Reverse Engineering Challenges

Week 1

Sign-in Challenge

The provided assembly file was decompiled into equivalent C code. The program reads a string, processes it by XORing even-indexed characters with 7 and subtracting 5 from odd-indexed ones, then compares the result with a target string.

#include <stdio.h>
#include <string.h>

char target[] = "TTDv^jrZu`Gg6tXfi+pZojpZSjXmbqbmt.&x";

void recover_input(char *out) {
    for (int i = 0; i < 18; ++i) {
        out[i*2] = target[i*2] ^ 7;
        out[i*2+1] = target[i*2+1] + 5;
    }
    out[36] = '\0';
}

int main() {
    char input[80];
    recover_input(input);
    printf("%s\n", input);
    return 0;
}

Flag: #SYC{You_re@l1y_kn0w_how_To_revers3!}

hello_re

The binary uses a custom encryption routine with key "SYCLOVER". Each byte of input is XORed with its index and the corresponding key byte modulo 8.

#include <stdio.h>

int main() {
    char key[] = "SYCLOVER";
    int expected[] = {0,1,2,52,3,96,47,28,107,15,9,24,45,62,60,2,17,123,39,58,41,48,96,26,8,52,63,100,33,106,122,48};

    for (int i = 0; i < 32; ++i)
        printf("%c", expected[i] ^ key[i%8] ^ i);

    return 0;
}

Flag: #SYC{H3lI0_@_new_R3vers3_Ctf3r!!}

ezzzzz

An Android APK using TEA encrypsion with key "GEEK". The ciphertext was extracted and decrypted using a standard TEA decryption routine.

#include <stdio.h>
#include <stdint.h>

void decrypt(uint32_t *v, uint32_t *k) {
    uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, delta=0x9E3779B9;
    for (int i=0; i<32; i++) {
        v1 -= ((v0<<4 ^ v0>>5) + v0) ^ (sum + k[sum>>11 & 3]);
        sum += delta;
        v0 -= ((v1<<4 ^ v1>>5) + v1) ^ (sum + k[sum & 3]);
    }
    v[0]=v0; v[1]=v1;
}

int main() {
    uint32_t data[] = { /* ... ciphertext values ... */ };
    uint32_t key[] = {'G','E','E','K'};
    
    for (int i=0; i<60; i+=2) {
        uint32_t block[2] = {data[i], data[i+1]};
        decrypt(block, key);
        data[i] = block[0]; data[i+1] = block[1];
    }
    
    for (int i=0; i<60; ++i) printf("%c", data[i]);
    return 0;
}

Flag: #SYC{g0od_j0b_wweLCoMeToooSSSyC_zz_1_et3start_yoUr_j0urney!!}

RC4 Challenge

The binary first XORs input with 0x14, then applies RC4 encryption with key "syclover". The ciphertext was decrypted by reversing both operations.

#include <stdio.h>

// RC4 implementation omitted for brevity

int main() {
    unsigned char ciphertext[] = { /* ... */ };
    char key[] = "syclover";
    
    // Decrypt RC4
    rc4_decrypt(ciphertext, sizeof(ciphertext), key);
    
    // Undo initial XOR
    for (int i=0; i<sizeof(ciphertext); ++i)
        printf("%c", ciphertext[i] ^ 0x14);
        
    return 0;
}

Flag: #SYC{we1come_t0_Geek's_3asy_rc4!}

Z3 Solver Challenge

This challenge required solving a system of equations to recover the flag after reversing a custom encryption routine involving rotations and XORs.

from z3 import *

# Equation solving omitted for brevity

# Decryption routine
def decrypt(data, key):
    # Reverse XOR operations
    for i in range(31, -1, -1):
        data[i] ^= ord(key[(47-i)%16]) ^ i
        data[i] ^= data[(i-1)%32]
    return data

# Apply rotation reversal
def reverse_rotation(arr):
    for i in range(0, 32, 4):
        temp = arr[i]
        arr[i] = arr[i+3]
        arr[i+3] = arr[i+2]
        arr[i+2] = arr[i+1]
        arr[i+1] = temp
    return arr

Flag: #SYC{Wow!!_Y0u_4r3_9o0d_At_r3$!!}

Week 2

Python Bytecode

The challenge involved reversing Python bytecode that performed Caesar cipher followed by custom XOR encryption.

def decrypt(num):
    key = "SYC"
    # Reverse XOR
    for i in range(18):
        num[i] = (num[i] - (~ord(key[i%3]) + 1)) ^ i
    
    # Reverse Caesar
    r = 13  # Calculated shift value
    result = []
    for x in num:
        if 65 <= x <= 90:
            result.append(chr((x - 65 - r) % 26 + 65))
        elif 97 <= x <= 122:
            result.append(chr((x - 97 - r) % 26 + 97))
        elif 48 <= x <= 57:
            result.append(chr((x - 48 - r) % 10 + 48))
        else:
            result.append(chr(x))
    return ''.join(result)

Flag: #SYC{ed798fdd74e5c382b9c7fcca88500aca}

Modified RC4

A Python executable using triple-layer encryption: modified RC4 (with +6 offset), XOR with index, and cumulative XOR.

def full_decrypt(cipher, key):
    # Reverse cumulative XOR
    for i in range(len(cipher)-1, 0, -1):
        cipher[i] ^= cipher[i-1]
    
    # Reverse index XOR
    for i in range(len(cipher)):
        cipher[i] ^= i
    
    # Reverse modified RC4
    s = KSA([ord(c) for c in key])
    prga = PRGA(s)
    for i in range(len(cipher)):
        cipher[i] ^= next(prga) + 6
        cipher[i] -= i
    
    return bytes(cipher).decode()

Flag: #SYC{Bel1eve_thAt_you_a3e_Unique_@nd_tHe_beSt}

Week 3

AES Modification

The binary implemented a modified AES with custom S-box and ShiftRows. The solution required generating the inverse S-box and implementing full AES decryption.

// Inverse S-box generation
void generate_inv_sbox(unsigned char sbox[256], unsigned char inv_sbox[256]) {
    for (int i=0; i<256; ++i)
        inv_sbox[sbox[i]] = i;
}

// Full AES decryption implementation with custom components

Flag: #SYC{B3l1eue_Th@t_y0u__l3aRn_Aes}

Maze Solver

An HTML/JS challange requiring solving a maze represented by two 10x10 grids. The solution path was derived by analyzing movement constraints.

// Grid parsing and pathfinding logic
char grid1[10][10], grid2[10][10];
// Parse coordinates and mark walls
// Find path from 'S' to 'Y' in both grids
// Combine paths: STTAAARRRR + AAATTTTS

Flag: #SYC{STTAAARRRRAAATTTTS}

Week 4

RSA Variant

A complex RSA implemantation with multiple prime generations and hints. The solution involved:

1. Solving DLP for exponent recovery
2. Factoring moduli using provided hints
3. Decrypting each segment with recovered parameters

# SageMath for DLP
n = 0x9c5ab7c1... # Large modulus
g = 0x488d156b... # Generator
h = 0xc028af32... # Target
e = discrete_log(n, h, g)  # Recovered exponent

# Python for RSA decryption
from Crypto.Util.number import *
p = ... # Factored prime
q = ... # Factored prime
phi = (p-1)*(q-1)
d = inverse(e, phi)
m = pow(c, d, p*q)

Final flag obtained by concatenating decrypted segments and hashing: flag{d3f06717efc6c0daf454ffeac9764687}

Miscellaneous Challenges

Word Document Steganography

Three hiding techniques were used:

1. White text on white background
2. Hidden image in media folder
3. VBA macro containing flag

Flag: #SYC{W0rd_H@5@_Ama1n9_StrUCtu3e!}

Network Analysis

PCAP file analysis revealed SMB protocol traffic containing the flag in plain text.

Flag: #SYC{smb_pcapng_1s_g00d!}

Cimbar Barcode

Decoded binary matrix representing ASCII characters:

01010011 01011001 01000011 01111011 ... → "SYC{An0th3r_Am@z1n9_QR_Co4e}"