forensicsfreeeasy

Obscure Crusher 1

tjctf

Task: 169-byte binary file containing three embedded file format identifiers (icns, ttf, lzma) and XOR-encrypted flag data. Solution: known-plaintext XOR attack using flag prefix to recover 16-byte key constructed from the file's non-zero header bytes.

$ ls tags/ techniques/
known_plaintext_attacklzmaxor_encryptionfile_format_analysiscustom_binary_formaticnsttf
xor_known_plaintext_attackbinary_structure_analysiskey_reconstruction_from_headerfile_format_identifier_recognition

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Obscure Crusher 1 — TJCTF 2026

Description

What if I make it so you need 3 keys to unlock the flag...

A 169-byte binary file (chall.bin) is provided. The file command identifies it as "Mac OS X icon (icns)" but the file is actually a custom binary container embedding three file format identifiers as the "3 keys" to decrypt the flag.

Analysis

File Structure

Hex dump analysis reveals the binary has a carefully crafted structure:

OffsetContentPurpose
0-7icns magic + size field (256)File format identifier #1
8-76Second icns marker + zero padding with 0x01 bytesPadding/structure
77-88name field with ttf and xy valuesFile format identifier #2
89-108Zero paddingSeparator
109-128LZMA properties (\x5d\x00\x00\x80\x00) + lzma label + KLZMA_DATA: markerFile format identifier #3
129-16436 bytes of XOR-encrypted flag dataEncrypted flag
165-168Trailing zerosPadding

Key Discovery via Known-Plaintext Attack

The XOR encryption key was recovered using the known flag prefix tjctf{:

  1. XOR the first 6 encrypted bytes (at offset 129) with tjctf{
  2. The resulting bytes are: i, c, n, s, \x01, t
  3. These match the beginning of the file's non-zero content sequence: icns...ttf...lzma...
  4. The full 16-byte repeating key is the concatenation of the three format identifiers with their structural separator bytes

XOR Key

Key (hex): 69 63 6e 73 01 74 74 66 02 78 79 6c 7a 6d 61 4b
Key (ascii): icns\x01ttf\x02xylzmaK

...

$ grep --similar

Similar writeups