**Description**
> https://www.youtube.com/watch?v=p2Rch6WvPJE
**Files provided**
 - [`unbreak_my_start.tar.xz`](https://github.com/EmpireCTF/empirectf/blob/master/writeups/2018-10-05-Hackover-CTF/files/unbreak_my_start.tar.xz)
**Solution**
    $ xxd unbreak_my_start.tar.xz    0000000: 504b 0304 1400 0800 0800 04e6 d6b4 4602  PK............F.    0000010: 0021 0116 0000 0074 2fe5 a3e0 07ff 007d  .!.....t/......}    0000020: 5d00 331b 0847 5472 2320 a8d7 45d4 9ae8  ].3..GTr# ..E...    0000030: 3a57 139f 493f c634 8905 8c4f 0bc6 3b67  :W..I?.4...O..;g    0000040: 7028 1a35 f195 abb0 2e26 666d 8c92 da43  p(.5.....&fm...C    0000050: 11e1 10ac 4496 e2ed 36cf 9c99 afe6 5a8e  ....D...6.....Z.    0000060: 311e cb99 f4be 6dca 943c 4410 8873 428a  1.....m..<D..sB.    0000070: 7c17 f47a d17d 7808 b7e4 22b8 ec19 9275  |..z.}x..."....u    0000080: 5073 0c34 5f9e 14ac 1986 d378 7b79 9f87  Ps.4_......x{y..    0000090: 0623 7369 4372 19da 6e33 0217 7f8d 0000  .#siCr..n3......    00000a0: 0000 001c 0f1d febd b436 8c00 0199 0180  .........6......    00000b0: 1000 00ad af23 35b1 c467 fb02 0000 0000  .....#5..g......    00000c0: 0459 5a                                  .YZ
We can see in the hexdump that the file ends in `YZ`, the normal footer for `xz` archives, but the header is `PK`, as seen in `zip` archives. Since the challenge says to unbreak its start, we can only assume that this should be a valid `xz` file, so the beginning is wrong.
First of all, we should find a specification for the format. Luckily, `xz` is [well documented](https://tukaani.org/xz/xz-file-format-1.0.4.txt). The relevant sections are the `2.1.1. Stream Header` and `2.1.2. Stream Footer`.
The header should be:
 - Magic bytes - `0xFD, "7xXZ", 0x00` - Stream flags - should be identical to the flags in the footer, i.e. `0x00 0x04` - [CRC32](https://en.wikipedia.org/wiki/Cyclic_redundancy_check) - calculated from the Stream flags only, `0xE6 0xD6 0xB4 0x46`
To calculate the CRC32 in the terminal (then change endianness of result):
    $ (printf "obase=16;ibase=10;"; printf "\x00\x04" | cksum -o 3 | cut -d " " -f 1) | bc    46B4D6E6
As it turns out, the correct CRC32 is already in the file, at offset `0x0B`. Let's try to replace the first 11 bytes of the file with our constructed header:
    $ dd if=unbreak_my_start.tar.xz of=trimmed.bin bs=1 skip=11    184+0 records in    184+0 records out    184 bytes transferred in 0.000920 secs (199988 bytes/sec)    $ (printf "\xFD7zXZ\x00\x00\x04"; cat trimmed.bin) > fixed.tar.xz    $ xz -d fixed.tar.xz    $ tar zxvf fixed.tar    x flag.txt
`hackover18{U_f0und_th3_B3st_V3rs10n}`