Tags: rev bruteforce 

Rating:

We're given this long script:

```
(defun checkFlag (input)
(if (not (= (length input) 34))
nil
(if (not (string= (subseq input 0 6) "UDCTF{"))
nil
(if (not (= (char-code (char input 6)) 104))
nil
(if (not (= (+ (char-code (char input 9)) 15) (- (char-code (char input 8)) (char-code (char input 7)))))
nil
(if (not (= (* (char-code (char input 7)) (char-code (char input 9))) 2652))
nil
(if (not (= (- (char-code (char input 7)) (char-code (char input 9))) 1))
nil
(if (not (string= (char input 10) (char input 14) ) )
nil
(if (not (string= (char input 14) (char input 21) ) )
nil
(if (not (string= (char input 10) (char input 25) ) )
nil
(if (not (string= (char input 21) (char input 27) ) )
nil
(if (not (= (ceiling (char-code (char input 10)) 2) (char-code (char input 12)) ) )
nil
(if (not (= 952 (- (expt (char-code (char input 11)) 2) (expt (char-code (char input 13)) 2)) ) )
nil
(if (not (string= (subseq input 14 21) (reverse "sy4wla_")))
nil
(if (not (string= (subseq input 22 24) (subseq input 6 8)))
nil
(if (not (= (mod (char-code (char input 24)) 97) 3))
nil
(if (not (string= (subseq input 14 16) (reverse (subseq input 26 28))))
nil
(if (not (= (complex (char-code (char input 28)) (char-code (char input 29))) (conjugate (complex 76 -49))))
nil
(if (not (= (lcm (char-code (char input 30)) (char-code (char input 31))) 6640))
nil
(if (not (> (char-code (char input 30)) (char-code (char input 31)) ) )
nil
(if (not (= (char-code (char input 32)) (- (+ (char-code (char input 31)) (char-code (char input 30))) (char-code (char input 24)))))
nil
(if (not (= (char-code (char input 33)) 125))
nil
t))))))))))))))))))))))

(print (checkFlag "FLAGHERE")
```

I had absolutely no idea what language this was, so I decided to do it all by hand, line by line!

```
length=34
[0-5]=UDCTF{
[6]=h
[7-9]=4v3
15 + [9] = [8] - [7]
[7][9] = 2652 --> factor --> 52, 51 --> "4", "3"
[7] - [9] = 1 --> [7] = "4", [9] = "3"
[8] = 118 = 'v'
[10]=[14]=[21]=[25]=[27]=_
[12] = ceiling([10] / 2) (guess) = 0
[11]^2 - [13]^2 = 952
11and13.py (see below)
[11]=121, [13]=117
[14-20]=_alw4ys
[22-23]=[6-7]=h4
[24] % 97 = 3 --> [24]=100
reverse([26-27]) = [14-15] --> [26-27]=a_
[28]=76, [29]=49
lcm([30],[31]) = 6640 --> factor --> 2^4 * 5 * 83 --> 80, 83
[30] > [31] --> [30-31]=83 80=SP
[32] = [31] + [30] - [24] = 80 + 83 - 100 = 63 = ?
[33] = 125
```

Note that for [11] and [13], I used a python script to figure them out:

```
import gmpy2

for i in range(200):
a = gmpy2.iroot(952 + i*i, 2)
if a[1]:
print(a[0], i)
```

And for [12], I guessed that, since we were using the ceiling function, and [10] was an underscore, or 95 in ASCII code, it was probably just getting divided by the 2 in the code.

UDCTF{h4v3_y0u_alw4ys_h4d_a_L1SP?}