136 (Домашний ELF)

Platform: duckerz | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: static_analysis, xor_decryption

Summary

Task: Analyze a 32-bit ELF without section headers that requests a 13-byte key. Solution: Extract XOR key from binary, decrypt flag using cyclic XOR with key substring.

136 (Домашний ELF) — duckerz

Description

We are given an unusual file homemade.elf. This is a 32-bit x86 executable that appears to be "homemade" — it lacks Section Header Table, which can confuse some analysis tools. The program requests a 13-byte key and, if successful, decrypts the flag.

Analysis

When analyzing the homemade.elf file with readelf -S, we see that section headers are missing. However, Program Headers are present, which allows the OS to load and run the file.

Key Verification

The program reads 13 bytes of input. Each byte is XORed with the constant 0x34 and compared with a buffer located at address 0x8048198. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

By extracting data from this address and performing the reverse XOR operation, we obtain the key: 4h0m3m4d3_3lf

Flag Decryption

After successful key verification, the program reports decrypting the last 27 bytes of the file. The decryption algorithm is as follows:

1. The key is taken starting from the second character: h0m3m4d3_3lf (12 bytes long).
2. The last 27 bytes of the file are XORed with this 12-byte key cyclically.

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3

def solve():
    # Extracted key
    full_key = b"4h0m3m4d3_3lf"
    
    # Key for flag (from second character)
    xor_key = full_key[1:] # h0m3m4d3_3lf
    
    # In the actual task we would read the last 27 bytes from homemade.elf
    # Here we know the decryption result
    flag = "DUCKERZ{REDACTED}"
    
    print(f"Key: {full_key.decode()}")
    print(f"Flag: {flag}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍