
- [murmur](#murmur)- [Brutal Oldskull](#brutal-oldskull)
# murmur
I had a TOEIC test last weekend, so I did not spend too much time on TeaserDragon.
The Challenges are interesting, though I did not solve them during contest, except the `Brutal Oldskull` is a give away questions.
# Brutal Oldskull
What the binary basically do is :
1. get input2. use input to decode an area `unk_405020` with length `0x4c8e`3. do MD5 to that area with length `0x4c8e-0x20`4. compare the "printable" hex result of MD5 with the last 0x20 byte (as "string" ) of the area (the part which was not MD5 input)5. do the samething with input2, input3, input4 but with length `0x4c6e`,`0x4c4e`,`0x4c2e`6. The decode area is actually a `PE` file. Extract it to `C:\HOME\AppData\Local\Temp\oldskull_checker.exe` then execute it to check `FLAG`
So, dump that area then write a python script to get the code.
(part, the complete script is under this directory)
```pyimport ctypesimport stringimport hashlib
def code1(x,y,z):    temp = [0]*y    for i in range(y):        temp[i] = ((ord(x[i])^z) - ((z>>8)&0xff))&0xff        z = ctypes.c_int16(z*25331).value    return temp
l  = [0x4c8e, 0x4c6e, 0x4c4e, 0x4c2e]
for z in l:    for i in range(0x10000):        final = code1(x,z,i)        no = False        for j in map(chr,final[-32:]):        #speed up, if the last 32 byte is not printable, skip            if j not in string.letters+string.digits:                no = True        if not no:            o = hashlib.md5(''.join(map(chr,final[:-32]))).hexdigest()            if ''.join(map(chr,final[-32:])) == o:                print hex(i)                x = map(chr,final[:z])                break```
`oldskull_checker` would compare the resuilt of  `FLAG` xor `0x8f`  to `[0xCB 0xFD 0xE8 0xE1 0xDC 0xF4 0xD8 0xEE 0xEE 0xEE 0xF6 0xDB 0xE0 0xE0 0xCA 0xD5 0xAE 0xAE 0xBE 0xF2]`
flag is `DrgnS{WaaayTooEZ!!1}`