1

This is be-quick-or-be-dead-1 in picoCTF challenge (Download)

in this file we can see decrypt_flag() function, this function return this flag:

./be-quick-or-be-dead-1 
Calculating key...
Done calculating key
Printing flag:
picoCTF{why_bother_doing_unnecessary_computation_fedbb737}

i wanted to implement this function with python, and i wrote this code:

key=[0x2c,0x97,0xa5,0xe9]
i=0
flag=[0x5c,0xfe,0xc6,0x86,0x6e,0xc3,0xe3,0x92,0x59,0xff,0xdc,0xb6,0x4d,0xf8,0xd1,0x81,0x55,0xe5,0xfa,0x8d,0x5e,0xfe,0xcb,0x8e,0x6d,0xe2,0xcb,0x87,0x56,0xf4,0xc0,0x9a,0x47,0xf6,0xd7,0x90,0x6a,0xf4,0xca,0x84,0x46,0xe2,0xd1,0x88,0x43,0xfe,0xca,0x87,0x67,0xf1,0xc0,0x8d,0x5b,0xf5,0x92,0xda,0x0d,0xea]
while i < 58 :
    flag[i] = chr(flag[i] ^ key[(i&3)])
    i=i+1

print "".join(flag)

but when i run it, print wrong flag:

picoBTF{uhy_aothyr_dringAunnzceskaryFcomjutaoionKfedwb73!}

what is my problem?

thank you

2

Your solution script is missing one vital part. if you look at the disassembly you could notice such part

0x004006ee      8b45ec         mov eax, dword [var_14h]
0x004006f1      83c001         add eax, 1
0x004006f4      8945ec         mov dword [var_14h], eax

Where var_14h the key is located so that this part is modifying the first entry in the key every time the algorithm loops over it (you can check few lines above those ones). You could modify your script like this:

➜ picoCTF cat solv.py

key=[0x2c,0x97,0xa5,0xe9]
i=0
flag=  [0x5c,0xfe,0xc6,0x86,0x6e,0xc3,0xe3,0x92,0x59,0xff,0xdc,0xb6,0x4d,0xf8,0xd1,0x81,0x55,0xe5,0xfa,0x8d,0x5e,0xfe,0xcb,0x8e,0x6d,0xe2,0xcb,0x87,0x56,0xf4,0xc0,0x9a,0x47,0xf6,0xd7,0x90,0x6a,0xf4,0xca,0x84,0x46,0xe2,0xd1,0x88,0x43,0xfe,0xca,0x87,0x67,0xf1,0xc0,0x8d,0x5b,0xf5,0x92,0xda,0x0d,0xea]
while i < 58 :
    flag[i] = chr(flag[i] ^ key[(i&3)])
    if i&3 == 0:
        key[0] = key[0] + 1
    i=i+1

print "".join(flag)

➜ picoCTF python solv.py
picoCTF{why_bother_doing_unnecessary_computation_fedbb737}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.