# roulette_wheel
**Category**: Rev \**Points**: 491 (15 solves) \**Author**: akhbaar
## Challenge
Akhbaar has opened an online casino to pass time during the pandemic. Come playat the roulette wheel.
Attachments: `wheel`
## Overview
Let's run it:```$ ./wheelWelcome to the roulette wheelWhat do you want to do?Press 1 for a hintPress 2 to choosePress 3 to play1VHJ5IGhhcmRlcgo=  [decodes to "Try harder"]What do you want to do?Press 1 for a hintPress 2 to choosePress 3 to play2What's your lucky number?50What do you want to do?Press 1 for a hintPress 2 to choosePress 3 to play3Let's see what happensYou chose:5000000The wheel chose....10570563710285841304848517216643991456000119161754206873Better luck next time, come again soon```
Ok great but WHERE'S THE FLAG??? Decompile `main` in Ghidra (btw it's C++ sothe output is ugly af)```c...          if (input != 1) break;          hint(local_98);        }        if (input != 2) break;        pick_numbers(local_98);      }      if (input == 3) {        play(local_98);      }      else {        if (input == 4) {          WHATS_THIS(local_98);        }...```
There's a hidden option 4:```$ ./wheelWelcome to the roulette wheelWhat do you want to do?Press 1 for a hintPress 2 to choosePress 3 to play4Quit looking for cheats you big baby!```
In Ghidra it looks like:```cvoid no_cheats(void)
{  basic_ostream *this;
  this = std::operator<<((basic_ostream *)std::cout,"Quit looking for cheats you big baby!");  std::basic_ostream<char,std::char_traits<char>>::operator<<            ((basic_ostream<char,std::char_traits<char>> *)this,             std::endl<char,std::char_traits<char>>);                    /* WARNING: Subroutine does not return */  exit(1);}```
Wow ok. But still, WHERE THE FUCK IS THE FLAG???
Don't feel like guessing, so time for some challenge author OSINT!!!  I findhis profile on GitHub and luckily he has a CTF writeups repo! I bet I'll findsomething interesting in there!!
Wow his[writeup](https://github.com/akhbaar/ctf-writeups/blob/master/0x414141-2021/hash.md)for Hash from [0x41414141 CTF](https://ctftime.org/event/1249) explains how thechallenge has dead code (code behind an `if` statement that's always false) sothat Ghidra doesn't show it! How sneaky!! I bet he used the same trick here!!
Guess what:
![dead](dead.png)
My two variables `stupid` and `idiot` are set to `0x42` and `0x3ab` andcompared. If the answer is true (which happens NEVER) it jumps to this`mYsTeRiOuS` label.
Now just patch the instruction with `Ctrl+Shift+G` and boom suddenly we see a bunchof code appear in the decompilation output, particularly```cprintf("0x%x\n",0x4d4a5258);printf("0x%x\n",0x495a5433);printf("0x%x\n",0x47525657);printf("0x%x\n",0x51595255);printf("0x%x\n",0x47525a44);printf("0x%x\n",0x434e4a55);printf("0x%x\n",0x4e555948);printf("0x%x\n",0x454d444f);printf("0x%x\n",0x50554641);printf("0x%x\n",0x3d3d3d3d);```
Unhex the numbers, Base32 decode, (who the fuck uses Base32?) and get the flag:
![flag](f.png)