See No Evil - Part 5

ringzer0ctf

Task: reverse the final part of a 5-level PE32+ anti-debug series where Part 5's DES magic is computed at runtime via a parent/child self-debugging trick over a named pipe. Solution: reason about the DebugActiveProcess branch to pick the correct of two movabs magics (0xd38b557a224ffedc), derive DES key = MD5(magic)[:8], and DES-ECB decrypt the level-5 blob statically.