feat(q-solved): add first q-solved writeup

Signed-off-by: Julien CLEMENT <julien.clement@epita.fr>

jujure/static/q-solved/circuit.json

@@ -0,0 +1 @@
+{"memory": 560, "ancilla": 1408, "circuit": [[[false, 0]], [[true, 0], [false, 8], [false, 280]], [[false, 0], [true, 8], [false, 280]], [[true, 280], [false, 0], [false, 8]], [[true, 0], [true, 8], [true, 280]], [[false, 280]], [[false, 19], [false, 11], [false, 281]], [[true, 11], [true, 19], [false, 281]], [[false, 19], [true, 11], [true, 281]], [[false, 11], [true, 19], [true, 281]], [[false, 281]], [[false, 18], [false, 26], [false, 282]], [[true, 18], [true, 26], [false, 282]], [[true, 18], [false, 26], [true, 282]], [[false, 18], [true, 26], [true, 282]], [[false, 282]], [[false, 25], [false, 33], [false, 283]], [[true, 25], [true, 33], [false, 283]], [[true, 25], [false, 33], [true, 283]], [[false, 25], [true, 33], [true, 283]], [[false, 283]], [[false, 32], [false, 40], [false, 284]], [[true, 32], [true, 40], [false, 284]], [[true, 32], [false, 40], [true, 284]], [[false, 32], [true, 40], [true, 284]], [[false, 284]], [[true, 40], [false, 48], [false, 285]], [[true, 48], [false, 40], [false, 285]], [[true, 285], [false, 40], [false, 48]], [[true, 40], [true, 48], [true, 285]], [[false, 285]], [[false, 50], [false, 58], [false, 286]], [[true, 50], [true, 58], [false, 286]], [[true, 50], [false, 58], [true, 286]], [[false, 50], [true, 58], [true, 286]], [[false, 286]], [[false, 57], [false, 65], [false, 287]], [[true, 57], [true, 65], [false, 287]], [[true, 57], [false, 65], [true, 287]], [[true, 65], [false, 57], [true, 287]], [[false, 287]], [[false, 68], [false, 76], [false, 288]], [[true, 68], [true, 76], [false, 288]], [[true, 68], [false, 76], [true, 288]], [[false, 68], [true, 76], [true, 288]], [[false, 288]], [[false, 73], [false, 81], [false, 289]], [[true, 73], [true, 81], [false, 289]], [[true, 73], [false, 81], [true, 289]], [[false, 73], [true, 81], [true, 289]], [[false, 289]], [[false, 88], [false, 80], [false, 290]], [[true, 80], [true, 88], [false, 290]], [[false, 88], [true, 80], [true, 290]], [[false, 80], [true, 88], [true, 290]], [[false, 290]], [[false, 88], [false, 96], [false, 291]], [[true, 88], [true, 96], [false, 291]], [[true, 88], [false, 96], [true, 291]], [[false, 88], [true, 96], [true, 291]], [[false, 291]], [[false, 97], [false, 105], [false, 292]], [[true, 97], [true, 105], [false, 292]], [[true, 97], [false, 105], [true, 292]], [[false, 97], [true, 105], [true, 292]], [[false, 292]], [[false, 106], [false, 114], [false, 293]], [[true, 106], [true, 114], [false, 293]], [[true, 106], [false, 114], [true, 293]], [[false, 106], [true, 114], [true, 293]], [[false, 293]], [[false, 112], [false, 120], [false, 294]], [[true, 112], [true, 120], [false, 294]], [[true, 112], [false, 120], [true, 294]], [[false, 112], [true, 120], [true, 294]], [[false, 294]], [[false, 122], [false, 130], [false, 295]], [[true, 122], [true, 130], [false, 295]], [[true, 122], [false, 130], [true, 295]], [[false, 122], [true, 130], [true, 295]], [[false, 295]], [[false, 129], [false, 137], [false, 296]], [[true, 129], [true, 137], [false, 296]], [[true, 129], [false, 137], [true, 296]], [[false, 129], [true, 137], [true, 296]], [[false, 296]], [[false, 139], [false, 147], [false, 297]], [[true, 139], [true, 147], [false, 297]], [[true, 139], [false, 147], [true, 297]], [[false, 139], [true, 147], [true, 297]], [[false, 297]], [[false, 144], [false, 152], [false, 298]], [[true, 144], [true, 152], [false, 298]], [[true, 144], [false, 152], [true, 298]], [[false, 144], [true, 152], [true, 298]], [[false, 298]], [[false, 161], [false, 153], [false, 299]], [[true, 153], [true, 161], [false, 299]], [[false, 161], [true, 153], [true, 299]], [[false, 153], [true, 161], [true, 299]], [[false, 299]], [[false, 161], [false, 169], [false, 300]], [[true, 161], [true, 169], [false, 300]], [[true, 161], [false, 169], [true, 300]], [[false, 161], [true, 169], [true, 300]], [[false, 300]], [[false, 169], [false, 177], [false, 301]], [[true, 169], [true, 177], [false, 301]], [[true, 169], [false, 177], [true, 301]], [[false, 169], [true, 177], [true, 301]], [[false, 301]], [[false, 179], [false, 187], [false, 302]], [[true, 179], [true, 187], [false, 302]], [[true, 179], [false, 187], [true, 302]], [[false, 179], [true, 187], [true, 302]], [[false, 302]], [[false, 185], [false, 193], [false, 303]], [[true, 185], [true, 193], [false, 303]], [[true, 185], [false, 193], [true, 303]], [[false, 185], [true, 193], [true, 303]], [[false, 303]], [[false, 194], [false, 202], [false, 304]], [[true, 194], [true, 202], [false, 304]], [[true, 194], [false, 202], [true, 304]], [[false, 194], [true, 202], [true, 304]], [[false, 304]], [[false, 210], [false, 202], [false, 305]], [[true, 202], [true, 210], [false, 305]], [[false, 210], [true, 202], [true, 305]], [[false, 202], [true, 210], [true, 305]], [[false, 305]], [[false, 210], [false, 218], [false, 306]], [[true, 210], [true, 218], [false, 306]], [[true, 210], [false, 218], [true, 306]], [[false, 210], [true, 218], [true, 306]], [[false, 306]], [[false, 227], [false, 219Line truncated

jujure/static/q-solved/flag.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+import json
+from z3 import *
+
+with open('circuit.json', 'r') as f:
+    j = json.load(f)
+
+nq = j['memory']
+
+system = [Bool(str(i)) for i in range(nq)]
+
+s = Solver()
+
+for cs in j['circuit']:
+    term = Or()
+    for c in cs:
+        term = Or(term, system[c[1]] == c[0])
+    s.add(term)
+
+print(s)
+print(s.check())
+
+m = s.model()
+
+result_arr = [''] * nq
+
+for d in m.decls():
+    result_arr[int(d.name())] = '1' if m[d] else '0'
+
+result_arr.reverse()
+result = "".join(result_arr)
+
+print(int.to_bytes(int(result, 2), nq//8, 'little'))

jujure/static/q-solved/poc_flag.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+import json
+
+with open('circuit.json', 'r') as f:
+    j = json.load(f)
+
+nq = j['memory']
+
+system = ['0'] * nq
+
+for cs in j['circuit']:
+    if len(cs) == 1:
+        system[cs[0][1]] = '1' if cs[0][0] else '0'
+
+
+system.reverse()
+result = "".join(system)
+
+print(int.to_bytes(int(result, 2), nq//8, 'little'))

jujure/static/q-solved/solve.py

@@ -0,0 +1,56 @@
+import gmpy2
+from qiskit import QuantumCircuit, execute, Aer
+from qiskit.circuit.library import XGate
+import json
+
+with open("circuit.json", "r") as f:
+    circ = json.load(f)
+
+nq = circ['memory']
+na = circ['ancilla']
+target = nq + na
+
+print("[+] Constructing circuit...")
+main = QuantumCircuit(nq + na + 1, nq)
+sub = QuantumCircuit(nq + na + 1)
+
+main.x(target)
+main.h(target)
+for i in range(circ['memory']):
+    main.h(i)
+
+t = circ['memory']
+for cs in circ['circuit']:
+    ctrl = ''.join(['0' if x else '1' for (x, _) in cs])
+    l = [c for (_, c) in cs]
+    sub.append(XGate().control(len(cs), ctrl_state=ctrl), l + [t])
+    t += 1
+
+sub.append(XGate().control(na, ctrl_state='0'*na),
+           [i for i in range(nq, nq + na)] + [target])
+
+for cs in circ['circuit'][::-1]:
+    t -= 1
+    ctrl = ''.join(['0' if x else '1' for (x, _) in cs])
+    l = [c for (_, c) in cs]
+    sub.append(XGate().control(len(cs), ctrl_state=ctrl), l + [t])
+
+sub.h([i for i in range(nq)])
+sub.append(XGate().control(nq, ctrl_state='0'*nq),
+           [i for i in range(nq)] + [target])
+sub.h([i for i in range(nq)])
+
+for i in range(round(0.785 * int(gmpy2.isqrt(2**nq)) - 0.5)):
+    main.append(sub, [i for i in range(na + nq + 1)])
+
+for i in range(nq):
+    main.measure(i, i)
+
+print("[+] Calculating flag...")
+emulator = Aer.get_backend('qasm_simulator')
+job = execute(main, emulator, shots=1024)
+hist = job.result().get_counts()
+result = sorted(hist.items(), key=lambda x: -x[1])[0][0]
+
+print("[+] FLAG:")
+print(int.to_bytes(int(result, 2), nq//8, 'little'))