We need to automate the config decryption for ten binaries. The decryption function is slightly different from Phase 2: a bit of reversing is needed. Good news: all the binaries use the same decryption function! ^^'
```from Crypto.Cipher import ARC4from pwn import *from base64 import b64decodeimport re
def rc4_decrypt2(key,ct):    dec = list(ct[1:])    cipher = ARC4.new(key)    tmp = cipher.decrypt(key[:16]) + ct[1:]    for i in range(0x31):        tmp2 = cipher.decrypt(tmp[i:i+16])        j,k = 0,0        while(k < 16):            j ^= tmp2[k]            k += 1        dec[i] ^= j    return bytes(dec).decode().rstrip('\x00')
FILE = "malware_phase3"
r = remote("chals.damctf.xyz", 32153)r.sendlineafter("Ready? Set? GO! (press enter to continue)","")for i in range(10):    print(r.recvline())    r.recvline()    BIN = b64decode(r.recvline())    f = open(FILE,"wb")    f.write(BIN)    f.close()
    elf = ELF(FILE)    ro = elf.get_section_by_name(".rodata").data()    data = elf.get_section_by_name(".data").data()
    key = ro[0x10:0x30]    config = {}    for i in range(10):        offset = 0x20+i*0x32        ct = data[offset:offset+0x32]        pt = rc4_decrypt2(key,ct)        config[pt[:4]] = pt[4:]    print(config)
    question = r.recvline()    print(question)    k = re.findall("'(.{4})'",question)[0]    if k not in config.keys():        print("\tkey is "+k)        exit()    r.sendline(config[k])    r.recvline()
r.interactive()r.close()```