Rating:

Transform the private key recovery problem into EHNP and use EHNP solver to calculate the private key

Original writeup (https://s3v3ru5.github.io/notes/tsgctf2021#flagiswin).