We have [file named triptych](https://github.com/KosBeg/ctf-writeups/raw/master/UIUCTF_2018/triptych)```pc@pc:~/ctfs$ file triptych triptych: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=cff282fd463037bb5f9e2cb8febae912fa7603eb, not stripped```Load into disassembler or debugger. In main we have```void main(void) {  char flag[25];
  fgets(flag, 25, stdin);  mprotect(&dword_400000, 0x1000, 7); // set RWX for range(0x400000, 0x401000)  the_first(flag);}```->```void the_first(char *flag) {  int i;  char key[42];
  strcpy(key, "lskvbsjcjflsksjcuyqocjmdnv66321i]';'falq[ ");  for ( i = 0; i < 245; ++i )    *(the_second + i) ^= key[i % 42]; // dynamic decryption of the_second  the_second(flag);}```the_second after decryption ->```void the_second(char *flag) {  int i;  char key[42];
  strcpy(key, "sjdsahhhhsiojcojjvb kwvavbkdsabk||'f8923;> ");  for ( i = 0; i < 245; ++i )    *(the_third + i) ^= key[i % 42]; // dynamic decryption of the_third  the_third(flag);}```the_third after decryption ->```void the_third(char *flag) {  int i;  char key[42];
  strcpy(key, "&^$^$slaivdgskg 32fir2igkgkds (*zop`~ !sia");  for ( i = 0; i < 352; ++i )    *(validate + i) ^= key[i % 42]; // and finally! dynamic decryption of validate  validate(flag);}```validate ->```void validate(char *flag) {  int i, j, k;  char crypted[32];  char table[32];
  strcpy(table, "_'qwertyuiop{}asdfghjklzxcvbnm|");  for ( i = 0; i <= 2; ++i )  {    if ( flag[i] <= 94 || flag[i] > 125 ) // only small letters and _`{|      exit(0);    for ( j = 0; j <= 23; ++j )      flag[j] = table[flag[j] - 95]; // some encryption  }  strcpy(crypted, "zmu}jnd{o{f_ndo{{_hz_{ga");  for ( k = 0; k <= 24; ++k )  {    if ( flag[k] != crypted[k] ) // compare crypted flag to hardcored string      exit(0);  }  puts("haha nice!"); // we win :D}```So let's write script to decode it!```table = "_'qwertyuiop{}asdfghjklzxcvbnm|"flag = list("zmu}jnd{o{f_ndo{{_hz_{ga")for k in range(3):  for i, byte in enumerate(flag):    flag[i] = chr(table.find(byte) + 95)
print ''.join(flag) # flag{theres_three_of_em}```