MC 6 (Dynamic Analysis)

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: disassembly_analysis, hash_function_reimplementation

Summary

Walkthrough of the CUSTOM Reversing MC 6 (Dynamic Analysis). Language: C. Binary only. "Now guess the string! App is compiled with optimizations, string functions may look scary."

Description

Language: C. Binary only. "Now guess the string! App is compiled with optimizations, string functions may look scary."

ELF 64-bit, dynamically linked, stripped, 10KB.

Analysis

The binary builds a string in flag{...} format. Each character is generated by a hash function (address 0xc60) that uses ~90 operations: rol, ror, xor, add, imul, not.

Seed values for the hash function: 0x0c, 0x1c, 0x0b, 0x0c, 0x0a, 0x03, 0x2b, 0x1f, 0x30, 0x14. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Each hash result is converted to a lowercase letter: (hash % 26) + 'a'.

Solution

Full reimplementation of the hash function in Python (all ~90 operations from 0xc60 to 0x1035), then computing each character using the seed values.

Important: a previous attempt gave an incorrect answer due to incomplete reimplementation (only 30 out of 90 operations). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering disassembly_analysis, hash_function_reimplementation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • MC 6 (Dynamic Analysis) • Difficulty: Medium