[ReverseMe] Recursion

GnikDroy · June 16, 2020, 7:59am

Goal

Get the flag which is in the form of REVERSE{...}

Rules

No rules. Everything is allowed.

Author assigned difficulty

None.

Community assigned difficulty

1
2
3
4
5

0 voters

Best of luck!

Executable

f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAQBEAAAAAAABAAAAAAAAAAEAxAAAAAAAAAAAAAEAAOAAN
AEAAHQAcAAYAAAAEAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAA2AIAAAAAAADYAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAAAYAwAAAAAAABgDAAAAAAAAGAMAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgHAAAAAAAAyAcAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAA1QQAAAAAAADVBAAAAAAAAAAQAAAA
AAAAAQAAAAQAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAQDQAAAAAAABANAAAAAAAAABAAAAAA
AAABAAAABgAAAIAtAAAAAAAAgD0AAAAAAACAPQAAAAAAAJACAAAAAAAAmAIAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAkC0AAAAAAACQPQAAAAAAAJA9AAAAAAAA8AEAAAAAAADwAQAAAAAAAAgAAAAAAAAA
BAAAAAQAAAA4AwAAAAAAADgDAAAAAAAAOAMAAAAAAAAgAAAAAAAAACAAAAAAAAAACAAAAAAAAAAE
AAAABAAAAFgDAAAAAAAAWAMAAAAAAABYAwAAAAAAAEQAAAAAAAAARAAAAAAAAAAEAAAAAAAAAFPl
dGQEAAAAOAMAAAAAAAA4AwAAAAAAADgDAAAAAAAAIAAAAAAAAAAgAAAAAAAAAAgAAAAAAAAAUOV0
ZAQAAAC4KwAAAAAAALgrAAAAAAAAuCsAAAAAAABEAAAAAAAAAEQAAAAAAAAABAAAAAAAAABR5XRk
BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQE
AAAAgC0AAAAAAACAPQAAAAAAAIA9AAAAAAAAgAIAAAAAAACAAgAAAAAAAAEAAAAAAAAAL2xpYjY0
L2xkLWxpbnV4LXg4Ni02NC5zby4yAAAAAAAEAAAAEAAAAAUAAABHTlUAAgAAwAQAAAADAAAAAAAA
AAQAAAAUAAAAAwAAAEdOVQCSJZX5oSYUqp1zI9+6jS/MiiKregQAAAAQAAAAAQAAAEdOVQAAAAAA
AwAAAAIAAAAAAAAAAAAAAAIAAAANAAAAAQAAAAYAAAAAAIEAAAAAAA0AAAAAAAAA0WXObQAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhAAAAEgAAAAAAAAAAAAAAAAAAAAAAAACKAAAAIAAAAAAA
AAAAAAAAAAAAAAAAAAALAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAEgAAAAAAAAAAAAAAAAAA
AAAAAAAwAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAApAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAA1AAAA
EgAAAAAAAAAAAAAAAAAAAAAAAABXAAAAEgAAAAAAAAAAAAAAAAAAAAAAAACmAAAAIAAAAAAAAAAA
AAAAAAAAAAAAAAA6AAAAEgAAAAAAAAAAAAAAAAAAAAAAAABBAAAAEgAAAAAAAAAAAAAAAAAAAAAA
AAC1AAAAIAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAIgAAAAAAAAAAAAAAAAAAAAAAAAAAbGliYy5z
by42AHB1dHMAX19zdGFja19jaGtfZmFpbABwdXRjaGFyAHByaW50ZgBtbWFwAHJlYWQAbWVtY3B5
AG11bm1hcABfX2N4YV9maW5hbGl6ZQBfX2xpYmNfc3RhcnRfbWFpbgBHTElCQ18yLjE0AEdMSUJD
XzIuNABHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX19nbW9uX3N0YXJ0
X18AX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQAAAAACAAAAAgADAAIAAgACAAIAAAAEAAIAAAAC
AAAAAAABAAMAAQAAABAAAAAAAAAAlJGWBgAABABpAAAAEAAAABRpaQ0AAAMAdAAAABAAAAB1GmkJ
AAACAH4AAAAAAAAAgD0AAAAAAAAIAAAAAAAAACASAAAAAAAAiD0AAAAAAAAIAAAAAAAAAOARAAAA
AAAACEAAAAAAAAAIAAAAAAAAAAhAAAAAAAAA2D8AAAAAAAAGAAAAAgAAAAAAAAAAAAAA4D8AAAAA
AAAGAAAACAAAAAAAAAAAAAAA6D8AAAAAAAAGAAAACQAAAAAAAAAAAAAA8D8AAAAAAAAGAAAADAAA
AAAAAAAAAAAA+D8AAAAAAAAGAAAADQAAAAAAAAAAAAAAmD8AAAAAAAAHAAAAAQAAAAAAAAAAAAAA
oD8AAAAAAAAHAAAAAwAAAAAAAAAAAAAAqD8AAAAAAAAHAAAABAAAAAAAAAAAAAAAsD8AAAAAAAAH
AAAABQAAAAAAAAAAAAAAuD8AAAAAAAAHAAAABgAAAAAAAAAAAAAAwD8AAAAAAAAHAAAABwAAAAAA
AAAAAAAAyD8AAAAAAAAHAAAACgAAAAAAAAAAAAAA0D8AAAAAAAAHAAAACwAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPMPHvpIg+wI
SIsF2S8AAEiFwHQC/9BIg8QIwwAAAAAA/zViLwAA8v8lYy8AAA8fAPMPHvpoAAAAAPLp4f///5Dz
Dx76aAEAAADy6dH///+Q8w8e+mgCAAAA8unB////kPMPHvpoAwAAAPLpsf///5DzDx76aAQAAADy
6aH///+Q8w8e+mgFAAAA8umR////kPMPHvpoBgAAAPLpgf///5DzDx76aAcAAADy6XH///+Q8w8e
+vL/JT0vAAAPH0QAAPMPHvry/yXNLgAADx9EAADzDx768v8lxS4AAA8fRAAA8w8e+vL/Jb0uAAAP
H0QAAPMPHvry/yW1LgAADx9EAADzDx768v8lrS4AAA8fRAAA8w8e+vL/JaUuAAAPH0QAAPMPHvry
/yWdLgAADx9EAADzDx768v8llS4AAA8fRAAA8w8e+jHtSYnRXkiJ4kiD5PBQVEyNBWYDAABIjQ3v
AgAASI09wQAAAP8Vci4AAPSQSI09mS4AAEiNBZIuAABIOfh0FUiLBU4uAABIhcB0Cf/gDx+AAAAA
AMMPH4AAAAAASI09aS4AAEiNNWIuAABIKf5IifBIwe4/SMH4A0gBxkjR/nQUSIsFJS4AAEiFwHQI
/+BmDx9EAADDDx+AAAAAAPMPHvqAPSUuAAAAdStVSIM9Ai4AAABIieV0DEiLPQYuAADoqf7//+hk
////xgX9LQAAAV3DDx8Aww8fgAAAAADzDx766Xf////zDx76VUiJ5UFUU0iD7DBkSIsEJSgAAABI
iUXoMcBIieBIicO4UAAAAEiYSIPoAUiJRdC4UAAAAEiYSYnAQbkAAAAAuFAAAABImEiJxr8AAAAA
uFAAAABImLoQAAAASIPqAUgB0LkQAAAAugAAAABI9/FIa8AQSInCSIHiAPD//0iJ4Ugp0UiJykg5
1HQSSIHsABAAAEiDjCT4DwAAAOvpSInCgeL/DwAASCnUSInCgeL/DwAASIXSdBAl/w8AAEiD6AhI
AeBIgwgASIngSIPAAEiJRdhIjT0HGAAA6Mb9//+4UAAAAEhj0EiLRdhIica/AAAAAOjt/f//iUXI
uFAAAAA5Rch0GUiNPeoXAADolP3//7j/////SInc6egAAABBuQAAAABBuP////+5IgAAALoHAAAA
vuQKAAC/AAAAAOiC/f//SIlF4EiDfeD/D4SsAAAASItF4LrkCgAASI01kwwAAEiJx+iL/f//SItF
2EmJxEiLVeC4AAAAAP/SiUXMg33MAXVXSI09iRcAALgAAAAA6D/9///HRcQAAAAA6ydIi1XYi0XE
SJgPtgQCD7bAicZIjT2EFwAAuAAAAADoE/3//4NFxAG4UAAAADlFxHzPv30AAADou/z//+sRSI09
YhcAALgAAAAA6Oj8//9Ii0XgvuQKAABIicfoB/3//0iJ3LgAAAAASItd6GRIMxwlKAAAAHQF6Jv8
//9IjWXwW0FcXcNmkPMPHvpBV0yNPSMpAABBVkmJ1kFVSYn1QVRBifxVSI0tFCkAAFNMKf1Ig+wI
6H/7//9Iwf0DdB8x2w8fgAAAAABMifJMie5EiedB/xTfSIPDAUg53XXqSIPECFtdQVxBXUFeQV/D
ZmYuDx+EAAAAAADzDx76wwAAAPMPHvpIg+wISIPECMMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAEiLNXwAAABBuiIAAAC4CQAAALoHAAAAScfA/////0gx/00xyQ8FSDHJ
SDH/SI0VWAAAAIoUCoDyn4gUCIn+SMHuGEjB5whAANdIMfdI/8FIOw0tAAAAddRBizQkOf4PlMN1
CkmDxARQ/9CIw1hIicdIizUMAAAAuAsAAAAPBUgPtsPDWQoAAAAAAADSrlbWWF9gYGBg165gJZif
n58nlp+fn94lvZ+fn9cUqsCfn5+QmteuVteuYNcSisefn58Vi5UfbSkXi5cWYddecYfXXniX359I
165o12Be16SSsp+fn+pL3hSru6ZhkAtc6pXP1hxbm2BPF1zH1xZYJ5Sfn5/XFKqYn5+fkJrXkClc
XFGWn5+fn5+fZBjgYO7p1tbW1mGiHFspKSmRICkpKZMuKSkpaJMLKSkpYRjWJixhGNZhGOBhpDxx
KSkpoz0jqdsloT0hoNdh6McxYejOIWkp/mEY3mHW6GESJAQpKSlc/WiiHQ0Q1ya96lwjYKrtLXnW
+aHqcWGg7pEiKSkpYaIcLikpKSYsYSaf6upqICkpKSkpKW0U2mzi5dra2tqdLCUlJW2uEEglJSVk
nwclJSWfIiUlJWgU7CogbRTsbRTabagwfSUlJa8xL6XXZ60xLazbbeTLPW3kwi1lJfJtFNJt2uRt
HigIJSUlUPFkrhEBHNsqseZQL3VspuEh2vWt5n1trOJtrhApJSUlnS4lJSUqIG0qk+bmnS0lJSUl
JSUuoKeYmJiYL1aY3WBnZ2cv7FIKZ2dnKlauJt1FZ2dn325nZ2doYi9WmC9Wri/qcj9nZ2ftc23n
lS3vc2/umS+miX8vpoBvJ2ewL1aQL5imL1xqSmdnZxKzJuxTQ16ZaPOkEm03LuSjY5i376Q/L+6g
L+xSa2dnZ99sZ2dnaGIvaNGkpEpvZ2dnZ2dnZRzSYBzklyotLS1lphhcLS0tZOrt0tLS0pUkLS0t
bJcPLS0tIihlHNJlHORloDh1LS0tpzknrd/npTklpNNl7MM1ZezKJW0t+mUc2mXS7GUWIAAtLS1Y
+WymGQkU0yK57lgnfWSu6SnS/aXudWWk6pUmLS0tZaYYKi0tLSIoZSKb7u6PKi0tLS0tLaZdxefn
569s0pHn5+euICcYGBgYr9YYqtYuX+7n5+dd4Ofn5+jir9YYr9Yur2ryv+fn523z7WcVoW/z724Z
ryYJ/68mAO+n5zCv1hCvGCav3OrK5+fnkjOmbNPD3hnocySS7a5kI+O3GDdvJL+vbiCvbNLr5+fn
X+zn5+fo4q/oUSQk8ODn5+fn5+cbpqGhoehmYV5eXl4ZqKGhoeyQaOkqlMmhoaHpkF7gG4OhoaGu
pOmQXumQaOkstPmhoaErtashUw8ptakoX+lgT7npYEap4aF26ZBW6V5g6ZqsjKGhodR14CqVhZhf
rjVi1Kvx6CJlpV5xKWL56Shm6SqUraGhoRmqoaGhrqTprhdiYi2noaGhoaGhQj7GTrUtDw8PR4Q6
fA8PD7UIDw8PRsjP8PDw8Ec+8LcGDw8PAApHPsZHPvBHghpXDw8PhRsFj/3PhxsHhvFHzuEXR87o
B08P2Ec++Efwzkc0AiIPDw96206EOys28QCbzHoFRozLC1/w34fMV0eGyEeEOgMPDw+3BA8PDwAK
RwC5zMwOCQ8PDw8PD4dE+rPPz8+GCA8wMDAwd8bPz8+Ode3Pz891yM/Pz4L+Bof+MMDKh/4wh/4G
h0Lal8/Pz0XbxU89Gkfbx0Yxhw4h14cOKMePzxiH/jiHMA6H9MLiz8/PuhuORPvr9jHAWwy6xYZM
C8ufMB9HDJeHRgh3xM/Pz4dE+sjPz8/AyofAeQwMucrPz8/Pz89SK+VSkS9jGhoaohMaGhpboDga
GhpT3drl5eXlVyvToB0aGhoVH1Ir5VIr01KXD0IaGhqQDhCa6LCSDhKT5FLb9AJS2/0SWhrNUivt
UuXbUiEXNxoaGm/OW5EuPiPkFY7ZbxBKU5neHuXKktlCUpPdUpEvFhoaGqIRGhoaFR9SFazZ2fEe
GhoaGhoaCrewsLD9gXn4gU8IubCwsPl3cE9PT0/xCpKwsLD4O4XvsLCwv7X4gU/4gXn4PaXosLCw
OqS6MEJbOKS4OU74cV6o+HFXuPCwZ/iBR/hPcfiLvZ2wsLDFZPE7hJSJTr8kc8W6+TN0tOBPYDhz
6Pg5dwi7sLCw+DuFt7CwsL+1+L8Gc3PQtLCwsLCwsBZqkuFcW1tbGuF5W1tb41JbW1sSnJukpKSk
E2qkE9BuBFtbW1ReE2qSE2qkE9ZOA1tbW9FPUdupFtNPU9KlE5q1QxOavFMbW4wTaqwTpJoTYFZ2
W1tbLo8a0G9/YqVUz5guUQsS2J9fpIvTmAMT0pwT0G5XW1tb41BbW1tUXhNU7ZiYjlhbW1tbW1tf
0dbp6enpV6w0FhYWrh8WFhZenSN8FhYWWyffrBEWFhZeJ+kZE14n6V4n316bA04WFhacAhyW5DWe
Ah6f6F7X+A5e1/EeVhbBXifhXunXXi0bOxYWFmPCV50iMi/oGYLVYxxGX5XSEunGntVOXp/RXp0j
GhYWFq4dFhYWGRNeGaDV1VwVFhYWFhYWjTw1NTV9vgBCNTU1fPL1ysrKynSPFzU1NY8yNTU1eAT8
fQTKOjB9BPx9BMp9uCBtNTU1vyE/tcfDvSE9vMt99NstffTSPXU14n0Ewn3K9H0OOBg1NTVA4XS+
AREMyzqh9kA/ZXy28THK5b32bX288n2+ADk1NTWNPjU1NTowfTqD9vaKNzU1NTU1NXnEw8PDe8rD
w8OKBAM8PDw8jvIKi0j2q8PDw4J54cPDw4vyPMzGi/IKi/I8i07Wm8PDw0nXyUMx6EvXy0o9iwIt
24sCJMuDwxSL8jSLPAKL+M7uw8PDtheCSPfn+j3MVwC2yZOKQAfHPBNLAJuLSgSLSPbPw8PDe8jD
w8PMxovMdQAA98HDw8PDw8NQ4ejo6KDZF6Bj3Zzo6OipUsro6OhS7+jo6KXZIaEvKBcXFxfn7aDZ
F6DZIaBl/bDo6Ohi/OJoGgFg/OBhFqApBvCgKQ/gqOg/oNkfoBcpoNPlxejo6J08qWPczNEW53wr
neK4oWss7Bc4YCuwoGEvUOPo6OigY93v6Ojo5+2g514rK0Hp6Ojo6OjoSYo0fQEBAUkw/rsGAQEB
QLsjAQEBuQgBAQFIxsH+/v7+TDDIDgRJMMhJMP5JjBRZAQEBixULgfOSiRUJiP9JwO8ZScDmCUEB
1kkw9kn+wEk6DCwBAQF01UCKNSU4/w6VwnQLSILFBVH+0YnCWUmIxkmKNA0BAQG5CgEBAQ4ESQ63
wsIfAAEBAQEBASqbkpKS36Nb2qNt0yiwkpKS2hmn+ZKSkiiVkpKS21VSbW1tbZ2X2qNt2qNb2h+H
ypKSkhiGmBJgpBqGmhts2lN8itpTdZrSkkXao2XabVPaqZ+/kpKS50bTGaa2q2ydBlHnmMLbEVaW
bUIaUcraG1XaGaeekpKSKpmSkpKdl9qdJFFRAZKSkpKSkpLplW0eo6SkpOwvkdCkpKTlHoakpKTs
lVvtY2RbW1tbHK2kpKSroeyVbeyVW+wpsfykpKQusK4kVowssKwtWuxlSrzsZUOs5KRz7JVT7Ftl
7J+piaSkpNFw5S+QgJ1aqzBn0a707SdgoFt0LGf87C1j7C+RqKSkpByvpKSkq6HsqxJnZ6ykpKSk
pKSkxEtMjYyMjE8AAAAAUAAAAEVudGVyIHRoZSBwYXNzd29yZDogAEluc3VmZmljaWVudCBwYXNz
Y29kZSBsZW5ndGgAAABDb25ncmF0dWxhdGlvbnMhIFRoZSBmbGFnIGlzOiBSRVZFUlNFewAlMDJ4
AAAAAABTb3JyeS4gV3JvbmcgZmxhZy4gVGhlIHBhc3N3b3JkIG1pZ2h0IG5vdCBiZSBwcmludGFi
bGUgY2hhcmFjdGVycy4gOikAAAABGwM7RAAAAAcAAABo5P//eAAAAPjk//+gAAAACOX//7gAAACI
5f//YAAAAHHm///QAAAAmOj///gAAAAI6f//QAEAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJAB
AAAUAAAAHAAAACDl//8vAAAAAEQHEAAAAAAkAAAANAAAAOjj//+QAAAAAA4QRg4YSg8LdwiAAD8a
OiozJCIAAAAAFAAAAFwAAABQ5P//EAAAAAAAAAAAAAAAFAAAAHQAAABI5P//gAAAAAAAAAAAAAAA
JAAAAIwAAACZ5f//JQIAAABFDhCGAkMNBkeMA4MEAxUCDAcIAAAAAEQAAAC0AAAAmOf//2UAAAAA
Rg4QjwJJDhiOA0UOII0ERQ4ojAVEDjCGBkgOOIMHRw5Abg44QQ4wQQ4oQg4gQg4YQg4QQg4IABAA
AAD8AAAAwOf//wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAgEgAAAAAAAOARAAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAA
AAAAABAAAAAAAAANAAAAAAAAAMgUAAAAAAAAGQAAAAAAAACAPQAAAAAAABsAAAAAAAAACAAAAAAA
AAAaAAAAAAAAAIg9AAAAAAAAHAAAAAAAAAAIAAAAAAAAAPX+/28AAAAAoAMAAAAAAAAFAAAAAAAA
ABgFAAAAAAAABgAAAAAAAADIAwAAAAAAAAoAAAAAAAAAzwAAAAAAAAALAAAAAAAAABgAAAAAAAAA
FQAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAgD8AAAAAAAACAAAAAAAAAMAAAAAAAAAAFAAAAAAAAAAH
AAAAAAAAABcAAAAAAAAACAcAAAAAAAAHAAAAAAAAAEgGAAAAAAAACAAAAAAAAADAAAAAAAAAAAkA
AAAAAAAAGAAAAAAAAAAeAAAAAAAAAAgAAAAAAAAA+///bwAAAAABAAAIAAAAAP7//28AAAAACAYA
AAAAAAD///9vAAAAAAEAAAAAAAAA8P//bwAAAADoBQAAAAAAAPn//28AAAAAAwAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAJA9AAAAAAAAAAAAAAAAAAAAAAAAAAAAADAQAAAAAAAAQBAAAAAA
AABQEAAAAAAAAGAQAAAAAAAAcBAAAAAAAACAEAAAAAAAAJAQAAAAAAAAoBAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIQAAAAAAAAEdDQzogKFVi
dW50dSA5LjMuMC0xMHVidW50dTIpIDkuMy4wAAAuc2hzdHJ0YWIALmludGVycAAubm90ZS5nbnUu
cHJvcGVydHkALm5vdGUuZ251LmJ1aWxkLWlkAC5ub3RlLkFCSS10YWcALmdudS5oYXNoAC5keW5z
eW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbGEuZHluAC5yZWxhLnBs
dAAuaW5pdAAucGx0LmdvdAAucGx0LnNlYwAudGV4dAAuZmluaQAucm9kYXRhAC5laF9mcmFtZV9o
ZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5maW5pX2FycmF5AC5keW5hbWljAC5kYXRhAC5ic3MA
LmNvbW1lbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAACwAAAAEAAAACAAAAAAAAABgDAAAAAAAAGAMAAAAAAAAcAAAAAAAA
AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABMAAAAHAAAAAgAAAAAAAAA4AwAAAAAAADgDAAAAAAAA
IAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAmAAAABwAAAAIAAAAAAAAAWAMAAAAAAABY
AwAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAOQAAAAcAAAACAAAAAAAAAHwD
AAAAAAAAfAMAAAAAAAAgAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEcAAAD2//9vAgAA
AAAAAACgAwAAAAAAAKADAAAAAAAAJAAAAAAAAAAGAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABRAAAA
CwAAAAIAAAAAAAAAyAMAAAAAAADIAwAAAAAAAFABAAAAAAAABwAAAAEAAAAIAAAAAAAAABgAAAAA
AAAAWQAAAAMAAAACAAAAAAAAABgFAAAAAAAAGAUAAAAAAADPAAAAAAAAAAAAAAAAAAAAAQAAAAAA
AAAAAAAAAAAAAGEAAAD///9vAgAAAAAAAADoBQAAAAAAAOgFAAAAAAAAHAAAAAAAAAAGAAAAAAAA
AAIAAAAAAAAAAgAAAAAAAABuAAAA/v//bwIAAAAAAAAACAYAAAAAAAAIBgAAAAAAAEAAAAAAAAAA
BwAAAAEAAAAIAAAAAAAAAAAAAAAAAAAAfQAAAAQAAAACAAAAAAAAAEgGAAAAAAAASAYAAAAAAADA
AAAAAAAAAAYAAAAAAAAACAAAAAAAAAAYAAAAAAAAAIcAAAAEAAAAQgAAAAAAAAAIBwAAAAAAAAgH
AAAAAAAAwAAAAAAAAAAGAAAAGAAAAAgAAAAAAAAAGAAAAAAAAACRAAAAAQAAAAYAAAAAAAAAABAA
AAAAAAAAEAAAAAAAABsAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAjAAAAAEAAAAGAAAA
AAAAACAQAAAAAAAAIBAAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAJcAAAAB
AAAABgAAAAAAAACwEAAAAAAAALAQAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAA
AACgAAAAAQAAAAYAAAAAAAAAwBAAAAAAAADAEAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA
ABAAAAAAAAAAqQAAAAEAAAAGAAAAAAAAAEARAAAAAAAAQBEAAAAAAACFAwAAAAAAAAAAAAAAAAAA
EAAAAAAAAAAAAAAAAAAAAK8AAAABAAAABgAAAAAAAADIFAAAAAAAAMgUAAAAAAAADQAAAAAAAAAA
AAAAAAAAAAQAAAAAAAAAAAAAAAAAAAC1AAAAAQAAAAIAAAAAAAAAACAAAAAAAAAAIAAAAAAAALYL
AAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAvQAAAAEAAAACAAAAAAAAALgrAAAAAAAAuCsA
AAAAAABEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAMsAAAABAAAAAgAAAAAAAAAALAAA
AAAAAAAsAAAAAAAAEAEAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADVAAAADgAAAAMAAAAA
AAAAgD0AAAAAAACALQAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA4QAAAA8A
AAADAAAAAAAAAIg9AAAAAAAAiC0AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAA
AO0AAAAGAAAAAwAAAAAAAACQPQAAAAAAAJAtAAAAAAAA8AEAAAAAAAAHAAAAAAAAAAgAAAAAAAAA
EAAAAAAAAACbAAAAAQAAAAMAAAAAAAAAgD8AAAAAAACALwAAAAAAAIAAAAAAAAAAAAAAAAAAAAAI
AAAAAAAAAAgAAAAAAAAA9gAAAAEAAAADAAAAAAAAAABAAAAAAAAAADAAAAAAAAAQAAAAAAAAAAAA
AAAAAAAACAAAAAAAAAAAAAAAAAAAAPwAAAAIAAAAAwAAAAAAAAAQQAAAAAAAABAwAAAAAAAACAAA
AAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAQAAAQAAADAAAAAAAAAAAAAAAAAAAAAQMAAA
AAAAACQAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAMAAAAAAAAAAAAAAAAAAAAA
AAAANDAAAAAAAAAKAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAA==

Build

cat rev.elf.b64 | base64 -d  > rev.elf && chmod +x rev.elf

Danus · June 16, 2020, 9:05am

This looks scary, gonna give this a shot when I get home

Leeky · June 16, 2020, 8:18pm

Was fun, the non printable flag messed a bit with me

sha1(flag) = 14ace92f2af048997932ba777cfe382803f48ce3

GnikDroy · June 17, 2020, 4:23am

The hash is correct! Very nice.

Since it was requested, I am posting a rar archive in base64 which contains the source files for the executable.
It is password protected with the flag REVERSE{..}

UmFyIRoHAQDX93M2IQQAAAEPeJxZELW4AlxE1UbTHZjZOrUUTrY9BRkJ5s7DK8NygbhEu0mhSCrm
XcrcGzwN/I2obT6K4cLlhaCul7SkOLFtZU5yLxWofiT2j0e5XAFXhNEEudBZoXGl3WbNzI+H2ztH
QmALABBaDYxaIrpKFX2ASLP4BmEnmktMAkbHsiuqFNwcYH5m/JY1/kSo2+KyDYzhYg6QvFzTkQzy
5mBCBEA7dDQ2Dcs3X05ov3HPIjoCQC0JOcXULluZH+XPW7dem6aGVLmXw05VFv6fGYCKKQYW6LBR
Ojy2kxlSibTMZwgo2uKp2knERvGNH0VkMokEbN206U34NXdJw6uiYajRqh1nR5RUHiY90xjqytfj
hrN5+mXbZT/mNax7aglsTqlaaT6lVcDoybbExVVcmUI0O7v4IxU3YS40F64ltkVTqHzELL45ruvG
DbFJ91U765yZg5DMCYAbQbbspnwpJUookreefvo+WcKjo/e+hYi14QU3ur8IypRQSMCf+3JI6TyG
3yS/YSqWs3kR5pxQTJomwIwoNXtzf33yqZyWdz50zw82IPDyAN31ki8Q9M973xCP9mPUFfR5gPb7
hxynpTyqy3cBiKtPX2j6wO+87OtXc8/KtGngWyAi7w+SomUFuMy0zJb2qWoW4mo2II6Hsj7c5feR
9q49dq0USgDmi/YDmpV+TK8WsKLpiJbJmWlS8pzYffz1w1y99JNVei89Nu5K9tnXUyhBNiE5kvR0
JnWwR4OwdOwntNoP/aA+DAXNeOUjoXJWdHuy8AERCJwVVFfqnScW4gmDY4ZPJMlamD0dTQRSA5/l
OKRYMz050gxP6s5hdkQjU3CDmE0JeTwDGxctRa0vCTV/pgMb/2Lhw/9aLKWC2Nj2ItgjTR3lNTOx
liiSz1dJWsXMTU8QJ32M0H8w2/elWfflIDb1RJk59x111IrVJ5/FCzvQVD2ujy+3gmyofwzkWHe0
1m9GN9IlzhfRLeW1L769E79uVeiP9Tpgkh0U17vy42l1Z7Mc3B3Bm3E+iLYr0rZaaqGi1rvsNHMt
+yer5jNpTx77ZxKN4jQ5PmxAP/o32jBw6ocNIlmhXQvub3zjXMdXR10W3qza8SvS7+SYPwC+QAGK
q1o2ysKOfQy/bKTO257bgGcBI6ELB1v9/b0f/ICn5wTziQZt79WkQJc3EH4Ywa1TcsnKgpyHHzXF
sy9j06Lc3k0WnzFT/6TP3Dw0/bah/v0cM1ZDFG7uFV+6qTsHE4aQnzrMUIsoUGjNjM0yXyxHaRc/
gV5WaTrPZds1Wh4F1muWMCd/7qz8EekUyz87S3bFwPaDxxRzH3r1x8V020rr0B/3f8P2ZaLl7EW7
75dvHE5IeNA/D/7nkUsR8PuTavIPT1S25AAcuRr6cMJ8qZgmLDo8tchNUUeB16YcBgqe5ABrI+D1
ydCbd2KI0AerVuVdf+sft/4scYl15pJ2Sbdhd2vDCC4Ppn8e6UTK40HGfUCMc8gz7qWOZgmzkvUy
V7nTThXZ7tMiXIO+fRu39n24x7gOWIvj6Knk0MJ4moEOSxmG0L5tSxMPepM0kjb2dBf81T2MNGZP
xoLomyV0NFC3Vay4WeCtB2AS9HQoiJrI+G1hJ715noIK2kIU9JjSVDm2fTMICEMUmRQoMk9/geSn
GGv1vZ9s9cYFRm6usa3CE2wA71Ihy0ak4AVb929yHVIsJ6ql0AJZpaW/fbaSN59WQXGrZRKobgj5
su7xgGeh1ag3p156LOwlUZNEV+/6NcZLuNZuF0LAZaPoziU6AR89RgSykKGmGG8hosrJss943U1C
6bUuSufgP7NUlHlJOPcVx2AlmzObgp2VAb8GVsr9ppISgdIdphPfPTvVhL5qhW+7dxHejcIZWY/6
Nsk/H0K4TVHZwWkxY5hKIsMmEaslXBOWPdbLIkoy1O/po5V+9L8wvDQ9MT3GNqPbr+XtzZnh/ee3
n42/iHIV/yhefxeO4msNleUFYb5StEedzuotIAxp7oVvhQo1giGNVgB39TWsffA9YSzvyUwpP7ya
G7ZXRM2Rk+QR3v2/7ZNcphjvhMd2JfBUJuFKBCcM1PLJZ7sh4g+DmUBVTgOfC0v3S90vuXd8xiko
DiWEEBEAP9rVho80C9hP5YAAD8VG9ydqJdMGy2PRZmEZtK3paU8TQD4lxMs+V+htvJXN+RcutcZq
6aCqTJK6BdMvCwkmXlyjCPtO9bgQWNQ+0NEiXMV0kfZjd7i2lVzehRBDwmR3eNqxWIYko3v3i/pa
ylFSQfFFTRhuX+OYuzgf+/i75d3WyCo1DZt/VkxiSOdeMfKz9jdgYBsBy3DnxkushNLaDt3nbASw
+7ZnP/XnVcmIDri/Tw5dEixzf+TSnG1dTmZHhMIW5k8SUL+ufVPKIHOBV8W6pwHnOiTLj4h6AU/w
0cgvg7slhw9za95WoxPzbnmy51SRkxsxpsFk2TBGTJZBiPe4kOoLaXa3xJo7MjYrmANEBsbfq5Ph
Xnwk52kiW4onbnsw7zZkT1YcyqWII0W9z6akkL7XUPQAk/dTFkaDaRajii+afZuQHLrHbQzrH13v
S+0PMRWYM4NvP++05KcjaldAMH8YFwB5F71uFo8Aykrtsx/109I7rHfwhS4wJUT6lGjeKe5xV4A4
JNDim7Qn/TR+mP+njFr92zapi2Je65JKXbK46FOv4ioyUzS9LMyHCZj2cny+r45S0M3InIl4RbjU
f1nE5gCdBUhNOe/s5zA44Uc2LPbMKeFS7gq1JPeYdRGI3rG/x1QAM6o33bonYbHXcB6oggUQsTFd
Yby2gOC8QdYv3RjToDqcEHew7EnkVSrP6yyr5wrtFrZCpfscxfeZCSRtg0Uen/MnUwR8xKa4vlvn
IsuqfGKvDWDe1hyeQlvGLCJzKeLfI9iYmVvmNJw1QWZoYGMJO/kM3v+Pl1iB7HvO/FX+QzUw28Qd
o8vT9wINr7hPyM7vwbUAIMwHuh5hXJfLhwehVeST5a5vzkAecx/LbBF9SBLFKcVsUMGHqGIEjHXe
SNkKgxHCvZxLJ3IUynGZFrOjQEpPRZaCqfW7uXy4DUWW2BNkCUsDqWJrqAeYD9Mv0/BZ66mPNCl9
BshnzG5Oo92ATZebsBKPm9EAxWn9iqe/fDfLDvVGV12VF/A906r15DnVmEJu0abrrCGMFOcgOcQv
dXu4SZAiFsfOsRPRqNqwIQm2AjSc3CJKVDOj7WjQ3ynJlKAmJu2App82EFu6+En0IEn7YzCIgHGt
N7/2gphraMe3dQHTBo3mBjFestz6auDKIjNVrhENrrQSz6LP0naHFNxDf9hWQUl3Q7ReWI5YrrGM
47DAl71aRoEOCoSHN8ByimTSjvTgtA8J8wezG2Lkok4s12TxeTqENNikgsFrhb7dpTSa88/tjc7K
7fDCAr29cVVJZ0XjS9rAi1ptItlhWS9yd2DVs8zgNVIGJj3Y8b9jxyb9wKBlET1ngTAqOTz0SIYb
ypfUrHks/yLIAovDu/iUrQ8WDV2sKDkfRozggoj+cARsjJunHA+387F1DY3E5zO1A8twVI/DX7Ng
q52DIBxy2fL2m+Zd800LHT0UY4NcuOcnpv+WP+ynjWaaqntUr4iLpRQ/UNprWDf+Vv5+E4yNSA/w
0jzwY94pibpx7yek6KRbjxuew+BjNcFahUHWzP93MkhR2Wde9h+Ru467rL9QQiKLiTqfF98Ntuhn
1QF93JpHpGpNFYVO4krJzWywd+TKdkzZn4JYmeY8ZjoX3wsVTFqO7U5JpVg8zwOo8rvp9YpSbwLR
aZo1mfPu8EHaiR/qxCtLUA0+yycKuVbkWIn3DA==

xusheng · July 18, 2020, 11:22am

sha512(flag) = 6a713602c25ccdbb0139a9fcc5fe778966e26df3af3d281d4a3a98fb7f8c85af06e2264ba1b7d172869fb5cac4620311d15d57e9fc0e95be3a97a649063e3171

I like this one! I made a Python-gdb script to solve it. Will write about it.

xusheng · July 18, 2020, 11:47am

My solver script:

import gdb
import struct

def get_reg_value(response):
    response = response.split()[2]
    value = int(response, 16)
    return value
    
class Solve(gdb.Command):
    def __init__(self):
        # This registers our class as "solve"
        super(Solve, self).__init__("solve", gdb.COMMAND_DATA)

    def invoke(self, arg, from_tty):
        # When we call "solve" from gdb, this is the method
        # that will be called.
        print("Hello from solve 123!")

        dummy_input = open('input.txt', 'wb')
        dummy_input.write(b'1' * 0x50)
        dummy_input.close()

        solution = bytes()

        inferiors = gdb.inferiors()
        inferior = inferiors[0]
        gdb.execute('del')
        gdb.execute('file crackme.elf')
        gdb.execute('set breakpoint pending on')
        gdb.execute('b __libc_start_main')
        gdb.execute('r < input.txt')
        response = gdb.execute('p/x $rdi', to_string = True)
        main_addr = get_reg_value(response)
        main_addr_raw = 0x1229
        print(main_addr)
        base = main_addr - main_addr_raw

        gdb.execute('b *%d' % (base + 0x1399))
        gdb.execute('c')

        response = gdb.execute('p/x $rax', to_string = True)
        input_addr = get_reg_value(response)
        print('input_addr', hex(input_addr))
        
        i = 0
        while True:
            try:
                gdb.execute('del')
                gdb.execute('rwatch *%d' % (input_addr + i * 4))
                gdb.execute('c')

                response = gdb.execute('p/x $edi', to_string = True)
                checksum = get_reg_value(response)
                print('checksum', hex(checksum))
                solution += struct.pack('<I', checksum)
                
                gdb.execute('set $rsi = %d' % checksum)
                i += 1
            except:
                break

        print('=' * 50)
        print('the flag is:')
        print(solution)
        print('len:', len(solution))

        output = open('solution.txt', 'wb')
        output.write(solution)
        output.close()


# This registers our class to the gdb runtime at "source" time.
Solve()

# usage:
# 1. run gdb
# 2. inside gdb, run `source gdb_solve.py`
# 3. inside gdb, run `solve`
# 4. after it runs, it should print the solution and also write it to solution.txt
# 5. verify it by `cat solution.txt | ./crackme.elf`

mrT4ntr4 · July 23, 2020, 9:40pm

Nice one enjoyed it
I used r2pipe for automating it…
Here’s my final script !

import r2pipe
import struct

password = ""
fname = "rec_pwd.txt"
f = open(fname, 'w')

with open('rec_profile.rr2', 'w') as prof:
        prof.write('#!/usr/bin/rarun2\nstdin="%s"\n'%('A'*80))

r = r2pipe.open('rec_crackme',flags=['-2'])
r.cmd("e dbg.profile=rec_profile.rr2")

r.cmd("doo ; aaa")
r.cmd("db ?v main+380 ; dc")
r.cmd("db ?v rdx+0x5c")

while True:
	r.cmd("dc ; db-*")
	edi = int(r.cmd("dr edi"),16)
	if edi == 0:
		break
	password += struct.pack('<I', edi)
	r.cmd("dr esi=edi")
	r.cmd("db ?v rax+0x5c")

f.write(password)
print "Password successfully saved at %s !!" % fname

system · October 16, 2020, 12:04am

This topic was automatically closed after 121 days. New replies are no longer allowed.