MC 6 (Dynamic Analysis)

Platform: rev-kids20.forkbomb.ru | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: disassembly_analysis, hash_function_reimplementation

Summary

Language: C. Binary only. "Now guess the string! App is compiled with optimizations, string functions may look scary."

MC 6 (Dynamic Analysis) — Reverse Kids 2.0

Description

Language: C. Binary only. "Now guess the string! App is compiled with optimizations, string functions may look scary."

ELF 64-bit, dynamically linked, stripped, 10KB.

Analysis

The binary builds a string in flag{...} format. Each character is generated by a hash function (address 0xc60) that uses ~90 operations: rol, ror, xor, add, imul, not.

Seed values for the hash function: 0x0c, 0x1c, 0x0b, 0x0c, 0x0a, 0x03, 0x2b, 0x1f, 0x30, 0x14. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Each hash result is converted to a lowercase letter: (hash % 26) + 'a'.

Solution

Full reimplementation of the hash function in Python (all ~90 operations from 0xc60 to 0x1035), then computing each character using the seed values.

Important: a previous attempt gave an incorrect answer due to incomplete reimplementation (only 30 out of 90 operations). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍