Daddy-Long-Arms

spbctf

Task: AArch64 Tigress-obfuscated ELF that XOR-decrypts a flag with a user-supplied key, but hides a backdoor lucky branch gated behind six fixed rand() return values. Solution: run the binary natively on Apple-Silicon arm64 in Docker and LD_PRELOAD a shim that makes rand() emit the magic sequence, forcing the lucky branch to decrypt the flag with the embedded correct key.