Rating: 5.0

Firstly, we got a python script which is confused:

```python
import cv2 as a
import soundfile as b
import random as c
import numpy as d
from tqdm import tqdm as e
import os as f
import binascii as z

g, h = a.imread("pls-no.jpg"), b.SoundFile("oh-gawd-plsno.wav", 'r')
i, j = g.shape[0], 0
k=d.zeros((i*i,2), dtype=d.float64)
l, m = e(total=i*i), h.read()
l.set_description(" nuKiNG")
h.close()
u=True

t = b'9\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
v = b'@\xe4\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

for n in range(0,i):
for o in range(0,i):
if u == True:

p, q, r = g[n][o][0], g[n][o][1], g[n][o][2]; p, q, r = str(p), str(q), str(r)
# me me me
while len(p) < 3:
p="0"+p
while len(q) < 3:
q="0"+q
while len(r) < 3:
r="0"+r#eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
result = p+q+r
for w in range(0, j+1):
x=z.b2a_uu(t); y=z.b2a_uu(v)
t = z.a2b_uu("0.00")
# ww
v = z.a2b_uu("-0.00")
s=c.randint(0,1)
if s == 0: k[j]=(m[j][0]*2,float(x.decode()[:-2].strip(" ")+result))
if s == 1: k[j]=(m[j][0]*2,float(y.decode()[:-2].strip(" ")+result))
j+=1
#b
l.update(1)

#wow 0 then
b.write('out.wav', k, 44100, 'FLOAT')
```

After a short analysis, seems that it conbined a `wav` file and a `jpg` file, and write the result into a new `wav` file:

```python
import cv2
import soundfile
import random
import numpy

h = soundfile.SoundFile("oh-gawd-plsno.wav", 'r')
sf = h.read()
h.close()

pic = cv2.imread("pls-no.jpg")
i = pic.shape[0]
j = 0
k = numpy.zeros((i*i, 2), dtype=numpy.float64)

for n in range(0, i):
for o in range(0, i):
r = str(pic[n][o][0])
g = str(pic[n][o][1])
b = str(pic[n][o][2])
while len(r) < 3:
r = "0" + r
while len(g) < 3:
g = "0" + g
while len(b) < 3:
b = "0" + b
result = r + g + b
s = random.randint(0, 1)
if s == 0:
k[j] = (sf[j][0]*2, float('0.00' + result))
if s == 1:
k[j] = (sf[j][0]*2, float('-0.00' + result))
j += 1

soundfile.write('out.wav', k, 44100, 'FLOAT')
```

And now we can confirm that there is a `jpg` file hidden in `aaaaaaaaaaaaaaaaaa.wav`. All we need to do is to reverse the code and to get the original `jpg` file:

```python
#!/usr/bin/env python
import soundfile
import cv2
import numpy

h = soundfile.SoundFile('aaaaaaaaaaaaaaaaaa.wav', 'r')
sf = h.read()
h.close()

l = 500
pic = numpy.zeros((l, l, 3), dtype=numpy.uint8)
for i in range(l):
for j in range(l):
count = i * l + j
result = str(sf[count][1])
if result.startswith('-'):
result = result[1:]
result = result[4:13]
#print str(count), result
r = int(result[0:3].zfill(3))
g = int(result[3:6].zfill(3))
b = int(result[6:9].zfill(3))
pic[i][j][0] = r
pic[i][j][1] = g
pic[i][j][2] = b
cv2.imwrite('res.jpg', pic)
```

Here is the flag:

![](https://raw.githubusercontent.com/qianfei11/writeups/master/2020-riceteacatpanda/screams%20(1500)/res.jpg)