Baby Rev

fortid2026

Task: a Python 3.10 .pyc validates a FortID{...} flag via a length-preserving T9 keypad transform and a SHA-256 gate. Solution: identify the pyc magic, disassemble with marshal+dis, invert the reversed T9 touchtone string using a wordlist and the Nokia theme, and confirm against the SHA-256 digest.

sha256 t9 python_bytecode pyc marshal dis

sha256_oraclepyc_magic_identificationmarshal_disassemblyt9_keypad_inversionwordlist_t9_decode

$ ls tags/ techniques/

sha256 t9 python_bytecode pyc marshal dis

sha256_oraclepyc_magic_identificationmarshal_disassemblyt9_keypad_inversionwordlist_t9_decode

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Baby Rev — fortid2026

Description

A flirty "texting" chatbot prompt keeps asking you for the flag. You are given a single file chall.pyc.

English summary: a compiled Python bytecode file checks a submitted FortID{...} flag. We must reverse the validation logic, invert its transforms, and recover the unique flag that satisfies every check.

Analysis

1. Identify the bytecode version

The .pyc header starts with magic bytes 6f 0d 0d 0a. Little-endian 0x0d6f = 3439, which is the Python 3.10 (3.10b1) magic number used for all 3.10.x releases (confirmed against the python-xdis magics table). Loading the marshalled code object under any other interpreter raises bad marshal data, so a Python 3.10 interpreter is required.

2. Disassemble

For Python 3.7+ the code object begins after a 16-byte header:

import marshal, dis
data = open('chall.pyc', 'rb').read()
code = marshal.loads(data[16:])  # skip 16-byte header
dis.dis(code)

3. Validation logic recovered from the disassembly

user_input must have length 81.
Must startswith('FortID{') and endswith('}').
words = user_input[7:-1] strips the wrapper.
Split on _; each resulting word must be all lowercase ASCII letters OR all digits (two all(... in string.ascii_lowercase) / string.digits list comprehensions).
words = '-'.join(words.split('_')) — underscores become dashes.
Transform check: t9text.t9.get_touchtone(words)[::-1] == '33696-7383-3824-4-9465664238-36-32347-878267-8766-348-55487-74-0133-24566'
Final gate: sha256(user_input.encode('utf-8')).hexdigest() == '3576c495f89236515fbbfbfb519dceb9899122e92460d418d2ce37a1ff357e0c'

4. Understand the transform

t9text.get_touchtone maps each letter to its phone-keypad (T9) digit (a/b/c→2, d/e/f→3, …, w/x/y/z→9) and passes through digits and dashes unchanged. The mapping is length-preserving, so the length-81 constraint holds for any valid letter/digit choice — length alone does not narrow the answer.

Solution

Invert the touchtone

Reverse the target string to obtain the forward touchtone, then split on -:

66542-3310-47-78455-843-6678-762878-74323-63-8324665649-4-4283-3837-69633

This yields 14 groups.

Decode each group with T9 → letters

...