# Eat Sleep Trace Repeat (RE)## Description
![chal](chal.png)```$ ./challenter password: zh3r0{xxxxxx...}search complete$ # :)```
## Files- [trace.txt](public/trace.txt)
Try to run `cat` but there are many lines of assembly and some are repeated, it has 181888 lines
```bashcat trace.txt 0x401000 : call 0x4010680x401068 : mov eax, 0x10x40106d : mov rdi, rax0x401070 : lea rsi, ptr [0x4028d0]0x401078 : mov edx, 0x100x40107d : syscall 0x40107f : call 0x4010050x401005 : push rbp0x401006 : mov rbp, rsp0x401009 : xor rax, rax......0x4010c2 : cmp rax, 0xffffffffffffffff0x4010c6 : jz 0x4010fa0x4010c8 : mov byte ptr [rsi+0x40286c], al0x4010ce : inc rsi0x4010d1 : cmp sil, 0x640x4010d5 : jnz 0x4010b60x4010d7 : mov eax, 0x10x4010dc : mov rdi, rax0x4010df : lea rsi, ptr [0x4028e1]0x4010e7 : mov edx, 0x100x4010ec : syscall 0x4010ee : mov eax, 0x3c0x4010f3 : mov edi, 0x00x4010f8 : syscall
wc -l trace.txt 181888 trace.txt
```So it decided to run `sort` and `uniq` to sort and filter out the repeated one:```bashsort trace.txt | uniq > asm.txt```Then we got this clean assembly code:```asm0x401000 : call 0x4010680x401005 : push rbp0x401006 : mov rbp, rsp0x401009 : xor rax, rax0x40100c : xor rdi, rdi0x40100f : lea rsi, ptr [0x402808]0x401017 : mov edx, 0x640x40101c : syscall 0x40101e : mov rsp, rbp0x401021 : pop rbp0x401022 : ret 0x401023 : mov rcx, qword ptr [0x402000]0x40102b : mov rdx, rcx0x40102e : shr rdx, 0xc0x401032 : xor rcx, rdx0x401035 : mov rdx, rcx0x401038 : shl rdx, 0x190x40103c : xor rcx, rdx0x40103f : mov rdx, rcx0x401042 : shr rdx, 0x1b0x401046 : xor rcx, rdx0x401049 : mov rax, 0x2545f4914f6cdd1d0x401053 : mul rcx0x401056 : mov qword ptr [0x402000], rcx0x40105e : ret 0x40105f : mov qword ptr [0x402000], rdi0x401067 : ret 0x401068 : mov eax, 0x10x40106d : mov rdi, rax0x401070 : lea rsi, ptr [0x4028d0]0x401078 : mov edx, 0x100x40107d : syscall 0x40107f : call 0x4010050x401084 : mov edi, 0x414243440x401089 : call 0x40105f0x40108e : mov ecx, 0x8000x401093 : xor r15, r150x401096 : test rcx, rcx0x401099 : jz 0x4010b10x40109b : push rcx0x40109c : call 0x4010230x4010a1 : pop rcx0x4010a2 : mov byte ptr [r15+0x402008], al0x4010a9 : inc r150x4010ac : dec rcx0x4010af : jmp 0x4010960x4010b1 : mov esi, 0x00x4010b6 : mov dil, byte ptr [rsi+0x402808]0x4010bd : call 0x4011060x4010c2 : cmp rax, 0xffffffffffffffff0x4010c6 : jz 0x4010fa0x4010c8 : mov byte ptr [rsi+0x40286c], al0x4010ce : inc rsi0x4010d1 : cmp sil, 0x640x4010d5 : jnz 0x4010b60x4010d7 : mov eax, 0x10x4010dc : mov rdi, rax0x4010df : lea rsi, ptr [0x4028e1]0x4010e7 : mov edx, 0x100x4010ec : syscall 0x4010ee : mov eax, 0x3c0x4010f3 : mov edi, 0x00x4010f8 : syscall 0x401106 : push rbp0x401107 : mov rbp, rsp0x40110a : mov rbx, rdi0x40110d : xor rdx, rdx0x401110 : mov al, byte ptr [rdx+0x402008]0x401116 : inc rdx0x401119 : cmp rdx, 0x7ff0x401120 : jz 0x4011310x401122 : cmp al, bl0x401124 : jnz 0x4011100x401126 : dec rdx0x401129 : mov rax, rdx0x40112c : mov rsp, rbp0x40112f : pop rbp0x401130 : ret ```Then I decided to analyse it manually
It look me some hours to analyse this assembly
Here is the summary of this program flow in Python:```pyprint("enter password: ")   # print the string at 0x4028d0read(0,0x402808,0x64)       # get input from user and store in 0x402808array = []a = 0x41424344          # Calculate some weird number and store in arrayfor i in range(0x800):	b = a >> 0xc	a = a ^ b	b = a	b = b << 0x19	a = a ^ b	b = a	b = b >> 0x1b	a = a ^ b	c = a * 0x2545f4914f6cdd1d	array.append(c & 0xff)
def find(c):	for a in array:		if a == c:			return array.index(a)	return False
index = []             # Find the index of input in the array and store for c in 0x402808:     # in index (Search each character in our input)	result = find(c)	if result:		index.append(array.index(result))	else:		print("search failed")		returnprint("search complete")  # If all character are found search complete```After I finish analyse a stuck for awhile, because I don't know how to get the flag just using this code
The flag is in the array but the order seems random:
```pyarray = bytearray(0x800)a = 0x41424344for i in range(0x800):	b = a >> 0xc	a = a ^ b	b = a	b = (b << 0x19) & 0xffffffffffffffff	a = a ^ b	b = a	b = b >> 0x1b	a = a ^ b	c = a * 0x2545f4914f6cdd1d	array[i] = c & 0xff
print(array.find(b'z'))print(array.find(b'h'))print(array.find(b'3'))print(array.find(b'r'))print(array.find(b'0'))
```Result:```26127612921```
## SolvingAnd then I start to look at the `trace.txt`, and start to think how to get the flag using the trace file
Then I realize **it keep track of the index** when it found the input in the array, so we can solve this by just **counting the specific instruction**!!
When it increase the index is at 0x401116:```asm0x401116 : inc rdx```After it found the index it will return to 0x4010c2:```asm0x4010c2 : cmp rax, 0xffffffffffffffff```So I run `grep` command to help me get only these two instruction:```bashgrep "0x401116\|0x4010c2" trace.txt > result.txt```Then I used python to split the instruction 0x4010c2 and count the instruction 0x401116 to get the index:
```pytext = open("result.txt").read().split("0x4010c2 : cmp rax, 0xffffffffffffffff")index = []for t in text:	index.append(t.count("0x401116"))```Then just get the flag using the index! *(index minus 1 because it increase before compare)*```pyflag = ''for i in index:	flag += chr(array[i-1])print(flag)# zh3r0{d1d_y0u_enjoyed_r3v3rs1ng_w1th0ut_b1n4ry_?}```[Full python script](public/solve.py)
Awesome challenge! I think this was my favourite challenge of Zh3r0 CTF
## Flag```zh3r0{d1d_y0u_enjoyed_r3v3rs1ng_w1th0ut_b1n4ry_?}```