需要把 local13/14/15 的前半段计算全逆出来**——直接在 verify_human 里 seed 刚算完（local.set 16）的位置把 seed 写到线性内存，然后用脚本读出来并拆成 4 个 16-bit “特征值”。

1）给 verify.wat 打补丁：把 seed 存到内存

先把 wasm 转 wat（需要 WABT 工具）：

bash
wasm2wat verify.wasm -o verify.wat

然后用下面这个脚本自动插入 i64.store（把 seed 写到地址 4096，8 字节对齐，安全）：

python
# patch_seed_store.py
from pathlib import Path

SEED_ADDR = 4096  # 你也可以换成 8192/16384 等，只要别撞到数据区

wat_in = Path("verify.wat")
wat_out = Path("verify_patched.wat")

s = wat_in.read_text(encoding="utf-8")

# 尽量限定在 verify_human 附近再找 local.set 16
anchor = s.find("verify_human")
if anchor == -1:
    anchor = 0

pos = s.find("local.set 16", anchor)
if pos == -1:
    raise SystemExit("没找到 'local.set 16'，请确认 verify.wat 里是否有该片段。")

insert = (
    "local.set 16\n"
    f"      i32.const {SEED_ADDR}\n"
    "      local.get 16\n"
    "      i64.store\n"
)

s2 = s[:pos] + insert + s[pos + len("local.set 16\n"):]
wat_out.write_text(s2, encoding="utf-8")
print(f"[+] wrote {wat_out}")

执行：

bash
python3 patch_seed_store.py
wat2wasm verify_patched.wat -o verify_patched.wasm

2）Node 脚本：喂点集，跑 verify_human，读 seed，拆特征值并算最终 flag

准备一个 points.json：

json
{"x":[12,13,14], "y":[200,201,199]}

然后用这个脚本（dump_features.js）：

js
// dump_features.js
const fs = require("fs");
const crypto = require("crypto");

const SEED_ADDR = 4096;

function readCString(u8, ptr) {
  let end = ptr;
  while (u8[end] !== 0) end++;
  return new TextDecoder("utf-8").decode(u8.slice(ptr, end));
}

(async () => {
  const wasm = fs.readFileSync("verify_patched.wasm");

  // 你的 verify.js 里把 env 和 wasi_snapshot_preview1 都指向同一份 imports
  const imports = {
    env: {
      emscripten_resize_heap: () => {
        throw new Error("emscripten_resize_heap called (unexpected)");
      },
    },
    wasi_snapshot_preview1: {
      emscripten_resize_heap: () => {
        throw new Error("emscripten_resize_heap called (unexpected)");
      },
    },
  };

  const { instance } = await WebAssembly.instantiate(wasm, imports);
  const { memory, malloc, free, verify_human } = instance.exports;

  const pointsPath = process.argv[2] || "points.json";
  const points = JSON.parse(fs.readFileSync(pointsPath, "utf-8"));
  const x = points.x || [];
  const y = points.y || [];
  if (x.length !== y.length) throw new Error("x/y length mismatch");
  if (x.length === 0) throw new Error("empty points");

  const len = x.length;

  // 分配并写入 i32 数组
  const xPtr = Number(malloc(len * 4));
  const yPtr = Number(malloc(len * 4));
  new Int32Array(memory.buffer, xPtr, len).set(x.map(v => v | 0));
  new Int32Array(memory.buffer, yPtr, len).set(y.map(v => v | 0));

  const resPtr = Number(verify_human(xPtr, yPtr, len));

  const u8 = new Uint8Array(memory.buffer);
  const dv = new DataView(memory.buffer);

  const resultStr = readCString(u8, resPtr);

  // i64.store 是 little-endian
  const lo = BigInt(dv.getUint32(SEED_ADDR, true));
  const hi = BigInt(dv.getUint32(SEED_ADDR + 4, true));
  const seed = lo | (hi << 32n);

  // 按你贴的 packing：高 16 / 次高 16 / 次低 16 / 低 16
  const f0 = Number((seed >> 48n) & 0xFFFFn);
  const f1 = Number((seed >> 32n) & 0xFFFFn);
  const f2 = Number((seed >> 16n) & 0xFFFFn);
  const f3 = Number(seed & 0xFFFFn);
  const sum = f0 + f1 + f2 + f3;

  // 题面更新：UniCTF{md5(UniCTF{abcd}44)}
  const md5 = crypto.createHash("md5").update(resultStr + String(sum), "utf8").digest("hex");
  const finalFlag = `UniCTF{${md5}}`;

  console.log("resultStr =", resultStr);
  console.log("seed     =", "0x" + seed.toString(16).padStart(16, "0"));
  console.log("features =", [f0, f1, f2, f3]);
  console.log("sum      =", sum);
  console.log("final    =", finalFlag);

  free(xPtr);
  free(yPtr);
})().catch((e) => {
  console.error(e);
  process.exit(1);
});

运行：

bash
node dump_features.js points.json

3）怎么拿到 points.json（从网页里直接导出）

你现在页面里的 points 在闭包里，外面拿不到。最简单改一行：

在 DOMContentLoaded 里 let points = { x: [], y: [] }; 后面加：

js
window.__points = points;

然后你画完之后，控制台：

js
copy(JSON.stringify(window.__points))

粘贴保存成 points.json 即可。

如果你把 verify.wat 里 verify_human 的完整函数（或者至少 local13/14/15 的计算那段）也贴出来，我还能帮你把这 4 个 16-bit 值分别对应到“速度/抖动/复杂度/长度”等更可读的特征定义（而不是只给 raw 值）。

Answer 2

可行，但完全没必要爆破——你这份 wat 已经把“生物特征值”写死成从轨迹点直接算出来的 4 个 16-bit 值了，确定性计算即可。

这题的 4 个特征值到底是什么（按你的 wat 精确还原）

令点数 N = len（注意 wasm 用 N 做分母，不是 N-1）。

对 i = 1..N-1：

dx = x[i] - x[i-1]
dy = y[i] - y[i-1]
ax = dx - prev_dx（prev_dx 初始为 0）
ay = dy - prev_dy（prev_dy 初始为 0）

累计：

L += sqrt(dx^2 + dy^2) （总路径长度）
SX += ax^2 （x 方向“加速度变化能量”）
SY += ay^2 （y 方向“加速度变化能量”）

然后 4 个 16-bit 特征值（都等价于 int(trunc toward 0)，再取低 16 位）：

f0 = int(0.16 * N) & 0xFFFF （写到 seed 的 bits 48..63）
f1 = int(L / N) & 0xFFFF （bits 32..47）
f2 = int(2 * (SY / N)) & 0xFFFF （bits 16..31）
f3 = int(2 * (SX / N)) & 0xFFFF （bits 0..15）

seed 组装就是：

seed = (f0<<48) | (f1<<32) | (f2<<16) | f3

特征值之和：sum = f0+f1+f2+f3

直接算特征值脚本（Python）

输入 points.json（格式同你前面：{"x":[...],"y":[...]}）：

python
# calc_features.py
import json, math, sys, hashlib

def calc_features(x, y):
    assert len(x) == len(y)
    N = len(x)
    prev_dx = 0.0
    prev_dy = 0.0
    SX = 0.0
    SY = 0.0
    L  = 0.0

    for i in range(1, N):
        dx = float(int(x[i]) - int(x[i-1]))
        dy = float(int(y[i]) - int(y[i-1]))

        ax = dx - prev_dx
        ay = dy - prev_dy
        SX += ax * ax
        SY += ay * ay
        L  += math.sqrt(dx*dx + dy*dy)

        prev_dx = dx
        prev_dy = dy

    f0 = (int(0.16 * N)          ) & 0xFFFF
    f1 = (int(L / N)             ) & 0xFFFF
    f2 = (int(2.0 * (SY / N))    ) & 0xFFFF
    f3 = (int(2.0 * (SX / N))    ) & 0xFFFF

    seed = (f0 << 48) | (f1 << 32) | (f2 << 16) | f3
    s = f0 + f1 + f2 + f3
    return (f0, f1, f2, f3, seed, s)

if __name__ == "__main__":
    points_path = sys.argv[1] if len(sys.argv) > 1 else "points.json"
    result_str  = sys.argv[2] if len(sys.argv) > 2 else None  # 例如 UniCTF{abcd}

    pts = json.load(open(points_path, "r", encoding="utf-8"))
    f0,f1,f2,f3,seed,s = calc_features(pts["x"], pts["y"])

    print("N       =", len(pts["x"]))
    print("features=", [f0,f1,f2,f3])
    print("sum     =", s)
    print("seed    =", f"0x{seed:016x}")

    if result_str is not None:
        md5 = hashlib.md5((result_str + str(s)).encode("utf-8")).hexdigest()
        print("final   =", f"UniCTF{{{md5}}}")

用法：

bash
python3 calc_features.py points.json "UniCTF{abcd}"

你问的“爆破特征值可行吗？”

结论

爆破“特征值”去找能解出 UniCTF... 的 seed：不太可行（除非你再引入约束/数学解法）。
因为 seed 有 64 bit（4×16），其中 f2/f3 本质上在 &0xFFFF 后几乎可以覆盖全空间，朴素枚举会很大（动辄 2^32 级别起步）。

更好的两条路（都比爆破强）

你已经有轨迹点 → 直接用上面脚本算出特征值（最推荐）。
你没有轨迹点，只想从密文+已知明文前缀 UniCTF 恢复 seed → 走“LCG 高位泄露求解”（SMT/格/分支剪枝），这属于另一套解法，比暴力枚举 2^64 强很多。

如果你把 verify.wasm 里 offset=1024 的 46 字节密文（或者完整 data 段）也贴出来，我可以给你写一个“从已知前缀 UniCTF 直接恢复 seed → 拆出 4 个特征值”的脚本（不需要画图、不需要 points）。

Câu hỏi

Suy nghĩ

Considering computation for feature values

Considering options for computing features from wasm

Brute-forcing feature values and seed derivation

Creating a script for extracting feature values

Brute-forcing seed with constraints

Proposing dynamic instrumentation for feature extraction

Patching wasm to extract seed

Recovering seed and deriving features

Outlining script options for patching wasm

Considering memory handling in wasm and flag generation

Providing solution and patching steps for feature extraction

Providing solution with patching script for feature extraction

Trả lời

1）给 verify.wat 打补丁：把 seed 存到内存

2）Node 脚本：喂点集，跑 verify_human，读 seed，拆特征值并算最终 flag

3）怎么拿到 points.json（从网页里直接导出）

Câu hỏi

Python

Python

Suy nghĩ

Understanding seed calculation breakdown

Finalizing the feature calculation logic

Clarifying loop logic and calculation details

Discussing feasibility of brute forcing features

Discussing brute-forcing feature values

Brute-forcing features and optimizing seed recovery

Recovering seed and feature values using LCG

Clarifying feature computation and providing script

Explaining brute-force and feature extraction logic

Creating feature computation scripts

Trả lời

这题的 4 个特征值到底是什么（按你的 wat 精确还原）

直接算特征值脚本（Python）

你问的“爆破特征值可行吗？”

结论

更好的两条路（都比爆破强）

Câu hỏi

Chia sẻ Q&A này