# Tokyowesterns rev_rev_rev

Let's take a look at the binary:

```
$    file rev_rev_rev-a0b0d214b4aeb9b5dd24ffc971bd391494b9f82e2e60b4afc20e9465f336089f
rev_rev_rev-a0b0d214b4aeb9b5dd24ffc971bd391494b9f82e2e60b4afc20e9465f336089f: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=e33eb178391bae637823f4645d63d63eac3a8d07, stripped
$    ./rev_rev_rev-a0b0d214b4aeb9b5dd24ffc971bd391494b9f82e2e60b4afc20e9465f336089f
Rev! Rev! Rev!
Your input: gimme that flag
Invalid!
```

So we are dealing with a `32` bit program that when we run it, it asks for input (and told us it was invalid). My guess is that this program takes input, alters it, and compares it against a string. Looking through the list of functions (or checking the X-References to strings) we find the `FUN_080485ab` function which looks like where the code we are interested in is:

```
undefined4 FUN_080485ab(void)

{
  char *bytesRead;
  int check;
  int in_GS_OFFSET;
  char input [33];
  int stackCanary;
 
  stackCanary = *(int *)(in_GS_OFFSET + 0x14);
  puts("Rev! Rev! Rev!");
  printf("Your input: ");
  bytesRead = fgets(input,0x21,stdin);
  if (bytesRead == (char *)0x0) {
    puts("Input Error.");
                    /* WARNING: Subroutine does not return */
    exit(0);
  }
  op0(input);
  op1(input);
  op2(input);
  op3(input);
  check = strcmp(input,PTR_DAT_0804a038);
  if (check == 0) {
    puts("Correct!");
  }
  else {
    puts("Invalid!");
  }
  if (stackCanary != *(int *)(in_GS_OFFSET + 0x14)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return 0;
}
```

So we can see this function starts off by scanning in `0x21` bytes into `input`. If the `fgets` call scans in no bytes, it exits with an error message. Then it runs `input` through 4 different functions (`op0-op3`). Then it compares our data against `PTR_DAT_0804a038` using `strcmp`, and if it is equivalent then we pass the challenge. We can check what the value of `PTR_DAT_0804a038` via clicking on it and checking it's value. What is happening here is it is scanning in input, altering it with the ops functions, then checking it against `PTR_DAT_0804a038`:

```
                             DAT_08048870                                    XREF[2]:     FUN_080485ab:08048668(*),
                                                                                          0804a038(*)  
        08048870 41              ??         41h    A
        08048871 29              ??         29h    )
        08048872 d9              ??         D9h
        08048873 65              ??         65h    e
        08048874 a1              ??         A1h
        08048875 f1              ??         F1h
        08048876 e1              ??         E1h
        08048877 c9              ??         C9h
        08048878 19              ??         19h
        08048879 09              ??         09h
        0804887a 93              ??         93h
        0804887b 13              ??         13h
        0804887c a1              ??         A1h
        0804887d 09              ??         09h
        0804887e b9              ??         B9h
        0804887f 49              ??         49h    I
        08048880 b9              ??         B9h
        08048881 89              ??         89h
        08048882 dd              ??         DDh
        08048883 61              ??         61h    a
        08048884 31              ??         31h    1
        08048885 69              ??         69h    i
        08048886 a1              ??         A1h
        08048887 f1              ??         F1h
        08048888 71              ??         71h    q
        08048889 21              ??         21h    !
        0804888a 9d              ??         9Dh
        0804888b d5              ??         D5h
        0804888c 3d              ??         3Dh    =
        0804888d 15              ??         15h
        0804888e d5              ??         D5h
        0804888f 00              ??         00h
```

So first we take a look at the `op0` function and we see this:

```
void op0(char *input)

{
  char *newLinePos;
 
  newLinePos = strchr(input,10);
  *newLinePos = '\0';
  return;
}
```

Looking at this function, we can see that it first looks for the character `0xa`, which is a newline character. Then it sets that equal to `0x0`. So essentially it replaces the newline character with a null byte. Let's take a look at `op1`:

```
void op1(char *input)

{
  size_t len;
  char *beg;
  char *end;
  char holder;
 
  beg = input;
  len = strlen(input);
  end = input + (len - 1);
  while (beg < end) {
    holder = *beg;
    *beg = *end;
    *end = holder;
    beg = beg + 1;
    end = end + -1;
  }
  return;
}
```

This code essentially takes our input (which has had the newline character stripped) and just reverses it. For instance, if we gave the program `1234`, it would reverse it to `4321`. Now let's look at `op2`.

```
void op2(byte *input)

{
  byte x;
  byte y;
  byte *inputCpy;
 
  inputCpy = input;
  while (*inputCpy != 0) {
    x = (char)*inputCpy >> 1 & 0x55U | (*inputCpy & 0x55) * '\x02';
    y = (char)x >> 2 & 0x33U | (byte)(((int)(char)x & 0x33U) << 2);
    *inputCpy = y >> 4 | (byte)((int)(char)y << 4);
    inputCpy = inputCpy + 1;
  }
  return;
}
```

This function alters the input, by performing various binary operations on our input (and in one case, multiplying it). We can see that it is a for loop that will run once per each character of our input. It will take the hex value of each character of our input and alter it, however it will only take the first 8 bits worth of data (so the least significant byte). This code effectively translates to the following python since this might be a bit easier to understand. Also shifting a value to the right by `2` is the same as multiplying it by `4`:

```
def enc(input):
    output = ""
    for c in input:
        c = ord(c)
        x = (2 * (c & 0x55)) | ((c >> 1) & 0x55)
        print "x is: " + hex(x)
        y = (4 * (x & 0x33)) | ((x >> 2) & 0x33)
        print "y is: " + hex(y)
        z = (16 * y) | ( y >> 4)
        print "z is: " + hex(z)
        output = hex(z).replace("0x", "")[-2:] + output
    return output
```

With all of that, let's take a look at the final function our input is ran through `op3`:

```
void op3(byte *input)

{
  byte *inputCpy;
 
  inputCpy = input;
  while (*inputCpy != 0) {
    *inputCpy = ~*inputCpy;
    inputCpy = inputCpy + 1;
  }
  return;
}
```

So like the previous function, this runs a loop that iterates for each character of the input. However this time it alters each character by performing a binary not (which it's operator in c is `~`). Essentially it takes the binary value of the character, and converts the zeros to ones and ones to zeros. For instance:

```
0:    0x30:    00110000
NOT 0:         11001111 = 0xcf
```

it essentially performs the same function as this python script: