Tags: forensic 

Rating: 5.0

# REC

## Task

![task](./src/task.png)

[REC](./src/REC.zip)

## Solution

After unpacking the archive I got a .exe file, but it is broken and won't be run by the system. So I looked at it's bytes and found out there was a broken header.

![hex](./src/hex.png)

I fixed it and it won't run anyway =)

So I just opened it in IDA and watched through functions. Finally I found the following code.

![ida](./src/ida.png)

The flag is `KorNewbie{Recover_Signature}`

Original writeup (https://github.com/0awawa0/CTF-Writeups/tree/master/Newbie%20CTF%202019/REC).