Phase 3 (75 pts)

This is a little more challenging but still nonetheless manageable.

Problem Statement

Reflections? Rotations? Translations? This is starting to sound like geometry...

Author: treap_treap

Solution

Sounds complex. Let's look at it using Ghidra.

Ghidra

phase3

bool phase3(undefined8 param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
           undefined4 param_5,undefined4 param_6,undefined4 param_7,undefined4 param_8,char *param_9
           )

{
  int strCmpRes;
  char *__s1;
  char *outputStr;
  undefined8 in_R8;
  undefined8 in_R9;
  undefined4 extraout_XMM0_Da;
  undefined in_stack_ffffffffffffffc8;
  char *inputPtr;

  puts("\nReflections? Rotations? Translations? This is starting to sound like geometry...");
  __s1 = (char *)calloc(0x29,1);
  getInput(extraout_XMM0_Da,param_2,param_3,param_4,param_5,param_6,param_7,param_8,3,param_9,
           &DAT_001028d1,__s1,in_R8,in_R9,in_stack_ffffffffffffffc8);
  inputPtr = __s1;
  while (*inputPtr != '\0') {
    outputStr = func3_1(inputPtr);
    *inputPtr = *outputStr;
    outputStr = func3_2(inputPtr);
    *inputPtr = *outputStr;
    inputPtr = inputPtr + 1;
  }
  strCmpRes = strcmp(__s1,"\"_9~Jb0!=A`G!06qfc8\'_20uf6`2%7");
  free(__s1);
  return strCmpRes == 0;
}

func3_1

char * func3_1(char *character)

{
  char cVar1;

  if (('@' < *character) && (*character < '[')) {
    *character = *character + -0xd;
    if (*character < 'A') {
      cVar1 = '\x1a';
    }
    else {
      cVar1 = '\0';
    }
    *character = cVar1 + *character;
  }
  if (('`' < *character) && (*character < '{')) {
    *character = *character + -0xd;
    if (*character < 'a') {
      cVar1 = '\x1a';
    }
    else {
      cVar1 = '\0';
    }
    *character = cVar1 + *character;
  }
  return character;
}

func3_2

char * func3_2(char *character)

{
  char cVar1;

  if ((' ' < *character) && (*character != '\x7f')) {
    *character = *character + -0x2f;
    if (*character < '!') {
      cVar1 = '^';
    }
    else {
      cVar1 = '\0';
    }
    *character = cVar1 + *character;
  }
  return character;
}

Understanding

Initially, I had spent a huge amount of time trying to reverse the functions by coding a Python script to attempt to go backwards from the given string back to the flag.

However, I realise that it might not be an onto function, where every output can easily be mapped back to the original flag.

Hence, I decided to replicate the 2 functions in Python and brute force the flag using the 127 different characters in ASCII.

Solve.py

target = "\"_9~Jb0!=A`G!06qfc8\'_20uf6`2%7"
flag = ""

for c in target:
    for i in range(1, 128):
        tmp = i
        # Function3_1
        if tmp > ord('@') and tmp < ord('['):
            tmp -= 0xd
            if tmp < ord('A'):
                tmp += 0x1a

        if tmp > ord('`') and tmp < ord('{'):
            tmp -= 0xd
            if tmp < ord('a'):
                tmp += 0x1a

        # Function3_2
        if tmp > ord(' ') and tmp != 0x7f:
            tmp -= 0x2f
            if tmp < ord('!'):
                tmp += ord('^')

        if (chr(tmp) == c):
            flag += chr(i)
            break

print(flag)

Flag

DawgCTF{D0uBl3_Cyc1iC_rO74tI0n_S7r1nGs}