{"id":3346,"date":"2025-04-14T20:12:22","date_gmt":"2025-04-14T11:12:22","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3346"},"modified":"2025-04-14T20:20:45","modified_gmt":"2025-04-14T11:20:45","slug":"lactf2024-rbp","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3346","title":{"rendered":"[LACTF2024] rbp"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Analysis<\/h2>\n\n\n\n<p>IDA\ub85c \uc5f4\uc5b4\ubcf4\uba74, libc PLT\/GOT \uc8fc\uc18c\uac00 \uc0ac\ub77c\uc838\uc788\uc74c.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"332\" height=\"127\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-48.png\" alt=\"\" class=\"wp-image-3347\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-48.png 332w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-48-300x115.png 300w\" sizes=\"auto, (max-width: 332px) 100vw, 332px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"831\" height=\"694\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-49.png\" alt=\"\" class=\"wp-image-3348\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-49.png 831w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-49-300x251.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-49-768x641.png 768w\" sizes=\"auto, (max-width: 831px) 100vw, 831px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\uc2ec\ubcfc \ucc3e\uae30<\/h3>\n\n\n\n<p>main\uc5d0\uc11c \ucc98\uc74c \ud638\ucd9c\ub418\ub294 sub_71840 \ud568\uc218<\/p>\n\n\n\n<p>\u2192 <code>_dl_runtime_resolve<\/code> \u2192 <code>jmp r11<\/code>\u2192 <code>sigemptyset<\/code><\/p>\n\n\n\n<p>\uc2ec\ubcfc \ubcf5\uad6c \uacb0\uacfc (\ud76c\ubbf8\ud55c XREF \ubb38\uad6c \ucc38\uace0):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"888\" height=\"384\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-50.png\" alt=\"\" class=\"wp-image-3349\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-50.png 888w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-50-300x130.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-50-768x332.png 768w\" sizes=\"auto, (max-width: 888px) 100vw, 888px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">sub_71247<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">1. \uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc5f4 a1\uc758 \uae38\uc774\uac00 0x23, 35\ubc14\uc774\ud2b8\uc778\uc9c0 \ud655\uc778\ud568.<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">_BOOL8 __fastcall sub_71247(__int64 a1)\n{\n  int v1; \/\/ eax\n  int v3; \/\/ eax\n  int v4; \/\/ [rsp+14h] [rbp-FCh]\n  int v5; \/\/ [rsp+18h] [rbp-F8h]\n  int i; \/\/ [rsp+1Ch] [rbp-F4h]\n  int v7; \/\/ [rsp+20h] [rbp-F0h]\n  int j; \/\/ [rsp+24h] [rbp-ECh]\n  int k; \/\/ [rsp+28h] [rbp-E8h]\n  int m; \/\/ [rsp+2Ch] [rbp-E4h]\n  __int64 v11; \/\/ [rsp+30h] [rbp-E0h]\n  __int64 v12; \/\/ [rsp+38h] [rbp-D8h]\n  _OWORD v13[2]; \/\/ [rsp+40h] [rbp-D0h] BYREF\n  __int64 v14; \/\/ [rsp+60h] [rbp-B0h]\n  _DWORD v15[38]; \/\/ [rsp+70h] [rbp-A0h]\n  unsigned __int64 v16; \/\/ [rsp+108h] [rbp-8h]\n\n  v16 = __readfsqword(0x28u);\n  v12 = _strlen_avx2(a1);\n  memset(v13, 0, sizeof(v13));\n  v14 = 0;\n  v4 = 0;\n  v5 = 2;\nLABEL_7:\n  while ( v4 &lt;= 9 )\n  {\n    ++v5;\n    for ( i = 2; i &lt; v5; ++i )\n    {\n      if ( !(v5 % i) )\n        goto LABEL_7;\n    }\n    v1 = v4++;\n    *((_DWORD *)v13 + v1) = v5;\n  }\n  ...<\/pre>\n\n\n\n<p>C\uc5b8\uc5b4 \uc7ac\ud604 \ucf54\ub4dc<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>check1.c<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#include &lt;stdio.h>\n#include &lt;stdint.h>\n\nint main(void) {\n\n    int v1;\n    int v5 = 2;\n    int v4 = 0;\n    int i;\n    int v13[8];\n\nLABEL_7:\n    while ( v4 &lt;= 9 )\n    {\n        ++v5;\n        for ( i = 2; i &lt; v5; ++i )\n        {\n          if ( !(v5 % i) )\n            goto LABEL_7;\n        }\n        v1 = v4++;\n        \/\/ *((_DWORD *)v13 + v1) = v5;\n        v13[v1] = v5;\n    }\n\n    int v12 = (v13[1]) * (v13[2]);\n\n    printf(\"v12 should be: %d\\n\", v12);\n\n    return 0;\n}<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ gcc -o check1 check1.c &amp;&amp; .\/check1\nv12 should be: 35<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. \uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc5f4\uc774 <code>\u201clactf{\u201d<\/code> \ub85c \uc2dc\uc791\ud558\ub294\uc9c0 \ud655\uc778.<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc5f4\uc740 \ubb38\uc790\ub4e4 \uc11c\ub85c XOR \uac80\uc0ac\ub97c \ud1b5\ud574 <code>v15<\/code> 1\ubc14\uc774\ud2b8\uc529 \uac80\uc0ac.<\/li>\n\n\n\n<li><code>input[0] * input[1] * input[2] * input[3] * input[4] * input[5] == 0x15F6D1945A0LL<\/code> \uc131\ub9bd \ud544\uc694.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">  v15[0] = 0;\n  v15[1] = 13;\n  v15[2] = 15;\n  v15[3] = 24;\n  v15[4] = 10;\n  v15[5] = 23;\n  v15[6] = 13;\n  v15[7] = 0;\n  v15[8] = 2;\n  v15[9] = 21;\n  v15[10] = 7;\n  v15[11] = 26;\n  v15[12] = 15;\n  v15[13] = 2;\n  v15[14] = 0;\n  v15[15] = 23;\n  v15[16] = 5;\n  v15[17] = 24;\n  v15[18] = 24;\n  v15[19] = 21;\n  v15[20] = 23;\n  v15[21] = 0;\n  v15[22] = 18;\n  v15[23] = 15;\n  v15[24] = 10;\n  v15[25] = 7;\n  v15[26] = 5;\n  v15[27] = 18;\n  v15[28] = 0;\n  v15[29] = 29;\n  v15[30] = 23;\n  v15[31] = 26;\n  v15[32] = 24;\n  v15[33] = 15;\n  v15[34] = 29;\n  v15[35] = 0;\n  v11 = 1;\n  v7 = 0;\n  for ( j = 0; j &lt;= 5; ++j )\n  {\n    for ( k = 0; k &lt;= 5; ++k )\n    {\n      v3 = v7++;\n      if ( (char)(*(_BYTE *)(j + a1) ^ *(_BYTE *)(k + a1)) != v15[v3] )\n        return 0;\n    }\n    v11 *= *(char *)(j + a1);\n  }\n  \n  if ( v11 != 0x15F6D1945A0LL )\n    return 0;<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1\ubc14\uc774\ud2b8\uc529 \uac80\uc0ac\ub294 \uc544\ub798\uc640 \uac19\uc774 \uc218\ud589\ud55c\ub2e4 \ubcfc \uc218 \uc788\uc74c<\/li>\n\n\n\n<li>\ucd1d 36\ubc88 \uc0ac\uc774\ud074<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">input[0] ^ input[0] == v15[0]\ninput[0] ^ input[1] == v15[2]\ninput[0] ^ input[2] == v15[3]\ninput[0] ^ input[3] == v15[4]\ninput[0] ^ input[4] == v15[5]\ninput[0] ^ input[5] == v15[6]\ninput[1] ^ input[0] == v15[0]\n...\ninput[5] ^ input[5] == v15[35]<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>check2.py<\/li>\n<\/ul>\n\n\n\n<p>z3 \uc194\ubc84\ub85c \ubb38\uc790\uc5f4 \uad6c\ud558\uae30 \uac00\ub2a5 (GPT \u3133)<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">import z3\n\n# v15 \ub9e4\ud2b8\ub9ad\uc2a4\ub294 \uadf8\ub300\ub85c\nv15 = [\n    0,   0xD, 0xF, 0x18, 0xA, 0x17,\n    0xD, 0,   2,   0x15, 7,    26,\n    15,  2,   0,   23,   5,    24,\n    24,  21,  23,  0,    18,   15,\n    10,  7,   5,   18,   0,    29,\n    23,  26,  24,  15,   29,   0,\n]\n\n# 1) BitVec \ubcc0\uc218 6\uac1c\ub97c 64\ube44\ud2b8\ub85c \uc120\uc5b8\na1 = [z3.BitVec(f'input_{i}', 64) for i in range(6)]\n\nsolver = z3.Solver()\n\n# 2) XOR \uc81c\uc57d\nv7 = 0\nfor j in range(6):\n    for k in range(6):\n        solver.add(a1[j] ^ a1[k] == v15[v7])\n        v7+=1\n\n# 3) (\uc120\ud0dd) \ub9cc\uc57d \uc774 \uac12\ub4e4\uc774 printable ASCII\ub77c\uba74 \ubc94\uc704 \uc81c\ud55c\nfor v in a1:\n    solver.add(z3.UGE(v, z3.BitVecVal(32, 64)),\n               z3.ULE(v, z3.BitVecVal(126, 64)))\n\n# 4) \uacf1\uc148 \uc81c\uc57d: input_0 * input_1 * \u2026 * input_5 == 1509363893664\nprod = a1[0]\nfor v in a1[1:]:\n    prod = prod * v\nsolver.add(prod == z3.BitVecVal(1509363893664, 64))\n\n# 5) \ud480\uc5b4\ubcf4\uae30\nif solver.check() == z3.sat:\n    m = solver.model()\n    res = [m[v].as_long() for v in a1]\n    print(\"solution:\", res)\n    print(\"as chars:\", ''.join(chr(x) for x in res))\nelse:\n    print(\"unsat\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 check2.py\nsolution: [108, 97, 99, 116, 102, 123]\nas chars: lactf{<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. \ub9e8 \ub9c8\uc9c0\ub9c9 \ubb38\uc790\uac00 <code>\u2018}\u2019<\/code> \uc778\uc9c0 \ud655\uc778<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">if ( *(_BYTE *)(a1 + 34) != '}' )\n    return 0;<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">4. \uc2dc\ud589 \ucc29\uc624 \uc2dc\uc791<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>sub_71247<\/code> \uc77c\ubd80 \ucf54\ub4dc<\/li>\n\n\n\n<li><code>sub_68000<\/code>, <code>sub_69000<\/code>, <code>sub_70000<\/code> \ud568\uc218 \ubaa8\ub450 \ub9ac\ud134\uac12 1 \uc131\ub9bd \ud544\uc694.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">for ( m = 6; m &lt;= 33; ++m )\n{\n    if ( dword_70AE8 != -1 )\n    {\n      sub_711A1(dword_70AE8);\n      dword_70AE8 = -1;\n    }\n    if ( (unsigned __int8)sub_68000(*(_BYTE *)(m + a1)) != 1\n      || (unsigned __int8)sub_69000(*(_BYTE *)(m + a1)) != 1\n      || (unsigned __int8)sub_70000(*(_BYTE *)(m + a1)) != 1 )\n    {\n      return 0;\n    }\n}<\/pre>\n\n\n\n<p>\uc784\uc758\ub85c <code>lactf{a0_JKLMNOPQRSTUVWXYZabcdefgh}<\/code> \ubb38\uc790\uc5f4\uc744 \ub123\uc5c8\uc744\ub54c\ub97c \uc0b4\ud3b4\ubd04.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">sub_711A1<\/h3>\n\n\n\n<p><code>dword_70AE8<\/code> \ub294 \uace7 <code>a1<\/code>, 0\uc774\ubbc0\ub85c, <br><code>sub_68000<\/code> \u2192 RWX <br><code>sub_69000<\/code> \u2192 RW <br><code>sub_70000<\/code> \u2192 RW<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_711A1(char a1)\n{\n  unsigned int v1; \/\/ eax\n  unsigned int v2; \/\/ eax\n  unsigned int v3; \/\/ eax\n  __int64 result; \/\/ rax\n\n  if ( a1 )\n    v1 = 3;                                     \/\/ PROT_READ | PROT_WRITE\n  else\n    v1 = 7;                                     \/\/ PROT_READ | PROT_WRITE | PROT_EXEC\n  if ( (unsigned int)mprotect(sub_68000, 4096, v1) == -1 )\n    abort();\n  if ( a1 == 1 )\n    v2 = 7;                                     \/\/ PROT_READ | PROT_WRITE | PROT_EXEC\n  else\n    v2 = 3;                                     \/\/ PROT_READ | PROT_WRITE\n  if ( (unsigned int)mprotect(sub_69000, 4096, v2) == -1 )\n    abort();\n  if ( a1 == 2 )\n    v3 = 7;                                     \/\/ PROT_READ | PROT_WRITE | PROT_EXEC\n  else\n    v3 = 3;                                     \/\/ PROT_READ | PROT_WRITE\n  result = mprotect(sub_70000, 4096, v3);\n  if ( (_DWORD)result == -1 )\n    abort();\n  return result;\n}<\/pre>\n\n\n\n<p>a1\uc740 0, 1, 2 \uc774 \uc14b \uc911 \ud558\ub098\ub9cc \ub418\ubbc0\ub85c, \ud56d\uc0c1 2\ubc88\uc529\uc740 exception_hander\ub85c \ub118\uc5b4\uac10.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"645\" height=\"102\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-51.png\" alt=\"\" class=\"wp-image-3350\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-51.png 645w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-51-300x47.png 300w\" sizes=\"auto, (max-width: 645px) 100vw, 645px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">sub_68000<\/h3>\n\n\n\n<p>a1\uc5d0\ub294 a \ubb38\uc790 \ub4e4\uc5b4\uac10. <\/p>\n\n\n\n<p>\uc218\ud589\uc804: <br><code>dword_70AE8 = 0<\/code> <br><code>dword_70AEC = 0<\/code><\/p>\n\n\n\n<p>\uc218\ud589\ud6c4: <br><code>dword_70AE4 = 1<\/code><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_68000(char a1)\n{\n  int v2; \/\/ eax\n\n  if ( a1 &lt;= 0x60 || a1 > 0x7A )                \/\/ abcdefghijklmnopqrstuvwxyz\n    return 0;\n  v2 = dword_70AE4++;\n  byte_70B00[v2] = a1;\n  if ( (a1 == 'b' || a1 == 'c' || a1 == 'h' || a1 == 's' || a1 == 't')\n    &amp;&amp; ++dword_70AEC != 2\n    &amp;&amp; dword_70AEC != 8\n    &amp;&amp; dword_70AEC != 9\n    &amp;&amp; dword_70AEC != 12 )\n  {\n    dword_70AE8 = 1;\n  }\n  if ( a1 == 'd' )\n    dword_70AE8 = 2;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">exception_hander (sub_710F9)<\/h3>\n\n\n\n<p><code>sub_69000<\/code> \ud568\uc218\ub294 \uc218\ud589 X. exception_hander\uc778 sub_710F9\ub85c \ub118\uc5b4\uac10.<\/p>\n\n\n\n<p>\uc218\ud589\uc804: <br><code>dword_70AE4 = 1<\/code><br><code>dword_70AE8 = -1<\/code><br><code>dword_70AEC = 0<\/code><\/p>\n\n\n\n<p>.bss:0000000000070B00 byte_70B00 db &#8216;a&#8217;, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 .bss:0000000000070B00 ; DATA XREF: sub_68000+30\u2191o .bss:0000000000070B00 ; exception_handler+1D\u2193o &#8230; .bss:0000000000070B16 db 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0<\/p>\n\n\n\n<p>a3: 00007FFFFFFFD340 \u2192 dq 7<\/p>\n\n\n\n<p>\uc218\ud589\uc2dc: a = 97 = 0x61<br>byte_70B00[i] = (byte_70B00[i] &#8211; 96) % 26 + 97;<br>= (97 &#8211; 96) % 26 + 97 = 98 = <strong>\u2018b\u2019<\/strong><\/p>\n\n\n\n<p>\uc218\ud589 \ud6c4: \uccab\ubb38\uc790\uc778 a \u2192 b \ubcc0\ud658, \ud56d\uc0c1 1\uc744 \ub9ac\ud134\ud568.<\/p>\n\n\n\n<p>\ub9c8\ucc2c\uac00\uc9c0\ub85c, <code>sub_70000<\/code>\uac00 \uc218\ud589\ub418\uc9c0 \uc54a\uace0, <code>exception_hander<\/code>\ub85c \ub118\uc5b4\uac10. <br>\ub530\ub77c\uc11c b \u2192 c \ubcc0\ud658. <br>\ucd1d \uc624\ub978\ucabd\uc73c\ub85c 2\ubc88 \uc2dc\ud504\ud2b8 \uc5f0\uc0b0.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ucontext_t *__fastcall exception_handler(__int64 a1, siginfo_t *a2, ucontext_t *a3)\n{\n  ucontext_t *result; \/\/ rax\n  int i; \/\/ [rsp+1Ch] [rbp-Ch]\n\n  for ( i = 0; i &lt; dword_70AE4; ++i )\n    byte_70B00[i] = (byte_70B00[i] - 96) % 26 + 97;\n  a3->uc_mcontext.gregs[13] = 1; \/\/ 13 = REG_RAX\n  result = a3;\n  a3->uc_mcontext.gregs[16] = *(_QWORD *)a3->uc_mcontext.gregs[15];\n  \/\/ 16 = REG_RIP, 15 = REG_RSP\n  return result;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_68000<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc18c\ubb38\uc790 \uc54c\ud30c\ubcb3 \ubc94\uc704\uc778\uc9c0 \ud655\uc778<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall check3_small_ascii(char a1)\n{\n  int v2; \/\/ eax\n\n  if ( a1 &lt;= 0x60 || a1 > 0x7A )                \/\/ 'abcdefghijklmnopqrstuvwxyz'\n    return 0;\n  v2 = dword_70AE4++;\n  byte_70B00[v2] = a1;\n  if ( (a1 == 'b' || a1 == 'c' || a1 == 'h' || a1 == 's' || a1 == 't')\n    &amp;&amp; ++dword_70AEC != 2\n    &amp;&amp; dword_70AEC != 8\n    &amp;&amp; dword_70AEC != 9\n    &amp;&amp; dword_70AEC != 12 )\n  {\n    dword_70AE8 = 1;\n  }\n  if ( a1 == 'd' )\n    dword_70AE8 = 2;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_69000<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc22b\uc790 \ubc94\uc704\uc778\uc9c0 \ud655\uc778<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_69000(char a1)\n{\n  if ( a1 &lt;= 0x2F || a1 > 0x39 )                \/\/ 0123456789\n    return 0;\n  if ( a1 - 48 != dword_70824 % 10 )\n    return 0;\n  dword_70824 \/= 10;\n  if ( dword_70AEC == 3 )\n    dword_70AE8 = 2;\n  else\n    dword_70AE8 = 0;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_70000<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ubb38\uc790\ub97c \uc544\uc2a4\ud0a4\ucf54\ub4dc\ub85c \ubcc0\ud658\ud6c4, \uc11c\ub85c \uacf1\ud588\uc744\ub54c 9024\ub85c \ub098\ub208 \ub098\uba38\uc9c0\uac00 0\ub9cc \uc544\ub2c8\uba74 \ub428.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_70000(char a1)\n{\n  if ( !(a1 * a1 % 9024) )\n    return 0;\n  dword_70AE8 = 0;\n  return 1;\n}<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>9024\uc758 \uc81c\uacf1\uadfc = 94.99473669630333<\/li>\n\n\n\n<li><code>95 = \u2018_\u2019<\/code><\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ cat tmp3.py\nimport math\n\nnumber = 9024\nsqrt_number = math.sqrt(number)\nprint(sqrt_number)\n\nprint(chr(95))\nseo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp3.py\n94.99473669630333\n_<\/pre>\n\n\n\n<p>\uac04\ub7b5\ud788 \uc0b4\ud3b4\ubd24\uc744\ub54c,<\/p>\n\n\n\n<p><code>sub_68000<\/code>\ub294 \uc791\uc740 \uc54c\ud30c\ubcb3 \ubc94\uc704\uc778\uc9c0 \ud655\uc778, \ub530\ub77c\uc11c <code>check3_small_ascii<\/code>\ub85c \ud568\uc218 \uc774\ub984 \uba85\uba85<br><code>sub_69000<\/code>\uc740 \uc22b\uc790 \ubc94\uc704\uc778\uc9c0 \ud655\uc778, \ub530\ub77c\uc11c <code>check4_number<\/code> \uba85\uba85<br><code>sub_70000<\/code>\uc740 <code>\u2018_\u2019<\/code>\uc778\uc9c0 \ud655\uc778, \ub530\ub77c\uc11c <code>check5_underbar<\/code> \uba85\uba85<br><code>sub_710F9<\/code> \uc774\ud558 <code>exception_hander<\/code>\ub294, <code>shift_right<\/code> \uba85\uba85<\/p>\n\n\n\n<p>\uacb0\uacfc\uac12\uc744 \uc27d\uac8c \uc54c\uc544\ubcf4\uae30 \uc704\ud574 <br>\ud574\ub2f9 4\uac1c\uc758 \ud568\uc218\uc640 <code>strcmp<\/code> \ud568\uc218 \ud6c4\ud0b9 \uc801\uc6a9.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>hook.c<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#define _GNU_SOURCE\n#include &lt;link.h>\n#include &lt;stdio.h>\n#include &lt;stdlib.h>\n#include &lt;stdint.h>\n#include &lt;string.h>\n#include &lt;signal.h>\n#include &lt;sys\/mman.h>\n\n#include &lt;dobby.h>\n#include &lt;funchook.h>\n\nbool has_exec(uintptr_t addr) {\n    FILE *fp = fopen(\"\/proc\/self\/maps\", \"r\");\n    if (!fp) {\n        perror(\"fopen\");\n        return false;\n    }\n\n    char line[256];\n    while (fgets(line, sizeof(line), fp)) {\n        uintptr_t start, end;\n        char perms[5];  \/\/ e.g. \"r-xp\"\n\n        if (sscanf(line, \"%lx-%lx %4s\", &amp;start, &amp;end, perms) != 3)\n            continue;\n\n        if (addr >= start &amp;&amp; addr &lt; end) {\n            fclose(fp);\n            return (perms[2] == 'x');  \/\/ perms[2]\uc774 'x'\uba74 \uc2e4\ud589 \uad8c\ud55c\n        }\n    }\n\n    fclose(fp);\n    return false;\n}\n\nvoid check3_small_ascii_handler(void *address, DobbyRegisterContext *reg_ctx) {\n    uint64_t rax = (uint64_t)(reg_ctx->general.regs.rax);\n    uint64_t rdi = (uint64_t)(reg_ctx->general.regs.rdi);\n\n    printf(\"[hook.so] check3_small_ascii: rax = 0x%lx, rdi = %c\\n\", rax, rdi);\n}\n\nvoid check4_number_handler(void *address, DobbyRegisterContext *reg_ctx) {\n    uint64_t rax = (uint64_t)(reg_ctx->general.regs.rax);\n    uint64_t rdi = (uint64_t)(reg_ctx->general.regs.rdi);\n\n\n    printf(\"[hook.so] check4_number: rax = 0x%lx, rdi = %c, dword_70824 = %u\\n\", rax, rdi, *(uint32_t*)(0x70824));\n}\n\nvoid check5_underbar_handler(void *address, DobbyRegisterContext *reg_ctx) {\n    uint64_t rax = (uint64_t)(reg_ctx->general.regs.rax);\n    uint64_t rdi = (uint64_t)(reg_ctx->general.regs.rdi);\n\n    \/\/ uint32_t dword_70AE8 = *(uint32_t*)(0x70AE8);\n    bool _has_exec = has_exec(0x70000);\n    \/\/ printf(\"dword_70AE8: %u, has_exec: %d\\n\", dword_70AE8, _has_exec);\n\n    if(_has_exec) {\n        printf(\"[hook.so] Called check5_underbar: rax = 0x%lx, rdi = %c\\n\", rax, rdi);\n        if(rdi != '_') {\n            printf(\"[hook.so] check5_underbar mismatch!\\n\");\n            exit(1);\n        }\n    }\n}\n\nvoid shift_right_handler(void *address, DobbyRegisterContext *reg_ctx) {\n    printf(\"[hook.so] shift_right: \\n\");\n}\n\n\n\nstatic int (*orig_strcmp)(const char *p1, const char *p2);\nstatic int hook_strcmp(const char *p1, const char *p2) {\n    printf(\"[hook.so] strcmp p1: %s, p2: %s\\n\", p1, p2);\n    return orig_strcmp(p1, p2);\n}\n\n\/\/ static int64_t (*orig_check5_underbar)(char a1);\n\/\/ static int64_t hook_check5_underbar(char a1)\n\/\/ {\n\/\/     int64_t rv;\n\n\/\/     printf(\"!!!\\n\");\n\n\/\/     rv = orig_check5_underbar(a1);\n\n\n\/\/     return rv;\n\/\/ }\n\n\/\/ static int64_t (*orig_main)(int a1, char **a2, char **a3);\n\/\/ static int64_t hook_main(int a1, char **a2, char **a3) {\n\/\/     printf(\"[hook.so] Called main!\\n\");    \n\n\/\/     funchook_t *funchook = funchook_create();\n\/\/     int rv;\n\/\/     printf(\"rv: %d\\n\", rv);\n\n\/\/     \/\/ void *res = mmap(0x70000, 4096, PROT_READ | PROT_WRITE,\n\/\/     \/\/     MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);\n\/\/     \/\/ printf(\"res: %p\\n\", res);\n\n\/\/     \/\/ printf(\"mprotect: %d\\n\", mprotect(0x70000, 4096, 7));\n\/\/     orig_check5_underbar = (void *)(0x70000);\n\/\/     rv = funchook_prepare(funchook, (void**)&amp;orig_check5_underbar, hook_check5_underbar);\n\n\/\/     rv = funchook_install(funchook, 0);\n\n\/\/     int64_t ret = orig_main(a1, a2, a3);\n\n\n\/\/     return ret;\n\/\/ }\n\n__attribute__((constructor)) \nvoid initialize() {\n    printf(\"[hook.so] Successfully Loaded!\\n\");\n\n    dobby_enable_near_branch_trampoline();\n\tDobbyInstrument((void *)(0x680B6), (dobby_instrument_callback_t)check3_small_ascii_handler);\n    DobbyInstrument((void *)(0x690A8), (dobby_instrument_callback_t)check4_number_handler);\n    DobbyInstrument((void *)(0x715FD), (dobby_instrument_callback_t)check5_underbar_handler);\n    DobbyInstrument((void *)(0x71197), (dobby_instrument_callback_t)shift_right_handler);\n    DobbyHook((void*)(strcmp), (void*)hook_strcmp, (void**)&amp;orig_strcmp);\n\tdobby_disable_near_branch_trampoline();\n\n    \/\/ DobbyHook((void*)(0x7165e), (void*)hook_main, (void**)&amp;orig_main);\n\n}<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>build.sh<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/bin\/bash\ngcc -shared -fPIC -o hook.so hook.c -ldl -L. -ldobby -lfunchook<\/pre>\n\n\n\n<p><code>lactf{aaaaaaaaaaaaaaaaaaaaaaaaaaaa}<\/code> \ubb38\uc790\uc5f4\uc744 \ub123\uc5c8\uc744\ub54c \uacb0\uacfc \uc0b4\ud3b4\ubd04.<\/p>\n\n\n\n<p>\ub9e8 \ub9c8\uc9c0\ub9c9 \ub2e8\uacc4\uc778 <code>strcmp<\/code> \ud568\uc218\uc5d0\uc11c \ub9c9\ud798.<\/p>\n\n\n\n<p><code>shift_right<\/code> \uc5f0\uc0b0\uc740 <strong>\ucd1d 56\ubc88 \uc218\ud589.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"57\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-52-1024x57.png\" alt=\"\" class=\"wp-image-3351\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-52-1024x57.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-52-300x17.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-52-768x43.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-52.png 1077w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><code>[hook.so] strcmp p1: ecaywusqomkigecaywusqomkigec, p2: vwbowpcjrhpkobfryu<\/code><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ LD_PRELOAD=.\/hook\/hook.so .\/rbp\n[hook.so] Successfully Loaded!\nshe r on my b till I p > lactf{aaaaaaaaaaaaaaaaaaaaaaaaaaaa}\n[hook.so] check3_small_ascii: rax = 0x1, rdi = a\n[hook.so] shift_right:\n[hook.so] shift_right:\n[hook.so] check5_underbar: rax = 0x1, rdi = a\n[hook.so] check3_small_ascii: rax = 0x1, rdi = a\n[hook.so] shift_right:\n[hook.so] shift_right:\n...\n[hook.so] check5_underbar: rax = 0x1, rdi = a\n[hook.so] strcmp p1: ecaywusqomkigecaywusqomkigec, p2: vwbowpcjrhpkobfryu\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<p>\uc0b4\ud3b4\ubd24\uc744\ub54c, <code>aaa...<\/code> \ubb38\uc790\uc5f4\uc774 <code>ecaywusqomkigecaywusqomkigec<\/code>\ub85c \ucd5c\uc885 \ubcc0\ud658\ub418\uc5c8\uc74c.<\/p>\n\n\n\n<p>\uc5ed\uc5f0\uc0b0 \ucf54\ub4dc\ub97c \uc9dc\uba74<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"ecaywusqomkigecaywusqomkigec\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\nfor i in range(len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\nprint(dec)<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Result<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp\/hook$ python3 ..\/tmp2.py\n28\naaaaaaaaaaaaaaaaaaaaaaaaaaaa<\/pre>\n\n\n\n<p><code>\u201cvwbowpcjrhpkobfryu\u201d<\/code> \ubb38\uc790\uc5f4\uc744 \uc5ed\uc5f0\uc0b0 \ucf54\ub4dc\uc5d0 \ub123\uc5c8\uc744\ub54c <br><code>rubqavktdvfcixdray<\/code><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp\/hook$ python3 ..\/tmp2.py\n18\nrubqavktdvfcixdray<\/pre>\n\n\n\n<p>\ud574\ub2f9 \ubb38\uc790\uc5f4\uc5d0\ub2e4 a \ub354\ubbf8\ub97c \ucc44\uc6e0\uc744\ub54c \u2192 <code>lactf{rubqavktdvfcixdrayaaaaaaaaaa}<\/code><\/p>\n\n\n\n<p>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>check4_number<\/code>\uc5d0\uc11c \ub9c9\ud798<\/li>\n\n\n\n<li>4\ubc88\uc9f8 \ubb38\uc790\ubd80\ud130\ub294 0~9\uac00 \ub4e4\uc5b4\uac00\uc57c\ud560 \uac83.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ LD_PRELOAD=.\/hook\/hook.so .\/rbp\n[hook.so] Successfully Loaded!\nshe r on my b till I p > lactf{rubqavktdvfcixdrayaaaaaaaaaa}\n[hook.so] check3_small_ascii: rax = 0x1, rdi = r\n[hook.so] shift_right:\n[hook.so] shift_right:\n[hook.so] check5_underbar: rax = 0x1, rdi = r\n[hook.so] check3_small_ascii: rax = 0x1, rdi = u\n[hook.so] shift_right:\n[hook.so] shift_right:\n[hook.so] check5_underbar: rax = 0x1, rdi = u\n[hook.so] check3_small_ascii: rax = 0x1, rdi = b\n[hook.so] shift_right:\n[hook.so] shift_right:\n[hook.so] check5_underbar: rax = 0x1, rdi = b\n[hook.so] shift_right:\n[hook.so] check4_number: rax = 0x0, rdi = q\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">check4_number<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>dword_70824 = 13003401<\/code><\/li>\n\n\n\n<li>a1 = <code>dword_70824 % 10 + 0x30<\/code><\/li>\n\n\n\n<li>a1 = <code>13003401<\/code> % 10 + 0x30<\/li>\n\n\n\n<li>a1 = 49 = <code>\u20181\u2019<\/code><\/li>\n\n\n\n<li>4\ubc88\uca30 \ubb38\uc790 = <code>\u20181\u2019<\/code><\/li>\n\n\n\n<li>dword_70824\/=10, <code>dword_70824 = 1300340<\/code><\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall check4_number(char a1)\n{\n  if ( a1 &lt;= 0x2F || a1 > 0x39 )\n    return 0;\n  if ( a1 - 0x30 != dword_70824 % 10 )\n    return 0;\n  dword_70824 \/= 10;\n  if ( dword_70AEC == 3 )\n    dword_70AE8 = 2;\n  else\n    dword_70AE8 = 0;\n  return 1;\n}<\/pre>\n\n\n\n<p>5\ubc88\uc9f8 \ubb38\uc790\ubd80\ud130 \ub2e4\uc2dc \ubcf5\ud638\ud654 \uc2dc\uc791.<\/p>\n\n\n\n<p><code>lactf{rub1scxmvfxhekzftcaaaaaaaaaa}<\/code><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\nfor i in range(3, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1scxmvfxhekzftcaaaaaaaaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1scxmvfxhekzftcaaaaaaaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>check4_number<\/code>\uc5d0\uc11c \ub9c9\ud798<\/li>\n\n\n\n<li><code>\u2018x\u2019<\/code> \ubb38\uc790 \ub300\uc2e0 <code>\u20180\u2019<\/code>\uc774 \ub4e4\uc5b4\uac00\uc57c\ud560 \uac83.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = x, dword_70824 = 1300340\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<p><code>lactf{rub1sc0mvfxhekzftcaaaaaaaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\u2018m\u2019<\/code> \ub300\uc2e0\uc5d0 <code>\u2018_\u2019<\/code><\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] Called check5_underbar: rax = 0x1, rdi = m\n[hook.so] check5_underbar mismatch!<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n\nfor i in range(5, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_bqzjbliodjxgeaaaaaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_bqzjbliodjxgeaaaaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>q \ub300\uc2e0 4<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = q, dword_70824 = 130034\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n\nfor i in range(6, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4sbldnkqflzigaaaaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4sbldnkqflzigaaaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>b \ub300\uc2e0 3<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = b, dword_70824 = 13003\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n\nfor i in range(7, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3dnfpmshnbkiaaaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3dnfpmshnbkiaaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>n \ub300\uc2e0 \u2018_\u2019<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] Called check5_underbar: rax = 0x1, rdi = n\n[hook.so] check5_underbar mismatch!<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n\nfor i in range(8, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">18\nlactf{rub1sc0_b4s3d_phroujpdmkaaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3d_phroujpdmkaaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>r \ub300\uc2e0\uc5d0 \u20180\u2019<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = r, dword_70824 = 1300\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# p\ndec += left_shift(enc[8], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[9], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n\nfor i in range(10, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3d_ph0tqwlrfomaaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3d_ph0tqwlrfomaaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>q \ub300\uc2e0 0<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = q, dword_70824 = 130\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# p\ndec += left_shift(enc[8], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[9], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# t\ndec += left_shift(enc[10], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n\nfor i in range(11, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3d_ph0t0synthqoaa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3d_ph0t0synthqoaa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>q \ub300\uc2e0 3<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = q, dword_70824 = 13\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# p\ndec += left_shift(enc[8], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[9], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# t\ndec += left_shift(enc[10], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# s\ndec += left_shift(enc[11], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# y\ndec += left_shift(enc[12], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# n\ndec += left_shift(enc[13], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# t\ndec += left_shift(enc[14], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[15], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n\nfor i in range(16, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3d_ph0t0synth3sqa}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3d_ph0t0synth3sqa}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<p>q \ub300\uc2e0 1<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] check4_number: rax = 0x0, rdi = q, dword_70824 = 1\nextremely loud incorrect buzzer<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\nloopcnt_7155B -= 1\ndec += \"4\"\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# p\ndec += left_shift(enc[8], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[9], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# t\ndec += left_shift(enc[10], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\nloopcnt_7155B -= 1\ndec += \"0\"\n\n# s\ndec += left_shift(enc[11], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# y\ndec += left_shift(enc[12], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# n\ndec += left_shift(enc[13], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# t\ndec += left_shift(enc[14], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[15], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\nloopcnt_7155B -= 1\ndec += \"3\"\n\n# s\ndec += left_shift(enc[16], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\nloopcnt_7155B -= 1\ndec += \"1\"\n\nfor i in range(17, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3d_ph0t0synth3s1s}<\/pre>\n\n\n\n<p><code>lactf{rub1sc0_b4s3d_ph0t0synth3s1s}<\/code><br>\ud504\ub85c\uadf8\ub7a8 \uacb0\uacfc:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[hook.so] strcmp p1: vwbowpcjrhpkobfryu, p2: vwbowpcjrhpkobfryu\nomg how did u guess<\/pre>\n\n\n\n<p>\ub05d..<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. \ub9ac\ubdf0<\/h3>\n\n\n\n<p>\ub2e4\uc2dc \uc815\ub9ac\ud574\ubcf4\uc790\uba74<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">sub_711A1<\/h3>\n\n\n\n<p>\uc544\ub798 3\uac00\uc9c0 \ud568\uc218\ub4e4 \uc911 <strong>\uc2e4\ud589\ud560 \uc218 \uc788\ub294<\/strong> \ud558\ub098\ub97c \uacb0\uc815<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>check3_small_ascii (sub_68000)<\/li>\n\n\n\n<li>check4_number (sub_69000)<\/li>\n\n\n\n<li>check5_underbar (sub_70000)<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_711A1(char a1)\n{\n  unsigned int v1; \/\/ eax\n  unsigned int v2; \/\/ eax\n  unsigned int v3; \/\/ eax\n  __int64 result; \/\/ rax\n\n  if ( a1 )\n    v1 = 3;\n  else\n    v1 = 7;\n  if ( (unsigned int)mprotect(check3_small_ascii, 4096, v1) == -1 )\n    abort();\n  if ( a1 == 1 )\n    v2 = 7;\n  else\n    v2 = 3;\n  if ( (unsigned int)mprotect(check4_number, 4096, v2) == -1 )\n    abort();\n  if ( a1 == 2 )\n    v3 = 7;\n  else\n    v3 = 3;\n  result = mprotect(check5_underbar, 4096, v3);\n  if ( (_DWORD)result == -1 )\n    abort();\n  return result;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">exception_handler (sub_710F9)<\/h3>\n\n\n\n<p>\uc2e4\ud589\ud560 \uc218 \uc5c6\ub294 \ud568\uc218\uc77c \uacbd\uc6b0,<br>\ubaa8\ub4e0 \ubb38\uc790\ub97c \uc624\ub978\ucabd\uc73c\ub85c \uc26c\ud504\ud2b8 \uc5f0\uc0b0 1\ubc88 \uc218\ud589\ud568.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ucontext_t *__fastcall exception_handler(__int64 a1, siginfo_t *a2, ucontext_t *a3)\n{\n  ucontext_t *result; \/\/ rax\n  int i; \/\/ [rsp+1Ch] [rbp-Ch]\nucontext_t *__fastcall exception_handler(__int64 a1, siginfo_t *a2, ucontext_t *a3)\n{\n  ucontext_t *result; \/\/ rax\n  int i; \/\/ [rsp+1Ch] [rbp-Ch]\n\n  for ( i = 0; i &lt; dword_70AE4; ++i )\n    byte_70B00[i] = (byte_70B00[i] - 96) % 26 + 97;\n  a3->uc_mcontext.gregs[13] = 1;                \/\/ 13 = REG_RAX\n  result = a3;\n  a3->uc_mcontext.gregs[16] = *(_QWORD *)a3->uc_mcontext.gregs[15];\/\/ 16 = REG_RIP, 15 = REG_RSP\n  return result;\n}\n  for ( i = 0; i &lt; dword_70AE4; ++i )\n    byte_70B00[i] = (byte_70B00[i] - 96) % 26 + 97;\n  a3->uc_mcontext.gregs[13] = 1;                \/\/ 13 = REG_RAX\n  result = a3;\n  a3->uc_mcontext.gregs[16] = *(_QWORD *)a3->uc_mcontext.gregs[15];\/\/ 16 = REG_RIP, 15 = REG_RSP\n  return result;\n}\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">check3_small_ascii (sub_68000)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc18c\ubb38\uc790 \uc54c\ud30c\ubcb3 \ubc94\uc704\uc778\uc9c0 \ud655\uc778<\/li>\n\n\n\n<li><code>dword_70AE4<\/code>\ub294 \uc554\ud638\ud654\ub41c \ub370\uc774\ud130\uc758 \uc778\ub371\uc2a4\ub97c \uc758\ubbf8, 1\uc529 \uc99d\uac00.<\/li>\n\n\n\n<li><code>byte_70B00<\/code>\ub294 \uc554\ud638\ud654\ub41c \ub370\uc774\ud130\ub85c 1\ubc14\uc774\ud2b8\uc529 \ucd94\uac00, \ub9e8 \ub9c8\uc9c0\ub9c9\uc5d0 <code>strcmp<\/code>\uc5d0\uc11c \ucd5c\uc885 \ube44\uad50\ud568.<\/li>\n\n\n\n<li>\uc785\ub825\ubc1b\ub294 \ubb38\uc790\uac00 <code>\u2018b\u2019, \u2018c\u2019, \u2018h\u2019, \u2018s\u2019, \u2018t\u2019<\/code> \uc911 \ud558\ub098\uc77c \uacbd\uc6b0, <code>dword_70AEC<\/code> \uce74\uc6b4\ud2b8 \uc99d\uac00.<\/li>\n\n\n\n<li>\uc99d\uac00\ub41c <strong><code>dword_70AEC<\/code> \uce74\uc6b4\ud2b8 \uac12\uc774 <code>2, 8, 9, 12<\/code>\uc77c \uacbd\uc6b0, <code>dword_70AE8 = 1<\/code><\/strong><\/li>\n\n\n\n<li>\uc785\ub825\ubc1b\ub294 \ubb38\uc790\uac00 \u2018d\u2019\uc77c \uacbd\uc6b0, <strong><code>dword_70AE8 = 2<\/code><\/strong><\/li>\n\n\n\n<li><code>dword_70AE8<\/code>\uc5d0 \uc758\ud574 \uc774 \ub2e4\uc74c\uc5d0 \uc2e4\ud589\uc2dc\ud0ac \uc218 \uc788\ub294 \ud568\uc218\ub97c <code>sub_711A1<\/code>\uc5d0\uc11c \uacb0\uc815\ud574\uc90c.<\/li>\n\n\n\n<li><code>dword_70AE8<\/code>\uc774 0\uc77c \uacbd\uc6b0: <code>check3_small_ascii<\/code><\/li>\n\n\n\n<li><strong><code>dword_70AE8<\/code>\uc774 1\uc77c \uacbd\uc6b0: <code>check4_number<\/code><\/strong><\/li>\n\n\n\n<li><strong><code>dword_70AE8<\/code>\uc774 2\uc77c \uacbd\uc6b0: <code>check5_underbar<\/code><\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall check3_small_ascii(char a1)\n{\n  int v2; \/\/ eax\n\n  if ( a1 &lt;= 0x60 || a1 > 0x7A )                \/\/ 'abcdefghijklmnopqrstuvwxyz'\n    return 0;\n  v2 = dword_70AE4++;\n  byte_70B00[v2] = a1;\n  if ( (a1 == 'b' || a1 == 'c' || a1 == 'h' || a1 == 's' || a1 == 't')\n    &amp;&amp; ++dword_70AEC != 2\n    &amp;&amp; dword_70AEC != 8\n    &amp;&amp; dword_70AEC != 9\n    &amp;&amp; dword_70AEC != 12 )\n  {\n    dword_70AE8 = 1;\n  }\n  if ( a1 == 'd' )\n    dword_70AE8 = 2;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">check4_number (sub_69000)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>0~9 \ubc94\uc704\uc778\uc9c0 \ud655\uc778<\/li>\n\n\n\n<li>\ucd08\uae30 <code>dword_70824<\/code>\ub294 <code>13003401<\/code> \uac12\uc744 \uac00\uc9d0.<\/li>\n\n\n\n<li>\uc5ed\uc5f0\uc0b0 \uc218\ud589\uc2dc a1 = \u20181\u2019 \ucda9\uc871 \ud544\uc694, <code>dword_70824 = 1300340<\/code><\/li>\n\n\n\n<li>2\ubc88\uca30 \uc218\ud589\uc2dc a1 = \u20180\u2019, <code>dword_70824 = 130034<\/code><\/li>\n\n\n\n<li>3\ubc88\uc9f8 \uc218\ud589\uc2dc a1 = \u20184\u2019, <code>dword_70824 = 13003<\/code><\/li>\n\n\n\n<li><code>check3_small_ascii<\/code> \uc5d0\uc11c <strong>\uc99d\uac00\ub41c <code>dword_70AEC<\/code> \uac12\uc774 3\uc77c \uacbd\uc6b0, <code>dword_70AE8 = 2<\/code><\/strong><\/li>\n\n\n\n<li><strong>\uc99d\uac00\ub41c <code>dword_70AEC<\/code> \uac12\uc774 3\uc774 \uc544\ub2c8\uba74, <code>dword_70AE8 = 0<\/code><\/strong><\/li>\n\n\n\n<li><strong><code>dword_70AE8<\/code>\uc774 0\uc77c \uacbd\uc6b0: <code>check3_small_ascii<\/code><\/strong><\/li>\n\n\n\n<li><code>dword_70AE8<\/code>\uc774 1\uc77c \uacbd\uc6b0: <code>check4_number<\/code><\/li>\n\n\n\n<li><strong><code>dword_70AE8<\/code>\uc774 2\uc77c \uacbd\uc6b0: <code>check5_underbar<\/code><\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall sub_69000(char a1)\n{\n  if ( a1 &lt;= 0x2F || a1 > 0x39 )                \/\/ 0123456789\n    return 0;\n  if ( a1 - 48 != dword_70824 % 10 )\n    return 0;\n  dword_70824 \/= 10;\n  if ( dword_70AEC == 3 )\n    dword_70AE8 = 2;\n  else\n    dword_70AE8 = 0;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">check5_underbar (sub_70000)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc758 \uc81c\uacf1\uc744 9024\ub85c \ub098\ub234\uc744\ub54c \ub098\ub204\uc5b4 \ub5a8\uc5b4\uc9c0\uc9c0\ub9cc \uc54a\uc73c\uba74 \ub428.<\/li>\n\n\n\n<li>\uc0ac\uc2e4 \uc218\ub9ce\uc740 \ubb38\uc790\uac00 \uc870\uac74\uc744 \ub9cc\uc871\uc2dc\ud0ac \uc218 \uc788\uc73c\ub098,<\/li>\n\n\n\n<li>9024\uc758 \uc81c\uacf1\uadfc = 94.99473669630333<\/li>\n\n\n\n<li>\uc720\ucd94\ud558\uba74 <code>95 = \u2018_\u2019<\/code> \ubb38\uc790\uac00 \ub4e4\uc5b4\uac00\uc57c\ud560 \uac83 \uac19\uc74c.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall check5_underbar(char a1)\n{\n  if ( !(a1 * a1 % 9024) )\n    return 0;\n  dword_70AE8 = 0;\n  return 1;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">exception_handler<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc2e4\ud589\ud560 \uc218 \uc5c6\ub294 \uc601\uc5ed\uc5d0 \ub2ff\uc558\uc744\ub54c \ud574\ub2f9 \ud568\uc218\uac00 \ud638\ucd9c\ub428.<\/li>\n\n\n\n<li>RAX\ub294 \ud56d\uc0c1 1\uc744 \ubc18\ud658\ud568.<\/li>\n\n\n\n<li><code>byte_70B00<\/code>\ub294 \ub9e8 \ub9c8\uc9c0\ub9c9\uc5d0 <code>strcmp<\/code>\uc5d0\uc11c \ucd5c\uc885 \ube44\uad50\ud568.<\/li>\n\n\n\n<li><code>byte_70B00<\/code> \ubb38\uc790\ub4e4\uc744 \uc624\ub978\ucabd\uc73c\ub85c 1\ub9cc\ud07c \uc2dc\ud504\ud2b8 \uc5f0\uc0b0\ud568.<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ucontext_t *__fastcall exception_handler(__int64 a1, siginfo_t *a2, ucontext_t *a3)\n{\n  ucontext_t *result; \/\/ rax\n  int i; \/\/ [rsp+1Ch] [rbp-Ch]\n\n  for ( i = 0; i &lt; dword_70AE4; ++i )\n    byte_70B00[i] = (byte_70B00[i] - 96) % 26 + 97;\n  a3->uc_mcontext.gregs[13] = 1;                \/\/ 13 = REG_RAX\n  result = a3;\n  a3->uc_mcontext.gregs[16] = *(_QWORD *)a3->uc_mcontext.gregs[15];\/\/ 16 = REG_RIP, 15 = REG_RSP\n  return result;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">solve.py<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">def left_shift(_chr, cnt):\n    _chr = ord(_chr)\n    for i in range(cnt):\n        _chr = (_chr - 97) \n        while(_chr &lt;= 0):\n            _chr += 26\n        _chr += 96\n    return chr(_chr)\n\ndword_70824 = 13003401\nenc = \"vwbowpcjrhpkobfryu\"\ndec = \"\"\nloopcnt_7155B = 33-6 + 1\n\nprint(len(enc))\n\n# r\ndec += left_shift(enc[0], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# u\ndec += left_shift(enc[1], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# b\ndec += left_shift(enc[2], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# s\ndec += left_shift(enc[3], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# c\ndec += left_shift(enc[4], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# b\ndec += left_shift(enc[5], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 4\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# s\ndec += left_shift(enc[6], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# d\ndec += left_shift(enc[7], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# _\nloopcnt_7155B -= 1\ndec += \"_\"\n\n# p\ndec += left_shift(enc[8], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[9], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# t\ndec += left_shift(enc[10], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 0\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# s\ndec += left_shift(enc[11], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# y\ndec += left_shift(enc[12], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# n\ndec += left_shift(enc[13], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# t\ndec += left_shift(enc[14], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# h\ndec += left_shift(enc[15], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 3\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\n# s\ndec += left_shift(enc[16], loopcnt_7155B*2)\nloopcnt_7155B -= 1\n\n# 1\ndec += chr((dword_70824 % 10) + 48)\nloopcnt_7155B -= 1\ndword_70824 = int(dword_70824 \/ 10)\n\nfor i in range(17, len(enc)):\n    dec += left_shift(enc[i], loopcnt_7155B*2)\n    loopcnt_7155B -= 1\n\ndec = dec.ljust(28, \"a\")\nprint(\"lactf{\" + dec + \"}\")<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">result<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">seo@seo:~\/study\/LACTF2024\/rbp$ python3 tmp2.py\n18\nlactf{rub1sc0_b4s3d_ph0t0synth3s1s}<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Analysis IDA\ub85c \uc5f4\uc5b4\ubcf4\uba74, libc PLT\/GOT \uc8fc\uc18c\uac00 \uc0ac\ub77c\uc838\uc788\uc74c. \uc2ec\ubcfc \ucc3e\uae30 main\uc5d0\uc11c \ucc98\uc74c \ud638\ucd9c\ub418\ub294 sub_71840 \ud568\uc218 \u2192 _dl_runtime_resolve \u2192 jmp r11\u2192 sigemptyset \uc2ec\ubcfc \ubcf5\uad6c \uacb0\uacfc (\ud76c\ubbf8\ud55c XREF \ubb38\uad6c \ucc38\uace0): sub_71247 1. \uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc5f4 a1\uc758 \uae38\uc774\uac00 0x23, 35\ubc14\uc774\ud2b8\uc778\uc9c0 \ud655\uc778\ud568. C\uc5b8\uc5b4 \uc7ac\ud604 \ucf54\ub4dc 2. \uc785\ub825\ubc1b\uc740 \ubb38\uc790\uc5f4\uc774 \u201clactf{\u201d \ub85c \uc2dc\uc791\ud558\ub294\uc9c0 \ud655\uc778. z3 \uc194\ubc84\ub85c \ubb38\uc790\uc5f4 \uad6c\ud558\uae30 \uac00\ub2a5 (GPT \u3133) 3. \ub9e8&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=3346\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[LACTF2024] rbp<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[19],"tags":[24],"class_list":["post-3346","post","type-post","status-publish","format-standard","hentry","category-ctf-private","tag-reversing"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3346"}],"version-history":[{"count":2,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3346\/revisions"}],"predecessor-version":[{"id":3354,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3346\/revisions\/3354"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}