tl;dr:

- use homomorphic property to get `ct_mod` such that `decrypt(ct_mod) == pt + x`
- recover low bits by observing overflows in bit 512 when adding `1` to lower bits
- use homomorphic property to get `ct_mod` such that `decrypt(ct_mod) == pt/2` for even `pt`
- subtract all low bits from `pt` (add `n-low`) to get even number
- recover high bits by dividing `pt` by 2

Full writeup: https://github.com/p4-team/ctf/tree/master/2017-09-02-tokyo/crypto_pinhole

Original writeup (https://github.com/p4-team/ctf/tree/master/2017-09-02-tokyo/crypto_pinhole).