Tags: idapython pintool ida 

Rating:

Similar to zwiebel, decrypted code in ida using `idc` script. Then wrote a pintool to keep `ecx` 0 for jumps and collect condition for flag bytes.

![solve](https://gist.githubusercontent.com/sudhackar/ad9c15851f274b3248ef1645abee9ae8/raw/ce857ac93e1da9f3eecf80c76a68a05f4ad32020/zwiebel-revenge.png)

Original writeup (https://gist.github.com/sudhackar/ad9c15851f274b3248ef1645abee9ae8#file-zwiebel-revenge-cpp).