题目实现了Twisted Hessian Curve上的点加法与标量乘法
参考Crypto CTF 2023 WriteUps | 廢文集中區 (maple3142.net)博客，即可实现从TH curve到Weierstrass型曲线的转换（主要分为曲线方程求解与曲线点映射两步）
然后就是朴素的ecdlp求解，同样利用小子群阶实施 PH+BSGS得到flag
from Crypto.Util.number import *
from sage.all import *
p = 10297529403524403127640670200603184608844065065952536889
a = 2
G = (8879931045098533901543131944615620692971716807984752065, 4106024239449946134453673742202491320614591684229547464)
Q = (6784278627340957151283066249316785477882888190582875173, 6078603759966354224428976716568980670702790051879661797)
sk = 126879961154507942934597133279713552400602
d = ZZ((a*G[0]**3 + G[1]**3 + 1)*inverse(G[0]*G[1], p) % p)
F = GF(p)
x, y, z = QQ["x,y,z"].gens()
eq = a*x ** 3 + y ** 3 + z ** 3 - d * x * y * z
phi = EllipticCurve_from_cubic(eq)
E = phi.codomain().change_ring(F)
fx, fy, fz = map(lambda f: f.change_ring(F), phi.defining_polynomials())
phiP = lambda x, y, z=1: E(fx(x, y, z) / fz(x, y, z), fy(x, y, z) / fz(x, y, z))
EG = phiP(G[0], G[1], 1)
EQ = phiP(Q[0], Q[1], 1)
order = EG.order()
subs = list(factor(order))
sks = list()
mods = list()
print(order, factor(order))
for sub, i in subs[:-1]:
sub = sub**i
A = order//sub * EG
B = order//sub * EQ
sk = discrete_log_lambda(B, A, (0, sub), operation="+")
sks.append(sk)
mods.append(sub)
print(sub, sk)
sk = crt(sks, mods)
print(sk.nbits(), sk)
print(long_to_bytes(int(sk)))
