Venkata

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-26 | Status: Solved Techniques: character_range_validation, constraint_solving, static_analysis

Summary

Task: ELF32 binary validates input string with length, position, and character range constraints. Solution: reverse check() function to extract constraints - length must be odd >4, specific chars at start/middle/end, character ranges for halves.

Venkata — spbctf (rev-kids20.forkbomb.ru)

Description

TASK #2, by sirroko Flag is the input that makes the app say 'Yes'. There are many correct flags.

ELF 32-bit binary that validates user input and prints "Yes" or "No". The flag is any input that passes validation.

Analysis

Binary info:

• ELF 32-bit LSB executable, Intel 80386, dynamically linked, not stripped
• Key functions: check, main, print_flag, get_user_input, print_banner
• Key strings: [*] FLAG{%s}, [*] Enter something:, [+] Yes..., [-] No... ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The check() function at 0x08048688 validates input with these constraints:

Variables in check():

• [ebp-0x2c] = input string pointer
• [ebp-0x10] = strlen(input) = len
• [ebp-0x1c] = error flag (0 = success, 1 = fail)
• [ebp-0x18] = loop counter i (first loop)
• [ebp-0x14] = loop counter j (second loop)

Constraints:

1. Length check: len > 4 AND len must be odd (len & 1 != 0)

2. First character (position 0): Must be ^ (0x5e)

3. Middle character (position len/2): Must be _ (0x5f) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Last character (position len-1): Must be ^ (0x5e)

5. First half (positions 1 to len/2-1): Characters must be in range (0x20, 0x2f]

   • Valid chars: !"#$%&'()*+,-./

6. Second half (positions len/2+1 to len-2): Characters must be in range (0x2f, 0x39]

   • Valid chars: 0123456789

Structure visualization:

For length 5: ^ + ! + _ + 0 + ^ For length 7: ^ + !! + _ + 00 + ^ For length 9: ^ + !!! + _ + 000 + ^

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Venkata - Solution
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Constraints:
1. len > 4 AND len must be ODD
2. input[0] = '^' (0x5e)
3. input[len/2] = '_' (0x5f) - middle character
4. input[len-1] = '^' (0x5e) - last character
5. First half (1 to len/2-1): chars in (0x20, 0x2f] = !"#$%&'()*+,-./
6. Second half (len/2+1 to len-2): chars in (0x2f, 0x39] = 0123456789
"""

def generate_valid_input(length):
    """Generate a valid input of given odd length > 4"""
    if length <= 4 or length % 2 == 0:
        return None
    
    mid = length // 2
    result = [None] * length
    
    # Fixed positions
    result[0] = '^'           # First char
    result[mid] = '_'         # Middle char
    result[length - 1] = '^'  # Last char
    
    # First half: positions 1 to mid-1, chars from !"#$%&'()*+,-./
    for i in range(1, mid):
        result[i] = '!'  # 0x21, simplest valid char
    
    # Second half: positions mid+1 to length-2, digits 0-9
    for i in range(mid + 1, length - 1):
        result[i] = '0'  # 0x30, simplest valid char
    
    return ''.join(result)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Generate valid inputs
for length in [5, 7, 9]:
    print(f"len={length}: {generate_valid_input(length)}")

# Simplest valid input
flag = generate_valid_input(5)
print(f"\nFLAG{{{flag}}}")

Output:

len=5: ^!_0^
len=7: ^!!_00^
len=9: ^!!!_000^

FLAG{REDACTED}

Verification:

 bash read-only • copy allowed Copy
$ echo "^!_0^" | ./venkata.elf
+------------------------------------+
|              TASK #2               |
|            by sirroko              |
+------------------------------------+

[*] Enter something: [+] Yes...
[*] FLAG{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍