1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
// read the flag
function _sparxie_redeem(noncePtr, nonceLen) {
    if (nonceLen !== 32) {
        throw new Error("invalid backstage witness")
    }
    const nonce = HEAPU8.slice(noncePtr, noncePtr + nonceLen);
    let witness = 0;
    for (const byte of nonce) {
        witness = (witness * 257 ^ byte) >>> 0
    }
    let flag = null;
    try {
        flag = require("fs").readFileSync("/flag.txt", "utf8").trim()
    } catch (_) {}
    if (!flag) {
        throw new Error("backstage flag is unavailable")
    }
    out("[Sparxie] The final encore reached backstage.");
    out(flag);
    out("[analytics] backstage witness " + witness.toString(16).padStart(8, "0"))
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
var asmLibraryArg = {
    "__syscall_dup3": ___syscall_dup3,
    "__syscall_fcntl64": ___syscall_fcntl64,
    "__syscall_ioctl": ___syscall_ioctl,
    "__syscall_open": ___syscall_open,
    "_emscripten_throw_longjmp": __emscripten_throw_longjmp,
    "abort": _abort,
    "clock": _clock,
    "emscripten_memcpy_big": _emscripten_memcpy_big,
    "emscripten_resize_heap": _emscripten_resize_heap,
    "fd_close": _fd_close,
    "fd_read": _fd_read,
    "fd_seek": _fd_seek,
    "fd_write": _fd_write,
    "getTempRet0": _getTempRet0,
    "invoke_vii": invoke_vii,
    "setTempRet0": _setTempRet0,
    "sparxie_prepare": _sparxie_prepare,
    "sparxie_redeem": _sparxie_redeem,
    "time": _time
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
var wasmBinaryFile;
wasmBinaryFile = "sparxicle.wasm";
if (!isDataURI(wasmBinaryFile)) {
    wasmBinaryFile = locateFile(wasmBinaryFile)
}

function getBinary(file) {
    try {
        if (file == wasmBinaryFile && wasmBinary) {
            return new Uint8Array(wasmBinary)
        }
        if (readBinary) {
            return readBinary(file)
        } else {
            throw "sync fetching of the wasm failed: you can preload it to Module['wasmBinary'] manually, or emcc.py will do that for you when generating HTML (but not JS)"
        }
    } catch (err) {
        abort(err)
    }
}

function instantiateSync(file, info) {
    var instance;
    var module;
    var binary;
    try {
        binary = getBinary(file);
        module = new WebAssembly.Module(binary);
        instance = new WebAssembly.Instance(module, info)
    } catch (e) {
        var str = e.toString();
        err("failed to compile wasm module: " + str);
        if (str.includes("imported Memory") || str.includes("memory import")) {
            err("Memory size incompatibility issues may be due to changing INITIAL_MEMORY at runtime to something too large. Use ALLOW_MEMORY_GROWTH to allow any size memory (and also make sure not to set INITIAL_MEMORY at runtime to something smaller than it was at compile time).")
        }
        throw e
    }
    return [instance, module]
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
function createWasm() {
    var info = {
        "env": asmLibraryArg,
        "wasi_snapshot_preview1": asmLibraryArg
    };

    function receiveInstance(instance, module) {
        var exports = instance.exports;
        Module["asm"] = exports;
        wasmMemory = Module["asm"]["memory"];
        updateGlobalBufferAndViews(wasmMemory.buffer);
        wasmTable = Module["asm"]["__indirect_function_table"];
        addOnInit(Module["asm"]["__wasm_call_ctors"]);
        removeRunDependency("wasm-instantiate")
    }
    addRunDependency("wasm-instantiate");
    if (Module["instantiateWasm"]) {
        try {
            var exports = Module["instantiateWasm"](info, receiveInstance);
            return exports
        } catch (e) {
            err("Module.instantiateWasm callback failed with error: " + e);
            return false
        }
    }
    var result = instantiateSync(wasmBinaryFile, info);
    receiveInstance(result[0]);
    return Module["asm"]
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
var asm = createWasm();
var ___wasm_call_ctors = Module["___wasm_call_ctors"] = asm["__wasm_call_ctors"];
var ___errno_location = Module["___errno_location"] = asm["__errno_location"];
var _free = Module["_free"] = asm["free"];
var _main = Module["_main"] = asm["main"];
var _malloc = Module["_malloc"] = asm["malloc"];
var ___stdio_exit = Module["___stdio_exit"] = asm["__stdio_exit"];
var ___funcs_on_exit = Module["___funcs_on_exit"] = asm["__funcs_on_exit"];
var _setThrew = Module["_setThrew"] = asm["setThrew"];
var _saveSetjmp = Module["_saveSetjmp"] = asm["saveSetjmp"];
var stackSave = Module["stackSave"] = asm["stackSave"];
var stackRestore = Module["stackRestore"] = asm["stackRestore"];
var stackAlloc = Module["stackAlloc"] = asm["stackAlloc"];
var dynCall_jiji = Module["dynCall_jiji"] = asm["dynCall_jiji"];

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
var calledRun;

function ExitStatus(status) {
    this.name = "ExitStatus";
    this.message = "Program terminated with exit(" + status + ")";
    this.status = status
}
var calledMain = false;
dependenciesFulfilled = function runCaller() {
    if (!calledRun) run();
    if (!calledRun) dependenciesFulfilled = runCaller
};

function callMain(args) {
    var entryFunction = Module["_main"];
    var argc = 0;
    var argv = 0;
    try {
        var ret = entryFunction(argc, argv);
        exit(ret, true);
        return ret
    } catch (e) {
        return handleException(e)
    } finally {
        calledMain = true
    }
}

function run(args) {
    args = args || arguments_;
    if (runDependencies > 0) {
        return
    }
    preRun();
    if (runDependencies > 0) {
        return
    }

    function doRun() {
        if (calledRun) return;
        calledRun = true;
        Module["calledRun"] = true;
        if (ABORT) return;
        initRuntime();
        preMain();
        if (shouldRunNow) callMain(args);
        postRun()
    } {
        doRun()
    }
}
Module["run"] = run;

function exit(status, implicit) {
    EXITSTATUS = status;
    if (keepRuntimeAlive()) {} else {
        exitRuntime()
    }
    procExit(status)
}

function procExit(code) {
    EXITSTATUS = code;
    if (!keepRuntimeAlive()) {
        ABORT = true
    }
    quit_(code, new ExitStatus(code))
}
var shouldRunNow = true;
run();