spbctf_3_x86_64

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-25 | Status: Solved Techniques: objdump_disassembly, shuffle_algorithm_reversal, static_analysis, swap_operation_analysis

Summary

Task: ELF64 binary encodes strings using iterative swap operations with decreasing step sizes. Solution: Reverse the swap algorithm by applying same operations in reverse order (increasing steps 2-10).

spbctf_3_x86_64 — spbctf

Description

ELF64 binary that encodes a string given as command line argument using a series of swap operations. Given the encoded string _A_m_aFneSuyn_w_IypvSr_ahIEwp_gitrnMhaetevT_so!, find the original string.

ELF64 binary that takes a string as command line argument and encodes it using a custom swap-based permutation algorithm. The goal is to reverse the encoding to recover the original flag.

Analysis

Disassembled the binary with objdump. Found two key functions: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. swaper(string, step) - The core encoding function that iterates i from 0 to len(s) - step with step step, swapping s[i] with s[i + step - 1] at each iteration.

2. main - Calls swaper with decreasing step sizes: 10, 9, 8, 7, 6, 5, 4, 3, 2.

The encoding is a series of permutations applied to the string. Each call to swaper with a different step size performs a specific pattern of character swaps.

Solution

To reverse the encoding, apply the same swap operations in reverse order — using increasing step sizes from 2 to 10 instead of decreasing from 10 to 2. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Reverse the swaper encoding by applying swaps in reverse order

encoded = '_A_m_aFneSuyn_w_IypvSr_ahIEwp_gitrnMhaetevT_so!'
s = list(encoded)

# Original encoding: steps 10, 9, 8, 7, 6, 5, 4, 3, 2 (decreasing)
# To reverse: steps 2, 3, 4, 5, 6, 7, 8, 9, 10 (increasing)
for step in range(2, 11):
    for i in range(0, len(s) - step, step):
        s[i], s[i + step - 1] = s[i + step - 1], s[i]

print(''.join(s))  # REDACTED

The key insight is that swap operations are self-inverse — applying the same swap twice returns to the original state. However, when multiple swaps are chained, the order matters. To undo the sequence of operations, we must apply them in reverse order. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍