#!/usr/bin/env python3
"""
Based on the extracted data, try "axel_outrun" as username
"""
import requests

def lcg_step(seed):
    return (seed * 0x52c6425d + 0xcc52c) % (2**32)

def generate_keys(passcode):
    seed = passcode
    keys = []
    for _ in range(6):
        seed = lcg_step(seed)
        keys.append(seed % 0xffffff)
    return keys

# From the extracted data:
# Offset 0x20-0x35: "axel_outrun" with null bytes
# Let me convert to hex without nulls
username_ascii = "axel_outrun"
username_hex = ''.join(f'{ord(c):02x}' for c in username_ascii)

print(f"[*] Username: {username_ascii}")
print(f"[*] Username hex: {username_hex}")

#  Looking at the data after the username (removing 0x00 bytes):
# Offset 0x40-0x5F: 02 92 64 04 64 02 0a 82 08 60 08 16 08 cd 08 33...
#  Try filtering out 0x00 bytes

# From extract_region output, removing nulls:
# 02 92 64 04 64 02 0a 82 08 60 08 16 (12 bytes)
# Rest: 08 cd 08 33 08 5e 08 31 08 4d 08 4f 08 86 08 34 08 cd 08 1f  0e 04 04 04 04 04 04 04...

# Let's try the first 16 non-null bytes after username as sector 22
sector_22_bytes = "02926404640200a082000008600816"[:32]  # 16 bytes
sector_34_bytes = "08cd08330" + "85e08310884d084f0886080834"[:32]  # 16 bytes

print(f"[*] Sector 22: {sector_22_bytes}")
print(f"[*] Sector 34: {sector_34_bytes}")  

print(f"\n[*] Trying with axel_outrun...")

# Try a few common passcodes
passcodes = [0, 1, 1234, 0x1337, 0xDEAD, 0xBEEF]

for pc in passcodes:
    keys = generate_keys(pc)
    key_bytes = []
    for key in keys[4:6]:
        key_bytes.extend([key >> 16, (key >> 8) & 0xFF, key & 0xFF])
    key_hex = ''.join(f'{b:02x}' for b in key_bytes)
    
    auth_code = sector_22 + key_hex
    
    data = {
        'uid': '04f6555b',
        'username': username_hex,
        'authorization_code': auth_code,
        'access_level': sector_34
    }
    
    try:
        r = requests.post('http://154.57.164.61:31938/api', data=data, timeout=5)
        result = r.json()
        print(f"\n  Passcode {pc} (0x{pc:x}): {result}")
        
        if result.get('flag') and len(result.get('flag', '')) > 5:
            print(f"\n{'='*70}")
            print(f"SUCCESS! FLAG: {result['flag']}")
            print(f"{'='*70}")
            break
    except Exception as e:
        print(f"  Passcode {pc}: Error - {e}")