Не стоит вскрывать эту тему (stop)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: xor_decryption, disassembly_analysis, data_section_extraction

Summary

The task references a famous Russian internet copypasta warning not to dig into a certain topic.

Не стоит вскрывать эту тему — HackerLab

Description

Ребята, не стоит вскрывать эту тему. Вы молодые, шутливые, вам все легко. Это не то. Это не Чикатило и даже не архивы спецслужб. Сюда лучше не лезть.

The task references a famous Russian internet copypasta warning not to dig into a certain topic.

Analysis

Binary Identification

 bash read-only • copy allowed Copy
file task_stop
# ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, not stripped

The binary is not stripped — symbols are available, which simplifies analysis. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Disassembling main()

 bash read-only • copy allowed Copy
objdump -d task_stop | grep -A 50 '<main>'

Program logic:

1. Reads user input via fgets()
2. XORs each input character with constant 0x41 (ASCII 'A')
3. Compares the result with array wtf (21 bytes at address 0x41d0) via memcmp()
4. If it matches — prints "Correct!", otherwise — "Wrong!"

Extracting Encrypted Data

 bash read-only • copy allowed Copy
objdump -s -j .data task_stop

Array wtf (21 bytes):

wtf = [0x02, 0x0e, 0x05, 0x04, 0x03, 0x18, 0x3a, 0x16, 0x73, 0x1e, 
       0x36, 0x01, 0x33, 0x0f, 0x24, 0x05, 0x1e, 0x38, 0x71, 0x34, 0x3c]

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

XOR is a symmetric operation. If input XOR 0x41 = wtf, then wtf XOR 0x41 = input.

 python read-only • copy allowed Copy
#!/usr/bin/env python3

wtf = [0x02, 0x0e, 0x05, 0x04, 0x03, 0x18, 0x3a, 0x16, 0x73, 0x1e, 
       0x36, 0x01, 0x33, 0x0f, 0x24, 0x05, 0x1e, 0x38, 0x71, 0x34, 0x3c]

key = 0x41

flag = ''.join(chr(b ^ key) for b in wtf)
print(flag)

Result:

CODEBY{REDACTED}

Notes

The flag "REDACTED" (We warned you) — references the copypasta text warning not to dig into the topic. The irony is that we "opened this topic" anyway and got the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍