Obscure Crusher 1 — TJCTF 2026

Description

What if I make it so you need 3 keys to unlock the flag...

A 169-byte binary file (chall.bin) is provided. The file command identifies it as "Mac OS X icon (icns)" but the file is actually a custom binary container embedding three file format identifiers as the "3 keys" to decrypt the flag.

Analysis

File Structure

Hex dump analysis reveals the binary has a carefully crafted structure:

Offset	Content	Purpose
0-7	icns magic + size field (256)	File format identifier #1
8-76	Second icns marker + zero padding with 0x01 bytes	Padding/structure
77-88	name field with ttf and xy values	File format identifier #2
89-108	Zero padding	Separator
109-128	LZMA properties (\x5d\x00\x00\x80\x00) + lzma label + KLZMA_DATA: marker	File format identifier #3
129-164	36 bytes of XOR-encrypted flag data	Encrypted flag
165-168	Trailing zeros	Padding

Key Discovery via Known-Plaintext Attack

The XOR encryption key was recovered using the known flag prefix tjctf{:

1. XOR the first 6 encrypted bytes (at offset 129) with tjctf{
2. The resulting bytes are: i, c, n, s, \x01, t
3. These match the beginning of the file's non-zero content sequence: icns...ttf...lzma...
4. The full 16-byte repeating key is the concatenation of the three format identifiers with their structural separator bytes

XOR Key

Key (hex): 69 63 6e 73 01 74 74 66 02 78 79 6c 7a 6d 61 4b
Key (ascii): icns\x01ttf\x02xylzmaK

The key is literally built from the non-zero bytes of the file header — the three file format identifiers (icns, ttf, lzma) concatenated with their separator/structural bytes (\x01, \x02, xy, K).

Solution

#!/usr/bin/env python3
"""Solve script for Obscure Crusher 1 - TJCTF 2026"""

data = open('chall.bin', 'rb').read()

# Extract 36 bytes of encrypted flag data at offset 129
encrypted = data[129:165]

# XOR key: non-zero bytes from file header = icns + separators + ttf + separators + lzma + K
key = bytes([
    0x69, 0x63, 0x6e, 0x73,  # icns
    0x01,                      # separator
    0x74, 0x74, 0x66,          # ttf
    0x02,                      # separator
    0x78, 0x79,                # xy
    0x6c, 0x7a, 0x6d, 0x61,   # lzma
    0x4b                       # K
])

# Decrypt with repeating XOR
flag = bytes([encrypted[i] ^ key[i % len(key)] for i in range(len(encrypted))])
print(flag.decode())  # tjctf{REDACTED}

Verification

The flag in leet speak reads "obscure crusher: icns, ttf, lzma" — confirming the three file format identifiers are indeed the "3 keys" referenced in the challenge description.