# Angstrom CTF : Rev3
**Category:** Reverse Engineering**Points:** 110 
> Let's try Rev 3! For this executable, you will need to figure out what input makes the program return "Correct". You don't need the shell server for this one, but the binary can be found at /problems/rev3/ on the shell server.> > >  HINTS> > Use a dissasembler or decompiler, then try and figure out how the program is checking your input.
## Write-upFirst we run the binary through a free decompiler over at https://retdec.com```//// This file was generated by the Retargetable Decompiler// Website: https://retdec.com// Copyright (c) 2018 Retargetable Decompiler <[email protected]>//
#include <stdint.h>#include <stdio.h>#include <string.h>
// ------------------- Function Prototypes --------------------
int32_t encode(char * str, int32_t a2);
// ------------------------ Functions -------------------------
// Address range: 0x80484cb - 0x8048514int32_t encode(char * str, int32_t a2) {    int32_t len = strlen(str); // 0x80484d7    // branch -> 0x80484eb    for (int32_t i = 0; i < len; i++) {        char v1 = *(char *)(i + (int32_t)str); // 0x80484fb        *(char *)(i + a2) = (v1 ^ 9) - 3;        // continue -> 0x80484eb    }    // 0x8048512    return len;}
// Address range: 0x8048515 - 0x804862fint main(int argc, char ** argv) {    // 0x8048515    int32_t v1;    char * str2 = (char *)v1; // bp-64    int32_t v2 = *(int32_t *)20; // 0x8048530    if (argc != 2) {        // 0x8048544        str2 = "Usage: ./rev1 <inputString>";        puts("Usage: ./rev1 <inputString>");        // branch -> 0x804860d        // 0x804860d        if (*(int32_t *)20 != v2) {            // 0x804861b            __stack_chk_fail();            // branch -> 0x8048620        }        // 0x8048620        return 0;    }    int32_t * v3 = (int32_t *)((int32_t)argv + 4); // 0x8048564_0    char * str = (char *)*v3;    str2 = str;    strlen(str);    encode((char *)*v3, (int32_t)&str2;;    strlen((char *)&str2;;    if (strcmp((char *)&str2, "egzloxi|ixw]dkSe]dzSzccShejSi^3q") == 0) {        // 0x80485e6        puts("Congrats, that's right! Enter your input as the flag!");        // branch -> 0x804860d    } else {        // 0x80485f8        puts("Oops, that wasn't right. Please try again!");        // branch -> 0x804860d    }    // 0x804860d    if (*(int32_t *)20 != v2) {        // 0x804861b        __stack_chk_fail();        // branch -> 0x8048620    }    // 0x8048620    return 0;}```
The function encode is intersting, specifically this part:```char v1 = *(char *)(i + (int32_t)str); // 0x80484fb*(char *)(i + a2) = (v1 ^ 9) - 3;```They also give us a string which compares the encrpted text to it:```egzloxi|ixw]dkSe]dzSzccShejSi^3q```
A simple script I wrote reverses the string back into the flag:```string = "egzloxi|ixw]dkSe]dzSzccShejSi^3q"
#Gets the ascii valuedec = [ord(i) for i in string]flag = ""
#For loop to reverse the encoding function, basically just add 3 then xor 9for a in dec:	d = a + 3	flag += chr(d ^ 9)
#prints the flagprint(flag)```
Running the script we get the flag: actf{reversing_aint_too_bad_eh?}