reverse_cipher picoCTF 2019 Solution

Description

1. Step 1Examine the binary
   Run strings on the binary to find any hardcoded values. Then open it in Ghidra or Radare2 to decompile the encryption logic. The encryption function applies a simple transformation to each character.
   bash

   strings rev

   Copied!

   bash

   file rev

   Copied!

   bash

   ghidra rev &

   Copied!
   Learn more

   Ghidra is a free reverse engineering tool from the NSA. It decompiles binaries to C-like pseudocode. Load the binary, let it auto-analyze, then navigate to the main function to see the encryption logic.

2. Step 2Understand the encryption algorithm
   The binary likely applies a character-by-character transformation: for example, adding a fixed value to uppercase letters, subtracting from lowercase, or leaving non-alpha characters unchanged. Note the exact transformation.
   Learn more

   A common pattern: if the character is uppercase, apply one transformation; if lowercase, apply another. The key insight is that you need to identify what transformation was applied and reverse it. For example, if the binary adds 3 to uppercase chars (Caesar shift), subtracting 3 reverses it.

3. Step 3Write a Python decryption script
   Apply the inverse of the encryption transformation to each byte of the enc file to recover the original flag.
   python

   python3 << 'EOF'
   with open('enc', 'r') as f:
       ciphertext = f.read()
   
   result = ''
   for c in ciphertext:
       if c.isupper():
           # Reverse the upper-case transformation
           result += chr(ord(c) - <OFFSET>)  # fill in from Ghidra analysis
       elif c.islower():
           # Reverse the lower-case transformation
           result += chr(ord(c) + <OFFSET>)  # fill in from Ghidra analysis
       else:
           result += c
   print(result)
   EOF

   Copied!
   Learn more

   When reversing a cipher, always test with a known input first: run the binary on a test file you create, then try to reverse the output back to the original. This validates your understanding before applying it to the real ciphertext.

Alternate Solution

Flag

Decompile the rev binary to find the character transformation, then write a Python script applying the inverse to the enc file.