Einarr

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2023-01-01 | Status: Solved Techniques: euclidean_gcd, static_binary_analysis, validation_range_extraction

Summary

Task: Windows PE32 binary asking for age and year inputs. Solution: Static analysis of disassembly to extract validation ranges and GCD algorithm logic, brute-force all valid (age, year) pairs where GCD(age, year) = 7.

Einarr — spbctf

Description

Original task description (keep in original language)

Binary: einarr.exe "Enter age and year. Flag is 'AGE YEAR' separated by space. There are many correct flags"

English summary: A Windows PE32 binary asks for two inputs (age and year). The flag format is "AGE YEAR" separated by a space, and there are multiple valid solutions.

Analysis

1. Initial Reconnaissance

   • Downloaded and analyzed the Windows PE32 binary using strings and objdump -d
   • Identified validation logic from disassembly ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Validation Constraints Discovered

   • Age input: Must be >= 14 (0xe) and <= 100 (0x64), else "Too young!" or "Too old!"
   • Year input: Must be >= 2017 (0x7e1) and <= 2200 (0x898), else "Too early!" or "Too late!"

3. GCD Algorithm Identification

   • After validation, the program runs a Euclidean GCD algorithm in a loop:
     • Repeatedly divides year by age, tracking remainders
     • Final GCD value is compared to 7 — must equal 7 for success ("You are welcome!")
   • Mathematically: GCD(age, year) must equal 7 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Brute-force all valid (age, year) pairs that satisfy:

• 14 <= age <= 100
• 2017 <= year <= 2200
• GCD(age, year) = 7

Found 208 valid combinations — any works since the task states "many correct flags".

Example valid pair: age=14, year=2023

• 2023 % 14 = 7
• 14 % 7 = 0 → GCD = 7 ✓

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import math

def find_valid_pairs():
    valid_pairs = []
    for age in range(14, 101):  # 14 to 100 inclusive
        for year in range(2017, 2201):  # 2017 to 2200 inclusive
            if math.gcd(age, year) == 7:
                valid_pairs.append((age, year))
    return valid_pairs
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

pairs = find_valid_pairs()
print(f"Found {len(pairs)} valid pairs")
print(f"Example: age={pairs[0][0]}, year={pairs[0][1]}")
# Output: Found 208 valid pairs
# Example: age=14, year=2023

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍