Crack Digital Physiognomy 1 831 -

$ file physiognomy physiognomy: ELF 64-bit LSB executable, x86-64, dynamically linked, stripped $ checksec physiognomy Arch: amd64 RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE

undefined8 main(void) { char input[32]; char expected[32]; printf("Enter digital physiognomy key: "); fgets(input, 32, stdin); input[strcspn(input, "\n")] = 0;

Now for each char c in reversed target:

flag = ''.join(flag_chars) print(flag)

void transform(char *src, char *dst) { int len = strlen(src); for (int i = 0; i < len; i++) { dst[i] = (src[i] ^ 0x42) + 0x13; } dst[len] = 0; reverse(dst); } We know: reverse( (input[i] ^ 0x42) + 0x13 ) == "831_physiognomy_cracked"

Run it:

$ ./physiognomy Enter digital physiognomy key: test Access denied. No other output. Likely checks a specific input. Load into Ghidra. The entry calls __libc_start_main with FUN_00101260 as main. Crack Digital Physiognomy 1 831

No PIE means addresses are fixed – good for static analysis.

First, reverse target : "dekarc_demongysoihp_138"

Decompile main :

$ python3 solve.py CTF{d1g1t4l_f4c3_831} $ ./physiognomy Enter digital physiognomy key: CTF{d1g1t4l_f4c3_831} Flag: CTF{d1g1t4l_f4c3_831} Matches expected output. Flag CTF{d1g1t4l_f4c3_831} Note: The number 831 appears as part of the intermediate constant string 831_physiognomy_cracked , likely referencing the challenge ID or a magic value.

We have: (input_byte ^ 0x42) + 0x13 = c So: input_byte ^ 0x42 = c - 0x13 input_byte = (c - 0x13) ^ 0x42 target_rev = "dekarc_demongysoihp_138"[::-1] # wait, no: reversed target is correct # Actually easier: just reverse the known output first known = "831_physiognomy_cracked" rev_known = known[::-1] # "dekarc_demongysoihp_138" flag_chars = [] for ch in rev_known: c = ord(ch) original = (c - 0x13) ^ 0x42 flag_chars.append(chr(original))

transform(input, expected); // custom obfuscation function if (strcmp(expected, "831_physiognomy_cracked") == 0) { printf("Flag: %s\n", input); } else { puts("Access denied."); } return 0; }