Challenge Description#

Given a 64-bit ELF executable named ngompor.

Analysis#

After disassembling the binary, we found that the flag data is stored in memory but encoded using a bitwise NOT operation.

$ objdump -d ngompor -M intel | grep -A 50 "flag_data"

The binary stores encoded bytes that need to be decoded by applying ~byte & 0xFF (bitwise NOT).

Solution#

#!/usr/bin/env python3
# Encoded flag data extracted from binary
encoded_data = [
    0xac, 0xbc, 0xac, 0xcd, 0xcf, 0x9a, 0xb4, 0xcd, 
    0x91, 0xb7, 0xcd, 0x93, 0x9c, 0x97, 0xb0, 0xb4,
    0x9c, 0x91, 0x8c, 0xb4, 0xb6, 0x90, 0xb4, 0xb6, 
    0xb0, 0x8c, 0x91, 0x9c, 0x9c, 0x92, 0xb2, 0x86
]

# Apply bitwise NOT to decode
flag = ''.join(chr(~b & 0xFF) for b in encoded_data)
print(flag)

Output: SCS26{m4nu4l_h3x_c0mp4r3_is_sneaky}