Challenge Description

Sometimes it's not what it seems!

Flag format UNBR{}

Flag proof

UNBR{Nicee_u_know_sum_py_trickz}

Summary

The .exe file is just python compiled code that can be first uncompressed with "pyinstxtractor.py", then after fixing the magic byte of src.pyc , can be decompiled with "uncompyle6". The resulted python code can be easily reversed to give the flag.

Details

After running “strings” on the given .exe, we find a lot of python related info.

Therefore we proceed to extract the exe content like this (https://github.com/extremecoders-re/pyinstxtractor):

http://thefewchosen.com:8080/pad/uploads/9ff1c5011632de376854b762b.png

Now let’s try to decompile src.pyc:

http://thefewchosen.com:8080/pad/uploads/9ff1c5011632de376854b762e.png

We get an error due to the wrong magic bytes of .pyc (I found that after a search on Google for the error).

After searching online for the needed magic bytes/numbers, we find that we need to use “42” as the 1st byte (it was set to 61):

http://thefewchosen.com:8080/pad/uploads/9ff1c5011632de376854b762d.png

Then we can successfully decompile: