CUSTOMEasyForensics

Obscure Crusher 1

XESXOR9/10/20263 min read

#forensics#custom#easy#binary_structure_analysis#file_format_identifier_recogni#key_reconstruction_from_header#xor_known_plaintext_attack

Obscure Crusher 1

Platform: CUSTOM | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: binary_structure_analysis, file_format_identifier_recognition, key_reconstruction_from_header, xor_known_plaintext_attack

Summary

Walkthrough of the CUSTOM Forensics Obscure Crusher 1. Task: 169-byte binary file containing three embedded file format identifiers (icns, ttf, lzma) and XOR-encrypted flag data. Solution: known-plaintext XOR attack using flag prefix to recover 16-byte ke

Description

What if I make it so you need 3 keys to unlock the flag...

A 169-byte binary file (chall.bin) is provided. The file command identifies it as "Mac OS X icon (icns)" but the file is actually a custom binary container embedding three file format identifiers as the "3 keys" to decrypt the flag.

Analysis

File Structure

Hex dump analysis reveals the binary has a carefully crafted structure:

Offset	Content	Purpose
0-7	`icns` magic + size field (256)	File format identifier #1
8-76	Second `icns` marker + zero padding with `0x01` bytes	Padding/structure
77-88	`name` field with `ttf` and `xy` values	File format identifier #2
89-108	Zero padding	Separator
109-128	LZMA properties (`\x5d\x00\x00\x80\x00`) + `lzma` label + `KLZMA_DATA:` marker	File format identifier #3
129-164	36 bytes of XOR-encrypted flag data	Encrypted flag
165-168	Trailing zeros	Padding

Key Discovery via Known-Plaintext Attack

The XOR encryption key was recovered using the known flag prefix tjctf{:

XOR the first 6 encrypted bytes (at offset 129) with tjctf{
The resulting bytes are: i, c, n, s, \x01, t
These match the beginning of the file's non-zero content sequence: icns...ttf...lzma...
The full 16-byte repeating key is the concatenation of the three format identifiers with their structural separator bytes

XOR Key

Key (hex): 69 63 6e 73 01 74 74 66 02 78 79 6c 7a 6d 61 4b
Key (ascii): icns\x01ttf\x02xylzmaK

The key is literally built from the non-zero bytes of the file header — the three file format identifiers (icns, ttf, lzma) concatenated with their separator/structural bytes (\x01, \x02, xy, K).

Solution

 python read-only • copy allowed
#!/usr/bin/env python3
"""Solve script for Obscure Crusher 1 - TJCTF 2026"""

data = open('chall.bin', 'rb').read()

# Extract 36 bytes of encrypted flag data at offset 129
encrypted = data[129:165]

# XOR key: non-zero bytes from file header = icns + separators + ttf + separators + lzma + K
key = bytes([
    0x69, 0x63, 0x6e, 0x73,  # icns
    0x01,                      # separator
    0x74, 0x74, 0x66,          # ttf
    0x02,                      # separator
    0x78, 0x79,                # xy
    0x6c, 0x7a, 0x6d, 0x61,   # lzma
    0x4b                       # K
])

# Decrypt with repeating XOR
flag = bytes([encrypted[i] ^ key[i % len(key)] for i in range(len(encrypted))])
print(flag.decode())  # tjctf{REDACTED}

Verification

The flag in leet speak reads "obscure crusher: icns, ttf, lzma" — confirming the three file format identifiers are indeed the "3 keys" referenced in the challenge description.

Key Takeaways / Lessons

Mastering binary_structure_analysis, file_format_identifier_recognition, key_reconstruction_from_header, xor_known_plaintext_attack was key to this challenge.
Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2026-05-15 • CUSTOM • Obscure Crusher 1 • Difficulty: Easy