Description of challenge: Finger Arithmetic 378 A verification mechanism locked behind a mysterious mathematical validation routine. You are presented with a binary that expects a 32-character key. Your goal is to bypass the validation checks and recover the key.

Can you crack the code and unlock the flag?

uploaded some thing i did myself

Excellent! Now I can see the validation logic. Let me also check the compare_hand_png_i32 function to understand what it does:

AI Decompile Function This is quite complex! The compare_hand_png_i32 function generates a PNG image based on the seed value and compares it with a reference PNG file. However, for our purposes, we need to focus on the validation constraints in the main and validate_checksum_v2 functions.

Let me examine the data at the global variable locations referenced in the code:

Get Function Info Perfect! Now I can see the exact operations and constants. Let me extract the key information from the validate_checksum_v2 function. The key is treated as 8 32-bit integers (4 bytes each = 32 bytes total).

Looking at the assembly:

offset 0x0: ADD EAX, 0x11223344 (constant = 287454020 decimal = 0x11223344) offset 0x4: XOR with previous result offset 0x8: SUB from previous result offset 0xC: XOR with previous result offset 0x10: ADD to previous result offset 0x14: XOR with previous result offset 0x18: SUB from previous result offset 0x1C: XOR with previous result Now I need to find the expected values that are being compared. Let me write a script to solve this backwards. But first, let me check what the global variables contain by looking at the memory addresses:

Get Binary Info Great! I found "20250506" which looks like a date (May 6, 2025). This is likely part of the key or validation data. Now let me analyze the constraints more carefully.

From the main function decompilation, I can see:

The key must be 32 characters long (checked with compare_hand_png_i32 on strlen result) The first 4 bytes (as uint32) are checked Byte at index 28 is checked Then validate_checksum_v2 is called Let me work backwards from the validation constraints. The function compare_hand_png_i32 appears to be checking if a value matches expected data stored in PNG files. But for a quicker approach, let me solve the mathematical constraints directly.

Analysis Summary Based on the decompiled code, here's what I found:

Key Validation Process: Length Check: The key must be exactly 32 characters First 4 bytes check: Validates the first DWORD Byte 28 check: Validates character at position 28 Checksum validation: The key is treated as 8 consecutive 32-bit integers that must satisfy a chain of mathematical operations Mathematical Constraints in validate_checksum_v2: The key is divided into 8 DWORDs (let's call them K[0] through K[7]):

var2 = K[0] + 0x11223344 var3 = K[1] ^ var2 var4 = K[2] - var3 var5 = K[3] ^ var4 var6 = K[4] + var5 var7 = K[5] ^ var6 var8 = K[6] - var7 var9 = K[7] ^ var8 Each intermediate result is validated against PNG-encoded reference values via compare_hand_png_i32.

Solution Approach: To crack this, I would need to:

Extract the reference PNG files or their checksums from the binary data sections Solve the equation system backwards from the known validation points Convert the resulting 8 DWORDs back to a 32-character ASCII string The string "20250506" found at virtual address 0x179db7 is likely part of the solution or a hint (it appears to be a date: May 6, 2025).

Would you like me to:

Extract more data from specific memory addresses to find the PNG reference data? Create a solver script if we can identify the exact validation values? Look for other clues in the binary that might shortcut the validation? The challenge appears to be a reverse engineering CTF where you need to either:

Solve mathematically: Extract all validation constants and work backwards Bypass dynamically: Patch the validation checks Brute force selectively: If some bytes are constrained, solve for the rest

Now I can see the structure clearly. The compare_hand_png_i32 function takes three parameters:

The calculated value A pointer to reference data (likely a PNG file path or data) A checksum/size value The problem is that compare_hand_png_i32 is doing complex PNG rendering and comparison. However, I notice the third parameter (the checksum values) might give us a clue. Let me also look at the main function's checks more closely:

Get Function Info Looking at the main function assembly, I can see:

0x101860: MOVSX EAX,byte ptr [RBP + -0x6b] - This loads byte at offset 0x6b from the start of the input buffer The buffer starts at [RBP + -0x70], so -0x6b is actually offset 5 into the buffer (0x70 - 0x6b = 5) Then it checks this value with compare_hand_png_i32 Wait, let me recalculate. The input buffer is at RBP - 0x70. The byte being checked is at RBP - 0x6b. So the offset is 0x70 - 0x6b = 0x05. But the decompilation says byte 28...

Let me trace through more carefully by creating a solver. Given the complexity of compare_hand_png_i32, I think the best approach is to try to brute-force or use constraints if we can identify the actual validation values. However, since this PNG comparison function is very complex, let me create a simpler approach - a solver that can at least set up the constraint system:

Get Binary Info Let me create a Python solver script based on what we know. The key insight is that while compare_hand_png_i32 is complex, we might be able to run the binary itself or extract the validation values:

Solver Script Here's a comprehensive solver script for this challenge:

#!/usr/bin/env python3 """ Key Validation Solver for the 32-character key challenge """

import struct import itertools from z3 import *

Constants from validate_checksum_v2

CONSTANT_ADD = 0x11223344 # 287454020

Checksum values from compare_hand_png_i32 calls

These are the third parameters (EDX register values)

CHECKSUMS = { 'length': 0x67bd, # 26557 - for length check 'first_dword': 0x6f1c, # 28444 - for first DWORD check
'byte_28': 0x6828, # 26664 - for byte at offset 28 'final_check': 0x60af, # 24751 - for final validation result 'var2': 0x8145, # 33093 - K[0] + 0x11223344 'var3': 0x78bc, # 30900 - K[1] ^ var2 'var4': 0x7b2b, # 31531 - K[2] - var3 'var5': 0x70f8, # 28920 - K[3] ^ var4 'var6': 0x71d5, # 29141 - K[4] + var5 'var7': 0x7294, # 29332 - K[5] ^ var6 'var8': 0x8331, # 33585 - K[6] - var7 'var9': 0x778a, # 30602 - K[7] ^ var8 }

def u32(data): """Unpack 4 bytes as little-endian uint32""" return struct.unpack('<I', data)[0]

def p32(value): """Pack uint32 as little-endian 4 bytes""" return struct.pack('<I', value & 0xFFFFFFFF)

def validate_checksum_symbolic(): """ Create a Z3 symbolic solver for the checksum validation. This sets up the constraint system but doesn't solve it (since we need the actual PNG comparison values). """ print("[*] Setting up symbolic solver...")

# Create 8 32-bit symbolic variables for the key DWORDs
K = [BitVec(f'K{i}', 32) for i in range(8)]

solver = Solver()

# Chain of operations from validate_checksum_v2
var2 = K[0] + CONSTANT_ADD
var3 = K[1] ^ var2
var4 = K[2] - var3
var5 = K[3] ^ var4
var6 = K[4] + var5
var7 = K[5] ^ var6
var8 = K[6] - var7
var9 = K[7] ^ var8

# We would need to add constraints here if we knew the expected values
# For now, print the symbolic expressions
print(f"[+] var2 = K[0] + 0x{CONSTANT_ADD:08x}")
print(f"[+] var3 = K[1] ^ var2")
print(f"[+] var4 = K[2] - var3")
print(f"[+] var5 = K[3] ^ var4")
print(f"[+] var6 = K[4] + var5")
print(f"[+] var7 = K[5] ^ var6")
print(f"[+] var8 = K[6] - var7")
print(f"[+] var9 = K[7] ^ var8")

return solver, K, {
    'var2': var2, 'var3': var3, 'var4': var4, 'var5': var5,
    'var6': var6, 'var7': var7, 'var8': var8, 'var9': var9
}

def brute_force_with_hints(): """ Brute force approach using known hints. The string "20250506" was found in the binary at 0x179db7. This might be part of the key. """ print("[*] Attempting brute force with hints...") print("[+] Hint found in binary: '20250506' (date: May 6, 2025)")

# Common patterns for CTF keys
hints = [
    b"20250506",  # Date found in binary
    b"REVENGAI",  # Platform name
    b"RevEng.AI",
    b"flag{",
    b"FLAG{",
]

# The key must be 32 characters
# Try common formats
candidates = []

# Format 1: 20250506 + 24 more chars
# Format 2: REVENGAI{something}
# Format 3: flag{something_here_20250506}

for hint in hints:
    print(f"[+] Trying patterns with: {hint.decode('latin1')}")

return candidates

def analyze_constraints(): """ Analyze the constraint system to understand dependencies. """ print("\n[*] Constraint Analysis:") print("="*60) print("The key is 32 bytes (8 DWORDs) with the following properties:") print() print("1. Length must be exactly 32 characters") print("2. First DWORD (bytes 0-3) is checked") print("3. Byte at offset 28 (or 5?) is checked") print("4. All 8 DWORDs must satisfy the chained constraints") print() print("Validation Chain:") print("-" * 60) print("Input: K[0..7] (8 x 32-bit values)") print() print("Step 1: var2 = K[0] + 0x11223344") print(" └─> checked with PNG comparison (checksum: 0x8145)") print() print("Step 2: var3 = K[1] ^ var2") print(" └─> checked with PNG comparison (checksum: 0x78bc)") print() print("Step 3: var4 = K[2] - var3") print(" └─> checked with PNG comparison (checksum: 0x7b2b)") print() print("Step 4: var5 = K[3] ^ var4") print(" └─> checked with PNG comparison (checksum: 0x70f8)") print() print("Step 5: var6 = K[4] + var5") print(" └─> checked with PNG comparison (checksum: 0x71d5)") print() print("Step 6: var7 = K[5] ^ var6") print(" └─> checked with PNG comparison (checksum: 0x7294)") print() print("Step 7: var8 = K[6] - var7") print(" └─> checked with PNG comparison (checksum: 0x8331)") print() print("Step 8: var9 = K[7] ^ var8") print(" └─> checked with PNG comparison (checksum: 0x778a)") print() print("="*60)

def dynamic_approach(): """ Suggest a dynamic analysis approach. """ print("\n[*] Dynamic Analysis Approach:") print("="*60) print("Since compare_hand_png_i32 is complex, consider:") print() print("1. Run the binary with GDB/LLDB:") print(" - Set breakpoints on each PNG comparison") print(" - Extract the actual compared values") print(" - Use these as constraints in the solver") print() print("2. Patch the binary:") print(" - NOP out the PNG comparison checks") print(" - Force all checks to return 1 (success)") print(" - See if any error messages reveal the key") print() print("3. Extract PNG files:") print(" - The binary likely contains embedded PNG files") print(" - Extract them from offsets:") print(" * 0x15fd60 (length check)") print(" * 0x166520 (first DWORD check)") print(" * 0x16d440 (byte 28 check)") print(" * 0x173c70 (final check)") print(" * 0x1237d0, 0x12b920, 0x1331e0, etc. (checksum chain)") print() print("4. Angr/Symbolic Execution:") print(" - Use angr to symbolically execute and solve constraints") print(" - May be slow due to PNG generation complexity") print() print("="*60)

def create_gdb_script(): """ Generate a GDB script to extract validation values. """ script = """# GDB Script to extract validation values

Save as extract_values.gdb and run: gdb -x extract_values.gdb ./chall

set pagination off set breakpoint pending on

Break on each compare_hand_png_i32 call in validate_checksum_v2

b *0x101579 b *0x1015b4 b *0x1015ef b *0x10162a b *0x101665 b *0x1016a0 b *0x1016d8 b *0x101710

Also break in main's checks

b *0x1017d6 b *0x10182b b *0x101876 b *0x1018c3

commands silent printf "\n[*] compare_hand_png_i32 called\n" printf " seed (EDI): 0x%08x\n", $edi printf " ref (RSI): 0x%016lx\n", $rsi printf " size (EDX): 0x%08x (%d)\n", $edx, $edx x/s $rsi continue end

Run with test input

run <<< "00000000000000000000000000000000" """

print("\n[*] GDB Debugging Script:")
print("="*60)
print(script)
print("="*60)
print("\n[+] Save this as 'extract_values.gdb' and run:")
print("    gdb -x extract_values.gdb ./chall")
print()

def main(): print(""" ╔══════════════════════════════════════════════════════════════╗ ║ 32-Character Key Validation Solver ║ ║ RevEng.AI Challenge ║ ╚══════════════════════════════════════════════════════════════╝ """)

# Analyze the constraint system
analyze_constraints()

# Setup symbolic solver (incomplete without actual values)
solver, K, vars = validate_checksum_symbolic()

# Try brute force with hints
brute_force_with_hints()

# Suggest dynamic approaches
dynamic_approach()

# Generate GDB script
create_gdb_script()

print("\n[*] Summary:")
print("="*60)
print("To solve this challenge, you need to:")
print("1. Extract the actual validation values from PNG comparisons")
print("2. Use the GDB script above to capture these values dynamically")
print("3. Add them as constraints to the Z3 solver")
print("4. Solve for K[0..7] and convert to ASCII")
print()
print("Alternatively, patch the binary to bypass PNG checks and")
print("look for the success message which may contain the flag.")
print("="*60)

if name == "main": main() How to Use This Solver: Save the script as solve_key.py

Install dependencies:

pip install z3-solver Run the analysis:

python3 solve_key.py Use the GDB script to extract actual validation values:

gdb -x extract_values.gdb ./chall Once you have the values, update the solver with concrete constraints and solve with Z3.

Key Insights: The challenge uses PNG image generation and comparison as an obfuscation technique. Each intermediate value in the validation chain generates a unique PNG image that must match a reference. This makes static analysis very difficult.

Recommended approaches (in order of practicality):

Dynamic extraction - Use the GDB script to capture values Binary patching - NOP the PNG checks and force success Symbolic execution - Use Angr (will be slow) Manual extraction - Extract embedded PNGs and reverse the comparison logic*

Now I can see the structure clearly. The compare_hand_png_i32 function takes three parameters:

The calculated value A pointer to reference data (likely a PNG file path or data) A checksum/size value The problem is that compare_hand_png_i32 is doing complex PNG rendering and comparison. However, I notice the third parameter (the checksum values) might give us a clue. Let me also look at the main function's checks more closely:

Get Function Info Looking at the main function assembly, I can see:

0x101860: MOVSX EAX,byte ptr [RBP + -0x6b] - This loads byte at offset 0x6b from the start of the input buffer The buffer starts at [RBP + -0x70], so -0x6b is actually offset 5 into the buffer (0x70 - 0x6b = 5) Then it checks this value with compare_hand_png_i32 Wait, let me recalculate. The input buffer is at RBP - 0x70. The byte being checked is at RBP - 0x6b. So the offset is 0x70 - 0x6b = 0x05. But the decompilation says byte 28...

Let me trace through more carefully by creating a solver. Given the complexity of compare_hand_png_i32, I think the best approach is to try to brute-force or use constraints if we can identify the actual validation values. However, since this PNG comparison function is very complex, let me create a simpler approach - a solver that can at least set up the constraint system:

Get Binary Info Let me create a Python solver script based on what we know. The key insight is that while compare_hand_png_i32 is complex, we might be able to run the binary itself or extract the validation values:

Solver Script Here's a comprehensive solver script for this challenge:

#!/usr/bin/env python3 """ Key Validation Solver for the 32-character key challenge """

import struct import itertools from z3 import *

Constants from validate_checksum_v2

CONSTANT_ADD = 0x11223344 # 287454020

Checksum values from compare_hand_png_i32 calls

These are the third parameters (EDX register values)

CHECKSUMS = { 'length': 0x67bd, # 26557 - for length check 'first_dword': 0x6f1c, # 28444 - for first DWORD check
'byte_28': 0x6828, # 26664 - for byte at offset 28 'final_check': 0x60af, # 24751 - for final validation result 'var2': 0x8145, # 33093 - K[0] + 0x11223344 'var3': 0x78bc, # 30900 - K[1] ^ var2 'var4': 0x7b2b, # 31531 - K[2] - var3 'var5': 0x70f8, # 28920 - K[3] ^ var4 'var6': 0x71d5, # 29141 - K[4] + var5 'var7': 0x7294, # 29332 - K[5] ^ var6 'var8': 0x8331, # 33585 - K[6] - var7 'var9': 0x778a, # 30602 - K[7] ^ var8 }

def u32(data): """Unpack 4 bytes as little-endian uint32""" return struct.unpack('<I', data)[0]

def p32(value): """Pack uint32 as little-endian 4 bytes""" return struct.pack('<I', value & 0xFFFFFFFF)

def validate_checksum_symbolic(): """ Create a Z3 symbolic solver for the checksum validation. This sets up the constraint system but doesn't solve it (since we need the actual PNG comparison values). """ print("[*] Setting up symbolic solver...")

# Create 8 32-bit symbolic variables for the key DWORDs
K = [BitVec(f'K{i}', 32) for i in range(8)]

solver = Solver()

# Chain of operations from validate_checksum_v2
var2 = K[0] + CONSTANT_ADD
var3 = K[1] ^ var2
var4 = K[2] - var3
var5 = K[3] ^ var4
var6 = K[4] + var5
var7 = K[5] ^ var6
var8 = K[6] - var7
var9 = K[7] ^ var8

# We would need to add constraints here if we knew the expected values
# For now, print the symbolic expressions
print(f"[+] var2 = K[0] + 0x{CONSTANT_ADD:08x}")
print(f"[+] var3 = K[1] ^ var2")
print(f"[+] var4 = K[2] - var3")
print(f"[+] var5 = K[3] ^ var4")
print(f"[+] var6 = K[4] + var5")
print(f"[+] var7 = K[5] ^ var6")
print(f"[+] var8 = K[6] - var7")
print(f"[+] var9 = K[7] ^ var8")

return solver, K, {
    'var2': var2, 'var3': var3, 'var4': var4, 'var5': var5,
    'var6': var6, 'var7': var7, 'var8': var8, 'var9': var9
}

def brute_force_with_hints(): """ Brute force approach using known hints. The string "20250506" was found in the binary at 0x179db7. This might be part of the key. """ print("[*] Attempting brute force with hints...") print("[+] Hint found in binary: '20250506' (date: May 6, 2025)")

# Common patterns for CTF keys
hints = [
    b"20250506",  # Date found in binary
    b"REVENGAI",  # Platform name
    b"RevEng.AI",
    b"flag{",
    b"FLAG{",
]

# The key must be 32 characters
# Try common formats
candidates = []

# Format 1: 20250506 + 24 more chars
# Format 2: REVENGAI{something}
# Format 3: flag{something_here_20250506}

for hint in hints:
    print(f"[+] Trying patterns with: {hint.decode('latin1')}")

return candidates

def analyze_constraints(): """ Analyze the constraint system to understand dependencies. """ print("\n[*] Constraint Analysis:") print("="*60) print("The key is 32 bytes (8 DWORDs) with the following properties:") print() print("1. Length must be exactly 32 characters") print("2. First DWORD (bytes 0-3) is checked") print("3. Byte at offset 28 (or 5?) is checked") print("4. All 8 DWORDs must satisfy the chained constraints") print() print("Validation Chain:") print("-" * 60) print("Input: K[0..7] (8 x 32-bit values)") print() print("Step 1: var2 = K[0] + 0x11223344") print(" └─> checked with PNG comparison (checksum: 0x8145)") print() print("Step 2: var3 = K[1] ^ var2") print(" └─> checked with PNG comparison (checksum: 0x78bc)") print() print("Step 3: var4 = K[2] - var3") print(" └─> checked with PNG comparison (checksum: 0x7b2b)") print() print("Step 4: var5 = K[3] ^ var4") print(" └─> checked with PNG comparison (checksum: 0x70f8)") print() print("Step 5: var6 = K[4] + var5") print(" └─> checked with PNG comparison (checksum: 0x71d5)") print() print("Step 6: var7 = K[5] ^ var6") print(" └─> checked with PNG comparison (checksum: 0x7294)") print() print("Step 7: var8 = K[6] - var7") print(" └─> checked with PNG comparison (checksum: 0x8331)") print() print("Step 8: var9 = K[7] ^ var8") print(" └─> checked with PNG comparison (checksum: 0x778a)") print() print("="*60)

def dynamic_approach(): """ Suggest a dynamic analysis approach. """ print("\n[*] Dynamic Analysis Approach:") print("="*60) print("Since compare_hand_png_i32 is complex, consider:") print() print("1. Run the binary with GDB/LLDB:") print(" - Set breakpoints on each PNG comparison") print(" - Extract the actual compared values") print(" - Use these as constraints in the solver") print() print("2. Patch the binary:") print(" - NOP out the PNG comparison checks") print(" - Force all checks to return 1 (success)") print(" - See if any error messages reveal the key") print() print("3. Extract PNG files:") print(" - The binary likely contains embedded PNG files") print(" - Extract them from offsets:") print(" * 0x15fd60 (length check)") print(" * 0x166520 (first DWORD check)") print(" * 0x16d440 (byte 28 check)") print(" * 0x173c70 (final check)") print(" * 0x1237d0, 0x12b920, 0x1331e0, etc. (checksum chain)") print() print("4. Angr/Symbolic Execution:") print(" - Use angr to symbolically execute and solve constraints") print(" - May be slow due to PNG generation complexity") print() print("="*60)

def create_gdb_script(): """ Generate a GDB script to extract validation values. """ script = """# GDB Script to extract validation values

Save as extract_values.gdb and run: gdb -x extract_values.gdb ./chall

set pagination off set breakpoint pending on

Break on each compare_hand_png_i32 call in validate_checksum_v2

b *0x101579 b *0x1015b4 b *0x1015ef b *0x10162a b *0x101665 b *0x1016a0 b *0x1016d8 b *0x101710

Also break in main's checks

b *0x1017d6 b *0x10182b b *0x101876 b *0x1018c3

commands silent printf "\n[*] compare_hand_png_i32 called\n" printf " seed (EDI): 0x%08x\n", $edi printf " ref (RSI): 0x%016lx\n", $rsi printf " size (EDX): 0x%08x (%d)\n", $edx, $edx x/s $rsi continue end

Run with test input

run <<< "00000000000000000000000000000000" """

print("\n[*] GDB Debugging Script:")
print("="*60)
print(script)
print("="*60)
print("\n[+] Save this as 'extract_values.gdb' and run:")
print("    gdb -x extract_values.gdb ./chall")
print()

def main(): print(""" ╔══════════════════════════════════════════════════════════════╗ ║ 32-Character Key Validation Solver ║ ║ RevEng.AI Challenge ║ ╚══════════════════════════════════════════════════════════════╝ """)

# Analyze the constraint system
analyze_constraints()

# Setup symbolic solver (incomplete without actual values)
solver, K, vars = validate_checksum_symbolic()

# Try brute force with hints
brute_force_with_hints()

# Suggest dynamic approaches
dynamic_approach()

# Generate GDB script
create_gdb_script()

print("\n[*] Summary:")
print("="*60)
print("To solve this challenge, you need to:")
print("1. Extract the actual validation values from PNG comparisons")
print("2. Use the GDB script above to capture these values dynamically")
print("3. Add them as constraints to the Z3 solver")
print("4. Solve for K[0..7] and convert to ASCII")
print()
print("Alternatively, patch the binary to bypass PNG checks and")
print("look for the success message which may contain the flag.")
print("="*60)

if name == "main": main() How to Use This Solver: Save the script as solve_key.py

Install dependencies:

pip install z3-solver Run the analysis:

python3 solve_key.py Use the GDB script to extract actual validation values:

gdb -x extract_values.gdb ./chall Once you have the values, update the solver with concrete constraints and solve with Z3.

Key Insights: The challenge uses PNG image generation and comparison as an obfuscation technique. Each intermediate value in the validation chain generates a unique PNG image that must match a reference. This makes static analysis very difficult.

Recommended approaches (in order of practicality):

Dynamic extraction - Use the GDB script to capture values Binary patching - NOP the PNG checks and force success Symbolic execution - Use Angr (will be slow) Manual extraction - Extract embedded PNGs and reverse the comparison logic*

use gdb: 🚀 Key Entry Points & Exports These are the standard entry points where the program lifecycle begins and ends:

_start (Address: 0x101340, Size: 38 bytes) The standard ELF entry point that initializes the environment and invokes main. main (Address: 0x101740, Size: 466 bytes) Crucial Entry Point. Orchestrates the password reading via fgets, performs the initial validation logic, and invokes validate_checksum_v2. _init (Address: 0x101000, Size: 27 bytes) & _fini (Address: 0x1179b4, Size: 13 bytes) Default initialization and finalization runtime routines. 🔒 Security & Key-Validation Routines These are the most critical functions to focus on for reverse engineering the validation logic and bypassing checks:

validate_checksum_v2 (Address: 0x101550, Size: 492 bytes) Highly Security-Relevant. Implements a chained constraint check over 8 consecutive 32-bit blocks (total 32 bytes) of the key input. compare_hand_png_i32 (Address: 0x115ee0, Size: 6742 bytes) Extremely Complex & Obfuscated. This function functions as a "render-and-compare" oracle. It accepts a seed value, renders a procedurally generated 3D capsule-like PNG image inside memory, and compares it byte-by-byte with a reference PNG. print_obfuscated (Address: 0x101440, Size: 134 bytes) Decrypts and prints XOR-obfuscated success/failure messages (e.g., flag reveals). print_prompt (Address: 0x1014d0, Size: 124 bytes) Decrypts and displays the user prompts. 📈 Unusually Large Functions (Potential Obfuscation / Core Logic) Large functions often contain complex algorithms, static structures, or embedded crypto/obfuscation matrices:

Function Name Address Size (Bytes) Description lodepng_encode 0x112080 10,803 Legitimate LodePNG core compression and structure encoding. lodepng_deflate 0x109610 8,410 DEFLATE compression engine. compare_hand_png_i32 0x115ee0 6,742 Custom CTF validation logic rendering/comparing graphics. lodepng_inflatev 0x105660 5,764 DEFLATE decompression logic. unfilter 0x107850 5,709 PNG reconstruction scanline filter remover. lodepng_convert 0x10e820 4,594 Color-space conversion engine. lodepng_decode 0x111140 3,592 Legitimate LodePNG PNG structure parsing and decoding. lodepng_compute_color_stats 0x10fc70 3,312 Computes color histograms for optimization. filter 0x10ca10 3,183 PNG scanline filtering engine. encodeLZ77 0x103c40 2,113 LZ77 sliding-window dictionary compressor. 📉 Unusually Small Functions (Utility / Helper Routines) Small functions can be stubs, wrappers, or optimized inline utilities:

Function Name Address Size (Bytes) Description lodepng_chunk_length 0x10bbb0 5 Returns PNG chunk size. lodepng_chunk_data 0x10bc70 5 Returns pointer to raw chunk data. lodepng_chunk_data_const 0x10bc80 5 Const variant of above. lodepng_is_palette_type 0x10dd80 9 Boolean check for palette images. lodepng_is_alpha_type 0x10dd70 10 Boolean check for transparency channels. lodepng_chunk_ancillary 0x10bc40 11 Utility wrapper. lodepng_chunk_private 0x10bc50 11 Utility wrapper. lodepng_chunk_safetocopy 0x10bc60 11 Utility wrapper. 🏷️ Named vs. Auto-Named (Stripped) Functions All 167 functions listed in this analysis are fully Named (reconstructed via debug symbols or signature matching). There are no anonymous sub_ or auto-named functions left unresolved.

This suggests that either:

The binary was compiled without stripping symbols (common for educational CTF challenges). The RevEng.AI platform successfully matched signatures against libraries like LodePNG and standard C++ templates. 💡 Summary of Investigation Focus: To bypass the key check or recover the flag:

Break inside main (0x101740) right after fgets. Analyze the parameter flows going into validate_checksum_v2 (0x101550). Since compare_hand_png_i32 (0x115ee0) validates mathematical operations via heavy graphic rendering, the easiest way to solve this is to extract the correct values dynamically using GDB/LLDB or by patching the jump instructions directly after each call to this function in validate_checksum_v2 to always proceed as if it returned 1.

do one thing now bruteforce whatever you see as a potential key by running command like this: (base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$ ./chall Enter the flag: data_479ff7 Incorrect flag!

(base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$ ./chall Enter the flag: 20250506 Incorrect flag!

(base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$

(base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$ echo -n "20250506202505062025050620250506" | ./chall Enter the flag: Incorrect flag!

(base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$ echo -n "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" | ./chall Enter the flag: Incorrect flag!

(base) ┌──(forensics_venv)(batman㉿Dead-Network)-[/mnt/d/TracebashCTF/REV/Finger/finger-arithmetic] └─$ python3 -c "import sys; sys.stdout.buffer.write(bytes.fromhex('014edeeef9f90000e7f30000d30b0000dd00000041030000c5f50000bbf40000'))" | ./chall Enter the flag: Incorrect flag!

(base) ┌──(forensics