C# reverse engineering bypass obfuscation

Question

I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.

I managed to pass the obfuscation and reached the main() file.

using System;

using System.Text;

// Token: 0x0200000B RID: 11

internal class Class5

{

// Token: 0x06000034 RID: 52 RVA: 0x0000339C File Offset: 0x0000159C

private static void Main(string[] args)

{

    string text = "BXQMRxx7GDwXHgAAF2QLCzMQNWUIaAgABx8yERMBZlI=";

    string text2 = "Q0BwVHVyZVRoZUZsQGc=";

    if (args.Length < 1)

    {

        return;

    }

    if (args.Length > 1)

    {

        Console.WriteLine(Encoding.UTF8.GetString(Convert.FromBase64String("VHJ5IGFnYWluLCB0aGlzIGlzIG5vdCBjb3JyZWN0Lg==")));

        return;

    }

    if (!Class5.smethod_0(Convert.ToBase64String(Encoding.UTF8.GetBytes(args[0])), text2).Equals(text))

    {

        Console.WriteLine(Encoding.UTF8.GetString(Convert.FromBase64String("VHJ5IGFnYWluLCB0aGlzIGlzIG5vdCBjb3JyZWN0Lg==")));

        return;

    }

    Console.WriteLine(Encoding.UTF8.GetString(Convert.FromBase64String("Q29uZ3JhdHVsYXRpb25zLCB5b3UgaGF2ZSBmb3VuZCB0aGUgcmlnaHQgZmxhZy4=")));

}


// Token: 0x06000035 RID: 53 RVA: 0x0000344C File Offset: 0x0000164C
public static string smethod_0(string string_0, string string_1)
{
    byte[] bytes = Encoding.UTF8.GetBytes(string_0);
    byte[] array = new byte[bytes.Length];
    for (int i = 0; i < bytes.Length; i++)
    {
        array[i] = (byte)((char)bytes[i] ^ string_1[i % string_1.Length]);
    }
    return Convert.ToBase64String(array);
}

// Token: 0x06000036 RID: 54 RVA: 0x00003498 File Offset: 0x00001698
public static string smethod_1(string string_0, string string_1)
{
    byte[] array = Convert.FromBase64String(string_0);
    byte[] array2 = new byte[array.Length];
    for (int i = 0; i < array.Length; i++)
    {
        array2[i] = (byte)((char)array[i] ^ string_1[i % string_1.Length]);
    }
    return Encoding.UTF8.GetString(array2);
}

}

From what I understand, my flag, the argument with which the script must be run is string text = "BXQMRxx7GDwXHgAAF2QLCzMQNWUIaAgABx8yERMBZlI=";

But when I run the file with the decoded base64 value(tG{<��d35eh�2fR) of BXQMRxx7GDwXHgAAF2QLCzMQNWUIaAgABx8yERMBZlI= as an argument, it does not take it into account.

With what argument should the file be run?

Answer 1

Have you pay attention to code smethod_1 ?

Console.WriteLine(smethod_1("BXQMRxx7GDwXHgAAF2QLCzMQNWUIaAgABx8yERMBZlI=","Q0BwVHVyZVRoZUZsQGc="));

TDN0J3NEMHRoM1QxbWVXYXJwQWdhIW4=

echo TDN0J3NEMHRoM1QxbWVXYXJwQWdhIW4= | base64 -d
L3t'sD0th3T1meWarpAga!