PlaidCTF 2020 - Reee

This is the solution of the challenge “Reee” given during the PlaidCTF 2020 CTF. It was solved by executing an unscrambling function to get the compare algorithm. Then figure out what the algorithm does to recover the flag.


Reversing (150 pts)


Tired from all of the craziness in the Inner Sanctum, you decide to venture out to the beach to relax. You doze off in the sand only to be awoken by the loud “reee” of an osprey. A shell falls out of its talons and lands right where your head was a moment ago. No rest for the weary, huh? It looks a little funny, so you pick it up and realize that it’s backwards. I guess you’ll have to reverse it. Problem Details


Hint: Flag format

The flag format is pctf{$FLAG}. This constraint should resolve any ambiguities in solutions.


Points: 150

Category: reverse


The file is a standard x86-64 binary:

$ file reee
reee: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/, for GNU/Linux 2.6.32, BuildID[sha1]=3ccec76609cd013bea7ee34dffc8441bfa1d7181, stripped

And it’s waiting an argument:

$ ./reee hello

I opened it in radare2:


I remarked that the argument is passed to the fcn.004006e5 function and if the result is 0 then the string “Correct!” is printed. But this function seems scrambled:

[0x004006e5]> s fcn.004006e5; pd 10
       ╎╎   ; CALL XREFS from main @ 0x400699, 0x4006a5, 0x4006db
 60: fcn.004006e5 (int64_t arg2, uint32_t arg4, int64_t arg_58ae7f6ah);
 bp: 1 (vars 0, args 1)
 sp: 0 (vars 0, args 0)
 rg: 2 (vars 0, args 2)
      ╎╎   0x004006e5      f9             stc
      ╎╎   0x004006e6      93             xchg eax, ebx
     ┌───< 0x004006e7      752d           jne 0x400716
     ╎╎   0x004006e9      dbc6           fcmovnb st(0), st(6)
     ╎╎   0x004006eb      ab             stosd dword [rdi], eax
     ╎└─< 0x004006ec      e0a2           loopne 0x400690
         0x004006ee      3b499d         cmp ecx, dword [rcx - 0x63] ; arg4
         0x004006f1      8c5c86dd       mov word [rsi + rax*4 - 0x23], ds ; arg2
          0x004006f5      0e             invalid
      └──< 0x004006f6      73cd           jae 0x4006c5                ; main+0x77

In fact if we break just before the function call we have the function unscrambled. I just checked that the scrambling was the same for different input arguments:

[0x004006d4]> ood hello; dcu 0x4006d4
child received signal 9
Stepping failed!
Process with PID 10921 started...
= attach 10921 10921
File dbg:////reee  hello reopened in read-write mode
Continue until 0x004006d4 using 1 bpsize
[0x7fde560fcfe6]> s fcn.004006e5; pd 10
            ; CALL XREFS from main @ 0x400699, 0x4006a5, 0x4006db
 60: fcn.004006e5 (int64_t arg2, uint32_t arg4, int64_t arg_58ae7f6ah);
 bp: 1 (vars 0, args 1)
 sp: 0 (vars 0, args 0)
 rg: 2 (vars 0, args 2)
           0x004006e5      55             push rbp
           0x004006e6      488bec         mov rbp, rsp
           0x004006e9      e814000000     call 0x400702
           0x004006ee      8ac8           mov cl, al                  ; arg4
           0x004006f0      b832e45fae     mov eax, 0xae5fe432
            0x004006f5      05ce1ba051     add eax, 0x51a01bce
            0x004006fa      ffc0           inc eax
        ┌─< 0x004006fc      7308           jae 0x400706
           0x004006fe      8ac1           mov al, cl
           0x00400700      c9             leave

Then we can decompile the function:

[0x00400702]> pdg
bool fcn.00400702(void)
    char cVar1;
    char *in_RAX;
    int32_t iVar2;
    int64_t iVar3;
    char *pcVar4;
    uint8_t uVar5;
    int32_t iVar6;
    int32_t iVar7;
    bool bVar8;
    iVar3 = -1;
    pcVar4 = in_RAX;
    do {
        if (iVar3 == 0) break;
        iVar3 = iVar3 + -1;
        cVar1 = *pcVar4;
        pcVar4 = pcVar4 + 1;
    } while (cVar1 != '\0');
    iVar2 = ~(uint32_t)iVar3 - 1;
    uVar5 = 0x50;
    iVar6 = 0;
    while (iVar6 < 0x539) {
        iVar7 = 0;
        while (iVar7 < iVar2) {
            in_RAX[iVar7] = in_RAX[iVar7] ^ uVar5;
            uVar5 = uVar5 ^ in_RAX[iVar7];
            iVar7 = iVar7 + 1;
        iVar6 = iVar6 + 1;
    bVar8 = true;
    iVar6 = 0;
    while (iVar6 < iVar2) {
        if (bVar8 == false) {
            bVar8 = false;
        } else {
            bVar8 = in_RAX[iVar6] == *(char *)((int64_t)iVar6 + 0x4008eb);
        iVar6 = iVar6 + 1;
    return bVar8;

So the first byte of the flag is XORed with 0x50 the second byte is XORed with the first byte of the flag and so on 1337 times. The result is compared with the data stored at 0x4008eb. If they match it prints “Correct”. Since the 34th byte is 0 I guessed the flag length was 33. So we can starts from the results:

[0x00400702]> pxj 34@0x4008eb

And come back to the beginning, i.e. until the value to XORed equals 0x50. Since we do not know the last byte value XORed we have to bruteforce it. It gives in Python:

data = [72,95,54,53,53,37,20,44,29,1,3,45,12,111,53,97,126,52,10,68,36,44,74,70,25,89,91,14,120,116,41,19,44]
length = len(data)-1

for k in range(0,256):
	mask = k
	flag = bytearray(data)
	for i in range(0,1337):
		for j in range(length,-1,-1):
			mask = flag[j] ^ mask
			flag[j] = flag[j] ^ mask
	if mask == 0x50:

And I got the flag:


z3 ?