#!/usr/bin/env python3
"""
solve_spirit.py - reference solution for "spirit" (Minecraft PCAP forensics).

Path:
  1. reassemble the client->server TCP stream (port 25565)
  2. frame Minecraft packets: VarInt(length) VarInt(id) payload
  3. keep "Use Item On" (0x3f on protocol 772): hand, position(long), face, ...
  4. apply the face offset -> the block that was actually placed
  5. plot the dense Y plane top-down; read it rotated 180

Usage: python3 solve_spirit.py spirit.pcap
"""
import sys
from collections import Counter, defaultdict
from scapy.all import PcapReader, TCP, IP

USE_ITEM_ON = 0x3F
FACE = {0: (0, -1, 0), 1: (0, 1, 0), 2: (0, 0, -1),
        3: (0, 0, 1), 4: (-1, 0, 0), 5: (1, 0, 0)}


def read_varint(buf, i):
    val = 0
    for k in range(5):
        if i >= len(buf):
            return None, i
        b = buf[i]; i += 1
        val |= (b & 0x7F) << (7 * k)
        if not (b & 0x80):
            return val, i
    return None, i


def decode_pos(v):
    """Packed block position: x=26 bits, z=26 bits, y=12 bits."""
    x, z, y = (v >> 38) & 0x3FFFFFF, (v >> 12) & 0x3FFFFFF, v & 0xFFF
    if x >= 1 << 25: x -= 1 << 26
    if z >= 1 << 25: z -= 1 << 26
    if y >= 1 << 11: y -= 1 << 12
    return x, y, z


def reassemble_c2s(pcap):
    """Rebuild every client->server stream. Trim Ethernet padding via IP len."""
    flows = defaultdict(dict)
    with PcapReader(pcap) as pr:
        for pkt in pr:
            if TCP not in pkt or IP not in pkt:
                continue
            ip, t = pkt[IP], pkt[TCP]
            if t.dport != 25565:
                continue
            plen = ip.len - (ip.ihl * 4) - (t.dataofs * 4)
            if plen <= 0:
                continue
            key = (ip.src, t.sport)
            flows[key].setdefault(t.seq, bytes(t.payload)[:plen])
    return {k: b"".join(p for _, p in sorted(v.items())) for k, v in flows.items()}


def frames(blob):
    i = 0
    while i < len(blob):
        ln, j = read_varint(blob, i)
        if ln is None or ln <= 0 or j + ln > len(blob):
            return
        body = blob[j:j + ln]
        pid, k = read_varint(body, 0)
        yield pid, body[k:]
        i = j + ln


def main():
    pcap = sys.argv[1] if len(sys.argv) > 1 else "spirit.pcap"
    streams = reassemble_c2s(pcap)
    blob = max(streams.values(), key=len)          # the play session
    print(f"[+] client->server stream: {len(blob)} bytes")

    placed = []
    for pid, payload in frames(blob):
        if pid != USE_ITEM_ON or len(payload) < 10:
            continue
        p = 0
        hand, p = read_varint(payload, p)
        if hand is None or hand > 1:
            continue
        v = int.from_bytes(payload[p:p + 8], "big"); p += 8
        cx, cy, cz = decode_pos(v)
        face, p = read_varint(payload, p)
        dx, dy, dz = FACE.get(face, (0, 0, 0))
        placed.append((cx + dx, cy + dy, cz + dz))

    print(f"[+] block placements: {len(placed)}")
    uniq = sorted(set(placed))
    plane_y, _ = Counter(y for _, y, _ in uniq).most_common(1)[0]
    pts = {(x, z) for x, y, z in uniq if y == plane_y}
    print(f"[+] flag plane: y={plane_y} ({len(pts)} blocks)")

    # keep only the dense rows (drop stray noise placements)
    cz = Counter(z for _, z in pts)
    rows = sorted(z for z, n in cz.items() if n >= 10)
    pts = {(x, z) for x, z in pts if rows[0] <= z <= rows[-1]}

    xs = sorted({x for x, _ in pts})
    grid = [[('#' if (x, z) in pts else '.') for x in range(min(xs), max(xs) + 1)]
            for z in range(rows[0], rows[-1] + 1)]
    grid = [list(reversed(r)) for r in reversed(grid)]   # rotate 180

    print(f"[+] flag plane spans X {min(xs)}..{max(xs)}, Z {rows[0]}..{rows[-1]}\n")
    for r in grid:
        print("".join(r))


if __name__ == "__main__":
    main()