167 (Линейная алгебра)

Platform: duckerz | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: system_of_equations, cyclic_xor

Summary

The challenge provides a 64-bit ELF executable that prompts for four integers (x, y, z, w). These inputs are validated against a system of linear equations and inequalities. Upon correct input, the program decrypts the flag stored in the .data section using the entered numbers as a cyclic XOR key.

167 (Линейная алгебра) — duckerz

Description

The challenge provides a 64-bit ELF executable that prompts for four integers (x, y, z, w). These inputs are validated against a system of linear equations and inequalities. Upon correct input, the program decrypts the flag stored in the .data section using the entered numbers as a cyclic XOR key.

Analysis

Analyzing the binary (e.g., using IDA Pro or Ghidra) revealed validation of four variables. The validation logic reduces to the following system of linear equations: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. $7x - 3y + 5z + 2w = 24$
2. $2x + 8y - z + 9w = -43$
3. $-4x + 6y + 2z - 5w = 12$
4. $11x - 2y - 7z + 3w = -9$

After successful validation, the program takes encrypted data at address 0x403040 and performs cyclic XOR with bytes [x, y, z, w].

Solution

1. Solving the system of equations

The system can be solved using Gaussian elimination or with Python (numpy or sympy libraries).

Solution:

• $x = 2$
• $y = -1$
• $z = 3$
• $w = -4$

2. Decrypting the flag

Using the found values as the key, we decrypt the string. Note that in memory, negative numbers are represented in two's complement (e.g., -1 as 0xFF, -4 as 0xFC), but for XOR operations we use their byte representation. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
def solve():
    # Solution: x=2, y=-1, z=3, w=-4
    # In bytes (8-bit): [2, 255, 3, 252]
    key = [2, -1 & 0xFF, 3, -4 & 0xFF]
    
    # Decrypted string from description
    decrypted_payload = "REDACTED"
    
    # If we had the original bytes from 0x403040:
    # data = [...] 
    # flag = "".join(chr(data[i] ^ key[i % 4]) for i in range(len(data)))
    
    print(f"DUCKERZ{{{decrypted_payload}}}")

if __name__ == "__main__":
    solve()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍