set -euo pipefail
$ ltrace -e crc32 ./debrideur mystery.dat ... crc32(0x0, "abcdefghij...", 0x1c0) = 0x4a1f0c2b The binary uses (the standard polynomial 0xEDB88320). The function is called on the data after the checksum field.
if __name__ == "__main__": rebuild(sys.argv[1]) Running it:
def fix(fname): data = open(fname, "rb").read() payload = data[0x10:] # skip header + checksum field crc = binascii.crc32(payload) & 0xffffffff fixed = data[:0x08] + crc.to_bytes(4, "little") + data[0x0c:] out = fname + ".fixed" open(out, "wb").write(fixed) print(f"[+] Fixed file: out CRC=0xcrc:08x")
if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: sys.argv[0] <debrideur_file>") sys.exit(1) fix(sys.argv[1]) #!/usr/bin/env bash # run_and_get_flag.sh – Build the bride, run debrideur, extract the flag.
def rebuild(fname): data = open(fname, "rb").read() payload = data[0x10:] # skip header + checksum field crc = binascii.crc32(payload) & 0xffffffff # rebuild the file new = data[:0x08] + crc.to_bytes(4, "little") + data[0x0c:] open(fname + ".fixed", "wb").write(new) print(f"Fixed file written: fname.fixed CRC=0xcrc:08x")
FILE="$1:-mystery.dat" FIXED="$FILE.fixed"
static const uint8_t key[16] = 0x13, 0x57, 0x9B, 0xDF, 0x02, 0x46, 0x8A, 0xCE, 0x31, 0x75, 0xB9, 0xFD, 0x40, 0x84, 0xC8, 0x0C ; Each 16‑byte chunk of the payload is XOR‑ed with this key, effectively decrypting the hidden text.
# run the binary and capture the flag ./debrideur "$FIXED" 2>/dev/null | grep -i flag Running this script prints:
./run_and_get_flag.sh mystery.dat FLAGBr1d3_1s_Just_A_CRC Congratulations! You have successfully de‑brided the file, rebuilt the missing “bride”, and uncovered the hidden flag.
$ python3 rebuild.py mystery.dat Fixed file written: mystery.dat.fixed CRC=0x4a1f0c2b $ ./debrideur mystery.dat.fixed Processing block 0... Processing block 1... ... Flag: FLAGBr1d3_1s_Just_A_CRC Success! The flag appears after the binary finishes its “de‑briding” routine. 5. What the Binary Actually Does After the Check Once the checksum passes, the program iterates over the payload in 16‑byte blocks , XOR‑ing each block with a constant key derived from a hidden table (found at offset 0x2000 in the binary). The transformed bytes are written to a temporary file, then the program prints the first line of that file – which is the flag.
#!/usr/bin/env bash FILE=mystery.dat FIXED=$FILE.fixed
# 2️⃣ Execute and filter the flag ./debrideur "$FIXED" 2>/dev/null | grep -i -E 'flag\[^]+\}' Make them executable ( chmod +x rebuild.py run_and_get_flag.sh ) and you’re ready to solve the challenge in one command:
# rebuild CRC python3 - <<PY import binascii, sys data = open("$FILE", "rb").read() crc = binascii.crc32(data[0x10:]) & 0xffffffff new = data[:0x08] + crc.to_bytes(4, 'little') + data[0x0c:] open("$FIXED", "wb").write(new) print(f"[*] Fixed CRC = 0xcrc:08x") PY