Clippy

Description:

Reverse

Difficulty:

easy

Flag:

Flag: AtHackCTF{w0w_cl1ppy_t4ugh7_u_d0t_n3t_spy1ng}

Solve:

This is .NET windows PE, After i decompilied it using dnSpy i found CheckFlag function

after looking at the array there was something that caught my eye

The first byte on the array0 is ‘65’ which equals ‘A’ on ascii.After that I looked at the function and understood how it works, I reversed it and XORed each byte of the flag with the next element on the array.. I wrote a python script to automate this task.

array = [65,53,125,28,127,20,87,3,69,62,73,121,14,81,50,94,111,31,111,22,73,61,9,124,27,115,68,27,110,49,85,101,17,78,32,19,103,56,75,59,66,115,29,122,7]

elm = "A"
for i in range(len(array)-1):
	elm += chr(array[i+1]^array[i])
print(elm)

and we will got the flag :D