Boss

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: multi_stage_reversing, simd_analysis, xor_reversing

Summary

Walkthrough of the CUSTOM Reversing Boss. Task: Reverse a multi-stage ELF binary with XOR encryption and SIMD operations. Solution: Reverse Stage 1 XOR with 2, then reverse Stage 2 word swapping and byte shifts to decode the flag.

Description

The challenge provided a ZIP file containing a Linux ELF binary task and an encrypted data file encrypted.bin. The goal is to defeat the "Boss" by passing through multiple stages of validation and decryption.

Analysis

Initial Reconnaissance

The provided files are:

• task: A 64-bit Linux ELF binary.
• encrypted.bin: A binary file containing encrypted data.

Running strings on the binary reveals some interesting strings like "wow_u_did_it_congrats" and references to stages. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Stage 1: The Gatekeeper

The first function handles the initial validation. It expects a 21-character input. The logic is straightforward:

1. Each character of the input is XORed with 2.
2. The result is compared against the hardcoded string "wow_u_did_it_congrats".

To pass this stage, we can calculate the required input: 'w' ^ 2, 'o' ^ 2, 'w' ^ 2, ... which results in uqu_w_fkb_it_amlepcru.

Decryption: The Hidden Data

Once Stage 1 is passed, the decrypt function is called. It performs the following:

1. Reads the contents of encrypted.bin.
2. Uses SIMD instructions (likely SSE/AVX) to XOR the data with 0xa5.
3. Prints a hex-encoded string: 3d3f3e49546f3f466c274e3c4d682d5359362d444d53496760275e275f382e487753. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Stage 2: The Final Boss

The second function applies a more complex transformation to the data. Based on static analysis:

1. Shifts: Characters are shifted (sub 6 and sub 12 with wrapping).
2. Packing: Bytes are packed into 16-bit words.
3. Swapping: Adjacent 16-bit words are swapped.

Solution

To find the flag, we need to reverse the Stage 2 transformation on the hex bytes printed by the decrypt function.

Reverse Transformation Logic:

1. Convert the hex string to bytes.
2. Swap adjacent 16-bit words back (which is the same as swapping them once).
3. Unpack the 16-bit words back into bytes.
4. Reverse the shifts (add 6 and add 12 with wrapping). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3

def solve():
    hex_str = "3d3f3e49546f3f466c274e3c4d682d5359362d444d53496760275e275f382e487753"
    data = bytes.fromhex(hex_str)
    
    # 1. Swap adjacent 16-bit words
    # A word is 2 bytes. We swap pairs of words (4 bytes total in a swap)
    # [W1, W2, W3, W4] -> [W2, W1, W4, W3]
    swapped = bytearray(data)
    for i in range(0, len(swapped), 4):
        if i + 3 < len(swapped):
            # Word 1: swapped[i:i+2], Word 2: swapped[i+2:i+4]
            w1 = swapped[i:i+2]
            w2 = swapped[i+2:i+4]
            swapped[i:i+2] = w2
            swapped[i+2:i+4] = w1
            
    # 2. Reverse shifts
    # The original had sub 6 and sub 12. We add them back.
    # Assuming alternating bytes or specific pattern. 
    # Based on analysis, even indices were sub 6, odd were sub 12.
    flag = ""
    for i in range(len(swapped)):
        if i % 2 == 0:
            flag += chr((swapped[i] + 6) % 256)
        else:
            flag += chr((swapped[i] + 12) % 256)
            
    print(f"Decoded Flag: {flag}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve()

Running the script reveals the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering multi_stage_reversing, simd_analysis, xor_reversing was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-09 • CUSTOM • Boss • Difficulty: Medium