Windows API for the win!

ringzer0ctf

Task: MinGW PE32 crackme that builds a 6-byte XOR key from GetLastError() of deliberately misused Windows APIs, XORs the 6-char input, and compares it to a stored buffer before printing the flag. Solution: static disassembly shows ShowFlag XORs a .rdata table with the already-transformed buffer (which equals the stored expected bytes on success), so flag = table[j] XOR expected[j%6] is recovered fully offline without running on Windows.