Tags: python rev math 

Rating:

Of the provided files only the .NET Core DLL is interesting. Opening it a .NET assembly browser we get the following class
```
using System;
using System.Linq;
using System.Numerics;
using System.Text;

namespace basicchall
{
internal class Program
{
private static string encryptedstuff(string arg)
{
return Program.hahalambdasgobrr(Program.uselessEncode(arg));
}

public static string uselessEncode(string plainText)
{
return Convert.ToBase64String(Encoding.UTF8.GetBytes(plainText));
}

private static string hahalambdasgobrr(string input)
{
if (string.IsNullOrEmpty(input))
{
return input;
}
return new string((from s in input.ToCharArray()
select (s >= 'a' && s <= 'z') ? ((s + '\r' > 'z') ? (s - '\r') : (s + '\r')) : ((s >= 'A' && s <= 'Z') ? ((s + '\r' > 'Z') ? (s - '\r') : (s + '\r')) : s)).ToArray<char>());
}

private static void Main(string[] args)
{
BigInteger right = BigInteger.Parse("8089390364467735077698396472118844991784106353624232752188925117000642749078392477000726461474971635917016810390936570526153112519081470670206265855935361540194194923977832689103430508815864607887175397925922606678257211908276404240676101731946520582573307113692772061443045502502491987593439178171359818088442419721372220822555");
if (args.Length > 2)
{
Console.WriteLine(Program.usageString);
}
string source = Console.ReadLine();
string text = Program.encryptedstuff(string.Join("", source.Select(delegate(char c)
{
int num = (int)c;
return num.ToString("X2");
})));
BigInteger bigInteger = new BigInteger(0);
for (int i = 0; i < text.Length; i++)
{
bigInteger <<= 21;
bigInteger += (int)(text[i] * 'ጷ');
}
if (bigInteger == right)
{
Console.WriteLine("You got the flag!");
}
}

public static string usageString = "Usage: Chall.exe";
}
}
```

The user input is turned into a hexadecimal representation, then base64 encoded. The base64 encoded string is mangled a bit, and the result is iterated over. Each byte is multiplied by 4919, the accumulating variable is shifted by 21 bits and the result of the multiplication is added. At the end the result is compared to an integer value to validate the flag.

Reversing the math, the Base64 mangling, and converting the resulting hex string to ASCII, you get the flag. I did the base64 decoding and dehexlifying in a hex editor, the rest with the following Python script:

```
orig = 8089390364467735077698396472118844991784106353624232752188925117000642749078392477000726461474971635917016810390936570526153112519081470670206265855935361540194194923977832689103430508815864607887175397925922606678257211908276404240676101731946520582573307113692772061443045502502491987593439178171359818088442419721372220822555
strink=""
while(orig > 0):
k = orig >> 21
num = orig-(k<<21)
orig = k
num=int(num/4919)
strink=chr(num)+strink

print(strink)

outstr=''
for char in strink:
if( ord(char) >= ord('a') and ord(char) <= ord('z') ):
if( ord(char)-ord('\r') > ord('a')):
outchar = chr( ord(char) - ord('\r') )
else:
outchar = chr( ord(char) + ord('\r') )
else:
if( ord(char) >= ord('A') and ord(char) <= ord('Z') ):
if(ord(char) - ord('\r') > ord('A')):
outchar = chr( ord(char) - ord('\r') )
else:
outchar = chr( ord(char) + ord('\r') )
else:
outchar = char
outstr+=outchar
print(outstr)
```