# Back to the basics, re, 293p
>You won't find any assembly in this challenge, only C64 BASIC. Once you get the password, the flag is CTF{password}. P.S. The challenge has been tested on the VICE emulator.
Running the attached file on the emulator greets us with password prompt, so we probably have to guess it.
The binary was "compiled" BASIC code, and running it through a few disassemblers showed only a couple oflines of source; much less than what we would expect from 32kB binary. There are a few strange `POKE`s there,and when we checked what addresses they write to, it turned out to be program memory - so we have a self-modifying codethere!
Not willing to run it with debugger, I wrote a simple dumb disassembler, not stopping on any errors - `replace.py`.We then found some extra lines:```2001 POKE  03397, 00069 : POKE  03398, 000132002 POKE  1024 +  CHKOFF +  1, 81:POKE  55296 +  CHKOFF +  1, 72004 ES =  03741 : EE =  04981 : EK =  1482005 FOR  I =  ES TO  EE : K =  ( PEEK (I) +  EK ) AND  255 : POKE  I, K : NEXT  I2009 POKE  1024 +  CHKOFF +  1, 87```These lines seem to be decoding some data, which happened to be garbage bytes placed right afterwards. We wrote ascript running the same algorithm (in a few places, since there were multiple blocks of code like that) - `decode.py`.Disassembling the new code too, we found most of it readable. The encrypted chunks were of following form:```2010 V =  0.6666666666612316235641 -  0.00000000023283064365386962890625 : G =  02020 BA =  ASC ( MID$ (P$, 1, 1) )2021 BB =  ASC ( MID$ (P$, 2, 1) )2025 P0 =  0:P1 =  0:P2 =  0:P3 =  0:P4 =  0:P5 =  0:P6 =  0:P7 =  0:P8 =  0:P9 =  0:PA =  0:PB =  0:PC =  02030 IF  BA AND  1 THEN  P0 =  0.0625000000018189894035458564758300781252031 IF  BA AND  2 THEN  P1 =  0.01562500000045474735088646411895751953122032 IF  BA AND  4 THEN  P2 =  0.00390625000011368683772161602973937988282033 IF  BA AND  8 THEN  P3 =  0.00097656250002842170943040400743484497072034 IF  BA AND  16 THEN  P4 =  0.00024414062500710542735760100185871124272035 IF  BA AND  32 THEN  P5 =  0.00006103515625177635683940025046467781072036 IF  BA AND  64 THEN  P6 =  0.00001525878906294408920985006261616945272037 IF  BA AND  128 THEN  P7 =  0.00000381469726573602230246251565404236322040 IF  BB AND  1 THEN  P8 =  0.00000095367431643400557561562891351059082031 IF  BB AND  2 THEN  P9 =  0.00000023841857910850139390390722837764772032 IF  BB AND  4 THEN  PA =  0.00000005960464477712534847597680709441192033 IF  BB AND  8 THEN  PB =  0.0000000149011611942813371189942017736032034 IF  BB AND  16 THEN  PC =  0.00000000372529029857033427974855044340072050 K =  V +  P0 +  P1 +  P2 +  P3 +  P4 +  P5 +  P6 +  P7 +  P8 +  P9 +  PA +  PB +  PC2060 G =  0.6715657063760172100 T0 =  K =  G : A =  86 : B =  102200 IF  T0 =  - 1 THEN  A =  83 : B =  52210 POKE  1024 +  CHKOFF +  1, 902500 REM ```
`P` was our password, and the code seems to be checking if sum of some bits of the passwordmultiplied by a few float constants is equal to another constant - i.e. subset sum problem.We simply brute forced all the possibilities and saved the one that gave result closest tothe expected - `final.py`. Combining answers to a single text, yields the flag: `LINKED-LISTS-AND-40-BIT-FLOATS`.