VSTECS Microsoft
Sign In

El Capo 2 Cap 57 -

def rotl8(v, r): return ((v << r) | (v >> (8 - r))) & 0xFF def inv_rotl8(v, r): return ((v >> r) | (v << (8 - r))) & 0xFF

static const char flag[] = "ECTFel_capo_2_cap_57_success"; Because the binary is stripped, the name isn’t visible in strings , but the decompiler reveals it as a global pointer used only in the success branch. The problem reduces to crafting a 64‑byte key.bin such that the checksum after the transformation equals the required constant ( 0xdeadbeef in the example). 4.1 Deriving the Required Plain‑text Let T[i] be the transformed byte for index i . We know: el capo 2 cap 57

key = bytearray(SIZE) csum = 0 for i in range(SIZE-1): key[i] = inv_rotl8(0, i % 8) ^ CONST_XOR # keep transformed byte = 0 # csum unchanged (adds 0) def rotl8(v, r): return ((v &lt;&lt; r) |

if (chk == 0xdeadbeef) // Success path – print the flag stored in the binary puts(flag); return 0; return -1; We know: key = bytearray(SIZE) csum = 0

#!/usr/bin/env python3 from Crypto.Util.number import long_to_bytes import struct

#!/usr/bin/env python3 import subprocess, os, struct