blob: bbb2e7721dfb8521ff75a8b146ce2515fbf4f821 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
# babushka
"I got this toy in a Russian gift shop."
The file `babushka.py` has been omitted due to the size. It was generated by
`gen.py`.
The challenge was named "babushka" because the program is designed like a
matryoshka doll. There is one entry point to a long (having 500 parts) chain of
functions, most unpacking the subsequent one in the chain.
Each function in the chain does some check on the input. All of them, except for
the fourteenth, have some check that involves some decoy flag, and some way of
combining the results of the checks further down in the lineage. They are
combined such that only the output of one of the 500 functions is used.
The intended solution was to write a script to extract all of the functions, and
look at the combiners to see which of the functions mattered. You could then
manually reverse engineer them to get the flag.
The way the input is checked is about the same across all functions, so in
theory, one could write a script to extract the value the input is checked
against from all of the functions, and then try all 500 to see which one worked.
|
