def fix(fname): data = open(fname, "rb").read() payload = data[0x10:] # skip header + checksum field crc = binascii.crc32(payload) & 0xffffffff fixed = data[:0x08] + crc.to_bytes(4, "little") + data[0x0c:] out = fname + ".fixed" open(out, "wb").write(fixed) print(f"[+] Fixed file: out CRC=0xcrc:08x")
The key table is:
The file format is:
./run_and_get_flag.sh mystery.dat FLAGBr1d3_1s_Just_A_CRC Congratulations! You have successfully de‑brided the file, rebuilt the missing “bride”, and uncovered the hidden flag.
# rebuild CRC python3 - <<PY import binascii, sys data = open("$FILE", "rb").read() crc = binascii.crc32(data[0x10:]) & 0xffffffff new = data[:0x08] + crc.to_bytes(4, 'little') + data[0x0c:] open("$FIXED", "wb").write(new) print(f"[*] Fixed CRC = 0xcrc:08x") PY
static const uint8_t key[16] = 0x13, 0x57, 0x9B, 0xDF, 0x02, 0x46, 0x8A, 0xCE, 0x31, 0x75, 0xB9, 0xFD, 0x40, 0x84, 0xC8, 0x0C ; Each 16‑byte chunk of the payload is XOR‑ed with this key, effectively decrypting the hidden text.
# run the binary and capture the flag ./debrideur "$FIXED" 2>/dev/null | grep -i flag Running this script prints:
# 2️⃣ Execute and filter the flag ./debrideur "$FIXED" 2>/dev/null | grep -i -E 'flag\[^]+\}' Make them executable ( chmod +x rebuild.py run_and_get_flag.sh ) and you’re ready to solve the challenge in one command:
# 1️⃣ Fix the CRC python3 rebuild.py "$FILE"
#!/usr/bin/env bash FILE=mystery.dat FIXED=$FILE.fixed
if __name__ == "__main__": rebuild(sys.argv[1]) Running it: