Добро пожаловать (Welcome)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: static_analysis, xor_arithmetic_reverse

Summary

Task: Reverse a simple XOR + arithmetic encoding in a binary. Solution: Disassemble the magic function, identify the transformation sequence (XOR 1, add 3, XOR 3, sub 7), and apply reverse operations to decode the flag.

Добро пожаловать — hackerlab

Description

Добро пожаловать, разомнись перед боем

Files

• welcome.zip contains welcome.elf and welcome.exe

Analysis

1. Disassembling main

Analysis of the main function revealed:

• 23 bytes of encoded data
• A call to the magic function to transform input

2. Analyzing the magic function

The magic function applies a sequence of operations to each input character:

1. XOR with 1
2. Add 3
3. XOR with 3
4. Subtract 7

The result is then compared with the encoded data. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Encoded data

0x3f, 0x4b, 0x44, 0x3d, 0x3e, 0x51, 0x77, 0x5d,
0x40, 0x6f, 0x71, 0x5b, 0x6e, 0x5d, 0x72, 0x2e,
0x6e, 0x6f, 0x3d, 0x24, 0x24, 0x24, 0x75

Solution

To obtain the flag, apply the reverse operations in reverse order:

1. Add 7
2. XOR with 3
3. Subtract 3
4. XOR with 1

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Solution for "Добро пожаловать" (Welcome) challenge
Reversing simple XOR + arithmetic encryption
"""

encoded_bytes = bytes([
    0x3f, 0x4b, 0x44, 0x3d, 0x3e, 0x51, 0x77, 0x5d,
    0x40, 0x6f, 0x71, 0x5b, 0x6e, 0x5d, 0x72, 0x2e,
    0x6e, 0x6f, 0x3d, 0x24, 0x24, 0x24, 0x75
])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def reverse_magic(data):
    """Reverse transformation of the magic function"""
    result = []
    for b in data:
        # Reverse order of operations:
        # magic: xor 1 -> add 3 -> xor 3 -> sub 7
        # reverse: add 7 -> xor 3 -> sub 3 -> xor 1
        b = (b + 7) & 0xFF
        b = b ^ 3
        b = (b - 3) & 0xFF
        b = b ^ 1
        result.append(b)
    return bytes(result)

flag = reverse_magic(encoded_bytes)
print(flag.decode())  # CODEBY{REDACTED}

Notes

• The challenge provides both variants (ELF and EXE) — either can be analyzed
• Simple static analysis via objdump is sufficient for the solution
• Classic warmup for the Reverse category ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍