Skip to main content

Phase 3 (75 pts)

This is a little more challenging but still nonetheless manageable.

Problem Statement

Reflections? Rotations? Translations? This is starting to sound like geometry...

Author: treap_treap

Solution

Sounds complex. Let's look at it using Ghidra.

Ghidra

bool phase3(undefined8 param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
undefined4 param_5,undefined4 param_6,undefined4 param_7,undefined4 param_8,char *param_9
)

{
int strCmpRes;
char *__s1;
char *outputStr;
undefined8 in_R8;
undefined8 in_R9;
undefined4 extraout_XMM0_Da;
undefined in_stack_ffffffffffffffc8;
char *inputPtr;

puts("\nReflections? Rotations? Translations? This is starting to sound like geometry...");
__s1 = (char *)calloc(0x29,1);
getInput(extraout_XMM0_Da,param_2,param_3,param_4,param_5,param_6,param_7,param_8,3,param_9,
&DAT_001028d1,__s1,in_R8,in_R9,in_stack_ffffffffffffffc8);
inputPtr = __s1;
while (*inputPtr != '\0') {
outputStr = func3_1(inputPtr);
*inputPtr = *outputStr;
outputStr = func3_2(inputPtr);
*inputPtr = *outputStr;
inputPtr = inputPtr + 1;
}
strCmpRes = strcmp(__s1,"\"_9~Jb0!=A`G!06qfc8\'_20uf6`2%7");
free(__s1);
return strCmpRes == 0;
}

Understanding

Initially, I had spent a huge amount of time trying to reverse the functions by coding a Python script to attempt to go backwards from the given string back to the flag.

However, I realise that it might not be an onto function, where every output can easily be mapped back to the original flag.

Hence, I decided to replicate the 2 functions in Python and brute force the flag using the 127 different characters in ASCII.

Solve.py

target = "\"_9~Jb0!=A`G!06qfc8\'_20uf6`2%7"
flag = ""

for c in target:
for i in range(1, 128):
tmp = i
# Function3_1
if tmp > ord('@') and tmp < ord('['):
tmp -= 0xd
if tmp < ord('A'):
tmp += 0x1a

if tmp > ord('`') and tmp < ord('{'):
tmp -= 0xd
if tmp < ord('a'):
tmp += 0x1a

# Function3_2
if tmp > ord(' ') and tmp != 0x7f:
tmp -= 0x2f
if tmp < ord('!'):
tmp += ord('^')

if (chr(tmp) == c):
flag += chr(i)
break

print(flag)

Flag

DawgCTF{D0uBl3_Cyc1iC_rO74tI0n_S7r1nGs}