[](ctf=defcamp-quals-2015)[](type=reverse)[](tags=shift-cipher)
We are given a [binary](../r100.bin).
```bash$ file r100.bin r100.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=0f464824cc8ee321ef9a80a799c70b1b6aec8168, stripped```On running it asks for a password and checks it.
```bash$ ./r100.bin Enter the password: AAAAAAIncorrect password!```
A quick strace shows its protected from debugging using [ptrace](https://en.wikipedia.org/wiki/Ptrace).
```bash$ strace ./r100.bin ..ptrace(PTRACE_TRACEME, 0, 0, 0)         = -1 EPERM (Operation not permitted)```So gdb won't work normally. The technique I used involved changing the return value in runtime during gdb debugging.
```bash$ objdump -d sep_15/d-ctf/r100.bin | grep \<ptrace@plt\>0000000000400600 <ptrace@plt>:  4007da:	e8 21 fe ff ff       	callq  400600 <ptrace@plt>``````bashgdb-peda$ b *0x4007dfBreakpoint 1 at 0x4007dfgdb-peda$ r..gdb-peda$ set $rax=0``` This will do the job. Now back to reversing.A brief decompilation gives us ```cint check(char *input){  int i;  char p1[8] = "Dufhbmf"; // [bp-20h]  char p2[8] = "pG`imos"; // [bp-18h]  char p3[8] = "ewUglpt"; // [bp-10h]  for ( i = 0; i <= 11; ++i )  {    if ( p1[8 * (i % 3)] + 2 * (i / 3)) - (input[i]) != 1 )      return 1;  }  return 0;}```It is checking our input against the values in the fashion given above. The only effective chars we need 
> Dpef`Ubmlfst 
Our password should be 1 less than each of chars.```bash$ python -c "print (''.join(chr(ord(i)-1) for i in 'Dpef\`Ubmlfst'))"Code_Talkers```Flag> Code_Talkers