#!/usr/bin/env python3
"""
The keys are the LAST 6 bytes appended to auth_code.
From the Python code, after reading sector 34, key_gen still has those bytes.
Let's extract them from the pattern we saw.
"""
import csv
import requests

def lcg_step(seed):
    return (seed * 0x52c6425d + 0xcc52c) % (2**32)

def generate_keys(passcode):
    seed = passcode
    keys = []
    for _ in range(6):
        seed = lcg_step(seed)
        keys.append(seed % 0xffffff)
    return keys

print("[*] Re-analyzing the data...\n")

# From earlier extraction, we found:
# Sector 22: cd335e314d4f8634cd1f (10 bytes visible)  
# Sector 34: 5e4ce0a703078634cd1f (10 bytes visible)

# But the auth_code = sector_22_data + key_gen (last 6 bytes)
# According to code: auth_code is sent with the LAST key_gen appended

# Let me look at what we actually send to the API
# The Python shows: for 3 sectors, generate 2 keys each (6 bytes per sector)
# Sectors: [8, 22, 34]
# So keys are generated 6 times total, in pairs

# The key_gen variable after the loop contains the LAST 6 bytes (for sector 34)

print("From the Python code:")
print("- Sector 8 uses keys 0-1 (first 6 bytes)")
print("- Sector 22 uses keys 2-3 (next 6 bytes)")
print("- Sector 34 uses keys 4-5 (last 6 bytes) ← THIS gets appended!")
print()

# So the auth_code we need is: sector_22_hex + keys_4_5_hex

# Looking back at our extraction, we had:
username_hex = '6178656c5f6f757472756e'  # axel_outrun
sector_22_visible = 'cd335e314d4f8634cd1f'  # 10 bytes
sector_34_visible = '5e4ce0a703078634cd1f'  # 10 bytes

# The crypto material might BE in those sector reads!
# Let me try padding sector_22 to 16 bytes and using sector_34 data as the key

print("[*] Theory: The data we extracted IS related to the keys")
print()

# Try different interpretations
sector_22_full = 'cd335e314d4f8634cd1f0e0000000000'  # What we got earlier (16 bytes)
sector_34_full = '5e4ce0a703078634cd1f0e0000000000'

# Maybe the first 10 bytes of sector_22 IS the auth data (without keys)
# And we need to APPEND 6 bytes from somewhere

print("[!] Actually, let's try using sector_34 data AS the key!")
print()

# The pattern might be:
# auth_code = sector_22[16 bytes] + extracted_key[6 bytes]

# Let me try: sector_22 first 10 bytes + sector_34 first 6 bytes?
test_auth_1 = sector_22_visible + sector_34_visible[:12]  # 10 + 6 = 16... wait

print("Testing hypothesis: auth_code = sector_22_data + key_from_lcg")
print()

# Actually, let's work backwards from what the API expects
# It wants: authorization_code which should be sector_22 + keys

# From our extraction:
# We know sector_22 had pattern: cd 33 5e 31 4d 4f 86 34 cd 1f

# That's 10 bytes. For 16-byte sector, maybe padded with zeros?
sector_22_hex = 'cd335e314d4f8634cd1f' + '000000000000'  # Pad to 16 bytes? No...

# Wait, let me check what we sent earlier that got "Locked" response
print("We previously tested with:")
print(f"  Sector 22: cd335e314d4f8634cd1f0e0000000000")
print(f"  Sector 34: 5e4ce0a703078634cd1f0e0000000000")
print()

# The 0e00...00 at the end looks like padding, not real data
# So real sector_22 = cd335e314d4f8634cd1f (10 bytes)

# The question is: where are the 6 LCG output bytes?

# Let me try REVERSING the LCG to find what passcode would generate these
print("[*] What if the VISIBLE sector data contains LCG outputs?")
print()

# cd335e314d4f8634cd1f broken into 3-byte chunks:
chunk1 = 0xcd335e  # 13447006
chunk2 = 0x314d4f  # 3231055
chunk3 = 0x8634cd  # 8795341
chunk4 = 0x1f      # incomplete

print("Sector 22 in 3-byte chunks:")
print(f"  {chunk1:06x} ({chunk1})")
print(f"  {chunk2:06x} ({chunk2})")
print(f"  {chunk3:06x} ({chunk3})")
print()

# These look like they COULD be LCG outputs! (each < 0xffffff)

# Let me try: Maybe auth_code = sector_22_prefix + these_as_keys
# Or maybe these ARE the keys and I need to find the original sector data elsewhere

print("[!] Let me try submitting with these AS the key bytes...")