# hackyou 2k14: Reverse - Newbie calculations (200 points)


# cat rev200.py
#!/usr/bin/python

N = 32

def print_flag(flag):
        f = ''
        for i in xrange(N):
                f += chr(flag[i])
        return f

def add(a, b): #sub_401000
        return a + b

def mul(a, b): #sub_401100
        return a * b

def sub(a, b): #sub_401220
        return a - b

'''
for ( i = 0; i < 32; ++i )
v117[i] = 1;
'''
flag = []
for i in xrange(N):
        flag.append(1)

'''
v0 = sub_401100(v117, 1000000000);
v1 = sub_401220(v0, 999999950);
sub_401100(v1, 2);
'''
flag[0] = mul(sub(mul(flag[0], 1000000000), 999999950), 2)

'''
v2 = sub_401000(&v118, 5000000);
v3 = sub_401220(v2, 6666666);
v4 = sub_401000(v3, 1666666);
v5 = sub_401000(v4, 45);
v6 = sub_401100(v5, 2);
sub_401000(v6, 5);
'''
flag[1] = add(mul(add(add(sub(add(flag[1], 5000000), 6666666), 1666666), 45), 2), 5)

'''
v7 = sub_401100(&v119, 1000000000);
v8 = sub_401220(v7, 999999950);
v9 = sub_401100(v8, 2);
sub_401000(v9, 2);
'''
flag[2] = add(mul(sub(mul(flag[2], 1000000000), 999999950), 2),2)

'''
v10 = sub_401000(&v120, 55);
v11 = sub_401220(v10, 3);
v12 = sub_401000(v11, 4);
sub_401220(v12, 1);
'''
flag[3] = sub(add(sub(add(flag[3], 55), 3), 4), 1)

'''
v13 = sub_401100(&v121, 100000000);
v14 = sub_401220(v13, 99999950);
v15 = sub_401100(v14, 2);
sub_401000(v15, 2);
'''
flag[4] = add(mul(sub(mul(flag[4], 100000000), 99999950), 2), 2)

'''
v16 = sub_401220(&v122, 1);
v17 = sub_401100(v16, 1000000000);
v18 = sub_401000(v17, 55);
sub_401220(v18, 3);
'''
flag[5] = sub(add(mul(sub(flag[5], 1), 1000000000), 55), 3)

'''
v19 = sub_401100(&v123, 1000000);
v20 = sub_401220(v19, 999975);
sub_401100(v20, 4);
'''
flag[6] = mul(sub(mul(flag[6], 1000000), 999975), 4)

'''
v21 = sub_401000(&v124, 55);
v22 = sub_401220(v21, 33);
v23 = sub_401000(v22, 44);
sub_401220(v23, 11);
'''
flag[7] = sub(add(sub(add(flag[7], 55), 33), 44), 11)

'''
v24 = sub_401100(&v125, 10);
v25 = sub_401220(v24, 5);
v26 = sub_401100(v25, 8);
sub_401000(v26, 9);
'''
flag[8] = add(mul(sub(mul(flag[8], 10), 5), 8), 9)

'''
v27 = sub_401000(&v126, 0);
v28 = sub_401220(v27, 0);
v29 = sub_401000(v28, 11);
v30 = sub_401220(v29, 11);
sub_401000(v30, 53);
'''
flag[9] = add(flag[9], 53)

'''
v31 = sub_401000(&v127, 49);
v32 = sub_401220(v31, 2);
v33 = sub_401000(v32, 4);
sub_401220(v33, 2);
'''
flag[10] = add(flag[10], 49)

'''
v34 = sub_401100(&v128, 1000000);
v35 = sub_401220(v34, 999999);
v36 = sub_401100(v35, 4);
sub_401000(v36, 50);
'''
flag[11] = add(mul(sub(mul(flag[11], 1000000), 999999), 4), 50)

'''
v37 = sub_401000(&v129, 1);
v38 = sub_401000(v37, 1);
v39 = sub_401000(v38, 1);
v40 = sub_401000(v39, 1);
v41 = sub_401000(v40, 1);
v42 = sub_401000(v41, 1);
v43 = sub_401000(v42, 10);
sub_401000(v43, 32);
'''
flag[12] = add(flag[12], 48)

'''
v44 = sub_401100(&v130, 10);
v45 = sub_401220(v44, 5);
v46 = sub_401100(v45, 8);
v47 = sub_401000(v46, 9);
sub_401000(v47, 48);
'''
flag[13] = add(add(mul(sub(mul(flag[13], 10), 5), 8), 9), 48)

'''
v48 = sub_401220(&v131, 1);
v49 = sub_401100(v48, -294967296);
v50 = sub_401000(v49, 55);
sub_401220(v50, 3);
'''
flag[14] = sub(add(mul(sub(flag[14], 1), -294967296), 55), 3)

'''
v51 = sub_401000(&v132, 1);
v52 = sub_401000(v51, 2);
v53 = sub_401000(v52, 3);
v54 = sub_401000(v53, 4);
v55 = sub_401000(v54, 5);
v56 = sub_401000(v55, 6);
v57 = sub_401000(v56, 7);
sub_401000(v57, 20);
'''
flag[15] = add(flag[15], 48)

'''
v58 = sub_401100(&v133, 10);
v59 = sub_401220(v58, 5);
v60 = sub_401100(v59, 8);
v61 = sub_401000(v60, 9);
sub_401000(v61, 48);
'''
flag[16] = add(add(mul(sub(mul(flag[16], 10), 5), 8), 9), 48)

'''
v62 = sub_401000(&v134, 7);
v63 = sub_401000(v62, 6);
v64 = sub_401000(v63, 5);
v65 = sub_401000(v64, 4);
v66 = sub_401000(v65, 3);
v67 = sub_401000(v66, 2);
v68 = sub_401000(v67, 1);
sub_401000(v68, 20);
'''
flag[17] = add(flag[17], 48)

'''
v69 = sub_401000(&v135, 7);
v70 = sub_401000(v69, 2);
v71 = sub_401000(v70, 4);
v72 = sub_401000(v71, 3);
v73 = sub_401000(v72, 6);
v74 = sub_401000(v73, 5);
v75 = sub_401000(v74, 1);
sub_401000(v75, 20);
'''
flag[18] = add(flag[18], 48)

'''
v76 = sub_401100(&v136, 1000000);
v77 = sub_401220(v76, 999999);
v78 = sub_401100(v77, 4);
v79 = sub_401000(v78, 50);
sub_401220(v79, 1);
'''
flag[19] = sub(add(mul(sub(mul(flag[19], 1000000), 999999), 4), 50), 1)

'''
v80 = sub_401220(&v137, 1);
v81 = sub_401100(v80, -294967296);
v82 = sub_401000(v81, 49);
sub_401220(v82, 1);
'''
flag[20] = sub(add(mul(sub(flag[20], 1), -294967296), 49), 1)

'''
v83 = sub_401220(&v138, 1);
v84 = sub_401100(v83, 1000000000);
v85 = sub_401000(v84, 54);
v86 = sub_401220(v85, 1);
v87 = sub_401000(v86, 1000000000);
sub_401220(v87, 1000000000);
'''
flag[21] = sub(add(sub(add(mul(sub(flag[21], 1), 1000000000), 54), 1), 1000000000), 1000000000)

'''
v88 = sub_401000(&v139, 49);
v89 = sub_401220(v88, 1);
v90 = sub_401000(v89, 2);
sub_401220(v90, 1);
'''
flag[22] = add(flag[22], 49)

'''
v91 = sub_401100(&v140, 10);
v92 = sub_401220(v91, 5);
v93 = sub_401100(v92, 8);
v94 = sub_401000(v93, 9);
sub_401000(v94, 48);
'''
flag[23] = add(add(mul(sub(mul(flag[23], 10), 5), 8), 9), 48)

'''
v95 = sub_401000(&v141, 1);
v96 = sub_401000(v95, 3);
v97 = sub_401000(v96, 3);
v98 = sub_401000(v97, 3);
v99 = sub_401000(v98, 6);
v100 = sub_401000(v99, 6);
v101 = sub_401000(v100, 6);
sub_401000(v101, 20);
'''
flag[24] = add(flag[24], 48)

'''
v102 = sub_401000(&v142, 55);
v103 = sub_401220(v102, 33);
v104 = sub_401000(v103, 44);
v105 = sub_401220(v104, 11);
sub_401000(v105, 42);
'''
flag[25] = add(sub(add(sub(add(flag[25], 55), 33), 44), 11), 42)

'''
sub_401000(&v143, v142);
'''
flag[26] = add(flag[26], flag[25])

'''
sub_401000(&v144, v129);
'''
flag[27] = add(flag[27], flag[12])

'''
v106 = v144;
v107 = sub_401220(&v145, 1);
v108 = sub_401000(v107, v106);
sub_401220(v108, 1);
'''
flag[28] = sub(add(sub(flag[28], 1), flag[27]), 1)

'''
v109 = v140;
v110 = sub_401220(&v146, 1);
v111 = sub_401100(v110, 1000000);
sub_401000(v111, v109);
'''
flag[29] = add(sub(flag[29], 1), flag[23])

'''
v112 = v144;
v113 = sub_401000(&v147, 1);
sub_401100(v113, v112);
'''
flag[30] = mul(add(flag[30], 1), flag[27])

'''
sub_401000(&v148, v147);
'''
flag[31] = add(flag[31], flag[30])

'''
sub_401D2B("Your flag is:");
((void (__cdecl *)(_DWORD, char))sub_401C7F)("CTF{", 1);
sub_401C7F("}\n");
'''
print 'Your flag is: CTF{' + print_flag(flag) + '}'
# ./rev200.py
Your flag is: CTF{daf8f4d816261a41a115052a1bc21ade}

No comments: