By studying the code, we can see that this is basically a recursive algorithm that divides the bytestring into two halves at each layer, until the base case where there are either 1 or 2 characters left. We can clearly see that at each layer, the result *r* can be expressed as
$$r=\frac{(i+j)(i+j+1)}{2}+j$$
where *i* and *j* are the results of calling the function on the lower and upper half of the input respectively. For each layer, if we are able to recover *i* and *j* from *r*, then we would be able to repeat this all the way until the base case, where we would be able to recover the ASCII characters.
**[Read the full writeup](https://zeyu2001.gitbook.io/ctfs/2021/zh3ro-ctf-v2/1n_jection)**