Category

Misc

Description

This is a two-for-one deal! We have reverse engineering and forensics all bunched up into a single challenge! With two categories comes two files. Good luck!

Solution

For this challenge we get a Python script and a image. Taking a look at the script, we find out that it has been used to encode the original image to the attached image.

from PIL import Image

def glorp(n):
    g = list(format(n, "08b"))
    for i in range(len(g)):
        t = g[i]
        g[i] = g[(i * 332 + 6) % 8]
        g[(i * 332 + 6) % 8] = t
    return int(''.join(g), 2)

lookup = [glorp(i) for i in range(256)]

img = Image.open("flag.png")
pix = img.load()

for i in range(img.size[0]):
    for j in range(img.size[1]):
        pix[i, j] = (lookup[pix[i, j][0]], lookup[pix[i, j][1]], lookup[pix[i, j][2]])

img.save("encoded.png")

And the resulting image is.

To recreate the original image we have to reverse the function in the encoding script. What we end up with is the following script.

from PIL import Image

def glorp(n):
    g = list(format(n, "08b"))
    for i in range(len(g)):
        t = g[i]
        g[i] = g[(i * 332 + 6) % 8]
        g[(i * 332 + 6) % 8] = t
    return int(''.join(g), 2)

lookup = [glorp(i) for i in range(256)]

img = Image.open("encoded.png")
pix = img.load()

for i in range(img.size[0]):
    for j in range(img.size[1]):
        pix[i, j] = (lookup.index(pix[i, j][0]), lookup.index(pix[i, j][1]), lookup.index(pix[i, j][2]))

img.save("flag.png")

After we execute the script we now have the original image.

Now we can see some text on the bottom right of the image. Taking a closer look at the text we can see that it’s text superimposed onto eachother.

We can pretty easily make out the first part of the flag from this, flag{tw0_.

To be able to read the rest of the text we have to mask out the lines that make up the first part of the flag. When we have done that we can read the rest of the flag.

Now we can make out the parts st3p5_t0_ and v1c70ry}, putting all the pieces together we have the flag.

flag{tw0_st3p5_t0_v1c70ry}