Go пореверсим

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: go_binary_reversing, polynomial_equation_solving, xor_with_known_plaintext, binary_pattern_search

Summary

Reverse engineering challenge for a Go binary targeting Windows x86-64. The program prompts for a numeric code and decrypts the flag upon correct input.

Go пореверсим — HackerLab

Description

Reverse engineering challenge for a Go binary targeting Windows x86-64. The program prompts for a numeric code and decrypts the flag upon correct input.

Analysis

Binary Identification

 bash read-only • copy allowed Copy
file main.exe
# PE32+ executable (console) x86-64, for MS Windows

Go binaries have a characteristic structure with runtime and specific function names.

Finding Key Functions

 bash read-only • copy allowed Copy
objdump -t main.exe | grep "main\."

Found functions:

• main.main — entry point
• main.enc — encryption/decryption function ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Disassembling main.main

 bash read-only • copy allowed Copy
objdump -d main.exe | grep -A 200 '<main.main>'

Program logic:

1. Prints a prompt for code input (integer)
2. Reads user input
3. Validates the code through a polynomial equation
4. On correct code — decrypts the flag via XOR
5. On incorrect code — prints "WRONG CODE!"

Polynomial Equation

Extracted validation equation from disassembly:

0x55b4 * x⁴ - 0x1b6d * x³ - 0xe7e6 * x² + 24 * x = 0x7db5a4622d3eab

In decimal form:

21940 * x⁴ - 7021 * x³ - 59366 * x² + 24 * x = 35426374046416555

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solving the Equation

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from sympy import symbols, solve

x = symbols('x')
equation = 21940*x**4 - 7021*x**3 - 59366*x**2 + 24*x - 35426374046416555

solutions = solve(equation, x)
print("Solutions:", solutions)

# Check for integer solutions
for sol in solutions:
    if sol.is_integer:
        print(f"Integer solution: {sol}")

Result: x = 1127

Encryption Algorithm

The flag is stored as an array of int64 values. Each value is XORed with the code (1127), resulting in an ASCII character of the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Finding Encrypted Data

Using known-plaintext attack. Known that the flag starts with "CODEBY{":

 python read-only • copy allowed Copy
#!/usr/bin/env python3

key = 1127
known_prefix = "CODEBY{"

# Calculate expected encrypted values
for char in known_prefix:
    encrypted = ord(char) ^ key
    print(f"'{char}' (0x{ord(char):02x}) XOR 1127 = {encrypted} (0x{encrypted:04x})")

Result:

'C' XOR 1127 = 1060 (0x424)
'O' XOR 1127 = 1064 (0x428)
'D' XOR 1127 = 1059 (0x423)
...

Extracting Flag from Binary

Searching for the pattern in the binary and decrypting: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import struct

# Encrypted int64 values found in the binary
encrypted = [
    1060, 1064, 1059, 1054, 1057, 1082, 1006, 1095,
    1079, 1127, 1048, 1059, 1127, 1119, 1095, 1127,
    1119, 1054, 1059, 1058, 1095, 1119, 1079, 1058,
    1127, 1058, 1079, 1058, 1079, 1058, 1079, 1036
]

key = 1127

flag = ''.join(chr(val ^ key) for val in encrypted)
print(flag)

Solution

Complete solution script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Go пореверсим - HackerLab Reverse Engineering Challenge
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Solve polynomial equation to find the code
2. Use code as XOR key to decrypt flag
"""

# Step 1: Polynomial equation solving
# 21940*x^4 - 7021*x^3 - 59366*x^2 + 24*x = 35426374046416555
# Solution: x = 1127

code = 1127

# Step 2: Encrypted flag values (int64 XORed with code)
encrypted_flag = [
    1060, 1064, 1059, 1054, 1057, 1082,  # CODEBY
    1006,                                  # {
    1095, 1079, 1127, 1048, 1059,         # s0n1c
    1127,                                  # _
    1119, 1095, 1127, 1119, 1054, 1059, 1058, 1095, 1119, 1079, 1058,  # REDACTED
    1127,                                  # _
    1058, 1079, 1058, 1079, 1058, 1079,   # g0g0g0
    1036                                   # }
]
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: XOR decryption
flag = ''.join(chr(val ^ code) for val in encrypted_flag)
print(f"Flag: {flag}")

Result:

CODEBY{REDACTED}

Notes

• Sonic the Hedgehog: The flag contains a reference to the famous video game character — Sonic the Hedgehog ("REDACTED" = "sonic the hedgehog gogogo")
• Go reversing: Go binaries are harder to reverse due to runtime, but function names are usually preserved
• Known-plaintext attack: Knowing the flag format (CODEBY{...}) allows verifying the found key
• Polynomial solving: sympy handles high-degree polynomial equations excellently ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍