Rating:

# sneks (212 solves, 403 points)

## Description:

[https://www.youtube.com/watch?v=0arsPXEaIUY](https://www.youtube.com/watch?v=0arsPXEaIUY)

[sneks.pyc](sneks.pyc)

[output.txt](output.txt)

## Solution:

Like with scrambler, this challenge gave us a .pyc file and an output to reverse. I again used the website [decompiler.com](https://www.decompiler.com/) to decompile the .pyc file into the following python script.

```python3

# uncompyle6 version 3.7.4

# Python bytecode 3.8 (3413)

# Decompiled from: Python 2.7.17 (default, Sep 30 2020, 13:38:04)

# [GCC 7.5.0]

# Warning: this version of Python has problems handling the Python 3 "byte" type in constants properly.

# Embedded file name: sneks.py

# Compiled at: 2021-05-19 21:21:59

# Size of source mod 2**32: 600 bytes

import sys

def f(n):

if n == 0:

return 0

if n == 1 or n == 2:

return 1

x = f(n >> 1)

y = f(n // 2 + 1)

return g(x, y, not n & 1)

def e(b, j):

return 5 * f(b) - 7 ** j

def d(v):

return v << 1

def g(x, y, l):

if l:

return h(x, y)

return x ** 2 + y ** 2

def h(x, y):

return x * j(x, y)

def j(x, y):

return 2 * y - x

def main():

if len(sys.argv) != 2:

print('Error!')

sys.exit(1)

inp = bytes(sys.argv[1], 'utf-8')

a = []

for i, c in enumerate(inp):

a.append(e(c, i))

else:

for c in a:

print((d(c)), end=' ')

if __name__ == '__main__':

main()

```

There are a lot of functions that are pointless, so I ended up copying them into their calling location. The last thing the program does is shifted each number's bits to left by 1 place. So to reverse, we just shift the bits to the right by one place(suprisingly this doesn't work the other way). The e function is also easily reversible. The main problem is the f function, which is recursive. To bypass that, I bruteforced values to find flag.

**Script:**

```python3

def f(n):

if n == 0:

return 0

if n == 1 or n == 2:

return 1

x = f(n >> 1)

y = f(n // 2 + 1)

return g(x, y, not n & 1)

def g(x, y, l):

if l:

return x * (2 * y - x)

return x ** 2 + y ** 2

file = open('output.txt', 'r')

strNums = file.read().split(' ')[:-1]

nums = [int(i) >> 1 for i in strNums]

flag = ''

for i, c in enumerate(nums):

c = (c + 7 ** i) // 5

for x in range(0,256):

if(f(x) == c):

flag += chr(x)

print(flag)

```

## Flag:

`flag{s3qu3nc35_4nd_5um5}`

Original writeup (https://github.com/BASHing-thru-challenges/HSCTF-2021-Writeups/tree/main/rev/sneks).