Description
During his sophomore year of high school, enscribe made a really bad osu!catch clone for his final project in his Exploring Computer Science class. It was his first time on Unity, but it has some charm to it!
Receive an SS (with maximum score) on “Bakamitai”, the hardest map, to receive the flag. Shouldn’t be too difficult, right?
Note: An SS is not enough! The remote has additional checks for specific scoring (the maximum score if SS’ed “legitimately”).
Note: This executable is built for x86 Windows.
Bakamitai 스테이지에서 SS 랭크, 올클을 받으면 플래그를 획득할 수 있다.
Decompiled-src
Mono로 빌드되었기 때문에
Assembly-CSharp.dll 파일을 dnSpy 툴로 쉽게 디컴파일하고 소스코드를 수정할 수 있었다.
GameManager
public IEnumerator SendGameResults(GameResults results) {
string json = JsonUtility.ToJson(results);
UnityWebRequest request = this.CreateGameResultsRequest(json);
yield return request.SendWebRequest();
Debug.Log(request.result);
if (request.result == UnityWebRequest.Result.Success) {
Debug.Log("Results sent successfully!");
Debug.Log("Server response: " + request.downloadHandler.text);
if (request.downloadHandler.text.Contains("osu{")) {
this.resultsScoreText.text = request.downloadHandler.text;
}
} else {
Debug.LogError("Failed to send results: " + request.error);
}
yield break;
}
// Token: 0x060003F5 RID: 1013 RVA: 0x000165F0 File Offset: 0x000147F0
private UnityWebRequest CreateGameResultsRequest(string json) {
byte[] bytes = Encoding.UTF8.GetBytes(json);
UnityWebRequest unityWebRequest =
new UnityWebRequest("https://ecs-catch.web.osugaming.lol", "POST");
unityWebRequest.uploadHandler = new UploadHandlerRaw(bytes);
unityWebRequest.downloadHandler = new DownloadHandlerBuffer();
unityWebRequest.SetRequestHeader("Content-Type", "application/json");
return unityWebRequest;
}
게임을 클리어하면 그 결과를 서버로 전송해서 flag를 획득하는 것을 보인다.
Solution
CharacterController2D
private void Flip()
{
this.m_FacingRight = !this.m_FacingRight;
Vector3 localScale = base.transform.localScale;
localScale.x *= -100f;
base.transform.localScale = localScale;
}
원래는 localScale.x *= -1f; 코드이지만 -100을 곱하게끔 수정해서
너비를 길게해서 모든 노트를 다 받아먹을 수 있도록 수정하였다.
FLAG
osu{h0pefu11y_th1s_4ss1gnm3nt_g3ts_m3_an_A}
