| arshi.py |
You were right, it was solvable, and GPT-6 Astra eventually pulled it off! About six hours total: exact passphrase recovered, full MAC verified, success message decrypted — all without executing the original. Full write-up is ready. Thanks for pushing us to keep digging! :)
Nice work.
|
2026-11-06 19:09 |
| arshi.py |
[Click to reveal]Spent about three hours on this with GPT-6 Astra, and we still couldn't recover the damn passphrase.
We deobfuscated the Python, reconstructed the validation pipeline, built separate implementations of the checker, and cross-checked their results. We also dug into the custom transformations and VM, tested millions of password candidates, and investigated whether the embedded tables or generated constants leaked anything useful. All of this was done through static analysis and our own models, without running the original script.
We got a pretty solid understanding of how the checker works, but couldn't turn that understanding into a practical attack. Even forcing the success branch wouldn't recover the protected message, because its decryption key depends on the input.
DeepSeek's verdict was that the challenge was unsolvable. I wouldn't treat that as proof — an AI giving up doesn't establish mathematical impossibility — but we certainly didn't find a workable path either.
Eventually I ran out of patience and couldn't be bothered to keep digging. If there really is a recoverable passphrase and an intended solution, congratulations: you've made one hell of an AI-resistant crackme. It thoroughly defeated our attempts.
|
2026-11-06 16:40 |