# SunshineCTF 2023
## Dill
> Originally this was going to be about pickles, but .pyc sounds close enough to "pickles" so I decided to make it about that instead.> >  Author: N/A>> [`dill.cpython-38.pyc`](https://raw.githubusercontent.com/D13David/ctf-writeups/main/sunshinectf23/rev/dill/dill.cpython-38.pyc)
Tags: _rev_
## SolutionFor this challenge we get some compiled bytecode. We easily can decompile this by using [`pycdc`](https://github.com/zrax/pycdc).
```pythonclass Dill:    prefix = 'sun{'    suffix = '}'    o = [        5,        1,        3,        4,        7,        2,        6,        0]
    def __init__(self = None):        self.encrypted = 'bGVnbGxpaGVwaWNrdD8Ka2V0ZXRpZGls'
    def validate(self = None, value = None):        if not value.startswith(Dill.prefix) or value.endswith(Dill.suffix):            return False        value = None[len(Dill.prefix):-len(Dill.suffix)]        if len(value) != 32:            return False        c = (lambda .0 = None: [ value[i:i + 4] for i in .0 ])(range(0, len(value), 4))        value = None((lambda .0 = None: [ c[i] for i in .0 ])(Dill.o))        if value != self.encrypted:            return False```
The `validate` function takes some input, encrypts it and checks if the encrypted value is the same as what is in `self.encrypted`. We have to find a value that matches then. The first condition (which the decompiler failed to understand) is that the input is pre- and suffixed with `sun{` respectively `}`. Then a `32` byte long value is expected that is seperated in 4 character chunks and reordered with help of the indirection table `o`.
This is easy to reverse, we take the `encrypted` version, split in 4 character chunks and inverse the ordering. If we do so, we get `ZGlsbGxpa2V0aGVwaWNrbGVnZXRpdD8K`. This is base64 encoded and decodes to `dilllikethepicklegetit?`. Submitting this as flag is not accepted, but submitting the base64 encoded version is.
Flag `sun{ZGlsbGxpa2V0aGVwaWNrbGVnZXRpdD8K}`