Rating:
## Just TV
We were given an `.asn` file. After some quick googling (before hint released) we can run theses file with [MhegPlus Player](https://sourceforge.net/projects/mhegplus)
To run it use this command
```
$ java -Dmheg-source-root=src/ -Ddfs-root-dir=src/ -Dfile-mapping.//a=src/a -Dmheg.profile=uk.dtt -jar MhegPlus.MhegPlayer-1.0.1a.jar
```
Then click `populate carousel from disk`. It has 3 modules which are clock, weather and extras. Choosing extras will prompt us a flag checker, and the main logic for flag checker are lies on extras.asn
After some reversing we manage to reconstruct the logic to a python code.
```py
correct = "11011100010101001000100011001000110010000110100011101010011110110110001001001111001000010110000101110011101011011101011001001011110100011000111100101110000100101001111001111011110111101001110100101100110101111101101110101111001000111100111000000100101001101000001101010111101010010100000101010001010010010100101111011101111100110010101000100000001101000011101001011111101001100110111001000000110110101010111100100101111110111010011110001000011011010010110000000011111100001100"
actual = "11010011010000101111101110101001011001101100101000111101101110101101010000010111101110000110100001000111101100000001110010010000000001011111001101111110011110111100111000111111101000110110010111100111110001111010110100110111000001001111010001100110111000101010010001000110010001100100001101000111010100111101101100010010011110010000101100001011100111010110111010110010010111101000110001111001011100001001010011110011110111101111010011101001011001101011111011011101011110010001"
list_bin = "0000000000000100000100000011000010000001010000110000011100010000001001000101000010110001100000110100011100001111001000000100010010010001001100101000010101001011000101110011000001100100110100011011001110000111010011110001111101000000100001010001001000110100100010010101001100100111010100001010010101010010101101011000101101010111001011110110000011000101100100110011011010001101010110110011011101110000111001011101001110110111100011110101111100111111100000010000011000010100001110001001000101100011010001111001000100100110010101001011"
list_char = "1234567890qwertyuiopasdfghjkl{zxcvbnm_!@#$%^&*+=3DQWERTYUIOPASDFGHJKL}ZXCVBNM-"
inp = "j"
dict = {}
for i in range(len(list_char)):
tmp = list_char[i]
index = list_char.index(tmp)
index += 1
print(list_char[i], index)
val1 = ((index - 1) * 7) + 1
val2 = index * 7
dict[list_bin[val1-1:val2]] = list_char[i]
print(dict)
assert len(correct) == len(actual)
nice = ""
for i in range(len(correct)):
if actual[i] == "0":
nice += correct[i]
else:
if correct[i] == "1":
nice += "0"
else:
nice += "1"
print(len(dict))
print(nice)
for i in range(0, len(nice), 7):
target = nice[i:i+7]
try:
print(dict[target])
except Exception as e:
print("unknown", target)
```
But its still not correct, after some debugging we found that var65 are rotated based on the length of the input that entered.
Looking back into the code we knew that it xor the input with var65. Now we just need to bruteforce the correct flag len.
```py
b = '00011001101110001010100100010001100100011001000011010001110101001111011011000100100111100100001011000010111001110101101110101100100101111010001100011110010111000010010100111100111101111011110100111010010110011010111110110111010111100100011110011100000010010100110100000110101011110101001010000010101000101001001010010111101110111110011001010100010000000110100001110100101111110100110011011100100000011011010101011110010010111111011101001111000100001101101001011000000001111110'
c = '11010011010000101111101110101001011001101100101000111101101110101101010000010111101110000110100001000111101100000001110010010000000001011111001101111110011110111100111000111111101000110110010111100111110001111010110100110111000001001111010001100110111000101010010001000110010001100100001101000111010100111101101100010010011110010000101100001011100111010110111010110010010111101000110001111001011100001001010011110011110111101111010011101001011001101011111011011101011110010001'
chars = '1234567890qwertyuiopasdfghjkl{zxcvbnm_!@#$%^&*+=3DQWERTYUIOPASDFGHJKL}ZXCVBNM-'
def split(s, n):
return [s[i:i+n] for i in range(0, len(s), n)]
def rotate(l, n):
return l[n:] + l[:n]
brr = [int(x, 2) for x in split(b, 7)]
crr = [int(x, 2) for x in split(c, 7)]
for i in range(len(brr)):
rotated = rotate(brr, i)
xrr = [i^j for i, j in zip(rotated, crr)]
print(i, xrr)
```
The correct flag len is 34, now just transform it to with the chars index.
```py
idx = [26, 16, 21, 14, 70, 52, 61, 29, 9, 28, 22, 37, 52, 71, 37, 32, 3, 35, 37, 34, 2, 37, 55, 35, 52, 12, 51, 3, 32, 14, 55, 33, 2, 67, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
for i in idx:
if i > 78 / 2:
i += 2
print(chars[i], end='')
```
> justCTF{0ld_TV_c4n_b3_InTeR4ctIv3}
