Rating:

See here : [https://berryberry.hatenablog.jp/](https://berryberry.hatenablog.jp/entry/2022/03/27/034315)

Opened with Ghidra for the first step.

![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327024910.png)

This program is similar to the Pascal. You can see that the ivar3 variable is compared with the input number in line 37.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025037.png)

In the function1, it calculates the greatest common divisor of local_20 variable and local_28 variable.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025047.png)

In the function2, it calculates the factorial of the ivar3 variable plus 3.
The solution is below.
```
import math
from pwn import *

elf = ELF("./decompile", checksec=False)

host = '143.198.224.219'
port = 21530

def func1(num1, num2):
return math.gcd(num1, num2)

def func2(num):
if (num == 0):
return 1
else:
return func2(num-1) * num

r = remote(host, port)

while (True):
# receive two numbers
now = r.recvline()
if (b"fun() took" in now):
break
a, b = map(str, now.decode('utf-8').split())

# send number which does func1 and func2
num = func2(func1(int(a), int(b))+3)
r.sendline(str(num).encode())

print(now.decode('utf-8'))
r.interactive()
```
You can get the FLAG.

![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025304.png)