snyk CTF 2025 - Math For Me

Writeup: Math For Me - Reverse Engineering
[email protected], 2025-02-28


% file math4me
math4me: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=662371bb4df3dc3e85b895f2e3f0f1c880c63471, for GNU/Linux 3.2.0, not stripped

% strings math4me
…
%d: %d
Welcome to the Math Challenge!
Find the special number:
Congratulations! Here's your flag: %s
That's not the special number. Try again!

Decompile with IDA-Free

Right magic number that makes check_number() true: 20

% cat m4m.c
#include <stdio.h>
#include <string.h>

int check_number(int n)
{
  return (5 * n + 4) / 2 == 52; // true for input 20
}

void compute_flag_char(char *target, int i, int input_num) // i=5, 6, ... 36
{
  int funnyoffset; // [rsp+1Ch] [rbp-A4h]
  int plusminus[20]; // [rsp+20h] [rbp-A0h]
  char longnumberstring[72]; // [rsp+70h] [rbp-50h] BYREF

  strcpy(longnumberstring, "5552ef842ecab9be1b15536653855555552ef842ecab9be1b1553665385555");
  plusminus[0] = 1;
  plusminus[1] = 3;
  plusminus[2] = -2;
  plusminus[3] = 4;
  plusminus[4] = -1;
  plusminus[5] = 2;
  plusminus[6] = -3;
  plusminus[7] = 1;
  plusminus[8] = 4;
  plusminus[9] = -2;
  plusminus[10] = 3;
  plusminus[11] = -1;
  plusminus[12] = 2;
  plusminus[13] = -4;
  plusminus[14] = 1;
  plusminus[15] = -2;
  plusminus[16] = 3;
  plusminus[17] = -1;
  plusminus[18] = 2;
  funnyoffset = i * input_num % 5 + plusminus[i % 10];
  printf("%d: %d\n", i, funnyoffset);
  *(char *)(i + target) = longnumberstring[i] + funnyoffset;
}

int main(void)
{
  int input_num; // [rsp+8h] [rbp-48h] BYREF
  int i; // [rsp+Ch] [rbp-44h]
  char v6[37]; // [rsp+10h] [rbp-40h] BYREF
  char v7[19]; // [rsp+35h] [rbp-1Bh] BYREF

  puts("Welcome to the Math Challenge!");
  printf("Find the special number: ");
  scanf("%d", &input_num);
  memcpy(v6, "flag{", 5);
  if ( check_number(input_num) )
  {
    for ( i = 5; i <= 36; ++i )
      compute_flag_char(v6, (unsigned int)i, input_num);
    strcpy(v7, "}");
    printf("Congratulations! Here's your flag: %s\n", v6);
  }
  else
  {
    puts("That's not the special number. Try again!");
  }
  return 0;
}
% gcc m4m.c -o m4m
% echo 20 | ./m4m
Welcome to the Math Challenge!
Find the special number: 20
5: 2
6: -3
7: 1
8: 4
9: -2
10: 1
11: 3
12: -2
13: 4
14: -1
15: 2
16: -3
17: 1
18: 4
19: -2
20: 1
21: 3
22: -2
23: 4
24: -1
25: 2
26: -3
27: 1
28: 4
29: -2
30: 1
31: 3
32: -2
33: 4
34: -1
35: 2
36: -3
Congratulations! Here's your flag: flag{h556cd-NOTGONNATELLYOU-368391gc

Note: add trailing '}':
flag{h556cdd`=ag.c53664:45569368391gc}