THE GARDEN

license-gate

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Reverse a small ELF validator and recover the license string compared with user input.

• •

  Approach

  • •

    strings exposed a hexadecimal blob and VER-ISAKOV. Disassembly showed the program reversing that text to VOKASI-REV, decoding the blob, XORing it with the repeated key, and comparing the result with strcmp.

  • •

    For decoded ciphertext byte $c_i$ and key length 10, $p_i=c_i\oplus k_{i\bmod10}$.

  • •

    Recovering the exact expected input is deterministic; guessing licenses is unnecessary.

• •

  Solution

  • •

    blob = bytes.fromhex(
        "1d0202111d7156202020333d38240c3d45371a31373b2e1e3d26590d313e3310"
        "2c34363a5e2f"
    )
    key = b"VOKASI-REV"
    license_value = bytes(c ^ key[i % len(key)] for i, c in enumerate(blob)).decode()
    print(license_value)
    # ./license_gate "$license_value"
    

• •

  Verification

  • •

    The hex blob decrypts locally to the flag recorded by the document.

• •

  Concepts

  • •

    Static string triage; control-flow confirmation in disassembly; hex decoding; repeated-key XOR.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 84–85.

  • •

    Flag: KMIPN8{reverse_the_gate_not_the_guess}.

◌ Explore connections in Graph view