Let's decompile this function into Python:
```python
def unpack(buf, buflen, secret):
"""Unpacks the WebAssebmly stage 2 payload."""
for i in range(0, buflen >> 9):
a = 255
for j in range(512):
b = ord(secret[j & 0x1F]) ^ a ^ buf[i*512 + j]
a = buf[i*512 + j]

buf[i*512 + j] = (b - (j & 0x1F)) & 0xFF

return buf
```

That's quite simple isn't it? **Each byte of the buffer is XORed with the next character from the
secret and the previous plaintext byte of the buffer**. We also know (from `j & 0x1F` part) that
the **secret is 32 characters long**.

### Cracking the Unpacking Routine

The question now, is how to find the secret? We know that somewhere in the decrypted buffer, there
is the string `Welcome to 0CTF/TCTF 2020! Have a g00d time`, so we can leverage that to do a
*Known Plaintext Attack*. If we know the position of the plaintext string in the buffer, we can
apply the reverse algorithm and recover the secret. Since the buffer is small only (`5200h` bytes),
we can brute force the starting position and check which decryption yields to a meaningful secret
(i.e., is ASCII printable). Here's how we do that:
```python
# Brute force plaintext location inside buf.
for i in range(len(buf) - len(plain)):
secret = [0]*32

for k in range(0, len(plain)):
j = (i + k) & 0x1F

b = (plain[k] + (j & 0x1F)) & 0xFF
a = buf[i + k - 1] if i + k - 1 > 0 else 255
secret[j] = b ^ a ^ buf[i + k]

if all(x >= 0x20 and x <= 0x7e for x in secret):
secret = ''.join(chr(s) for s in secret)
print(f'[+] Secret FOUND at offset {i} : {secret}')
break
```

The above code finds a unique solution at offset `20346`: `eNj0y_weba5SemB1Y.lstrip("web")!`

We try the secret to see if it works:
```
ispo@ispo-glaptop2:~/ctf/0ctf_2020/W$ ./wasm3 ww
Secret: ?
eNj0y_weba5SemB1Y.lstrip("web")!
Loading...
Go Go Go!!
aoshine~ What's up?
1. add pair
2. dump pair
3. check pair
4. exit

```

For more details please refer to the [w_crack.py](./w_crack.py) script.

### Reversing Second Stage Payload

If we go back to main (`__f13`) we can see what program does with the decrypted buffer:
```c
print__f258("Loading..."); // unpacking successful
int v9 = load_wasm__f33(gvar_5604_buflen, *(int*)((int)&gvar_1C_buf + v0));
*(int*)((int)&gvar_18 + v0) = v9;
int v10 = init_interpreter__f43(*(int*)((int)&gvar_18 + v0));
*((int*)((int)&gvar_10 + v0) + 1) = v10;
load_data_section__f46(*((int*)((int)&gvar_10 + v0) + 1));
load_globals__f47(*((int*)((int)&gvar_10 + v0) + 1));
print__f258("Go Go Go!!");
int res = run__f52(22, *((int*)((int)&gvar_10 + v0) + 1)); // start execution from function 22
*(int*)((int)&gvar_10 + v0) = res;
free_interpreter__f45(*((int*)((int)&gvar_10 + v0) + 1));
free_wasm_obj__f41(*(int*)((int)&gvar_18 + v0));
free__f236(*(int*)((int)&gvar_1C_buf + v0));
```

That is, we expect the decrypted buffer to also be a WebAssembly binary:
```
ispo@ispo-glaptop2:~/ctf/0ctf_2020/W$ file ww.stage2
ww.stage2: WebAssembly (wasm) binary module version 0x1 (MVP)
```

Let's load it again in JEB and start from function `22` (this is where `run__f52` starts from):
```c
int main__f22() {
int* glo = __g0 - 0x118;

__g0 -= 0x118;
*(glo + 0x117) = 0;
int num_a = __f23((int)(gvar_400 * 12)); // 0x80
*(glo + 0x116) = num_a;
if(*(glo + 0x116) == 0) {
*(glo + 0x117) = -1;
}
else {
int num_b = __f23((int)(gvar_400 * 4)); // 0x200
*(glo + 0x115) = num_b;
if(*(glo + 0x115) == 0) {
*(glo + 0x117) = -1;
}
else {
int fp = open(0, 0, "/dev/urandom");
*(glo + 0x114) = fp;
__f31(&gvar_400, 0, (int)(glo + 20));
*(glo + 19) = (int)(glo + 20);
*(glo + 18) = &gvar_400;
*(glo + 17) = 3;
*(long long*)(glo + 8) = 0L;
*(long long*)(glo + 14) = 0L;
*(long long*)(glo + 12) = 0L;
*(long long*)(glo + 10) = 0L;
*(glo + 7) = -1;
p_and_q__f7(*(glo + 0x116));
__f17((int)(gvar_400 * 4), -1, *(glo + 0x115));
puts__f20("aoshine~ What\'s up?\n");
*(glo + 6) = 0;
while(1) {
show_menu__f21();
read_str__f12(2, (int)(glo + 8), 0);
int choice = read_inp__f18((int)(glo + 8));
*(glo + 7) = choice;
if(*(glo + 7) == 1 && *(glo + 17) < gvar_400 && *(glo + 6) < &gvar_400) {
goto NEW_PAIR;
}
else if(*(glo + 7) == 2) {
DUMP_PAIR__f10(*(glo + 17), *(glo + 0x115), *(glo + 0x116));
continue;
}
if(*(glo + 7) == 3) {
int chk_res = CHECK_PAIR__f3(*(*(unsigned int*)(glo + 0x116) + 7), *(*(unsigned int*)(glo + 0x116) + 4));
*(glo + 3) = chk_res;
if(!*(glo + 3)) { // this must return non zero
puts__f20(*(*(unsigned int*)(glo + 0x116) + 1));
puts__f20("hmmm, try again\n");
}
else {
itoa__f19((int)(glo + 8), *(glo + 3)); // secret number is 32-bits
puts__f20("flag is: flag{secret+");
puts__f20((int)(glo + 8));
puts__f20("}\n");
continue;
NEW_PAIR:
puts__f20("input new pair:\n");
int len_maybe = read_str__f12(*(glo + 18) - *(glo + 6), *(glo + 19), 0);
*(glo + 5) = len_maybe;
if(*(glo + 5) <= 0) {
*(glo + 0x117) = -1;
break;
}
else if(*(glo + 5) + *(glo + 6) + 1 > &gvar_400) {
continue;
}
else {
*(glo + 6) = *(glo + 5) + *(glo + 6) + 1;
*(char*)(*(glo + 5) + *(glo + 19)) = 0;
int v6 = ADD_PAIR__f9(*(glo + 17), *(glo + 0x115), *(glo + 0x116), *(glo + 5), *(glo + 19));
*(glo + 4) = v6;
if(*(glo + 4)) {
goto loc_50002855;
}
else {
puts__f20(*(*(unsigned int*)(glo + 0x116) + 1));
puts__f20(", bye~\n");
}
}
}
}
if(*(glo + 0x116) != 0) {
__f25(*(glo + 0x116));
}
if(*(glo + 0x115) != 0) {
__f25(*(glo + 0x115));
}
*(glo + 0x117) = 0;
break;
loc_50002855:
*(glo + 17) = *(glo + 4) + *(glo + 17);
*(glo + 19) = *(glo + 5) + *(glo + 19) + 1;
}
}
}

int result = *(glo + 0x117);
__g0 = glo + 0x118;
return result;
}
```

```c
void show_menu__f21() {
puts__f20("1. add pair\n");
puts__f20("2. dump pair\n");
puts__f20("3. check pair\n");
puts__f20("4. exit\n");
}
```

Unfortunately, neither JEB not ReWasm provide function names (e.g., `itoa` or `puts`), but we can
easily recognize them by looking their input/output. Program shows a small menu where it can *add*,
*dump* and *check* a pair (whatever that means) in a loop. Let's see how we can get the flag:
```c
int chk_res = CHECK_PAIR__f3(*(*(unsigned int*)(glo + 0x116) + 7), *(*(unsigned int*)(glo + 0x116) + 4));
*(glo + 3) = chk_res;

if(!*(glo + 3)) { // this must return non zero
puts__f20(*(*(unsigned int*)(glo + 0x116) + 1));
puts__f20("hmmm, try again\n");
} else {
itoa__f19((int)(glo + 8), *(glo + 3)); // secret number is 32-bits
puts__f20("flag is: flag{secret+");
puts__f20((int)(glo + 8));
puts__f20("}\n");
}
```

Function `__f3` is responsible for implementing the `check pair` functionality. The input is a pair
of numbers and the output must be non-zero:
```c
// Function 3
fn func_3(i32 arg_0, i32 arg_1) -> i32 {
/* ... */
var_2 = global_0 - 32;
var_3 = global_0 - 32;
global_0 = var_3;
store<i32>(var_2 + 24, arg_0) // g24 = arg0
store<i32>(var_2 + 20, arg_1) // g20 = arg1
var_4 = load<i32>(var_2 + 24); // arg0
var_5 = var_4 != 0 & 1;
var_6 = var_5 == 0;
if !var_6 { // arg0 must be non-zero
var_7 = load<i32>(var_2 + 20); // arg1
var_8 = var_7 != 0 & 1;
var_9 = var_8;
if var_9 { // arg1 must be non zero as well
var_10 = load<i32>(var_2 + 24);
var_11 = func_18(var_10);
store<i32>(var_2 + 16, var_11) // g16 = func_18(arg0)
var_12 = load<i32>(var_2 + 20);
var_13 = func_18(var_12);
store<i32>(var_2 + 12, var_13) // g12 = func_18(arg1)
var_14 = load<i32>(var_2 + 16);
var_15 = func_4(var_14); // func_4(func_18(arg0))
var_16 = var_15 == 0;
if !var_16 { // must be nonzero
var_17 = load<i32>(var_2 + 12);
var_18 = func_4(var_17); // func_4(func_18(arg1))
var_19 = var_18;
if var_19 { // must be nonzero too
var_20 = load<i32>(var_2 + 16);
var_21 = load<i32>(var_2 + 12);
var_22 = var_21 * 87;
var_23 = var_20 * 20 + var_22;
store<i32>(var_2 + 8, var_23) // g8 = func_18(arg0)*20 + func_18(arg1)*87
var_24 = load<i32>(var_2 + 16);
var_25 = load<i32>(var_2 + 12);
var_26 = var_24 + var_25;
store<i32>(var_2 + 4, var_26) // g4 = func_18(arg0) + func_18(arg1)
var_27 = load<i32>(var_2 + 8);
var_28 = var_27 == 20200627 & 1; // func_18(arg0)*20 + func_18(arg1)*87 == 20200627
var_29 = var_28 == 0;
if !var_29 { // must be true
var_30 = load<i32>(var_2 + 4);
var_31 = var_30 == 249310 & 1; // func_18(arg0) + func_18(arg1) == 249310
}
if var_29 || !var_29 && var_31 == 0 {
store<i32>(var_2 + 28, 0) // g28 = 0
}
else {
var_32 = load<i32>(var_2 + 16);
var_33 = load<i32>(var_2 + 12);
var_34 = var_33 * 20; // func_18(arg1)*20
var_35 = var_32 * 20 + var_34; // func_18(arg0)*20 + func_18(arg1)*20
var_36 = var_35 + 628;
store<i32>(var_2 + 28, var_36) // g28 = 20*(func_18(arg0) + func_18(arg1)) + 628
}
}
}
if var_16 || !var_16 && !var_19 {
store<i32>(var_2 + 28, 0) // g28 = 0
}
}
}
if var_6 || !var_6 && !var_9 {
store<i32>(var_2 + 28, 0) // g28 = 0
}
var_37 = load<i32>(var_2 + 28);
global_0 = var_2 + 32;
return var_37; // return g28
}
```

Let's decompile this function into Python:
```python
def check_pair(arg0, arg1):
"""Checks if a pair of numbers is 'good'."""
if not func_4(func_18(arg0)) or not func_4(func_18(arg1)):
return 0

if func_18(arg0)*20 + func_18(arg1)*87 != 20200627:
return 0

if func_18(arg0) + func_18(arg1) != 249310:
return 0

return 20*(func_18(arg0) + func_18(arg1)) + 628
```

Function `func_4` is really long, but we do not really need to know what it does as it is only
used for a check. Apart from that, function takes as input **2** numbers, `x` and `y` and checks
if they satisfy the following equations:
```
20*x + 87*y = 20200627
x + y = 249310
```

If `x` and `y` satisfy the above equations, function returns `20*(x + y) + 628` which is our flag.

This is a linear system of **2** equations, so it's very easy to find `x = 22229` and `y = 227081`.
Then the expected return value of `check_pair` will be `4986828`.

So the flag is: `flag{eNj0y_weba5SemB1Y.lstrip("web")!+4986828}`

### Bonus: Verifying Flag in the Binary

At this point, the challenge was over (I already had the correct flag), but it was still unclear to
me how to pass the right input to the program:
```
ispo@ispo-glaptop2:~/ctf/0ctf_2020/W$ ./wasm3 ww
Secret: ?
eNj0y_weba5SemB1Y.lstrip("web")!
Loading...
Go Go Go!!
aoshine~ What's up?
1. add pair
2. dump pair
3. check pair
4. exit
1
input new pair:
22229 227081
1. add pair
2. dump pair
3. check pair
4. exit
3
Welcome to 0CTF/TCTF 2020! Have a g00d timehmmm, try again
```

Just for my curiosity I continued trying to understand the program. The first interesting part was
at function `__f7`:
```c
int p_and_q__f7(int param0) {
int* ptr0 = __g0 - 4;

__g0 -= 4;
*(ptr0 + 3) = param0;
__f17(0x600, 0, *(ptr0 + 3));
**(unsigned int*)(ptr0 + 3) = "0ops";
*(*(unsigned int*)(ptr0 + 3) + 1) = "Welcome to 0CTF/TCTF 2020! Have a g00d time";
*(*(unsigned int*)(ptr0 + 3) + 2) = 25;
*(*(unsigned int*)(ptr0 + 3) + 3) = "p";
*(*(unsigned int*)(ptr0 + 3) + 4) = 0; // p value
*(*(unsigned int*)(ptr0 + 3) + 5) = 0;
*(*(unsigned int*)(ptr0 + 3) + 6) = "q";
*(*(unsigned int*)(ptr0 + 3) + 7) = 0; // q value
*(*(unsigned int*)(ptr0 + 3) + 8) = 0;
int result = *(ptr0 + 3);
__g0 = ptr0 + 4;
return result;
}
```

This function initializes an object of pointers. The important part is the strings `p` and `q`. Now
let's look at how a new pair is added to the list (program can store multiple pairs):
```c
int ADD_PAIR__f9(int param0, int param1, int param2, int param3, int param4) {
int* ptr0 = __g0 - &gvar_10;

__g0 -= &gvar_10;
*(ptr0 + 14) = param0;
*(ptr0 + 13) = param1;
*(ptr0 + 12) = param2;
*(ptr0 + 11) = param3;
*(ptr0 + 10) = param4; // len maybe
if(*(ptr0 + 14) == 0 || *(ptr0 + 12) == 0 || !(unsigned int)(*(ptr0 + 11) != 0)) {
*(ptr0 + 15) = 0;
}
else {
*(ptr0 + 9) = *(ptr0 + 13) + *(ptr0 + 14);
if(*(ptr0 + 9) < *(ptr0 + 14)) {
*(ptr0 + 15) = 0;
}
else {
*(ptr0 + 8) = *(ptr0 + 14);
*(ptr0 + 7) = *(ptr0 + 14);
*(ptr0 + 6) = 0;
*(ptr0 + 5) = 128 - *(ptr0 + 10);
*(ptr0 + 4) = 0;
*(ptr0 + 3) = 0;
while(((*(ptr0 + 8) - *(ptr0 + 7) < *(ptr0 + 13) ? (unsigned int)(*(ptr0 + 4) < *(ptr0 + 5)): 0) & 0x1) != 0) {
int v0 = strcat__f16(*(ptr0 + 9) - *(ptr0 + 8), 10, *(ptr0 + 8));
*(ptr0 + 6) = v0;
if(*(ptr0 + 6) == 0 || (unsigned int)(*(ptr0 + 6) >= *(ptr0 + 9)) || *(ptr0 + 6) < *(ptr0 + 8)) {
break;
}
else {
**(unsigned int*)(ptr0 + 6) = 0;
if(*(ptr0 + 6) - *(ptr0 + 8) > 1) {
if((int)*(char*)((char*)*(unsigned int*)(ptr0 + 8) + 1) != '=') {
loc_50001098:
*(ptr0 + 3) = *(ptr0 + 10);
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 3) == (int)**(unsigned int*)(ptr0 + 8)) {
*(ptr0 + 3) = 1; // +3 = p
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 6) != (int)**(unsigned int*)(ptr0 + 8)) {
goto loc_50001098;
}
else {
*(ptr0 + 3) = 2; // +6 = q
}
*(ptr0 + 2) = *(ptr0 + 3) * 12 + *(ptr0 + 12); // (6 - 3)*4 = 12 ~> pointer to write number
__f8(*(ptr0 + 6) - *(ptr0 + 8), *(ptr0 + 8), *(ptr0 + 2));
*(int*)((*(ptr0 + 4) + *(ptr0 + 10)) * 4 + (int)*(unsigned int*)(ptr0 + 11)) = *(ptr0 + 3);
*(ptr0 + 4) = *(ptr0 + 4) + 1;
}
*(ptr0 + 8) = *(ptr0 + 6) + 1;
}
}
if(*(ptr0 + 8) - *(ptr0 + 7) < *(ptr0 + 13) && *(ptr0 + 4) < *(ptr0 + 5)) {
if((int)*(char*)((char*)*(unsigned int*)(ptr0 + 8) + 1) != '=') {
loc_500013BF:
*(ptr0 + 3) = *(ptr0 + 10);
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 3) == (int)**(unsigned int*)(ptr0 + 8)) {
*(ptr0 + 3) = 1;
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 6) != (int)**(unsigned int*)(ptr0 + 8)) {
goto loc_500013BF;
}
else {
*(ptr0 + 3) = 2;
}
*(ptr0 + 1) = *(ptr0 + 3) * 12 + *(ptr0 + 12);
__f8(*(ptr0 + 7) + *(ptr0 + 13) - *(ptr0 + 8), *(ptr0 + 8), *(ptr0 + 1));
*(int*)((*(ptr0 + 4) + *(ptr0 + 10)) * 4 + (int)*(unsigned int*)(ptr0 + 11)) = *(ptr0 + 3);
*(ptr0 + 4) = *(ptr0 + 4) + 1;
}
*(ptr0 + 15) = *(ptr0 + 4);
}
}

int result = *(ptr0 + 15);
__g0 = ptr0 + &gvar_10;
return result;
}
```

This function looks complicated at the first glance, but let's focus on the most impoortant parts.
At the beginning we have an important assignment: `*(ptr0 + 12) = param2`. `param2` is a pointer to
the object that `p_and_q__f7` returns. Let's move on:
```c
if((int)*(char*)((char*)*(unsigned int*)(ptr0 + 8) + 1) != '=') {
loc_50001098:
*(ptr0 + 3) = *(ptr0 + 10);
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 3) == (int)**(unsigned int*)(ptr0 + 8)) {
*(ptr0 + 3) = 1; // +3 = p
}
else if((int)**(unsigned int*)(*(unsigned int*)(ptr0 + 12) + 6) != (int)**(unsigned int*)(ptr0 + 8)) {
goto loc_50001098;
}
else {
*(ptr0 + 3) = 2; // +6 = q
}
*(ptr0 + 2) = *(ptr0 + 3) * 12 + *(ptr0 + 12); // (6 - 3)*4 = 12 ~> pointer to write number
__f8(*(ptr0 + 6) - *(ptr0 + 8), *(ptr0 + 8), *(ptr0 + 2));
```

`ptr0 + 8` points to the input string. The first `if` checks if `inpt[1] != '='`. If this is true,
`ptr0 + 3` gets assigned the string `*(ptr0 + 10)`, which is `*(ptr0 + 8 + 2)`, which is `inp[2:]`.
The second `else if` checks the value of `(ptr0 + 12) + 3)` is equal to `(ptr0 + 8)` which is
`inp[0]`. `ptr0 + 12` points to the output of `p_and_q__f7` which is initialized to
`*(*(unsigned int*)(ptr0 + 3) + 3) = "p";` That is, this if checks if `inp[0] == 'p'`. If so, it
assigns `*(ptr0 + 3) = 1`. Then program makes another check but this time with `(ptr0 + 12) + 6)`
which is the assignment `*(*(unsigned int*)(ptr0 + 3) + 6) = "q";` in `p_and_q__f7`. That is, it
checks if `inp[0] == 'q'` and if so, it assigns `*(ptr0 + 3) = 2;`. Finally it makes an important
assignment: `*(ptr0 + 2) = *(ptr0 + 3) * 12 + *(ptr0 + 12);`, which can have **1** of the **2**
possible values:
```
if inp[0] == 'p':
*(ptr0 + 3)*12 + *(ptr0 + 8 + 4) = 1*12 + p_and_q_obj = p_and_q_obj->p_val (+3 * 4 + 4 = +16)

if inp[0] == 'q'
*(ptr0 + 3)*12 + *(ptr0 + 8 + 4) = 2*12 + p_and_q_obj = p_and_q_obj->q_val (+6 * 4 + 4 = +28)
```

Now let's go main (`__f22`) see the paramters of `check_pair`
```c
p_and_q__f7(*(glo + 0x116));
/* ... */

int chk_res = CHECK_PAIR__f3(*(*(unsigned int*)(glo + 0x116) + 7),
*(*(unsigned int*)(glo + 0x116) + 4));
```

For some reason, in ReWasm, parameters appear in the reverse order:
```c
var_124 = load<i32>(var_92 + 1112);
var_125 = load<i32>(var_124 + 16);

var_126 = load<i32>(var_92 + 1112);
var_127 = load<i32>(var_126 + 28);

var_128 = func_3(var_125, var_127);
````

The first parameter is `p_and_q_obj->p_val` (offset **+4** or **16**) and the second parameter is
`p_and_q_obj->q_val` (offset **+7** or **28**). That is, we need to pass **2** distinct pairs to
the program: `p=22229` and `q=227081`. Let's try it out:
```
ispo@ispo-glaptop2:~/ctf/0ctf_2020/W$ ./wasm3 ww
Secret: ?
eNj0y_weba5SemB1Y.lstrip("web")!
Loading...
Go Go Go!!
aoshine~ What's up?
1. add pair
2. dump pair
3. check pair
4. exit
1
input new pair:
p=22229
1. add pair
2. dump pair
3. check pair
4. exit
1
input new pair:
q=227081
1. add pair
2. dump pair
3. check pair
4. exit
2
p=22229
q=227081

1. add pair
2. dump pair
3. check pair
4. exit
3
flag is: flag{secret+4986828}
1. add pair
2. dump pair
3. check pair
4. exit
4
```