Skip to content

Commit

Permalink
fix(drone-army): add link
Browse files Browse the repository at this point in the history
  • Loading branch information
apogiatzis committed May 13, 2024
1 parent c61171a commit 9ae889e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion reverse/drone-army/solution/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ In the first section of the program we can see line 19 loads the number 29 to th
If that's true the execution continues and byte with value 0x65 is loaded to register x3. Then the program enters a loop of 29 iterations (we see x5 = 0 compared to the length of the input (x3) which should be 29 at that point) and each byte from user input is loaded to the w6 register and xored with the previous character (w4 starts with 0x65 in this case).
This continues for all 29 bytes. In summary the program implements a simple XOR encryption where a rolling window of 2 characters are taken from the bytes defined in the data section and XORED together to make up the flag, which is checked against the user input.

Alternatively, players can take the bytes from the data section and get the XOR input differential (even without the leading 0x65 bytes) and they will get the flag.
Alternatively, players can take the bytes from the data section and get the XOR input differential (e.g. using [CyberChef](https://gchq.github.io/CyberChef/), even without the leading 0x65 bytes) and they will get the flag (bar the first char which it will be obvious that is "C").

Here is a PoC script to decrypt that using python:
```python
Expand Down

0 comments on commit 9ae889e

Please sign in to comment.