## Cereal Killer 02
### Description
> Points: 100>> Created by: `TheZeal0t`
luciafer can be a bit of trouble sometimes, but she can put away the sugary monster cereals with the best of them! She has a favorite, too, and it is based on her favorite monster. See if you can figure it out! Select the binary for your preferred platform.
[Download file](https://gr007.tech/writeups/2023/deadface/rev/cereal_killer_2/cereal)
### Solution
when the binary is run, it asks for Luciafer's favorite breakfast cereal.
```shdeadface/rev/cereal_killer_2 on  master [?]❯ ./cerealLuciafer also loves Halloween, so she, too, LOVES SPOOKY CEREALS!She has different favorite villain from 70-80's horror movies.What is Luciafer's favorite breakfast cereal? adfsdaINCORRECT....: I'm afraid that is not Lucia's current favorite monster cereal.  She is kind of capricious, you know, so it changes often.```
The following code (after some cleanup) snippets are the interesting parts from looking at it in ghidra.
```c  puts("Luciafer also loves Halloween, so she, too, LOVES SPOOKY CEREALS!");  puts("She has different favorite villain from 70-80\'s horror movies.");  printf("What is Luciafer\'s favorite breakfast cereal? ");  fgets(input,0xfff,_stdin);  decode_str(input,63,             "\b=3?\x1562GR\x12\x1bekHA\v<\x14\x01\x1d4A[)\x1b\x13L&\x024+\x16\x06@\x17\r8_\"\x02=\x 1c\bK5\\Hi\x0f\x13L/1\x11K-\x1aWIejS\x1c"             ,correct);  iVar1 = strncmp(correct,"CORRECT!!!!!",12);  if (iVar1 == 0) {    puts(correct);  }  else {    printf("%s",           "INCORRECT....: I\'m afraid that is not Lucia\'s current favorite monster cereal.  She is  kind of capricious, you know, so it changes often.\n"          );  }```
```cvoid decode_str(char *input,int len,char *flag,char *correct)
{  int mod;  int i;
  mod = 0;  i = 0;  while (i < len) {    correct[i] = flag[i] ^ input[mod];    i += 1;    mod += 1;    if (11 < mod) {      mod = 0;    }  }  correct[i] = '\0';  return;}```
After analyzing the `decode_str` function, we can see that we cannot use the trick we used in [cereal killer 1](https://gr007.tech/writeups/2023/deadface/index.html#cereal-killer-01) to bypass the check but we can do something pretty interesting instead. The `decode_str` takes our input and uses it as a key for rotating xor cipher to decode the flag string that has been encoded by the original key. And we can see that the first 12 characters are later compared in the main function with the string `CORRECT!!!!!`. Now, if we input our favourite cereal as `CORRECT!!!!!`, we sould get a string comparison with our cereal and `CORRECT!!!!!` in the main function.
```sh[ Legend: Modified register | Code | Heap | Stack | String ]───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────$eax   : 0xffffbc2c  →  0x6d61724b ("Kram"?)$ebx   : 0x56558ff4  →  <_GLOBAL_OFFSET_TABLE_+0> call 0x86559037$ecx   : 0x4e$edx   : 0x3f$esp   : 0xffffac10  →  0xffffbc2c  →  0x6d61724b ("Kram"?)$ebp   : 0xffffcc38  →  0x00000000$esi   : 0xffffcd0c  →  0xffffcf45  →  "VIMRUNTIME=/usr/share/nvim/runtime"$edi   : 0xf7ffcb80  →  0x00000000$eip   : 0x56556301  →  <main+202> call 0x56556080 <strncmp@plt>$eflags: [zero carry parity ADJUST SIGN trap INTERRUPT direction overflow resume virtualx86 identification]$cs: 0x23 $ss: 0x2b $ds: 0x2b $es: 0x2b $fs: 0x00 $gs: 0x63───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────0xffffac10│+0x0000: 0xffffbc2c  →  0x6d61724b    ← $esp0xffffac14│+0x0004: 0x56557187  →  "CORRECT!!!!!"0xffffac18│+0x0008: 0x00000c ("                               "?)0xffffac1c│+0x000c: 0xffffbc2c  →  0x6d61724b0xffffac20│+0x0010: 0x56557008  →  "INCORRECT....: I'm afraid that is not Lucia's curr[...]"0xffffac24│+0x0014: 0x56557094  →   or BYTE PTR ds:0x36153f33, bh0xffffac28│+0x0018: 0x000000000xffffac2c│+0x001c: "CORRECT!!!!!\n"─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:32 ────   0x565562f9 <main+194>       push   eax   0x565562fa <main+195>       lea    eax, [ebp-0x100c]   0x56556300 <main+201>       push   eax → 0x56556301 <main+202>       call   0x56556080 <strncmp@plt>   ↳  0x56556080 <strncmp@plt+0>  jmp    DWORD PTR [ebx+0x1c]      0x56556086 <strncmp@plt+6>  push   0x20      0x5655608b <strncmp@plt+11> jmp    0x56556030      0x56556090 <_start+0>       endbr32      0x56556094 <_start+4>       xor    ebp, ebp      0x56556096 <_start+6>       pop    esi─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── arguments (guessed) ────strncmp@plt (   [sp + 0x0] = 0xffffbc2c → 0x6d61724b,   [sp + 0x4] = 0x56557187 → "CORRECT!!!!!")─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────[#0] Id 1, Name: "cereal", stopped 0x56556301 in main (), reason: BREAKPOINT───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────[#0] 0x56556301 → main()────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────gef➤  x/s 0xffffbc2c0xffffbc2c:     "KramPuffs3:D(\a\023YyWU<\025`z\bX\\\036tGw\1777'a6,{\020pPx_\\j\024}iHL\\\036}tR\037\f;vhD)\034N"gef➤```
```shdeadface/rev/cereal_killer_2 on  master❯ ./cerealLuciafer also loves Halloween, so she, too, LOVES SPOOKY CEREALS!She has different favorite villain from 70-80's horror movies.What is Luciafer's favorite breakfast cereal? KramPuffs3:DCORRECT!!!!! : flag{GramPa-KRAMpus-Is-Comin-For-Da-Bad-Kids!!!}```
flag: `flag{GramPa-KRAMpus-Is-Comin-For-Da-Bad-Kids!!!}`