Javatask

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: jar_decompilation, keygen_implementation, xor_swap_analysis

Summary

Walkthrough of the CUSTOM Reversing Javatask. Flag is serial for SPbCTF_2020!. Download: spbctfjavatask.jar.

Description

Flag is serial for SPbCTF_2020!. Download: spbctfjavatask.jar.

Analysis

The JAR file contains a Java class with a serial number generation function:

1. A 12-byte name is split into 3 blocks of 4 bytes (big-endian integers)
2. XOR swap is performed between array elements
3. The result is formatted as hex with dashes

Solution

 python read-only • copy allowed Copy
name = b'SPbCTF_2020!'
vals = [
    int.from_bytes(name[0:4], 'big'),   # SPbC = 0x53506243
    int.from_bytes(name[4:8], 'big'),   # TF_2 = 0x54465f32
    int.from_bytes(name[8:12], 'big')   # 020! = 0x30323021
]
# XOR swap vals[0] and vals[1]
vals[0] ^= vals[1]; vals[1] ^= vals[0]; vals[0] ^= vals[1]
serial = f'{vals[0]:08x}-{vals[1]:08x}-{vals[2]:08x}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Important: The flag is submitted without a wrapper — just the serial number. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering jar_decompilation, keygen_implementation, xor_swap_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Javatask • Difficulty: Easy