--- /dev/null
+FROM ubuntu:18.04
+
+RUN apt-get update && dpkg --add-architecture i386 && apt-get -y dist-upgrade && apt-get -y install socat libc6-x32 libc6-i386
+
+COPY bwv2342 /
+COPY flag.txt /
+
+WORKDIR /
+
+#USER ctf
+EXPOSE 1337
+ENTRYPOINT ["socat", "tcp-listen:1337,fork,reuseaddr", "exec:./bwv2342,PTY,stderr,raw,echo=0"]
--- /dev/null
+The binary 'bwv2342' has been compiled with movcc. So static analysis of the binary should be rather difficult but knowing all 88 keys of the keyboard should help.
\ No newline at end of file
--- /dev/null
+hackover18{M0V_70_7h4_w0h173mp3r13r73_Kl4v13r}
--- /dev/null
+#!/usr/bin/env python2
+
+from pwn import *
+import sys
+import string
+
+tone_ord = {'A 0': 0,
+ 'A#0': 1,
+ 'B 0': 2,
+ 'C 1': 3,
+ 'C#1': 4,
+ 'D 1': 5,
+ 'D#1': 6,
+ 'E 1': 7,
+ 'F 1': 8,
+ 'F#1': 9,
+ 'G 1': 10,
+ 'G#1': 11,
+ 'A 1': 12,
+ 'A#1': 13,
+ 'B 1': 14,
+ 'C 2': 15,
+ 'C#2': 16,
+ 'D 2': 17,
+ 'D#2': 18,
+ 'E 2': 19,
+ 'F 2': 20,
+ 'F#2': 21,
+ 'G 2': 22,
+ 'G#2': 23,
+ 'A 2': 24,
+ 'A#2': 25,
+ 'B 2': 26,
+ 'C 3': 27,
+ 'C#3': 28,
+ 'D 3': 29,
+ 'D#3': 30,
+ 'E 3': 31,
+ 'F 3': 32,
+ 'F#3': 33,
+ 'G 3': 34,
+ 'G#3': 35,
+ 'A 3': 36,
+ 'A#3': 37,
+ 'B 3': 38,
+ 'C 4': 39,
+ 'C#4': 40,
+ 'D 4': 41,
+ 'D#4': 42,
+ 'E 4': 43,
+ 'F 4': 44,
+ 'F#4': 45,
+ 'G 4': 46,
+ 'G#4': 47,
+ 'A 4': 48,
+ 'A#4': 49,
+ 'B 4': 50,
+ 'C 5': 51,
+ 'C#5': 52,
+ 'D 5': 53,
+ 'D#5': 54,
+ 'E 5': 55,
+ 'F 5': 56,
+ 'F#5': 57,
+ 'G 5': 58,
+ 'G#5': 59,
+ 'A 5': 60,
+ 'A#5': 61,
+ 'B 5': 62,
+ 'C 6': 63,
+ 'C#6': 64,
+ 'D 6': 65,
+ 'D#6': 66,
+ 'E 6': 67,
+ 'F 6': 68,
+ 'F#6': 69,
+ 'G 6': 70,
+ 'G#6': 71,
+ 'A 6': 72,
+ 'A#6': 73,
+ 'B 6': 74,
+ 'C 7': 75,
+ 'C#7': 76,
+ 'D 7': 77,
+ 'D#7': 78,
+ 'E 7': 79,
+ 'F 7': 80,
+ 'F#7': 81,
+ 'G 7': 82,
+ 'G#7': 83,
+ 'A 7': 84,
+ 'A#7': 85,
+ 'B 7': 86,
+ 'C 8': 87,
+ 'C#0': 88
+ }
+
+if len(sys.argv) != 3:
+ print('Usage: ./solve.py <ip> <port>')
+ sys.exit(1)
+
+ip = sys.argv[1]
+port = sys.argv[2]
+
+p = remote(ip, port)
+#p = process("./bwv2342")
+
+valid_characters = string.ascii_letters + string.digits + string.punctuation
+
+p.eatprompt = lambda: p.recvuntil('Please enter your guess:\n')
+found = []
+done = False
+while not done:
+ for c in valid_characters:
+ tmp = p.eatprompt()
+ test_string = "".join(found) + c
+ p.sendline(test_string)
+ x = p.recvline(False)
+ if tone_ord[x] == len(test_string):
+ found.append(c)
+ print("".join(found))
+ if c == '}':
+ done = True
+ break