Tags: windows reversing .net 

Rating: 0

<span>Original Article at:
https://penafieljlm.wordpress.com/2016/10/29/ekoparty-ctf-2016-write-ups/#rev-50

</span>Reversing 50 (F#ck)



A wild inappropriately named reverse engineering challenge appears!The attachment contains a single Windows executable file named “FlagGenerator.exe”. Upon closer inspection (via a text editor), one would see that the executable is a .NET assembly.

Requirements

Process
  1. Open the “FlagGenerate.exe” file with ILSpy
  2. View the decompilation for “FlagGenerator/-/Program”
  3. Create a Visual Studio Project
  4. Add the “FSharp.Core” assembly to the References of your project
  5. Copy all of the imports in the decompilation to your project
  6. Copy the entire “Program” class to your project
  7. Replace all instances of teArr@9 to teArrat9 (or any other valid name) to suppress some of the syntax errors

    Before


    After
  8. Replace entire main method with a call to Program.get_flag(“t#hs_siht_kc#f”) and and print of its return value

    Before


    After
  9. Run the program, copy the output, and pass it as an argument to “FlagGenerator.exe”

  10. The flag is “EKO{f#ck_this_sh#t}”