Rev Enigma

Why bruteforce when you can just angr your way out of rev challenges. (+ firstblood)

Challenge files

• foobar
• index.md
• messenger
• pyproject.toml
• README.md
• solve.py
• uv.lock

Problem Statement

Simple input checker binary, converts argv to an integer somehow and runs passes it to a function. Expects function to return specific value.

Then uses userinput as a parameter to AES iirc to decrypt flag.

Just a bunch of constraints that need to be solved, so bring in angr because there just wasn’t enough time to manually create constraint set and solve with z3.

Angry Sovle script

We have function, say foobar that takes an arg, say damn_son that returns an integer.

The return value must meet a constraint (== 0x5c6ab823e810a060).

So we take two states of the program - one before the functoin is called and one after the function is called. We apply constrating on the return value and try to find damn_son such that the function returns 0x5c6ab823e810a060

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

import angr
import claripy

proj = angr.Project("./messenger", auto_load_libs=False,     main_opts={'base_addr': 0x00100000},)
func_addr = 0x00101406
sym_arg = claripy.BVS("damn_son", 64)

state = proj.factory.callable(func_addr)
res = state(sym_arg)

state.result_state.add_constraints(state.result_state.regs.rax == 0x5c6ab823e810a060)  # pyright: ignore[reportOptionalMemberAccess]
thing = (state.result_state.solver.eval(sym_arg))
print(thing)
print(hex(thing))

It outputs a number that must be converted to a string and be passed into the binary. I was too lazy to figure that part out, so I patched the string parsing function to always return this number. Patched binary at ./files/foobar.

outer-heaven :: inctf-finals-2026/rev-enigma/files ‹master*› » ./foobar o
Welcome!

Entered Key : o
Encoded using computing: 5c6ab823e810a060

Key matches!


The hidden message:
Decrypted: inctf{A5tr0n4ut5_4r3_b3st_3nc0d3rs!}
outer-heaven :: inctf-finals-2026/rev-enigma/files ‹master*› »

Flag

1

inctf{A5tr0n4ut5_4r3_b3st_3nc0d3rs!}