Day 1

Description

Every year, Santa maintains the legendary Naughty-or-Nice list, and despite the rumors, there’s no magic behind it at all—it’s pure, meticulous byte-level bookkeeping. Your job is to apply every tiny change exactly and confirm the final list matches perfectly—check it once, check it twice, because Santa does not tolerate even a single incorrect byte. At the North Pole, it’s all just static analysis anyway: even a simple objdump | grep naughty goes a long way.

Provided

/challenge/check-list

My Solve

First check what type of file it is, run the binary

$ file /challenge/check-list
/challenge/check-list: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=bec7b06ce41d2387ff43f204bc4e91193111b83a, stripped

Running the binary stops at stdin, providing any input returns

🚫 Wrong: Santa told you to check that list twice!

Naturally , I started decompiling with IDA. but i think the file was too large or something

Decided to go with dynamic analysis with gdb

gef➤  x/30i $rip
=> 0x401000:    mov    rbp,rsp
   0x401003:    sub    rsp,0x500
   0x40100a:    mov    eax,0x0
   0x40100f:    mov    edi,0x0
   0x401014:    lea    rsi,[rbp-0x400]
   0x40101b:    mov    edx,0x400
   0x401020:    syscall
   0x401022:    sub    BYTE PTR [rbp-0x49],0xc0
   0x401026:    add    BYTE PTR [rbp-0x1cb],0xa
   0x40102d:    add    BYTE PTR [rbp-0x1d0],0xb7
   0x401034:    sub    BYTE PTR [rbp-0x1fc],0x60
   0x40103b:    sub    BYTE PTR [rbp-0x58],0xc3
   0x40103f:    sub    BYTE PTR [rbp-0x4b],0x63
   0x401043:    sub    BYTE PTR [rbp-0x3],0xc5
   0x401047:    add    BYTE PTR [rbp-0x3d6],0x4e
   0x40104e:    add    BYTE PTR [rbp-0x11a],0xa7
   0x401055:    sub    BYTE PTR [rbp-0x2b1],0x94
   0x40105c:    sub    BYTE PTR [rbp-0x120],0x5e
   0x401063:    add    BYTE PTR [rbp-0x264],0xe6

Up to 0x400 bytes are read from stdin and stored at [rbp-0x400]. In the next few instructions after the read syscall, these input bytes are manipulated, with random values being added to and subtracted from each byte.

Since there are a lot of these operations, I decided to just check what each byte ends up being compared with after all the add and subtract steps.

$ objdump -d -M intel /challenge/check-list | grep cmp| grep -o ',0x[0-9a-fA-F]\+' |  tr '\n' ' ' > cmp.txt

Extracting these bytes via grep, we have in a python list :

values = [
0x2b,0x8f,0x22,0xaf,0xc7,0x19,0xbc,0x74,0x46,0xc2,0x4f,0x1d,0x30,0x97,0x4e,0xaf,0x73,0xe4,0x22,0xfd,0xb6,0x3e,0x47,0x1f,0xbd,0x63,0x30,0xd2,0xc0,0x2,0x17,0x4d,0xd4,0xf8,0x2b,0x20,0x6b,0x42,0x6d,0x94,0x60,0x35,0xdd,0xbb,0xde,0xba,0xad,0x89,0xde,0xc2,0xc9,0xb4,0xf3,0x16,0x96,0x81,0x59,0xf3,0xbb,0xac,0x7b,0xb2,0xe7,0x9e,0x38,0xf5,0xc0,0x29,0x9d,0xc9,0x42,0xee,0xc5,0x61,0x4f,0xde,0x24,0xc9,0xc6,0xfa,0xe,0xbc,0x55,0xcf,0xe0,0x8b,0x27,0x2b,0x6e,0x1b,0x8f,0xa9,0x92,0x40,0x4b,0x22,0x6d,0xa3,0x60,0x2a,0xa5,0x60,0x3a,0xec,0xf8,0x32,0x6f,0x18,0x6,0xe7,0x1,0x26,0x57,0x35,0x24,0xfa,0xc4,0x12,0xfe,0x5d,0x7d,0xb2,0x2f,0x46,0xa8,0xd,0x4a,0x50,0xd6,0xc0,0x8a,0x27,0xd,0xdb,0x32,0xd8,0xa5,0xd7,0x43,0x64,0x9c,0xda,0xee,0x75,0x5d,0x65,0x12,0x5d,0xe6,0x5c,0x1e,0x7f,0x6b,0x8f,0x6b,0x5a,0xc3,0x77,0xc,0xf3,0xfc,0x85,0x89,0xfc,0xda,0xa5,0xba,0x8a,0x8e,0x16,0xba,0x3b,0x78,0x37,0xfe,0xe6,0xac,0x11,0xc3,0x97,0x75,0x9f,0x7f,0x9a,0xd0,0x55,0x81,0xca,0x4e,0xd1,0xf1,0xb4,0xa9,0x4a,0x16,0x2a,0x9b,0x98,0xcc,0x3f,0x45,0x8a,0xa0,0x6a,0x16,0x5e,0x9,0x7f,0x5d,0xdb,0x84,0xa2,0x49,0x10,0x73,0xc4,0xa4,0xe,0xbc,0x0,0x53,0x8,0x9c,0xb2,0x6e,0xbe,0x27,0x9,0x53,0x51,0xa2,0x9d,0x2b,0xe2,0xa1,0xb1,0x4e,0xd6,0x5f,0x56,0x72,0x8f,0x1b,0x10,0x17,0xdd,0x2e,0xe8,0x42,0x55,0x84,0x58,0x98,0x2d,0x76,0xa8,0xf8,0x92,0x90,0x6d,0x11,0xd9,0x28,0xcc,0x85,0x65,0x8a,0x7c,0x71,0x6b,0x13,0xd,0xd6,0xda,0xa4,0x22,0x5b,0xa7,0x7b,0xdc,0xf8,0xd2,0xeb,0x1,0xd,0xdf,0x26,0x37,0x12,0xba,0x2a,0x81,0xb7,0x56,0x2d,0xe,0x89,0x1,0x7,0xfd,0x2d,0xfa,0xe9,0x62,0xf6,0x6d,0x9e,0x20,0x43,0xef,0x9d,0x78,0x7,0x63,0x36,0xc7,0x1e,0x17,0xd0,0x18,0xd8,0xf5,0x96,0xaa,0x21,0xb8,0x66,0x23,0xeb,0x8a,0x5a,0xf6,0xdf,0x12,0xe2,0xac,0x84,0x84,0x21,0x58,0x29,0xc0,0xd1,0xd4,0x3c,0x6c,0xcd,0xad,0x5b,0xcf,0xc8,0xda,0x28,0xff,0x8,0xc3,0x2,0x29,0x91,0x46,0x56,0xdd,0x94,0x76,0x8e,0x67,0x6,0x41,0x88,0xf2,0x83,0x4b,0x6c,0xf7,0x30,0x73,0xaf,0x99,0x20,0x56,0xe6,0xf3,0xa7,0xb2,0xc8,0x57,0x63,0xb3,0x0,0xe8,0xeb,0x91,0xce,0x1c,0x86,0x9a,0x61,0x57,0xc0,0x6a,0x87,0xc0,0x43,0xb,0x85,0xc3,0xf4,0x4d,0x1e,0x87,0xf4,0x6c,0xd3,0x4b,0xeb,0xa8,0xfb,0xbe,0x1e,0x7,0xee,0xf1,0xea,0x98,0xbf,0xa,0x62,0xff,0x8e,0xfd,0x18,0xba,0x47,0x4a,0x31,0xd0,0x8,0x7d,0x1b,0xf0,0x91,0x4c,0x67,0xd2,0x96,0x9e,0x20,0x5e,0x18,0xd4,0xb8,0xdd,0xef,0xaf,0x78,0x61,0x19,0x26,0x4a,0x8f,0x91,0xb0,0x95,0x79,0xcf,0xc,0xd2,0xb0,0xec,0x21,0x70,0x88,0x67,0xd3,0x19,0x12,0xa9,0xa8,0xef,0xa,0x90,0x56,0x2b,0xdc,0xa9,0x49,0x11,0xa5,0x4d,0x5f,0xdd,0x5a,0xd1,0x49,0xcf,0x48,0xc5,0x4d,0x66,0xc5,0x7a,0xdf,0x16,0xb0,0xfe,0x8c,0x1b,0x75,0x11,0xcc,0x68,0x59,0x47,0x62,0x51,0xf8,0x1f,0x1e,0xb5,0xc5,0xa4,0xb5,0x9f,0x6c,0xf0,0xbc,0x9c,0x46,0x7f,0x41,0x8a,0x42,0xb1,0x1,0x27,0x1,0x63,0xce,0x2d,0x2e,0x3e,0x2f,0x60,0x14,0x73,0x26,0x37,0xa5,0x2c,0xda,0x1,0xb9,0x72,0x8b,0x6a,0x4d,0x86,0xef,0x92,0xf3,0xe9,0xfb,0x5d,0x52,0xae,0xc,0xd3,0xd6,0xc3,0x71,0x2c,0xd7,0xbb,0x95,0x1e,0x2e,0x28,0x11,0x45,0xbf,0xf3,0x4,0xa7,0xa3,0xc8,0x40,0x92,0xa7,0x6d,0x10,0x9a,0x8f,0x8a,0x17,0x1d,0x75,0x1a,0x32,0x44,0x92,0xeb,0x76,0x3,0x8d,0xf3,0x86,0x32,0xee,0x47,0x1,0x54,0x56,0x9a,0xc7,0x95,0xe2,0xbd,0xff,0x83,0xe8,0x96,0xf2,0xac,0xe9,0x68,0x63,0x7c,0xd6,0xd2,0x42,0x3d,0xfe,0xd1,0x23,0x42,0x45,0x94,0xef,0xd3,0xe4,0x86,0x9,0x99,0xe7,0x25,0xf3,0x5b,0x28,0xdf,0x85,0x97,0xb3,0xd6,0xd5,0x9f,0xec,0x6f,0x1,0xf7,0x4,0xb5,0x1c,0x79,0xca,0xda,0x4a,0xd9,0xe8,0x66,0xb1,0xa3,0x5e,0x84,0x4f,0xee,0xbf,0xc6,0xad,0xcd,0x39,0x27,0x8c,0xaa,0x9c,0xae,0xc0,0xac,0x31,0x5e,0xb5,0xa8,0x27,0x7f,0x98,0x9c,0x5c,0x14,0xcb,0x12,0x93,0xd5,0xa5,0xa,0x60,0x29,0x7f,0xf,0x5f,0xb3,0x14,0xa7,0xc1,0x7c,0x39,0x9d,0x39,0xb3,0x4,0x1d,0xad,0x78,0xce,0xe2,0xab,0x4f,0x4,0xe7,0xe2,0x89,0x70,0x78,0xfd,0xc8,0x70,0x7,0x9c,0x3f,0x5a,0x9b,0x12,0xaf,0xc9,0x0,0x56,0xf7,0xc9,0x80,0xe7,0x5f,0xe9,0x95,0xa4,0x30,0x78,0xbe,0xc1,0x47,0x38,0x5a,0x4d,0x66,0x24,0xee,0xef,0x45,0x9,0x22,0xf6,0x9e,0x8d,0xf4,0xa1,0x64,0xa6,0x72,0xd7,0x3a,0x70,0x77,0x0,0xb5,0xba,0xff,0xda,0xc,0x56,0x4d,0xca,0x2,0x9a,0x8c,0x7a,0x1a,0x1c,0x7e,0x1d,0xe2,0xde,0x4d,0x7b,0x50,0x42,0x2,0xb5,0xe7,0xd6,0xd7,0x22,0x27,0xc5,0x56,0xae,0x59,0x96,0xc0,0x8b,0x90,0x52,0x46,0x63,0xaf,0x84,0xc9,0x9b,0xf2,0xa,0xf,0xfe,0xb3,0x6b,0x79,0x3c,0x75,0x7b,0xc8,0x37,0x87,0x7f,0x2d,0x91,0xa3,0xb6,0x70,0xb3,0xfe,0x1,0x49,0x7e,0x44,0x70,0x3f,0x44,0xe7,0xcb,0x2,0x97,0x30,0xda,0x7d,0xb4,0xa8,0x2a,0x8f,0x9d,0xef,0xcf,0xb9,0x8c,0x56,0xce,0x34,0x70,0xb8,0x21,0x43,0x92,0x3,0x6d,0xc2,0xb7,0x72,0x27,0xb5,0x46,0xdb,0x28,0xda,0x6b,0xcc,0x69,0xe2,0x30,0x16,0x1e,0xc6,0xb5,0x7e,0x98,0xf0,0x40,0x9,0x46,0x82,0xfa,0xc3,0x62,0xaf,0x6a,0xd7,0x4f,0x6e,0x1f,0x2b,0x2e,0xe4,0x31,0x2f,0xad,0xb8,0x45,0x75,0x75,0x50,0xb1,0x3b,0x46,0xe2,0x7c,0x40,0xd6,0x8,0x11,0x69,0x43,0x31,0xdc,0xa4,0x55,0x58,0x83,0x9,0xb4,0xd2,0xf3,0x7,0x7a,0x30,0xfb,0xd2,0xd3,0x91,0xc6,0x82,0xa9,0x38,0xa1,0xf4,0xd1,0x76,0x9,0xa0,0xb3,0xae,0xb6,0x46,0xaa,0x2f,0x9b,0x7e,0x92,0x3a,0xee,0x25,0xba,0xf7,0xb0,0x4e,0xa4,0xad,0x3f,0x96,0x97,0x12,0xf5,0x84,0x98,0xc5,0x42,0xd7,0xdc,0xa0,0x8a,0x55,0xbb,0x7b,0x82,0x5f,0x7d,0x55,0x45,0xd9,0xc0,0x6e,0xe4,0x4c,0x9,0x8f,0xca,0x38,0xb,0xdb,0x0,0x65,0x53,0xaf,0x7c,0x3c,0xc1,0x74,0xd4,0x7e,0x9,0xab,0x29
]

I decided to send 0x400 bytes 0xff via stdin, so that after the addition and subtraction operation is done , i can have the resulting bytes before the compare instructions , this way, i can know how to adjust my input so it ends up as the bytes i wxtracted above

from pwn import *


context.update(arch="amd64") 


path =  '/challenge/check-list'


gdbscript = """
set logging file dump.txt
break *0xaa1454

commands 1
    set $start = $rbp - 1
    set $end = $rbp - 0x400
    set $size = $end - $start
    set $i = 0
    set logging on
    printf "DumpStart\\n"

    while ($i <= 0x400)
        printf "0x%x,", *(unsigned char*)($end + $i)
        set $i = $i + 1
    end
    printf "\\nDumpEnd\\n"
    set logging off
end

continue
"""


initial_values =  [0xff] * 0x400

p = gdb.debug(path, gdbscript=gdbscript, api=True)
p.send(initial_values)

The resulting bytes are dumped in dump.txt file, putting that in a list

ola_val = [0xf1,0xfb,0xa0,0xbb,0x93,0x8a,0x40,0xa0,0x74,0xb4,0x22,0xc1,0xae,0x6f,0xf8,0x3e,0xa6,0xf4,0x1a,0x4a,0xe0,0x6,0x9c,0x79,0x12,0xa,0x53,0x23,0x6e,0xdb,0x76,0xb1,0x2,0x60,0xd9,0x47,0xa2,0xbd,0x45,0xa0,0xca,0xe7,0x3b,0x8,0x74,0x1c,0xf4,0x8,0xaa,0x28,0x58,0x54,0xd8,0xe,0x1a,0x5c,0xee,0xa4,0x55,0x77,0xd8,0xfc,0xaf,0x42,0x3,0x10,0x46,0x3b,0xd7,0xc8,0x67,0x38,0xc,0x25,0x89,0xf3,0xe7,0x82,0x6d,0x6f,0xd9,0xf3,0x61,0x43,0x8d,0x95,0x15,0xe4,0x2a,0xb8,0x40,0x80,0x44,0x6b,0x6c,0x1,0xe2,0x18,0xd8,0x7,0x21,0x8f,0x63,0x6a,0x3a,0x92,0x59,0xcc,0x5e,0xf7,0x20,0x13,0x4,0x3e,0x1b,0x5b,0xb0,0x2b,0x7e,0xbf,0x7,0xa2,0x87,0x62,0x5b,0xb6,0xa4,0xdc,0x7,0x5,0x5e,0x83,0x74,0x84,0xfd,0x1,0xec,0x0,0x2a,0xde,0xc9,0xdd,0xda,0xb5,0x67,0x8c,0xfb,0x60,0x84,0xac,0xdb,0x4b,0xd9,0x9b,0x43,0xb8,0x8e,0x98,0xd7,0x63,0x6e,0x5b,0x91,0x31,0x5a,0xca,0x21,0x37,0x6a,0x57,0xf1,0x20,0x56,0x82,0x64,0x23,0x1a,0x3a,0x67,0x8a,0x9a,0x7e,0x5b,0xde,0x7a,0x83,0xd2,0xe5,0x2c,0x21,0xac,0x98,0xeb,0x97,0xf2,0xec,0x6a,0x21,0x48,0x2,0x59,0x2b,0xd2,0x39,0x50,0xbc,0x0,0x3b,0x96,0xa5,0xad,0xdf,0x83,0xe5,0x8f,0x27,0xac,0x66,0xde,0x20,0x30,0xd,0xd8,0x85,0xff,0x57,0x65,0x58,0x1a,0x72,0x96,0x43,0xfb,0x25,0xe1,0x54,0x7b,0x84,0xcf,0xd6,0x8d,0xf5,0x60,0xb8,0xc2,0x38,0x94,0xaa,0x6d,0xd3,0x67,0x29,0x33,0xd9,0x72,0x70,0xde,0xf,0x3b,0x7f,0xa8,0xa1,0xb,0x7d,0x65,0xbc,0x69,0xc6,0x87,0x5b,0xa2,0x93,0xaa,0x5c,0x47,0x20,0xda,0x8d,0x1f,0xa,0x45,0x6a,0xa4,0x61,0xe7,0xa,0xec,0xf4,0x4e,0x7f,0x20,0x7d,0x4b,0x93,0x95,0xef,0x65,0xd3,0xb4,0xa3,0x95,0x13,0xd9,0xe6,0x64,0xb9,0xa3,0xed,0x5a,0xc6,0x82,0xf8,0xf8,0x4f,0xd5,0xb,0xee,0xd5,0x57,0x9c,0xc9,0xcf,0x3c,0xc1,0x32,0x4d,0xb2,0x90,0x29,0x8,0x1a,0x89,0x6c,0x35,0xc1,0x2,0x6c,0xab,0xb2,0x30,0xff,0xa4,0x30,0xc6,0xbf,0xac,0x2e,0xea,0x7a,0xf2,0x16,0xea,0xbb,0x64,0x75,0x4,0x8b,0xb,0x16,0x6d,0x3b,0xb0,0x11,0xc4,0x8f,0x90,0xd2,0x97,0x1a,0x76,0x6e,0x45,0xf7,0x7,0xe,0x72,0xa5,0x84,0x8,0x5d,0x93,0xce,0xf1,0x2b,0xa5,0xc9,0x3a,0x8c,0x1f,0xd,0xb,0x4d,0xe6,0x28,0x4b,0x4,0xc1,0x8d,0x84,0x93,0xf4,0x86,0xef,0xce,0x98,0xd1,0xac,0x89,0xb3,0xba,0x49,0x85,0x5,0xd,0x51,0x42,0x85,0x8c,0x57,0x27,0x98,0x82,0xf7,0x3d,0x8f,0xc4,0x7b,0x6c,0xed,0x8e,0x1c,0xcf,0xc,0x59,0x72,0xf3,0x84,0xfb,0x9c,0x6c,0xfc,0xa7,0x2e,0x7,0xff,0xed,0x42,0x2a,0x8b,0xbb,0xe0,0xe3,0x42,0xcc,0x90,0x95,0xac,0xef,0x5d,0xba,0xb3,0xff,0xc2,0xfe,0x7b,0x58,0xd5,0x43,0xd7,0xde,0x7d,0xea,0x6,0xea,0xb0,0x53,0x98,0x4a,0x3a,0xb4,0x78,0x42,0x8f,0xb1,0x5c,0x52,0x80,0x92,0x2,0x5c,0x1f,0x26,0xbe,0xa6,0x21,0xcd,0x82,0x69,0xe8,0x8d,0x68,0xaf,0x3d,0xe0,0x77,0xcc,0xf4,0xe9,0xf2,0xa6,0x1e,0xde,0xfd,0xdb,0x44,0x9a,0x9a,0x2d,0x86,0xb5,0x14,0x33,0xbe,0x34,0x63,0x4d,0x6e,0xa0,0x8,0x31,0x41,0xe1,0x1f,0xc8,0xa3,0x14,0xb5,0x9e,0xc7,0xe9,0x56,0x6e,0x9,0x8f,0xed,0x3f,0xbe,0xe5,0xbb,0x9,0x50,0x26,0x4,0xc6,0x2c,0xc9,0xf8,0x48,0xd,0x20,0x12,0xda,0xb1,0x54,0x6a,0x3f,0xd8,0xa8,0x81,0x9a,0xa,0x25,0x38,0xfd,0x94,0x92,0xf,0x6e,0xa3,0xce,0x6c,0x61,0x86,0xb2,0x14,0x18,0xf3,0x5c,0x7b,0x52,0x22,0xd2,0xcb,0x26,0xd0,0xc5,0x79,0x13,0xa0,0xff,0x9b,0x92,0x39,0x53,0x4a,0x40,0x8,0x9b,0x55,0x99,0x23,0xb0,0x64,0x9e,0x4e,0x39,0x8,0xf6,0xe9,0x14,0xa0,0x21,0x5c,0x4d,0xa5,0x4d,0x3c,0x82,0xb5,0xad,0xd6,0x8,0x76,0x58,0xaf,0xbd,0xc0,0x1b,0x14,0xc,0xa5,0xfd,0x21,0x94,0x27,0xe2,0xda,0xd4,0x66,0x24,0x3e,0x7,0x2e,0x5f,0x7b,0x65,0x73,0x91,0xc,0xc8,0x61,0xa0,0xc2,0x6c,0xd6,0x5,0x5f,0x8a,0x88,0x78,0xdd,0x32,0x3d,0xba,0x5b,0x90,0x52,0x1a,0xc7,0x88,0x3a,0x7e,0x4,0xb9,0xd6,0x7,0x7d,0x4c,0x76,0x97,0x5a,0x84,0x2,0xec,0x1,0xc8,0x31,0x5f,0x4d,0xb1,0x9,0xd0,0xde,0xbf,0x70,0xa,0xfd,0x28,0xec,0xfb,0xcd,0xe4,0x75,0xf3,0x2b,0xec,0x39,0xa6,0xbf,0xb0,0xe8,0xf1,0x6,0xc4,0x3f,0x74,0xb5,0x5,0x59,0x24,0xaf,0xf0,0x9e,0xb6,0xb9,0x9a,0x6c,0x75,0xc4,0x88,0xf6,0x33,0x2d,0xf4,0x5,0x12,0xbc,0xa9,0xab,0xba,0x9d,0x41,0x36,0x4f,0xfa,0x5,0x2c,0xc9,0x56,0x2f,0x98,0x70,0x92,0xfe,0xa,0xe2,0xab,0x6f,0x14,0xd0,0x7f,0xb7,0xb6,0x52,0xb3,0xf1,0x10,0x51,0xba,0xb0,0xc3,0x8,0x1b,0x6b,0x3b,0x1f,0x8e,0x82,0xc4,0x56,0x7d,0xda,0x26,0xdd,0xfa,0x27,0xf3,0xa6,0xa1,0xe4,0xf9,0xa6,0x4c,0x94,0x35,0x4d,0xad,0x36,0xd8,0x2d,0xe4,0xbb,0x9c,0x37,0x1d,0x14,0xd3,0x32,0xf2,0x15,0x33,0x6c,0x7c,0x76,0xc,0xdb,0x15,0xb3,0x32,0x52,0x85,0xb0,0x26,0xb1,0x0,0x82,0xc7,0x1b,0x4e,0x2c,0x2d,0xe1,0x2,0x5,0x11,0x7a,0x33,0xe,0x2,0x3c,0xd,0x3b,0x3a,0xe4,0x26,0x94,0x60,0x2c,0x4d,0xfa,0x47,0xec,0xc3,0x68,0xdf,0xb7,0x7d,0xb9,0x6d,0x90,0xf2,0x52,0x56,0x94,0x3b,0x8c,0x51,0x12,0xcc,0x4c,0x8b,0x66,0x6c,0x9a,0xd2,0x6b,0x43,0xb1,0xe,0x85,0x99,0xbf,0xba,0xd0,0x18,0x1c,0x1e,0xf6,0x57,0xfc,0x43,0x78,0x72,0x56,0xaa,0x25,0x85,0x5d,0xb9,0xbb,0xb7,0xc8,0x59,0xc9,0xe7,0x44,0xc8,0xe0,0x37,0x56,0xb9,0xde,0xe8,0x4b,0xa9,0xf9,0xa4,0xae,0xee,0x40,0x2b,0x0,0x8c,0xea,0xb9,0x21,0x84,0xdd,0x79,0xb9,0xd5,0x4e,0x1b,0xb8,0xf3,0x52,0xc3,0x34,0x82,0x5,0x16,0xfc,0xff,0x95,0xb,0x46,0x5b,0xb8,0xe9,0x74,0x8e,0xeb,0x4c,0xde,0x38,0xb6,0x68,0x6d,0x89,0x4e,0x97,0x66,0x5,0x36,0x1a,0x3c,0xc7,0x2c,0x81,0x67,0xba,0xa9,0xd7,0x1d,0xff,0x21,0xa3,0x4e,0xaf,0xd4,0x26,0xa7,0xfc,0xbc,0x48,0xe,0xbc,0x6c,0xd4,0xbb,0xfd,0x5b,0x5b,0xa8,0x69,0xb4,0x9c,0x49,0x1c,0xf,0x61,0xad,0x8b,0x12,0xdc,0x92,0xf,0xb7,0x8d,0x3,0x9,0x3a,0x63,0x4,0x1,
]

I can calculate the values needed to be send such that after the operations we end up with the values compared with

result = []
for i in range((0x400)):
    result.append(((values[i] + (0xff - ola_val[i])) & 0xff))

Finally

payload = bytes(result)

p = process(path)

p.send(payload)