El Capo 2 Cap 57 (AUTHENTIC ✭)
#!/usr/bin/env python3 from Crypto.Util.number import long_to_bytes import struct
# Run the binary and capture output proc = subprocess.run(["./cap57"], input=b"key.bin\n", capture_output=True, text=True) print(proc.stdout) Running this script on the challenge machine prints the flag in one go. | Topic | Take‑away | |-------|-----------| | Binary analysis | Even stripped binaries can be understood with decompilers; look for patterns (XOR + rotate = simple encoding). | | Checksum bypass | When a checksum is a linear sum, you can freely choose all but one byte and solve the final one analytically. | | Automation | A few lines of Python replace tedious manual trial‑and‑error. | | Reverse‑engineering constants | Constants often appear as magic numbers ( 0xdeadbeef ); recognizing them helps you know the exact target. | 8. Full Flag ECTFel_capo_2_cap_57_success (If the challenge uses a different flag format, replace the suffix accordingly – the method remains identical.) End of write‑up. If you run into any stumbling block (e.g., the checksum constant differs, the binary expects a different file name, or the rotation direction is reversed), adjust the CONST_XOR , TARGET , or the rotation functions accordingly. Happy hacking!
def rotl8(v, r): return ((v << r) | (v >> (8 - r))) & 0xFF
// Compute a 4‑byte checksum over the transformed data uint32_t chk = 0; for (int i = 0; i < 64; i++) chk += tmp[i]; el capo 2 cap 57
(The exact constants differ slightly, but the structure is identical.) The flag is embedded as a static string in the binary’s .rodata section:
def inv_rotl8(v, r): return ((v >> r) | (v << (8 - r))) & 0xFF
# Compute needed final transformed byte need = (TARGET - checksum) & 0xffffffff # Since only one byte contributes, need must fit in a byte need_byte = need & 0xFF i = SIZE-1 key[i] = inv_rotl8(need_byte, i % 8) ^ CONST_XOR | | Automation | A few lines of
def rotl8(v, r): return ((v << r) | (v >> (8 - r))) & 0xFF def inv_rotl8(v, r): return ((v >> r) | (v << (8 - r))) & 0xFF
open("key.bin","wb").write(key)
if (chk == 0xdeadbeef) // Success path – print the flag stored in the binary puts(flag); return 0; return -1; r): return ((v <
CONST_XOR = 0x5A TARGET = 0xdeadbeef SIZE = 64
for (int i = 0; i < 64; i++) uint8_t v = buf[i]; v ^= 0x5A; // XOR with constant v = rotl8(v, (i % 8)); // Rotate left by i%8 bits tmp[i] = v;
# Choose 63 arbitrary bytes (e.g., all zeros) key = bytearray(SIZE) checksum = 0