SAR Grid

A conjugation cipher C = A^-1 M A over 2x2 matrices mod n. The modulus n is composite, so the secret basis A only exists mod one factor, and Gaussian elimination leaks that factor through a non-invertible pivot.

Solve

1. Parse output.json: 511-bit modulus n, five known (M, C) training pairs, eleven flag ciphertext matrices, flag_length = 86.
2. C = A^-1 M A rearranges to the homogeneous linear system A C - M A = 0 in the four entries of A. Five pairs give 20 equations.
3. Eliminating mod n hits a pivot that is not invertible; p = gcd(pivot, n) is a 256-bit prime factor of n. The system is full rank over the other factor, so A exists only mod p. Every 8-byte plaintext chunk is far smaller than p, so working mod p is exact.
4. Solve the null space mod p, pick an invertible kernel vector as A, verify C == A^-1 M A on all five pairs, then decrypt each flag matrix as M = A C A^-1. The plaintext bytes sit in M[0][0] (8 big-endian ASCII bytes per chunk); the other entries are padding.

python3 solve.py

It recovers A, verifies it on all five training pairs mod p, and prints the flag.

Flag: SVIBGR{gr1d_w@s_spl1t_just_l1ke_my_h34rt_wh3n_1_h3ard_fukash1gi_n0_c4rte_1s_3nding_:(}