## Csaw 2017 Prophecy

The goal of this challenge is to print the contents of the flag file.

Let's take a look at the binary:

```
$ file prophecy
prophecy: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, not stripped
$ ./prophecy
----------------------------------------------
|PROPHECY PROPHECY PROPHECY PROPHECY PROPHECY|
----------------------------------------------
[*]Give me the secret name
>>guyinatuxedo
[*]Give me the key to unlock the prophecy
>>supersecretkey
```

So we can see that it prompts us for  a name and a key. When we look at the code in Ghidra, it is clear that the binary has been obfuscated. The program is run in a while true loop, and the code has been split into a lot of different sections. Which section runs depends on the value of the integer `codeFlow`. Also most of the code we are interested in is ran in the `parser` function, which is called in main. With that knowledge, let's find the pieces of code that scan in our name and secret.

Name: (address: 0x40254b)
```
                                                  this = operator<<<std--char_traits<char>>
                                                                   (cout,
                                                  "|PROPHECY PROPHECY PROPHECY PROPHECY PROPHECY| ",
                                                  puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x4024ab;
                                                  local_3a0 = operator<<(this,
                                                  _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
                                                  ,puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x4024cb;
                                                  this = operator<<<std--char_traits<char>>
                                                                   (cout,
                                                  "----------------------------------------------",
                                                  puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x4024dd;
                                                  local_3a8 = operator<<(this,
                                                  _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
                                                  ,puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x4024fd;
                                                  this = operator<<<std--char_traits<char>>
                                                                   (cout,
                                                  "[*]Give me the secret name",puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x40250f;
                                                  local_3b0 = operator<<(this,
                                                  _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
                                                  ,puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x40252f;
                                                  local_3b8 = operator<<<std--char_traits<char>>
                                                                        (cout,&DAT_0040647e,
                                                                         puVar5[0x2fffffab8]);
                                                  *(undefined8 *)(puVar5 + 0x2fffffab8) = 0x40254b;
                                                  sVar3 = read(0,local_d8,200,puVar5[0x2fffffab8]);
                                                  codeFlow = 0xac75072e;
                                                  local_49 = 0 < sVar3;
                                                  bVar9 = (x.28 * (x.28 + -1) & 1U) == 0;
                                                  puVar5 = (undefined *)local_58;
                                                  if (bVar9 != y.29 < 10 || bVar9 && y.29 < 10) {
                                                    codeFlow = 0xa0ebe5ab;
```

Here we can see that it prompts for the secret name. It scans in 200 bytes into `name_input` 200 bytes, then checks to see if it scanned in more than 0 bytes. Checking the references for `name_input` we find the following code block.

address: 0x402b57
```
                                                        containsStarcraft =
                                                             strstr(nameInput,".starcraft",
                                                                    puVar4[-8]);
                                                        starcraftCheck =
                                                             containsStarcraft != (char *)0x0;
```

Looking here, we can see that it checks to see if `nameInput` contains the string `.starcraft`. So the name we need to input is probably `.starcraft`

Secret: (address: 0x40289d)
```
                                                        this = operator<<<std--char_traits<char>>
                                                                         (cout,
                                                  "[*]Give me the key to unlock the prophecy",
                                                  puVar5[-8]);
                                                  *(undefined8 *)(puVar5 + -8) = 0x402866;
                                                  local_3d8 = operator<<(this,
                                                  _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
                                                  ,puVar5[-8]);
                                                  *(undefined8 *)(puVar5 + -8) = 0x402886;
                                                  local_3e0 = operator<<<std--char_traits<char>>
                                                                        (cout,&DAT_0040647e,
                                                                         puVar5[-8]);
                                                  *(undefined8 *)(puVar5 + -8) = 0x4028a2;
                                                  sVar3 = read(0,keyInput,300,puVar5[-8]);
                                                  codeFlow = 0x661c008b;
                                                  local_48 = 0 < sVar3;
                                                  bVar9 = (x.28 * (x.28 + -1) & 1U) == 0;
                                                  if (bVar9 != y.29 < 10 || bVar9 && y.29 < 10) {
                                                    codeFlow = 0xc0f1dacd;
```

Here we can see that it prints out `[*]Give me the key to unlock the prophecy`. Proceeding that