Khavid

(EN) PatriotCTF 2025 - Reverse

Sat, 22 Nov 2025 00:00:00 GMT

Space Pirates

...

#define FLAG_LEN 30
const uint8_t TARGET[FLAG_LEN] = {...};

// The pirate's rotating XOR key
const uint8_t XOR_KEY[5] = {0x42, 0x73, 0x21, 0x69, 0x37};

// The magic addition constant
const uint8_t MAGIC_ADD = 0x2A;
// PCTF{0x_M4rks_tH3_sp0t_M4t3y}

...

Yea, they wrote the right flag inside the file, how hilarious it is.

Flag: :spoiler[pctf{0x_M4rks_tH3_sp0t_M4t3y}]

Are You Pylingual?

We're giving .pyc file. Decompile it and we have this code:

import pyfiglet
file = open('flag.txt', 'r')
flag = file.read()
font = 'slant'
words = 'MASONCC IS THE BEST CLUB EVER'
flag_track = 0
art = list(pyfiglet.figlet_format(words, font=font))
i = len(art) % 10
for ind in range(len(art)):
    if ind == i and flag_track < len(flag):
        art[ind] = flag[flag_track]
        i += 28
        flag_track += 1
art_str = ''.join(art)
first_val = 5
second_val = 6
first_half = art_str[:len(art_str) // 2]
second_half = art_str[len(art_str) // 2:]
first = [~ord(char) ^ first_val for char in first_half]
second = [~ord(char) ^ second_val for char in second_half]
output = second + first
print(output)

Basically, the generator split the figlet output art_str into 2 parts, first_half (floor(L / 2)) and second_half. It encoded as:

first = [ord(char) ^ first_val for char in first_half]
second = [ord(char) ^ second_val for char in second_half]

then printed output = second + first.

So to decode this, we need to split the provided output list into second (length = ceil(len(output) / 2)) and first (length = floor(len(output) / 2)). Then, recover bytes with ord = (~(v ^ val)) & 0xFF and chr(ord) to print it out.

from pyfiglet import figlet_format

output = [...]
first_val = 5
second_val = 6

L = len(output)
first_len = L // 2         # = floor(L / 2)
second_len = L - first_len # = ceil(L / 2)
second_enc = output[:second_len]
first_enc  = output[second_len:]

def decode_list(enc_list, val):
    chars = []
    for v in enc_list:
        o = (~(v ^ val)) & 0xFF
        chars.append(chr(o))
    return ''.join(chars)

first_half = decode_list(first_enc, first_val)
second_half = decode_list(second_enc, second_val)
art_str = first_half + second_half
print(art_str[:1000])

Run this and it would print out the ASCII art with some characters from the flag.

  p __  ______   _____ ____  _c  ______________   ________t
   /  |/  /   | / ___// __f\/ | / / ____/ ____/  /  _/{___/
  / /|_/ / /| | \__ \/o/ / /  |/ / /   / /       /b/ \__ \
 / /  / / ___ |___F / /_/ / /|  / /___/ /___  u_/ / ___/ /
/_/  /_/_/  |_s____/\____/_/ |_/\____/\___c/  /___//____/
          4                           t
  ____i___  ________   ____  _____0___________   ________    _n  ______
 /_  __/ / / / ____/  / __ )/ ____/ ___/_  __i  / ____/ /   / / / / __ )
5 / / / /_/ / __/    / __  /n__/  \__ \ / /    / /   / /'  / / / / __  |
 / / / __  t /___   / /_/ / /___ ___/ /_ /    / /___/ /___/ /_/ / /E/ /
/_/ /_/ /_/_____/  /__n__/_____//____//_/     \___c/_____/\____/_____/
     R                           y                           p
    _______    _t__________
   / ____/ |  /1/ ____/ __ \
  / __/  | | /o/ __/ / /_/ /
 / /___  | |/N/ /___/ _, _/
/_____/  |__}/_____/_/ |_|

Flag: :spoiler[pctf{obFusc4ti0n_i5n't_EncRypt1oN}]

Space Pirates 2

use std::env;
use std::process;

const TARGET: [u8; 32] = [0x15, 0x5A, 0xAC, 0xF6, 0x36, 0x22, 0x3B, 0x52, 0x6C, 0x4F, 0x90, 0xD9, 0x35, 0x63, 0xF8, 0x0E, 0x02, 0x33, 0xB0, 0xF1, 0xB7, 0x69, 0x42, 0x67, 0x25, 0xEA, 0x96, 0x63, 0x1B, 0xA7, 0x03, 0x0B];
const XOR_KEY: [u8; 5] = [0x7E, 0x33, 0x91, 0x4C, 0xA5];
const ROTATION_PATTERN: [u32; 7] = [1, 3, 5, 7, 2, 4, 6];
const MAGIC_SUB: u8 = 0x5D;

fn print_flag(buffer: &str) {
    println!("Flag: {0}\n", buffer);
}

/// Rotate a byte left by n positions
/// This is a bijection because all 8 bit rotations of a byte are unique
/// ROL(ROL(x, n), 8-n) = x, proving invertibility
fn rotate_left(byte: u8, n: u32) -> u8 {
    byte.rotate_left(n % 8)
}

/// OPERATION 1: XOR with NEW rotating key
/// Each byte is XORed with one of 5 NEW key bytes (cycling through them)
/// Bijection proof: (x ⊕ k) ⊕ k = x (XOR involution)
fn apply_quantum_cipher_v2(buffer: &mut [u8]) {
    for (i, byte) in buffer.iter_mut().enumerate() {
        *byte ^= XOR_KEY[i % 5];
    }
}

/// OPERATION 2 (NEW!): Rotate Left with varying amounts
/// Each byte is rotated left by an amount determined by its position
/// Bijection proof: ROL⁻¹ = ROR with same amount
/// The rotation amount varies: position mod 7 selects from ROTATION_PATTERN
fn apply_stellar_rotation(buffer: &mut [u8]) {
    for (i, byte) in buffer.iter_mut().enumerate() {
        let rotation = ROTATION_PATTERN[i % 7];
        *byte = rotate_left(*byte, rotation);
    }
}

/// OPERATION 3: Swap adjacent byte pairs
/// Bytes at positions (0,1), (2,3), (4,5), etc. are swapped
/// Bijection proof: Swapping twice returns original (f ∘ f = identity)
fn apply_spatial_transposition(buffer: &mut [u8]) {
    for i in (0..buffer.len()).step_by(2) {
        buffer.swap(i, i + 1);
    }
}

/// OPERATION 4: Subtract magic constant (mod 256) - CHANGED FROM ADDITION!
/// Each byte has MAGIC_SUB subtracted from it (wrapping at 256)
/// Bijection proof: (x - k) + k ≡ x (mod 256)
/// Subtraction forms a group, every element has unique inverse
fn apply_gravitational_shift_v2(buffer: &mut [u8]) {
    for byte in buffer.iter_mut() {
        *byte = byte.wrapping_sub(MAGIC_SUB);
    }
}

/// OPERATION 5 (NEW!): Reverse bytes in chunks of 5
/// Splits the 30-byte buffer into 6 chunks of 5, reverses each chunk
/// Chunk 0: [0,1,2,3,4] -> [4,3,2,1,0]
/// Chunk 1: [5,6,7,8,9] -> [9,8,7,6,5], etc.
/// Bijection proof: Reversal is self-inverse, f(f(x)) = x
fn apply_temporal_inversion(buffer: &mut [u8]) {
    const CHUNK_SIZE: usize = 5;
    for chunk_start in (0..buffer.len()).step_by(CHUNK_SIZE) {
        let chunk_end = (chunk_start + CHUNK_SIZE).min(buffer.len());
        buffer[chunk_start..chunk_end].reverse();
    }
}

/// OPERATION 6 (NEW!): XOR each byte with its position SQUARED (mod 256)
/// Byte at position i is XORed with i² mod 256
/// Bijection proof: (x ⊕ k) ⊕ k = x (XOR involution)
/// While i² grows, mod 256 keeps values in range, and XOR remains invertible
fn apply_coordinate_calibration_v2(buffer: &mut [u8]) {
    for (i, byte) in buffer.iter_mut().enumerate() {
        let position_squared = ((i * i) % 256) as u8;
        *byte ^= position_squared;
    }
}

fn process_transmission(input: &str) -> Result<[u8; 32], String> {
    if input.len() != 32 {
        return Err(format!(input.len()));
    }
    let mut buffer = [0u8; 32];
    buffer.copy_from_slice(input.as_bytes());
    apply_quantum_cipher_v2(&mut buffer);
    apply_stellar_rotation(&mut buffer);
    apply_spatial_transposition(&mut buffer);
    apply_gravitational_shift_v2(&mut buffer);
    apply_temporal_inversion(&mut buffer);
    apply_coordinate_calibration_v2(&mut buffer);
    Ok(buffer)
}

fn main() {
    let args: Vec<String> = env::args().collect();
    if args.len() != 2 {
        process::exit(1);
    }

    let input = &args[1];
    match process_transmission(input) {
        Ok(buffer) => {
            if buffer == TARGET {
                print_flag(input);
            } else {
                println!("\n");
                process::exit(1);
            }
        }
        Err(err) => {
            eprintln!("{}", err);
            process::exit(1);
        }
    }
}

The pipeline for the encryption, from input to flag, is:

XOR with rotating key
Rotate left with varying amounts
Swap adjacent byte pairs
Subtract magic constant
Reverse bytes in chunks of 5
XOR each byte with its position squared

So, we need to undo these steps, from operation 6 back to 1, to get the orginal flag. Simple.

TARGET = [0x15, 0x5A, 0xAC, 0xF6, 0x36, 0x22, 0x3B, 0x52, 0x6C, 0x4F, 0x90, 0xD9, 0x35, 0x63, 0xF8, 0x0E, 0x02, 0x33, 0xB0, 0xF1, 0xB7, 0x69, 0x42, 0x67, 0x25, 0xEA, 0x96, 0x63, 0x1B, 0xA7, 0x03, 0x0B]
XOR_KEY = [0x7E, 0x33, 0x91, 0x4C, 0xA5]
ROTATION_PATTERN = [1, 3, 5, 7, 2, 4, 6]
MAGIC_SUB = 0x5D

def ror(byte, n):
    n %= 8
    return ((byte >> n) | ((byte << (8 - n)) & 0xFF)) & 0xFF

def solve():
    buf = TARGET.copy()
    # Operation 6
    for i in range(32):
        buf[i] ^= (i * i) % 256
    # Operation 5
    for cs in range(0, 32, 5):
        buf[cs:cs+5] = reversed(buf[cs:cs+5])
    # Operation 4
    for i in range(32):
        buf[i] = (buf[i] + MAGIC_SUB) & 0xFF
    # Operation 3
    for i in range(0, 32, 2):
        buf[i], buf[i+1] = buf[i+1], buf[i]
    # Operation 2
    for i in range(32):
        rot = ROTATION_PATTERN[i % 7]
        buf[i] = ror(buf[i], rot)
    # Operation 1
    for i in range(32):
        buf[i] ^= XOR_KEY[i % 5]
    s = bytes(buf).decode("utf-8")
    print("Recovered input:")
    print(s)

if __name__ == "__main__":
    solve()

Flag: :spoiler[pctf{Y0U_F0UND_TH3_P1R4T3_B00TY}]

Space Pirates 3

package main
import (
	"fmt"
	"os"
)
var target = [30]byte{
	0x60, 0x6D, 0x5D, 0x97, 0x2C, 0x04, 0xAF, 0x7C, 0xE2, 0x9E, 0x77, 0x85, 0xD1, 0x0F, 0x1D, 0x17, 0xD4, 0x30, 0xB7, 0x48, 0xDC, 0x48, 0x36, 0xC1, 0xCA, 0x28, 0xE1, 0x37, 0x58, 0x0F,
}
var xorKey = [7]byte{0xC7, 0x2E, 0x89, 0x51, 0xB4, 0x6D, 0x1F}
var rotationPattern = [8]uint{7, 5, 3, 1, 6, 4, 2, 0}
const magicSub byte = 0x93
const chunkSize = 6

func printFlag(input string) {
	fmt.Println("Flag: ", input)
}
func rotateLeft(b byte, n uint) byte {
	n = n % 8
	return (b << n) | (b >> (8 - n))
}
func applyUltimateQuantumCipher(buffer []byte) {
	for i := range buffer {
		buffer[i] ^= xorKey[i%len(xorKey)]
	}
}
func applyStellarRotationV2(buffer []byte) {
	for i := range buffer {
		rotation := rotationPattern[i%len(rotationPattern)]
		buffer[i] = rotateLeft(buffer[i], rotation)
	}
}
func applySpatialTransposition(buffer []byte) {
	for i := 0; i < len(buffer)-1; i += 2 {
		buffer[i], buffer[i+1] = buffer[i+1], buffer[i]
	}
}
func applyGravitationalShiftV3(buffer []byte) {
	for i := range buffer {
		buffer[i] -= magicSub
	}
}
func applyTemporalInversionV2(buffer []byte) {
	for chunkStart := 0; chunkStart < len(buffer); chunkStart += chunkSize {
		chunkEnd := chunkStart + chunkSize
		if chunkEnd > len(buffer) {
			chunkEnd = len(buffer)
		}
		for i, j := chunkStart, chunkEnd-1; i < j; i, j = i+1, j-1 {
			buffer[i], buffer[j] = buffer[j], buffer[i]
		}
	}
}
func applyCoordinateCalibrationV3(buffer []byte) {
	for i := range buffer {
		positionValue := ((i * i) + i) % 256
		buffer[i] ^= byte(positionValue)
	}
}

func processVault(input string) ([30]byte, error) {
	var result [30]byte
	if len(input) != 30 {
		return result, fmt.Errorf(
			"Invalid vault combination",
		)
	}
	copy(result[:], input)
	buffer := result[:]
	applyUltimateQuantumCipher(buffer)
	applyStellarRotationV2(buffer)
	applySpatialTransposition(buffer)
	applyGravitationalShiftV3(buffer)
	applyTemporalInversionV2(buffer)
	applyCoordinateCalibrationV3(buffer)
	return result, nil
}

func main() {
	if len(os.Args) != 2 {
		os.Exit(1)
	}
	input := os.Args[1]
	result, err := processVault(input)
	if err != nil {
		fmt.Fprintf(os.Stderr, " %v\n", err)
		os.Exit(1)
	}
	if result == target {
		printFlag(input)
	} else {
		fmt.Println("\n")
		os.Exit(1)
	}
}

Different programming language, but have the same meaning in each operation, the same as Sapce Pirates 2. So, to reverse it, we need to:

XOR each byte with (i^2 + i) mod 256
Reverse each 6-byte chunk
Add magicSub
Swap adjacent pairs
Rotate right by the rotation pattern
XOR with 7-byte xorKey

TARGET = [0x60, 0x6D, 0x5D, 0x97, 0x2C, 0x04, 0xAF, 0x7C, 0xE2, 0x9E, 0x77, 0x85, 0xD1, 0x0F, 0x1D, 0x17, 0xD4, 0x30, 0xB7, 0x48, 0xDC, 0x48, 0x36, 0xC1, 0xCA, 0x28, 0xE1, 0x37, 0x58, 0x0F]
XOR_KEY = [0xC7, 0x2E, 0x89, 0x51, 0xB4, 0x6D, 0x1F]
ROTATION_PATTERN = [7, 5, 3, 1, 6, 4, 2, 0]
MAGIC_SUB = 0x93

def ror(byte, n):
    n %= 8
    return ((byte >> n) | ((byte << (8 - n)) & 0xFF)) & 0xFF

def solve():
    buf = TARGET.copy()
    # Operation 6
    for i in range(30):
        buf[i] ^= ((i * i) + i) % 256
    # Operation 5
    for cs in range(0, 30, 6):
        buf[cs:cs+6] = reversed(buf[cs:cs+6])
    # Operation 4
    for i in range(30):
        buf[i] = (buf[i] + MAGIC_SUB) & 0xFF
    # Operation 3
    for i in range(0, 30, 2):
        buf[i], buf[i+1] = buf[i+1], buf[i]
    # Operation 2
    for i in range(30):
        rot = ROTATION_PATTERN[i % 8]
        buf[i] = ror(buf[i], rot)
    # Operation 1
    for i in range(30):
        buf[i] ^= XOR_KEY[i % 7]
    s = bytes(buf).decode("utf-8")
    print("Recovered input:")
    print(s)

if __name__ == "__main__":
    solve()

Flag: :spoiler[pctf{M4ST3R_0F_TH3_S3V3N_S34S}]

Vorpal Masters

void main(void) {
  int iVar1;
  int local_20;
  char local_1c [11];
  char local_11;
  char local_10;
  char local_f;
  char local_e;
  int local_c;
  
  puts("Welcome to {insert game here}\nPlease enter the license key from the 3rd page of the booklet.");
  local_c = __isoc99_scanf("%4s-%d-%10s", &local_11, &local_20, local_1c);
  if (local_c != 3) {
    puts("Please enter you key in the format xxxx-xxxx-xxxx");
    exit(0);
  }
  if ((((local_11 != 'C') || (local_f != 'C')) || (local_e != 'I')) || (local_10 != 'A')) {
    womp_womp();
  }
  if ((-0x1389 < local_20) && (local_20 < 0x2711)) {
    if ((local_20 + 0x16) % 0x6ca == ((local_20 * 2) % 2000) * 6 + 9) goto LAB_00101286;
  }
  womp_womp();
LAB_00101286:
  iVar1 = strcmp(local_1c, "PatriotCTF");
  if (iVar1 != 0) womp_womp();
  puts("Lisence key registered, you may play the game now!");
  return;
}

The key is in the form xxxx-xxxx-xxxx. In local_c, it decleares that local_c = __isoc99_scanf("%4s-%d-%10s", &local_11, &local_20, local_1c);, meaning there are 3 parts in the key:

First part is a string having 4 characters;
Second part is a number;
Third part is a string having 10 characters.

For the first part, although the arrangement in the code was wrong (CCIA), but based on the memory of each variable, we know that the first part is CACI (like what the challenge statement said).
For the second part, we know that:

  if ((-0x1389 < local_20) && (local_20 < 0x2711)) {
    if ((local_20 + 0x16) % 0x6ca == ((local_20 * 2) % 2000) * 6 + 9) goto LAB_00101286;
  }

which means:

for n in range(-4999, 10000):
    if (n + 22) % 1738 == ((n * 2) % 2000) * 6 + 9:
        print(n) # goto LAB_00101286;

So the second part is 2025.

For the third part, we already know it is PatriotCTF.

Flag: :spoiler[CACI{2025-PatriotCTF}]

(VN) TryHackMe - Reversing ELF

Tue, 18 Nov 2025 00:00:00 GMT

Link to the room

Crackme1

//...
  char local_98 [32];
  uint local_78 [28];
  
  local_78[0] = 0x25;
  local_78[1] = 0x2b;
  //...
  local_78[0x18] = 0x25;
  local_78[0x19] = 0x3c;
  local_78[0x1a] = 0xffffffbf;

  memset(local_98, 0x41, 0x1b);
  for (local_78[0x1b] = 0; local_78[0x1b] < 0x1b; local_78[0x1b] = local_78[0x1b] + 1) {
    local_98[(int)local_78[0x1b]] =
        (char)local_78[(int)local_78[0x1b]] + local_98[(int)local_78[0x1b]];
  }
  puts(local_98);
//...

local_98 = 32-byte buffer, cài đặt A [0x41] lập lại 27 [0x1B] lần.
local_78 = array gồm 27 số (từ 0 đến 0x1A).
local_98[i] = (char)local_78[i] + local_98[i], hoặc output[i] = 'A' + local_78[i].

local_78 = [0x25, 0x2b, 0x20, 0x26, 0x3a, 0x2d, 0x2e, 0x33, 0x1e, 0x33,
            0x27, 0x20, 0x33, 0x1e, 0x2a, 0x28, 0x2d, 0x23, 0x1e, 0x2e,
            0x25, 0x1e, 0x24, 0x2b, 0x25, 0x3c]

print("".join(chr(0x41 + i) for i in local_78))

What is the flag? - :spoiler[flag{not_that_kind_of_elf}]

Crackme2

//...
  if (param_1 == 2)
    iVar2 = strcmp((char *)param_2[1],"<password>");
    if (iVar2 == 0) {
      puts("Access granted.");
      giveFlag();
      uVar1 = 0;
    }
//...

What is the super secret password? - :spoiler[super_secret_password]

//...
  int iVar1;
  undefined4 *puVar2;
  undefined4 *puVar3;
  char local_11f [51];
  undefined4 local_ec [51];
  uint local_20;

  puVar2 = &DAT_080486c0;
  puVar3 = local_ec;
  for (iVar1 = 0x33; iVar1 != 0; iVar1 = iVar1 + -1) {
    *puVar3 = *puVar2;
    puVar2 = puVar2 + 1;
    puVar3 = puVar3 + 1;
  }
  memset(local_11f, 0x41, 0x33);
  for (local_20 = 0; local_20 < 0x33; local_20 = local_20 + 1) {
    local_11f[local_20] = (char)local_ec[local_20] + local_11f[local_20];
  }
//...

Dump data ở DAT_080486c0 để lấy data cần được xử lý.

(gdb) x/204xb 0x080486c0
0x80486c0:      0x25    0x00    0x00    0x00    0x2b    0x00    0x00    0x00
0x80486c8:      0x20    0x00    0x00    0x00    0x26    0x00    0x00    0x00
0x80486d0:      0x3a    0x00    0x00    0x00    0x28    0x00    0x00    0x00
0x80486d8:      0x25    0x00    0x00    0x00    0x1e    0x00    0x00    0x00
0x80486e0:      0x28    0x00    0x00    0x00    0x1e    0x00    0x00    0x00
0x80486e8:      0x32    0x00    0x00    0x00    0x34    0x00    0x00    0x00
...

Vì mỗi giá trị ở local_ec được định dạng bằng undefined4, tức là mỗi phần tử đều có giá trị là 4 byte. Nên chúng ta chỉ cần lấy byte thấp nhất của mỗi giá trị integer này.

byte = [0x25, 0x2b, 0x20, 0x26, 0x3a, 0x28, 0x25, 0x1e, 0x28, 0x1e, 
        0x32, 0x34, 0x21, 0x2c, 0x28, 0x33, 0x1e, 0x33, 0x27, 0x28, 
        0x32, 0x1e, 0x25, 0x2b, 0x20, 0x26, 0x1e, 0x33, 0x27, 0x24, 
        0x2d, 0x1e, 0x28, 0x1e, 0x36, 0x28, 0x2b, 0x2b, 0x1e, 0x26, 
        0x24, 0x33, 0x1e, 0x2f, 0x2e, 0x28, 0x2d, 0x33, 0x32, 0x3c]

print(''.join(chr(i + 0x41) for i in byte))

What is the flag? - :spoiler[flag{if_i_submit_this_flag_then_i_will_get_points}]

Crackme3

void processEntry entry(undefined4 param_1,undefined4 param_2) {
  undefined auStack_4 [4];
  __libc_start_main(FUN_080484f4, param_2,&stack0x00000004, FUN_08048d90, 
                    FUN_08048e00, param_1, auStack_4);
  do {} while( true );
}

Đọc function FUN_080484f4 để lấy thêm thông tin.

undefined4 FUN_080484f4(int param_1,undefined4 *param_2) {
    //...
    if ((sVar1 == 0x40) && (iVar2 = strcmp(__s_00,"<flag>"), iVar2 == 0)) {
        puts("Correct password!");
        return 0;
    }
    //...
}

What is the flag? - :spoiler[f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5]

Crackme4

undefined8 main(int param_1,undefined8 *param_2) {
  //...
  if (param_1 == 2) {
    compare_pwd((char *)param_2[1]);
  }
  //...
}

void compare_pwd(char *param_1) {
    //...
    builtin_strncpy(local_28,"I]{I\x14V\x17{WAGQV\x17{TS@",0x13);
    get_pwd((long)local_28);
    iVar1 = strcmp(local_28,param_1);
    if (iVar1 == 0) {
        puts("password OK");
    }
    //...
}

String ở local_28 bị mã hóa, đọc function get_pwd() để hiểu cách để đưa lại string ban đầu.

void get_pwd(long param_1) {
  undefined4 local_c; 
  local_c = -1;
  while (local_c = local_c + 1, *(char *)(param_1 + local_c) != '\0') {
    *(byte *)(local_c + param_1) = *(byte *)(param_1 + local_c) ^ 0x24;
  }
}

Ở đây, mỗi kí tự trong local_28 sẽ XOR với ký tự khác (0x24), từ đây viết lại code để in ra password.

local_28 = b"I]{I\x14V\x17{WAGQV\x17{TS@"
decoded = bytes([i ^ 0x24 for i in local_28])
print(decoded.decode())

What is the password? - :spoiler[my_m0r3_secur3_pwd]

Crackme5

undefined8 main(void) {
  //...
  builtin_strncpy(local_38,"OfdlDSA|3tXb32~X3tX@sX`4tXtz",0x1c);
  puts("Enter your input:");
  __isoc99_scanf(&DAT_00400966,local_58);
  iVar1 = strcmp_(local_58,local_38);
  if (iVar1 == 0) {
    puts("Good game");
  }
  //...
}

Có một bug trong chương trình này, thay vì strcmp() thì họ đã sử dụng strcmp_(). Mặc dù vô hại nhưng cách xử lý của 2 function này là hoàn toàn khác nhau. Đọc thử function strcmp_() để hiểu cách hoạt động.

void strcmp_(char *param_1, char *param_2) {
  //...
  while( true ) {
    sVar1 = strlen(param_1);
    if (sVar1 <= (ulong)(long)local_1c) break;
    param_1[local_1c] = (byte)key ^ param_1[local_1c];
    local_1c = local_1c + 1;
  }
  strncmp(param_1, param_2, 0x1c);
  return;
}

Có thể để ý ở đây mỗi ký tự được XOR với key. Xem thử key ở global có giá trị nào không.

(gdb) x/wx 0x601064
0x601064 <key>: 0x00000000

Vậy là xem như dãy kí tự ở local_38 không bị mã hóa như kí tự ở input ban đầu.

What is the input? - :spoiler[OfdlDSA|3tXb32~X3tX@sX`4tXtz]

Crackme6

undefined8 main(int param_1,undefined8 *param_2) {
  if (param_1 == 2) {
    compare_pwd((char *)param_2[1]);
  }
  //...
}

void compare_pwd(char *param_1) {
  //...
  uVar1 = my_secure_test(param_1);
  if ((int)uVar1 == 0) {
    puts("password OK");
  }
  //...
}

undefined8 my_secure_test(char *param_1) {
  undefined8 uVar1;
  
  if ((*param_1 == '\0') || (*param_1 != '1')) {
    uVar1 = 0xffffffff;
  }
  else if ((param_1[1] == '\0') || (param_1[1] != '3')) {
    uVar1 = 0xffffffff;
  }
  //...
  else if ((param_1[7] == '\0') || (param_1[7] != 'd')) {
    uVar1 = 0xffffffff;
  }
  else if (param_1[8] == '\0') {
    uVar1 = 0;
  }
  else {
    uVar1 = 0xffffffff;
  }
  return uVar1;
}

Mỗi ký tự ở password là parameter cần nhập vào input để check xem password đó có đúng hay chưa.

What is the password? - :spoiler[1337_pwd]

Crackme7

undefined4 main(undefined param_1) {
    //...
    else if (local_14 == 0x7a69) {
        puts("Wow such h4x0r!");
        giveFlag();
    }
    //...
}

void giveFlag(void) {
  //...
  puVar2 = &DAT_080488e0;
  puVar3 = local_a8;
  for (iVar1 = 0x22; iVar1 != 0; iVar1 = iVar1 + -1) {
    *puVar3 = *puVar2;
    puVar2 = puVar2 + 1;
    puVar3 = puVar3 + 1;
  }
  memset(local_ca,0x41,0x22);
  for (local_20 = 0; local_20 < 0x22; local_20 = local_20 + 1) {
    local_ca[local_20] = (char)local_a8[local_20] + local_ca[local_20];
  }
  //...
}

Tới đây, cách xử lý quay về như bài Crackme2.

(gdb) x/136xb 0x080488e0
0x80488e0:      0x25    0x00    0x00    0x00    0x2b    0x00    0x00    0x00
0x80488e8:      0x20    0x00    0x00    0x00    0x26    0x00    0x00    0x00
0x80488f0:      0x3a    0x00    0x00    0x00    0x2c    0x00    0x00    0x00
0x80488f8:      0x34    0x00    0x00    0x00    0x22    0x00    0x00    0x00
...

What is the flag? - :spoiler[flag{much_reversing_very_ida_wow}]

Crackme8

undefined4 main(int param_1,undefined4 *param_2) {
  //...
  if (param_1 == 2) {
    iVar2 = atoi((char *)param_2[1]);
    if (iVar2 == -0x35010ff3) {
      puts("Access granted.");
      giveFlag();
      uVar1 = 0;
    }
  }
  //...
}

Function giveFlag() hoàn toàn y chang với bài Crackme2 và Crackme7. Áp dụng các kỹ thuật đã được nêu ở 2 bài trên để ra được flag.

What is the flag? - :spoiler[flag{at_least_this_cafe_wont_leak_your_credit_card_numbers}]

(EN) osu!gaming CTF 2025 - Crypto

Fri, 31 Oct 2025 00:00:00 GMT

rot727

aeg{at_imuf_nussqd_zgynqd_paqezf_yqmz_yadq_eqogdq}

As the title mentioned, we can see that ROT727 is almost similar to ROT13. So we can put that in some decoder to brute-force the ROT, and the flag is encrypted in ROT14.

Flag: :spoiler[osu{oh_wait_bigger_number_doesnt_mean_more_secure}]

beyond-wood

from PIL import Image
import random

FLAG = Image.open("flag.png")
width, height = FLAG.size

key = [random.randrange(0, 256) for _ in range(width+height+3)]

out = FLAG.copy()
for i in range(width):
    for j in range(height):
        pixel = FLAG.getpixel((i, j))
        pixel = tuple(x ^ k for x, k in zip(pixel, key))
        newi, newj = (2134266 + i * 727) % width, (4501511 + j * 727) % height 
        out.putpixel((newi, newj), pixel)

out.save("output.png")

key is built with random bytes of length width + height + 3. For each (i, j) it XORS the pixel channels with key starting from key[0]. Meaning that XOR key takes the first 3 bytes of key, and it's constant per channel (one byte for R, one byte for G and one byte for B).

Then it write that XORed pixel to a new permuted location.

newi = (2134266 + i * 727) % width
newj = (4501511 + j * 727) % height

This is a linear (affine) permutation on each axis, so it's reversible.

To solve this challenge, we first invert the permutation, by using the formula, and place it at the original pixel.

inv_i[(2134266 + i * 727) % width] = i
inv_j[(4501511 + j * 727) % height] = j

Then recover the 3 key bytes. Because XOR key is global, so that we can use some frequency assumptions such as black (0, 0, 0) or white (255, 255, 255), to XOR the unshuffled image with the recovered key to get the original.

from PIL import Image
from collections import Counter

def build_inverse_map(length, offset, mult):
    inv = [None] * length
    for i in range(length):
        new = (offset + i * mult) % length
        inv[new] = i
    return inv

def unshuffle(img):
    width, height = img.size
    inv_i = build_inverse_map(width, 2134266, 727)
    inv_j = build_inverse_map(height, 4501511, 727)
    out = Image.new(img.mode, (width, height))
    src = img.load()
    dst = out.load()
    for x in range(width):
        for y in range(height):
            dst[inv_i[x], inv_j[y]] = src[x, y]
    return out

def xor_pixel(pixel, key):
    return tuple(p ^ k for p, k in zip(pixel, key))

def apply_key(img, key):
    width, height = img.size
    out = Image.new(img.mode, (width, height))
    src = img.load()
    dst = out.load()
    for x in range(width):
        for y in range(height):
            dst[x, y] = xor_pixel(src[x, y], key)
    return out

def main():
    img = Image.open("output.png").convert("RGB")
    width, height = img.size
    unshuffled = unshuffle(img)

    for bg in [(0,0,0), (255,255,255)]:
        key = tuple(mc[i] ^ bg[i] for i in range(3))
        print(f"Recovering {bg}, key = {key}")
        recovered = apply_key(unshuffled, key)
        recovered.save(f"recovered_{bg[0]}_{bg[1]}_{bg[2]}.png")

if __name__ == "__main__":
    main()

Flag: :spoiler[osu{h1_05u_d351gn_t34m}]

xnor-xnor-xnor

import os
flag = open("flag.txt", "rb").read()

def xnor_gate(a, b):
    if a == 0 and b == 0:
        return 1
    elif a == 0 and b == 1:
        return 0
    elif a == 1 and b == 0:
        return 0
    else:
        return 1

def str_to_bits(s):
    bits = []
    for x in s:
        bits += [(x >> i) & 1 for i in range(8)][::-1]
    return bits

def bits_to_str(bits):
    return bytes([sum(x * 2 ** j for j, x in enumerate(bits[i:i+8][::-1])) for i in range(0, len(bits), 8)])

def xnor(pt_bits, key_bits):
    return [xnor_gate(pt_bit, key_bit) for pt_bit, key_bit in zip(pt_bits, key_bits)]

key = os.urandom(4) * (1 + len(flag) // 4)
key_bits = str_to_bits(key)
flag_bits = str_to_bits(flag)
enc_flag = xnor(xnor(xnor(flag_bits, key_bits), key_bits), key_bits)

print(bits_to_str(enc_flag).hex())
# 7e5fa0f2731fb9b9671fb1d62254b6e5645fe4ff2273b8f04e4ee6e5215ae6ed6c

We have XNOR(a, b) = 1 - (a XOR b), so if we have t = XNOR(XNOR(XNOR(a, k), k), k), meaning that if k = 1 then t = a, and k = 0 then t = NOT a. Therefore the whole triple-XNOR is just a bitwise XOR with the bitwise complement of the key. In bytes:

mask_byte = 0xff - key_byte
cipher = plaintext XOR mask
plaintext = cipher XOR mask

Because key is os.urandom(4) repeated, mask repeats every 4 bytes. So if we know the what the plaintext is, it's reversible.

We know the flag format is osu{, it's 0x6f 0x73 0x75 0x7b. Calculate the first 4 mask bytes:

mask0 = 0x7e XOR 0x6f = 0x11
mask1 = 0x5f XOR 0x73 = 0x2c
mask2 = 0xa0 XOR 0x75 = 0xd5
mask3 = 0xf2 XOR 0x7b = 0x89

We have the 4-byte repeated mask as 0x11 0x2c 0xd5 0x89, so the key is 0xff - mask_byte, meaning 0xee 0xd3 0x2a 0x76. XOR it with the cipher text, and we have the flag.

c = bytes.fromhex("7e5fa0f2731fb9b9671fb1d62254b6e5645fe4ff2273b8f04e4ee6e5215ae6ed6c")
known = b"osu{"
mask = [c[i] ^ known[i] for i in range(4)]
t = bytes(c[i] ^ mask[i % 4] for i in range(len(c)))
print(t.decode())

Flag: :spoiler[osu{b3l0v3d_3xclus1v3_my_b3l0v3d}]

pls-nominate

from Crypto.Util.number import * 
FLAG = open("flag.txt", "rb").read() 
message = bytes_to_long( b"hello there can you pls nominate my map https://osu.ppy.sh/beatmapsets/2436259 :steamhappy: i can bribe you with a flag if you do: " + FLAG ) 

ns = [getPrime(727) * getPrime(727) for _ in range(5)] 
e = 5 
print(len(FLAG)) 
print(ns) 
print([pow(message, e, n) for n in ns])

This challenge is a simple Hastad-style broadcast RSA with e = 5. So we just need to combine 5 ciphertexts with the Chinese Remainder Theorem and search for the small multiple k so that M_e + k * N is a perfect 5th power.

ns = [...]
ciphers = [...]
e = 5

def prod(a):
    p = 1
    for x in a: p *= x
    return p

def ith_root(x, n):
    if x < 2: return x, True
    lo, hi = 0, 1 << ((x.bit_length() + n - 1) // n + 1)
    while lo + 1 < hi:
        m = (lo + hi) // 2
        if m ** n == x: return m, True
        if m ** n < x: lo = m
        else: hi = m
    return (lo, lo ** n == x)

# CRT
N = prod(ns)
Me = 0
for n, c in zip(ns, ciphers):
    Ni = N // n
    inv = pow(Ni, -1, n)
    Me += c * Ni * inv
Me %= N

# Search small k
r, exact = ith_root(Me, e)
if not exact:
    for k in range(0, 500000):
        r, exact = ith_root(Me + k*N, e)
        if exact:
            break

m = r
b = m.to_bytes((m.bit_length() + 7) // 8, 'big')
i = b.find(b"osu{")
print(b[i:i + 200].decode() if i != -1 else b[:200])

Flag: :spoiler[osu{pr3tty_pl3453_w1th_4_ch3rry_0n_t0p!?:pleading:}]

linear-feedback

from secrets import randbits 
from math import floor 
from hashlib import sha256 

class LFSR: 
    def __init__(self, key, taps, format): 
        self.key = key 
        self.taps = taps 
        self.state = list(map(int, list(format.format(key)))) 
        
    def _clock(self): 
        ob = self.state[0] 
        self.state = self.state[1:] + [sum([self.state[t] for t in self.taps]) % 2] 
        return ob 
        
def xnor_gate(a, b): 
    if a == 0 and b == 0: return 1 
    elif a == 0 and b == 1: return 0 
    elif a == 1 and b == 0: return 0 
    else: return 1 
        
key1 = randbits(21) 
key2 = randbits(29) 
L1 = LFSR(key1, [2, 4, 5, 1, 7, 9, 8], "{:021b}") 
L2 = LFSR(key2, [5, 3, 5, 5, 9, 9, 7], "{:029b}") 

bits = [xnor_gate(L1._clock(), L2._clock()) for _ in range(floor(72.7))] 
print(bits) 

FLAG = open("flag.txt", "rb").read() 
keystream = sha256((str(key1) + str(key2)).encode()).digest() * 2 
print(bytes([b1 ^ b2 for b1, b2 in zip(FLAG, keystream)]).hex())

This is the challenge where turning the LFSRs into a linear system over GF(2) and solving the initial register bits.

The two LFSRs are linear over GF(2), where each output bit at t is a linear function of the initial state bits.
The program prints bits = xnor(L1._clock(), L2._clock()). Since xnor(a, b) = 1 when a == b, we have: L1_t XOR L2_t = 1 ^ bits_t.
Build coefficient vectors for each LFSR output as linear combinations of their initial state bits, for every observed time step. That gives a linear system with 50 unknowns (21 + 29 initial bits) and 72 equations (observed outputs).
Solve the GF(2) linear system (Gaussian elimination). The system had 2 free variables; try 4 assignments, check which produces ASCII flag when decrypting the provided ciphertext.

Based on these steps, we can have the recovered values as:

key1 = 776071    #binary 10111101101001000111 as a 21-bit string
key2 = 340835109 #binary 0101000100010010101100010110101 as a 29-bit string

Flag: :spoiler[osu{th1s_hr1_i5_th3_m0st_fun_m4p_3v3r_1n_0wc}]

ssss

#!/usr/local/bin/python3 
from Crypto.Util.number import * 
import random 

p = 2**255 - 19 
k = 15 
SECRET = random.randrange(0, p) 

def lcg(x, a, b, p): 
    return (a * x + b) % p 
    
a = random.randrange(0, p) 
b = random.randrange(0, p) 
poly = [SECRET] 
while len(poly) != k: poly.append(lcg(poly[-1], a, b, p)) 

def evaluate_poly(f, x): 
    return sum(c * pow(x, i, p) for i, c in enumerate(f)) % p 
    
print("welcome to ssss", flush=True) 
for _ in range(k - 1): 
    x = int(input()) 
    assert 0 < x < p, "no cheating!" 
    print(evaluate_poly(poly, x), flush=True) 
    
if int(input("secret? ")) == SECRET: 
    FLAG = open("flag.txt").read() 
    print(FLAG, flush=True)

Server returns $$y = \sum_{i=0}^{k-1} c_i x^i$$ with $$c_{i+1} = ac_i + b, c_0 = SECRET$$.
Because $$c_i = C_1a^i + C_2$$, then $$y(x) = C_1S(x, a) + C_2U(x)$$

where $$S(x, a) = \frac{1 - (ax)^k}{1 - ax}$$ and $$U(x) = \frac{1 - x^k}{1 - x}$$

Send 3 values x (e.x. 2, 3, 5), receive 3 values y and calculate 3 nonlinear system for $$a, C_1, C_2$$.
Eliminate $$C_1, C_2$$ to get one polynomial equation in $$a$$, solve it modulo $$p$$, then recover $$C_1, C_2$$ by linear solve.
Compute $$SECRET = C_1 + C_2 \pmod{b}$$, send this SECRET to the server to receive the flag.

import socket, re, sys, time
from sympy import symbols, together, expand, Poly, factor_list, Integer
from Crypto.Util.number import inverse, long_to_bytes

HOST = "ssss.challs.sekai.team"
PORT = 1337

p = 2**255 - 19
k = 15
xs_to_send = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43]  # length 14

def recv_line(sock, timeout=10):
    sock.settimeout(timeout)
    data = b""
    try:
        while True:
            ch = sock.recv(1)
            if not ch:
                break
            data += ch
            if ch == b"\n":
                break
    except socket.timeout:
        pass
    return data

def extract_last_int_from_bytes(b: bytes):
    m = re.search(rb"(-?\d+)\s*$", b.strip())
    if not m:
        return None
    return int(m.group(1))

def query_server_and_get_results(host, port, xs):
    s = socket.create_connection((host, port))
    s.settimeout(5)
    for _ in range(4):
        line = recv_line(s, timeout=0.5)
        if not line:
            break

    outputs = []
    for x in xs:
        # send x
        s.sendall(f"{x}\n".encode())
        val = None
        start = time.time()
        while True:
            line = recv_line(s, timeout=5)
            if not line:
                break
            val = extract_last_int_from_bytes(line)
            if val is not None:
                break
            if time.time() - start > 8:
                break
        if val is None:
            remaining = line.decode(errors='ignore') if line else "<no data>"
            print(remaining)
            s.close()
            sys.exit(1)
        outputs.append((x, val))
    return s, outputs

def recover_secret_from_three_pairs(pairs):
    (x1, y1), (x2, y2), (x3, y3) = pairs
    a = symbols('a')
    def S_sym(x):
        return (1 - (a * Integer(x))**k) / (1 - a * Integer(x))
    def U_sym(x):
        xI = Integer(x)
        return (1 - xI**k) / (1 - xI)
    S1, S2, S3 = S_sym(x1), S_sym(x2), S_sym(x3)
    U1, U2, U3 = U_sym(x1), U_sym(x2), U_sym(x3)
    Y1, Y2, Y3 = map(Integer, [y1, y2, y3])
    expr = (Y1 * U2 - Y2 * U1) * S3 + (-Y1 * S2 + Y2 * S1) * U3 - Y3 * (S1 * U2 - S2 * U1)
    expr_s = together(expr)
    num, den = expr_s.as_numer_denom()
    poly_expr = expand(num)
    P = Poly(poly_expr, a)
    print("[*] Integer polynomial degree:", P.degree())
    coeffs_mod_p = [int(c % p) for c in P.all_coeffs()]
    Pp = Poly(coeffs_mod_p, a, modulus=p)
    print("[*] Degree over GF(p):", Pp.degree())
    print("[*] Factoring polynomial mod p (may take a moment)...")
    try:
        fact = factor_list(Pp.as_expr(), modulus=p)
        factors = fact[1]
    except Exception as e:
        print("[!] factor_list failed:", e)
        factors = []

    candidates = set()
    for fpol, mult in factors:
        fpoly = Poly(fpol, a, modulus=p)
        if fpoly.degree() == 1:
            coefs = fpoly.all_coeffs()
            Acoef, Bcoef = int(coefs[0]) % p, int(coefs[1]) % p
            root = (-Bcoef * inverse(Acoef, p)) % p
            candidates.add(root)

    if not candidates:
        print("[*] No linear factors found")
        for guess in range(0, 200000):
            if Pp.eval(guess) % p == 0:
                candidates.add(guess)
                print("[*] Found a by scanning:", guess)
                break

    if not candidates:
        raise RuntimeError("No candidate 'a' found.")

    def compute_S_num(x, a_val):
        ax = (a_val * x) % p
        if (1 - ax) % p == 0:
            return None
        num = (1 - pow(ax, k, p)) % p
        den = (1 - ax) % p
        return (num * inverse(den, p)) % p

    def compute_U_num(x):
        if (1 - x) % p == 0:
            return None
        num = (1 - pow(x, k, p)) % p
        den = (1 - x) % p
        return (num * inverse(den, p)) % p

    for a_cand in candidates:
        S1v = compute_S_num(x1, a_cand)
        S2v = compute_S_num(x2, a_cand)
        S3v = compute_S_num(x3, a_cand)
        U1v = compute_U_num(x1)
        U2v = compute_U_num(x2)
        U3v = compute_U_num(x3)
        if None in (S1v, S2v, S3v, U1v, U2v, U3v):
            continue
        det = (S1v * U2v - S2v * U1v) % p
        if det == 0:
            continue
        inv_det = inverse(det, p)
        C1 = ((Integer(y1) * U2v - Integer(y2) * U1v) * inv_det) % p
        C2 = ((-Integer(y1) * S2v + Integer(y2) * S1v) * inv_det) % p
        y3calc = (C1 * S3v + C2 * U3v) % p
        if y3calc == Integer(y3) % p:
            SECRET = int((C1 + C2) % p)
            return a_cand, SECRET
    raise RuntimeError("No candidate 'a' produced valid C1/C2.")

def send_secret_and_get_flag(sock, secret):
    sock.sendall(f"{secret}\n".encode())
    data = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            data += chunk
    except socket.timeout:
        pass
    return data.decode(errors='ignore')

def main():
    print("Connecting server")
    s, outputs = query_server_and_get_results(HOST, PORT, xs_to_send)
    print("Queried pairs:", outputs[:3], "... (total returned {})".format(len(outputs)))
    three = outputs[:3]
    try:
        a_val, secret = recover_secret_from_three_pairs(three)
    except Exception as e:
        print("Recovery failed:", e)
        s.close()
        sys.exit(1)

    print("Recovered a =", a_val)
    print("Recovered SECRET (int):", secret)
    try:
        print("SECRET (bytes):", long_to_bytes(secret))
    except Exception:
        pass

    print("Sending secret")
    flag_text = send_secret_and_get_flag(s, secret)
    s.close()
    print("---- SERVER OUTPUT ----")
    print(flag_text)
    print("-----------------------")

if __name__ == "__main__":
    main()

Flag: :spoiler[osu{0n3_hundr3d_p3rc3nt_4ccur4cy!}]