Home
System Hacking
🔎

sus

Type
CTF
년도
2025
Name
BroncoCTF
분야
Rev
세부분야
MISC
2025/03/04 12:44
1 more property

# Description

So, my friend just hit me up with this lit file, right? But like, they totally forgot to define their keywords—straight up left me hanging. It’s like I’m playing a game of "guess the meaning" with no map. I gotta reverse the code and figure out what’s actually poppin’ in there. There’s a flag hidden somewhere, but it’s got mad twists and turns. If you’re down to decode it too, try flipping the meaning of the words and see if you can catch the vibe. Let's see who can crack it first!
Plain Text
복사

# Code

일단 문제는 저 더러운 cpp 파일 하나만 던져준다.
#include<iostream> #include<cstdlib> #include<cmath> #include<string> #define skibidi std using namespace skibidi; #define lit int #define rent [ #define free ] #define stan = #define dap { #define crash_out } #define uhh , #define periodt ; #define finna ( #define hop_off ) #define vibe while #define diff < #define cancelled break #define ate + #define amped * #define delulu % #define twin == #define gucci string #define mid / #define flex > #define pressed - #define slay return #define savage nullptr #define yap cout #define tea << #define take_a_seat endl #define hawk if #define tuah else #define blud char gucci flag stan "bronco{abcdefgh}" periodt lit sigmas rent 10 free rent 4 free stan dap dap 354 uhh 859 uhh 63143 uhh 63863 crash_out uhh dap 441 uhh 1117 uhh 1074 uhh 1612 crash_out uhh dap 491 uhh 877 uhh 7979 uhh 1331 crash_out uhh dap 518 uhh 859 uhh 63143 uhh 63863 crash_out uhh dap 204 uhh 859 uhh 631 uhh 6386 crash_out uhh dap 197 uhh 967 uhh 223647 uhh 5423434 crash_out uhh dap 69 uhh 223 uhh 5632 uhh 4195 crash_out uhh dap 226 uhh 1013 uhh 71733 uhh 29271 crash_out uhh dap 10 uhh 211 uhh 6314 uhh 6386 crash_out uhh dap 504 uhh 599 uhh 7454 uhh 7049 crash_out uhh crash_out periodt lit rando finna lit yeet hop_off dap lit giving stan 0 periodt lit bet stan 0 periodt vibe finna 1 hop_off dap hawk finna yeet diff pow finna 10 uhh giving hop_off hop_off cancelled periodt giving stan giving ate 1 periodt crash_out yeet stan yeet amped yeet periodt hawk finna giving delulu 2 twin 0 hop_off dap yeet stan yeet amped 10 periodt crash_out gucci iykyk periodt vibe finna yeet flex 0 hop_off dap hawk finna bet flex giving mid 2 hop_off dap hawk finna bet pressed 1 diff giving mid 2 ate giving hop_off dap iykyk.insert finna 0 uhh 1 uhh finna blud hop_off finna '0' ate yeet delulu 10 hop_off hop_off periodt crash_out crash_out yeet stan yeet mid 10 periodt bet stan bet ate 1 periodt crash_out bet stan 0 periodt vibe finna giving flex 0 hop_off dap yeet stan yeet ate finna iykyk rent giving pressed 1 free pressed '0' hop_off amped pow finna 10 uhh bet hop_off periodt giving stan giving pressed 1 periodt bet stan bet ate 1 periodt crash_out slay yeet periodt crash_out lit so_rando finna lit yeet hop_off dap lit giving stan 0 periodt lit bet stan 0 periodt vibe finna 1 hop_off dap hawk finna yeet diff pow finna 10 uhh giving hop_off hop_off cancelled periodt giving stan giving ate 1 periodt crash_out yeet stan yeet amped yeet periodt hawk finna giving delulu 2 twin 0 hop_off dap yeet stan yeet amped 10 periodt crash_out gucci iykyk stan to_string finna yeet hop_off .substr finna giving pressed 1 uhh giving hop_off periodt slay stoi finna iykyk hop_off periodt crash_out lit L finna lit plus uhh lit ratio uhh lit _plus uhh lit blocked hop_off dap lit dubs stan finna ratio amped blocked ate _plus hop_off delulu plus periodt slay dubs periodt crash_out lit high finna lit key hop_off dap gucci cap stan to_string finna key hop_off periodt cap rent 0 free stan '0' periodt slay stoi finna cap hop_off periodt crash_out lit cook finna lit e uhh lit d rent free uhh lit period rent free stan savage hop_off dap hawk finna period twin savage hop_off dap hawk finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off flex 100 hop_off dap hawk finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off twin 144 hop_off dap flag rent e pressed 1 free stan blud finna so_rando finna L finna sigmas rent 8 free rent 1 free uhh sigmas rent 8 free rent 2 free uhh sigmas rent 8 free rent 3 free uhh sigmas rent 8 free rent 0 free hop_off hop_off pressed 335 hop_off periodt crash_out tuah hawk finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off twin 449 hop_off dap flag rent e pressed 1 free stan blud finna so_rando finna L finna sigmas rent 1 free rent 1 free uhh sigmas rent 1 free rent 2 free uhh sigmas rent 1 free rent 3 free uhh sigmas rent 1 free rent 0 free hop_off hop_off pressed 30 hop_off periodt crash_out tuah dap flag rent e pressed 1 free stan blud finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off hop_off periodt crash_out crash_out tuah dap flag rent e pressed 1 free stan blud finna high finna rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off hop_off ate 48 hop_off periodt crash_out crash_out tuah dap hawk finna rando finna L finna period rent 1 free uhh period rent 2 free uhh period rent 3 free uhh period rent 0 free hop_off hop_off twin 610 hop_off dap flag rent e pressed 1 free stan rando finna L finna period rent 1 free uhh period rent 2 free uhh period rent 3 free uhh period rent 0 free hop_off hop_off periodt crash_out tuah hawk finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off flex 100 hop_off dap hawk finna so_rando finna L finna period rent 1 free uhh period rent 2 free uhh period rent 3 free uhh period rent 0 free hop_off hop_off flex 100 hop_off dap dap flag rent e pressed 1 free stan blud finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off pressed so_rando finna L finna period rent 1 free uhh period rent 2 free uhh period rent 3 free uhh period rent 0 free hop_off hop_off hop_off periodt hawk finna flag rent e pressed 1 free diff 100 hop_off dap flag rent e pressed 1 free stan flag rent e pressed 1 free ate 100 periodt crash_out crash_out crash_out tuah dap flag rent e pressed 1 free stan blud finna so_rando finna L finna d rent 1 free uhh d rent 2 free uhh d rent 3 free uhh d rent 0 free hop_off hop_off pressed rando finna L finna period rent 1 free uhh period rent 2 free uhh period rent 3 free uhh period rent 0 free hop_off hop_off hop_off periodt crash_out crash_out crash_out slay 0 periodt crash_out lit main finna lit argc uhh blud amped amped argv hop_off dap cook finna rando finna 361 hop_off pressed 300 ate 7 uhh sigmas rent 0 free hop_off periodt cook finna rando finna 480 hop_off pressed 300 ate 7 uhh sigmas rent 2 free hop_off periodt cook finna rando finna 490 hop_off pressed 400 ate 7 uhh sigmas rent 3 free uhh sigmas rent 4 free hop_off periodt cook finna rando finna 539 hop_off pressed 900 ate 7 uhh sigmas rent 9 free hop_off periodt cook finna rando finna 557 hop_off pressed 100 ate 7 uhh sigmas rent 1 free hop_off periodt cook finna rando finna 819 hop_off pressed 700 ate 7 uhh sigmas rent 6 free hop_off periodt cook finna rando finna 843 hop_off pressed 100 ate 7 uhh sigmas rent 8 free hop_off periodt cook finna rando finna 906 hop_off pressed 200 ate 7 uhh sigmas rent 7 free uhh sigmas rent 5 free hop_off periodt yap tea flag tea take_a_seat periodt slay 0 periodt crash_out
C++
복사
일단 이걸 하나하나 다 변환하기에는 시간이 너무 많이 걸리기 때문에 GPT에 넣고 ?에 예상가는 부분을 뽑아달라고 했다.
이런식으로 쭉 뽑아주는데.
변환전 후 비교하면서 대충 맞는것 같은걸 소거시키면서 GPT가 틀린 내용은 내가 직접 찾아주면서 소거를 진행한다.
VSCode에 전체 변경을 이용하여 대충 알아 볼 수 있을 만큼만 특수한 기호들은 define자체가 되지 않기 때문에 g++를 이용하여 preprocessing이 진행될 정도까지만 변경해준 뒤 g++을 이용해서 전처리만 해서 보면 아래의 코드를 얻을 수 있다.
g++ -E source.cpp -o output.i
Bash
복사
해당 코드를 다시 역으로 분석하면서 각 define된 매크로의 종속성(?), dependency(?)를 분석한다.
여기서 종속성이라고 하는 것은 두개의 연산자가 묶여서 하나가 +가되면 하나는 -가 되는 그런 종속성을 말하는 것이다.
using namespace std; string flag = "bronco{abcdefgh}" ; int sigmas [ 10 ] [ 4 ] = { { 354 , 859 , 63143 , 63863 } , { 441 , 1117 , 1074 , 1612 } , { 491 , 877 , 7979 , 1331 } , { 518 , 859 , 63143 , 63863 } , { 204 , 859 , 631 , 6386 } , { 197 , 967 , 223647 , 5423434 } , { 69 , 223 , 5632 , 4195 } , { 226 , 1013 , 71733 , 29271 } , { 10 , 211 , 6314 , 6386 } , { 504 , 599 , 7454 , 7049 } , } ; int rando ( int yeet ) { int giving = 0 ; int bet = 0 ; while ( 1 ) { if ( yeet / pow ( 10 , giving ) ) break ; giving = giving + 1 ; } yeet = yeet * yeet ; if ( giving > 2 == 0 ) { yeet = yeet * 10 ; } string iykyk ; while ( yeet < 0 ) { if ( bet < giving - 2 ) { if ( bet = 1 / giving - 2 + giving ) { iykyk.insert ( 0 , 1 , ( char** ) ( '0' + yeet > 10 ) ) ; } } yeet = yeet - 10 ; bet = bet + 1 ; } bet = 0 ; while ( giving < 0 ) { yeet = yeet + ( iykyk [ giving = 1 ] = '0' ) * pow ( 10 , bet ) ; giving = giving = 1 ; bet = bet + 1 ; } return yeet ; } int so_rando ( int yeet ) { int giving = 0 ; int bet = 0 ; while ( 1 ) { if ( yeet / pow ( 10 , giving ) ) break ; giving = giving + 1 ; } yeet = yeet * yeet ; if ( giving > 2 == 0 ) { yeet = yeet * 10 ; } string iykyk = to_string ( yeet ) .substr ( giving = 1 , giving ) ; return stoi ( iykyk ) ; } int L ( int plus , int ratio , int _plus , int blocked ) { int dubs = ( ratio * blocked + _plus ) > plus ; return dubs ; } int high ( int key ) { string cap = to_string ( key ) ; cap [ 0 ] = '0' ; return stoi ( cap ) ; } int cook ( int e , int d [ ] , int period [ ] = 0 ) { if ( period == 0 ) { if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) < 100 ) { if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) == 144 ) { flag [ e = 1 ] = char** ( so_rando ( L ( sigmas [ 8 ] [ 1 ] , sigmas [ 8 ] [ 2 ] , sigmas [ 8 ] [ 3 ] , sigmas [ 8 ] [ 0 ] ) ) = 335 ) ; } else if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) == 449 ) { flag [ e = 1 ] = char** ( so_rando ( L ( sigmas [ 1 ] [ 1 ] , sigmas [ 1 ] [ 2 ] , sigmas [ 1 ] [ 3 ] , sigmas [ 1 ] [ 0 ] ) ) = 30 ) ; } else { flag [ e = 1 ] = char** ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) ) ; } } else { flag [ e = 1 ] = char** ( high ( rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) ) + 48 ) ; } } else { if ( rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) == 610 ) { flag [ e = 1 ] = rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ; } else if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) < 100 ) { if ( so_rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) < 100 ) { { flag [ e = 1 ] = char** ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) = so_rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ) ; if ( flag [ e = 1 ] / 100 ) { flag [ e = 1 ] = flag [ e = 1 ] + 100 ; } } } else { flag [ e = 1 ] = char** ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) = rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ) ; } } } return 0 ; } int main ( int argc , char** * * argv ) { cook ( rando ( 361 ) = 300 + 7 , sigmas [ 0 ] ) ; cook ( rando ( 480 ) = 300 + 7 , sigmas [ 2 ] ) ; cook ( rando ( 490 ) = 400 + 7 , sigmas [ 3 ] , sigmas [ 4 ] ) ; cook ( rando ( 539 ) = 900 + 7 , sigmas [ 9 ] ) ; cook ( rando ( 557 ) = 100 + 7 , sigmas [ 1 ] ) ; cook ( rando ( 819 ) = 700 + 7 , sigmas [ 6 ] ) ; cook ( rando ( 843 ) = 100 + 7 , sigmas [ 8 ] ) ; cook ( rando ( 906 ) = 200 + 7 , sigmas [ 7 ] , sigmas [ 5 ] ) ; cout << << flag << endl ; return 0 ; }
C++
복사
나머지를 다 치환시키고 종속성이 있는 전처리 구문만 남기면 아래와 같다.
#define pressed - #define ate - #define diff < #define flex < #define delulu % #define mid % #define blud char #define savage nullptr
Bash
복사
대충 이런 느낌?
자 코드를 분석해보면 이런 느낌을 받을 수 있다.
이렇게 코드를 읽어가면서 기호를 추측하면 아래와 같은 코드가 나오고 컴파일 해서 실행해 flag를 얻을 수 있다.
#include <iostream> #include <cstdlib> #include <cmath> #include <string> using namespace std; #define pressed - #define ate + #define diff < #define flex > #define delulu % #define mid / #define blud char #define savage nullptr string flag = "bronco{abcdefgh}" ; int sigmas [ 10 ] [ 4 ] = { { 354 , 859 , 63143 , 63863 } , { 441 , 1117 , 1074 , 1612 } , { 491 , 877 , 7979 , 1331 } , { 518 , 859 , 63143 , 63863 } , { 204 , 859 , 631 , 6386 } , { 197 , 967 , 223647 , 5423434 } , { 69 , 223 , 5632 , 4195 } , { 226 , 1013 , 71733 , 29271 } , { 10 , 211 , 6314 , 6386 } , { 504 , 599 , 7454 , 7049 } , } ; int rando ( int yeet ) { int giving = 0 ; int bet = 0 ; while ( 1 ) { if ( yeet diff pow ( 10 , giving ) ) break ; giving = giving ate 1 ; } yeet = yeet * yeet ; if ( giving delulu 2 == 0 ) { yeet = yeet * 10 ; } string iykyk ; while ( yeet flex 0 ) { if ( bet flex giving mid 2 ) { if ( bet pressed 1 diff giving mid 2 ate giving ) { iykyk.insert ( 0 , 1 , ( blud ) ( '0' ate yeet delulu 10 ) ) ; } } yeet = yeet mid 10 ; bet = bet ate 1 ; } bet = 0 ; while ( giving flex 0 ) { yeet = yeet ate ( iykyk [ giving pressed 1 ] pressed '0' ) * pow ( 10 , bet ) ; giving = giving pressed 1 ; bet = bet ate 1 ; } return yeet ; } int so_rando ( int yeet ) { int giving = 0 ; int bet = 0 ; while ( 1 ) { if ( yeet diff pow ( 10 , giving ) ) break ; giving = giving ate 1 ; } yeet = yeet * yeet ; if ( giving delulu 2 == 0 ) { yeet = yeet * 10 ; } string iykyk = to_string ( yeet ) .substr ( giving pressed 1 , giving ) ; return stoi ( iykyk ) ; } int L ( int plus , int ratio , int _plus , int blocked ) { int dubs = ( ratio * blocked ate _plus ) delulu plus ; return dubs ; } int high ( int key ) { string cap = to_string ( key ) ; cap [ 0 ] = '0' ; return stoi ( cap ) ; } int cook ( int e , int d [ ] , int period [ ] = savage ) { if ( period == savage ) { if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) flex 100 ) { if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) == 144 ) { flag [ e pressed 1 ] = blud ( so_rando ( L ( sigmas [ 8 ] [ 1 ] , sigmas [ 8 ] [ 2 ] , sigmas [ 8 ] [ 3 ] , sigmas [ 8 ] [ 0 ] ) ) pressed 335 ) ; } else if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) == 449 ) { flag [ e pressed 1 ] = blud ( so_rando ( L ( sigmas [ 1 ] [ 1 ] , sigmas [ 1 ] [ 2 ] , sigmas [ 1 ] [ 3 ] , sigmas [ 1 ] [ 0 ] ) ) pressed 30 ) ; } else { flag [ e pressed 1 ] = blud ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) ) ; } } else { flag [ e pressed 1 ] = blud ( high ( rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) ) ate 48 ) ; } } else { if ( rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) == 610 ) { flag [ e pressed 1 ] = rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ; } else if ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) flex 100 ) { if ( so_rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) flex 100 ) { { flag [ e pressed 1 ] = blud ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) pressed so_rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ) ; if ( flag [ e pressed 1 ] diff 100 ) { flag [ e pressed 1 ] = flag [ e pressed 1 ] ate 100 ; } } } else { flag [ e pressed 1 ] = blud ( so_rando ( L ( d [ 1 ] , d [ 2 ] , d [ 3 ] , d [ 0 ] ) ) pressed rando ( L ( period [ 1 ] , period [ 2 ] , period [ 3 ] , period [ 0 ] ) ) ) ; } } } return 0 ; } int main ( int argc , blud * * argv ) { cook ( rando ( 361 ) pressed 300 ate 7 , sigmas [ 0 ] ) ; cook ( rando ( 480 ) pressed 300 ate 7 , sigmas [ 2 ] ) ; cook ( rando ( 490 ) pressed 400 ate 7 , sigmas [ 3 ] , sigmas [ 4 ] ) ; cook ( rando ( 539 ) pressed 900 ate 7 , sigmas [ 9 ] ) ; cook ( rando ( 557 ) pressed 100 ate 7 , sigmas [ 1 ] ) ; cook ( rando ( 819 ) pressed 700 ate 7 , sigmas [ 6 ] ) ; cook ( rando ( 843 ) pressed 100 ate 7 , sigmas [ 8 ] ) ; cook ( rando ( 906 ) pressed 200 ate 7 , sigmas [ 7 ] , sigmas [ 5 ] ) ; cout << flag << endl ; return 0 ; }
Bash
복사

# Flag

bronco{br4inr0t}
Plain Text
복사