Question

What input will successfully validate this program? (Please show exactly how you did it, and what the input will be to validate it)

#!/usr/bin/env python

import sys

def verify(guess):
vals = [
       130,
       154,
       136,
       252,
       131,
       157,
       155,
       137,
       252,
       229,
       225,
       227,
       229
]

if len(guess) != 13:
return False

for i, c in enumerate(guess):
if (ord(c) ^ 209) != vals[i]:
return False
return True

if len(sys.argv) != 1:
print 'Usage: python check.pyc'
exit(1)

guess = raw_input("Enter your guess for the flag: ");

if verify(guess):
print "That's the correct flag!"
else:
print "Wrong flag."

Answer 1

Your Python Code ::

After keenly observing the code we can find,

(1) The above code is asking for an input (raw_input in python2) and it is calling the defined function named guess.There are already few values which are stored in a list we can observe that. And now the function is checking the len of the input string if it is not equal to 13 it is simply returning false and which in further will be returned to,

if verify(guess): //if len of the string is not equal to 13 it returns False.

Then the if statement is validated as,

if False: // Means it is False so the following statements in if block won't be executed and executes the statement in else block which is "Wrong Flag".

So,the first condition which need to be satisfied by the input string is it should be of length equal to 13.

Ok let's assume that we have given an input string of length 13.

The next condition is,it is enumerating the string.Let us see with an example how the for loop with enumerate works with an example.

For example I have a given a string of length 13. Let the string be 'ABCDEFGHIKLMN'

So, i is having the values of 0 to len(str)-1. And c is having the each chars in the string.

Ok next,the big thing. Here vals = [130,154,136,252,131,157,155,137,252,229,225,227,229] is,

if (ord(c) ^ 209) != vals[i]:
return False
return True

^ is the XOR operation.

ord(c),c has each char of the str. ord(c) is nothing but,ASCII value of the char. And it is been XORed with 209.

Let's see how the XOR operation works,

For example x^y if the corresponding bits in both x and y are same(both 0 are both 1) then it returns 0,if they are different(x is 0 and y is 1 (or) x is 1 and y is 0) it gives 1.

Truth Table for XOR operation ::

So, now let's see for our own example

Let c = 'A',ord(c) is 65 now,XOR it with 209.

Binary of 65		1	0	0	0	0	0	1
Binary of 209	1	1	0	1	0	0	0	1
Result ::	1	0	0	1	0	0	0	0

After,the XOR operation the result is 10010000. Converting into decimal form we get 144.

Let's see the same with python code.

So,now coming the condition in the code.

if (ord(c) ^ 209) != vals[i]:
return False
return True

(2) We need to give such type of string which ord is when XORed with 209 is equal to vals[i],then only it returns True.

So,we need to find the string which satisfies the above 2 conditions.One is it's length must be equal to 13.And the other is the above condition.

Ok so now our condition is,

Let a be the string and x be the each char in the string.We need to find the string which is equal to vals[i] after each iteration.

(ord(c) ^ 209) == vals[i]: //Only then it returns True to the called function.

vals = [130,154,136,252,131,157,155,137,252,229,225,227,229]

(ord(c) ^ 209) == vals[i]

This condition can be written as ::

ord(c) == vals[i] ^ 209

So for first iteration the value of vals[i] is 130.So,130^209 is 83. And chr(83) is 'S'

So doing the same for all the values in vals using python2 gives us.

Yep! We found the string which satisfies the above two conditions.Hence it returns True and prints us "That's the correct flag!".

Here I named the py file as check.py

Thanks. Happy Chegging.