← Back to CRACKON CTF

HEX OBFUSCATION

Reverse-engineer a custom repeating XOR encryption scheme to decode the flag.

Tools Used

objdumpPythonIDA Pro

Overview

The challenge outputs an obfuscated hex string. We must analyze the binary encryption logic to reverse the XOR key schedule and decrypt the flag.

Reconnaissance

We are given the hex output string:

0x700x430x550x510x580x7e0x5a0x490x430x5e0x050x5c0x470x430x400x530x410x4c

Splitting the hex values gives 18 bytes.

Exploitation Strategy

Disassembling the binary reveals a function dosmth called inside the loop.

The function performs XOR encryption on the characters using a rotating key schedule derived from static characters in .rodata ("34" and "1"/"2").

This results in a repeating 4-byte XOR key schedule: [0x33, 0x31, 0x34, 0x32]. XORing the 18 output bytes with this repeating key reveals the flag.

Solution Code

output = [0x70, 0x43, 0x55, 0x51, 0x58, 0x7e, 0x5a, 0x49, 0x43, 0x5e, 0x05, 0x5c, 0x47, 0x43, 0x40, 0x53, 0x41, 0x4c]
key = [0x33, 0x31, 0x34, 0x32]

flag = ""
for i, byte in enumerate(output):
    flag += chr(byte ^ key[i % 4])

print(flag) # CrackOn{po1ntrtar}

Flag

CrackOn{po1ntrtar}