Time Lock

This challenge is part of a set written up together in ctf/writeup.txt. Shared context for that set:

All 6 “beginner” tier Reverse Engineering challenges were solved via pure static analysis (radare2 / objdump / Python), no interactive debugging required. Each binary encodes/XOR-obfuscates the flag with a small pseudo-random-number-generator (LCG) keystream, seeded and iterated with constants recovered from the disassembly. Recovering the flag is simply a matter of re-implementing the same PRNG in Python and applying it to the encoded bytes pulled straight out of the binary. Binary: x86-64 dynamically-linked ELF, not stripped.

entry0 calls time(NULL), then does a fixed-point division trick (imul/sar by magic constants) to compute “days since epoch” and compares it against 0x2cbf34 (the day index for 1 January 9999). Only if that comparison passes does it decode and print the flag. The suggested solve is an LD_PRELOAD shim overriding time() to return the right value.

However, since the date check is a fixed constant to begin with, the XOR key used to decode the 46-byte flag blob at 0x404020 is also a hard-coded constant (0x4db55fbe) baked in right next to the (dead, unreachable-in- practice) comparison — it isn’t actually derived from the real return value of time() at runtime, only from the fact that the branch requires date == 1 Jan 9999. So we can decode statically:

state = 0x4db55fbe
for each of 46 bytes:
    state = state * 0x15a4e35 + 1   (mod 2^32)
    ks = (state >> 16) & 0xFF
    out.append(blob[i] ^ ks)

Flag: NNS{y0u_c4n_l13_70_4_pr0gr4m_w17h_ld_pr3l04d}