Jasper676767's Red light

Author:
Jasper676767

Language:
C/C++

Upload:
2026-08-08 07:47

Download

Platform:
Unix/linux etc.

Difficulty:
3.7

Quality:
4.0

Arch:
x86

Downloads:
49

Size:
14.14 KB

Writeups:
0

Comments:
3

Description

Can you find the flag? Hint: The flag is split into 4 parts yaey and has gone thru some encoding and encryption Good Luck!

Labels ?

String / data encryption XOR Base64 (encryption) Packer UPX

Comments (3)
Writeups (0)

You must be logged in to post a comment

LizaUniqueMe on 2026-08-09 12:14: Man what the hell is this binary A whole brain fuck.

LizaUniqueMe on 2026-08-09 13:23: [Click to reveal]

Jasper676767 on 2026-08-10 04:33: [Click to reveal]uhhh the flag is: FLAG{I_@m_A_MaSt3R_Ra1ge_5ai7er}. Ok so basically there are a bunch of functions, and since this aint stripped, you can find functions called checkpass() curfew() etc The first interesting discovery was that the program contains quite a lot of deliberate misdirection. Some branches look important but either lead nowhere useful or exist mainly to waste the reverser's time. For example, the first two inputs need to be different; making them equal causes checkPass() to take the distraction path. There are also suspicious-looking values and messages such as the "legal age limit is 0x23" and "key:105" hints. Naturally, these look like things you're supposed to use to recover the flag, which makes them excellent bait. Following the useful execution path eventually leads to curfew(). One of its checks involves the hexadecimal constant 0xceb433cd3bd85, which converts to the decimal value 3636373736373637. Passing the different checks allows the program to continue through the later stages, but at this point it becomes clear that simply satisfying the program's inputs isn't necessarily the easiest way to recover the flag. Static analysis is much faster. The biggest clue is the extremely suspicious sentence: Funny vultures Dance happily past ancient Doors over hills again It looks like random nonsense—which is exactly why it deserves attention in a crackme. Taking the first character of every word produces: fvDhpaDoha This turns out to be the repeating XOR key used for the encoded flag data. Elsewhere in the binary are strange hexadecimal-looking fragments, including data such as 021c58360710382e3502320. Rather than being random garbage, these are pieces of the encrypted payload. After reconstructing the relevant encoded data and XORing it with the repeating fvDhpaDoha key, the result still isn't the flag. Instead, it produces: RkxBR3tJX0BtX0FfTWFTdDNSX1JhMWdlXzVhaTdlcn0= The trailing = and character set make this recognizable as Base64. Decoding it gives the final flag: FLAG{I_@m_A_MaSt3R_Ra1ge_5ai7er}

Show all spoilers

You must be logged in to submit a writeup

crackmes.one

crackmes.one

Jasper676767's Red light