Simple Reverse - 0x14(2023 Lab - AssemblyDev)

Posted on | Post modified | In |

Simple Reverse - 0x14(2023 Lab - AssemblyDev)

Background

Tools Assembly x86 Emulator Compiler Explorer

Source code

:::spoiler arithmatic.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
#!/usr/bin/python
from module.checker import *
from module.math import *
from sys import argv

challenge_info = f'''
let a = MEM[RSP+0x0:RSP+0x4]
let b = MEM[RSP+0x4:RSP+0x8]
let c = MEM[RSP+0x8:RSP+0xc]

EAX = a + b
EBX = a - b
ECX = -c
EDX = 9*a + 7
'''

a = get_rand(4)
b = get_rand(4)
c = get_rand(4)

init_list = [
    (RSP_DEFAULT + 0x0, a, 4),
    (RSP_DEFAULT + 0x4, b, 4),
    (RSP_DEFAULT + 0x8, c, 4),
]
ans_list = [
    ("eax", add(a, b, 4)),
    ("ebx", sub(a, b, 4)),
    ("ecx", neg(c, 4)),
    ("edx", add(mul(a, 9, 4), 7, 4)),
]

if __name__ == "__main__":
    if len(argv) < 2:
        print(f"{C.BLUE}[+]{C.NC} Usage: python3 {__file__} <path_to_asm_file>")
        print(challenge_info)
        exit(0)

    code = open(argv[1], 'r').read()
    Checker(init_list, ans_list, code)

::: :::spoiler data_movement.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
#!/usr/bin/python
from module.checker import *
from module.math import *
from sys import argv

challenge_info = f'''
{C.BLUE}# Modify register value{C.NC}
RAX += 0x87
RBX -= 0x63
RCX, RDX = RDX, RCX

{C.BLUE}# Modify memory value{C.NC}
MEM[RSP+0x0:RSP+0x4] += 0xdeadbeef
MEM[RSP+0x4:RSP+0x8] -= 0xfaceb00c
MEM[RSP+0x8:RSP+0xc], MEM[RSP+0xc:RSP+0x10] = MEM[RSP+0xc:RSP+0x10], MEM[RSP+0x8:RSP+0xc]
'''

_rax = get_rand()
_rbx = get_rand()
_rcx = get_rand()
_rdx = get_rand()
mem = list()
for i in range(4):
    mem.append(get_rand(4))

init_list = [
    ("rax", _rax),
    ("rbx", _rbx),
    ("rcx", _rcx),
    ("rdx", _rdx),
    (RSP_DEFAULT + 0x0, mem[0], 4),
    (RSP_DEFAULT + 0x4, mem[1], 4),
    (RSP_DEFAULT + 0x8, mem[2], 4),
    (RSP_DEFAULT + 0xc, mem[3], 4),
]
ans_list = [
    ("rax", add(_rax, 0x87)),
    ("rbx", sub(_rbx, 0x63)),
    ("rcx", _rdx),
    ("rdx", _rcx),
    (RSP_DEFAULT + 0x0, add(mem[0], 0xdeadbeef, 4), 4),
    (RSP_DEFAULT + 0x4, sub(mem[1], 0xfaceb00c, 4), 4),
    (RSP_DEFAULT + 0x8, mem[3], 4),
    (RSP_DEFAULT + 0xc, mem[2], 4),
]

if __name__ == "__main__":
    if len(argv) < 2:
        print(f"{C.BLUE}[+]{C.NC} Usage: python3 {__file__} <path_to_asm_file>")
        print(challenge_info)
        exit(0)

    code = open(argv[1], 'r').read()
    Checker(init_list, ans_list, code)

::: :::spoiler condition.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
#!/usr/bin/python
from module.checker import *
from module.math import *
from sys import argv

challenge_info = f'''
let a = MEM[RSP+0x0:RSP+0x4]
let b = MEM[RSP+0x4:RSP+0x8]
let c = MEM[RSP+0x8:RSP+0xc]
let d = MEM[RSP+0xc:RSP+0x10]

{C.BLUE}# a, b -> signed 4 btyes integer{C.NC}
if a >= b:
    EAX = a
else:
    EAX = b

{C.BLUE}# c, d -> unsigned 4 btyes integer{C.NC}
if c < d:
    EBX = c
else:
    EBX = d

if c is an odd number:
    ECX = c // 8
else:
    ECX = c * 4
'''

a = get_rand(4)
b = get_rand(4)
c = get_rand(4)
d = get_rand(4)


init_list = [
    (RSP_DEFAULT + 0x0, a, 4),
    (RSP_DEFAULT + 0x4, b, 4),
    (RSP_DEFAULT + 0x8, c, 4),
    (RSP_DEFAULT + 0xc, d, 4),
]

a = u2signed(a, 4)
b = u2signed(b, 4)
_eax = (a if a >= b else b) & mask(4)
_ebx = (c if c < d else d) & mask(4)
_ecx = div(c, 8, 4) if is_odd(c) else mul(c, 4, 4)

ans_list = [
    ("eax", _eax),
    ("ebx", _ebx),
    ("ecx", _ecx),
]

if __name__ == "__main__":
    if len(argv) < 2:
        print(f"{C.BLUE}[+]{C.NC} Usage: python3 {__file__} <path_to_asm_file>")
        print(challenge_info)
        exit(0)

    code = open(argv[1], 'r').read()
    Checker(init_list, ans_list, code)

:::

Recon

這一題有三小題，包含arithmatic.py, data_movement.py, 以及condition.py，過關的條件是要自己寫assembly然後達帶這三個關卡的register或stack條件，我是直接用compiler explorer幫我把c code直接轉assembly然後再利用assembly x86 emulator做double check，速度應該會快很多

Exploit

  • 題目一: 就是一般的運算(+-*/) 
    1
    2
    3
    4
    5
    6
    7
    8
    		 
      let a = MEM[RSP+0x0:RSP+0x4]
  let b = MEM[RSP+0x4:RSP+0x8]
  let c = MEM[RSP+0x8:RSP+0xc]

  EAX = a + b
  EBX = a - b
  ECX = -c
  EDX = 9*a + 7

    :::spoiler Solution

      mov r8d, dword [rsp] ; 
  mov r9d, dword [rsp + 4] ; 
  mov r10d, dword [rsp + 8] ;

  ; EAX = a + b
  mov eax, r8d
  add eax, r9d

  ; EBX = a - b
  mov ecx, r8d
  sub ecx, r9d
  mov ebx, ecx

  ; ECX = -c
  mov ecx, r10d
  neg ecx

  ; EDX = 9 * a + 7
  mov edx, DWORD [rsp]
  sal edx, 3
  add edx, DWORD [rsp]
  add edx, 7

    :::

  • 題目二: 這邊是考register和stack之間的搬運和運算 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    		 
      # Modify register value
  RAX += 0x87
  RBX -= 0x63
  RCX, RDX = RDX, RCX

  {C.BLUE}# Modify memory value
  MEM[RSP+0x0:RSP+0x4] += 0xdeadbeef
  MEM[RSP+0x4:RSP+0x8] -= 0xfaceb00c
  MEM[RSP+0x8:RSP+0xc], MEM[RSP+0xc:RSP+0x10] = MEM[RSP+0xc:RSP+0x10], MEM[RSP+0x8:RSP+0xc]

    :::spoiler Solution

      ; Modify register value
  add rax, 0x87
  sub rbx, 0x63
  mov r8, rcx
  mov rcx, rdx
  mov rdx, r8

  ; MEM[RSP+0x0:RSP+0x4] += 0xdeadbeef
  mov r8d, dword [rsp]
  add r8d, 0xdeadbeef
  mov dword [rsp], r8d

  ; MEM[RSP+0x4:RSP+0x8] -= 0xfaceb00c
  mov r8d, dword [rsp+4]
  sub r8d, 0xfaceb00c
  mov dword [rsp+4], r8d

  ; MEM[RSP+0x8:RSP+0xc], MEM[RSP+0xc:RSP+0x10] = MEM[RSP+0xc:RSP+0x10], MEM[RSP+0x8:RSP+0xc]
  mov r8d, dword [rsp+8]
  mov r9d, dword [rsp+0xc]
  mov dword [rsp+8], r9d
  mov dword [rsp+0xc], r8d

    :::

  • 題目三: 需要考慮condition，然後看要跳轉到哪邊，重點是jump有分signed和unsigned，而仔細看source code他只有考慮unsinged，所以我們要特別挑選jump的類別 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    		 
      let a = MEM[RSP+0x0:RSP+0x4]
  let b = MEM[RSP+0x4:RSP+0x8]
  let c = MEM[RSP+0x8:RSP+0xc]
  let d = MEM[RSP+0xc:RSP+0x10]

  # a, b -> signed 4 btyes integer
  if a >= b:
      EAX = a
  else:
      EAX = b

  # c, d -> unsigned 4 btyes integer{C.NC}
  if c < d:
      EBX = c
  else:
      EBX = d

  if c is an odd number:
      ECX = c // 8
  else:
      ECX = c * 4

    :::spoiler Solution

      ; if a >= b:
  ;     EAX = a
  ; else:
  ;     EAX = b
      mov     eax, DWORD [rsp]
      cmp     eax, DWORD [rsp+4]
      jl      L2
      mov     eax, DWORD [rsp]
      jmp     L3
  L2:
      mov     eax, DWORD [rsp+4]


  ; if c < d:
  ;     EBX = c
  ; else:
  ;     EBX = d
  L3:
      mov     edi, DWORD [esp+0x8]
      mov 	esi, DWORD [esp+0xc]
      cmp     edi, esi
      jae     L4
      mov     ebx, DWORD [esp+0x8]
      jmp     L5
  L4:
      mov     ebx, DWORD [esp+0xc]


  ; if c is an odd number:
  ;     ECX = c // 8
  ; else:
  ;     ECX = c * 4
  L5:
      mov     edi, DWORD [esp+0x8]
      and     edi, 1
      cmp     edi, 1
      jne     L6
      mov     ecx, dword [esp+0x8]
      sar     ecx, 3
      jmp     L7
  L6:
      mov     ecx, dword [esp+0x8]
      sal     ecx, 2

  L7:

    :::

1
2
 
$ (cat arithmatic.asm | base64 -w0 ; echo '' ; cat data_movement.asm | base64 -w0 ; echo '' ; cat condition.asm | base64 -w0 ; echo '') > answer.txt
$ cat answer.txt | nc edu-ctf.zoolab.org 10020

:::spoiler 完整的輸出結果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
 
cat answer.txt | nc edu-ctf.zoolab.org 10020

──── Challenge Info ──────────────────────────────────────────────

let a = MEM[RSP+0x0:RSP+0x4]
let b = MEM[RSP+0x4:RSP+0x8]
let c = MEM[RSP+0x8:RSP+0xc]

EAX = a + b
EBX = a - b
ECX = -c
EDX = 9*a + 7

Give me your base64 of your assembly code!
>
──── Your Assembly ───────────────────────────────────────────────
mov r8d, dword [rsp] ;
mov r9d, dword [rsp + 4] ;
mov r10d, dword [rsp + 8] ;

; EAX = a + b
mov eax, r8d
add eax, r9d

; EBX = a - b
mov ecx, r8d
sub ecx, r9d
mov ebx, ecx

; ECX = -c
mov ecx, r10d
neg ecx

; EDX = 9 * a + 7
mov edx, DWORD [rsp]
sal edx, 3
add edx, DWORD [rsp]
add edx, 7

([68, 139, 4, 36, 68, 139, 76, 36, 4, 68, 139, 84, 36, 8, 68, 137, 192, 68, 1, 200, 68, 137, 193, 68, 41, 201, 137, 203, 68, 137, 209, 247, 217, 139, 20, 36, 193, 226, 3, 3, 20, 36, 131, 194, 7], 44)
[ Initial Context ]

──── register ────────────────────────────────────────────────────
$rax: 0x0000000000000000
$rbx: 0x0000000000000000
$rcx: 0x0000000000000000
$rdx: 0x0000000000000000
$rdi: 0x0000000000000000
$rsi: 0x0000000000000000
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0x3ad14697f68546bc     ← $rsp
0x7100008|+0x0008: 0x00000000aa428281
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

[ Final Context ]

──── register ────────────────────────────────────────────────────
$rax: 0x0000000031568d53
$rbx: 0x00000000bbb40025
$rcx: 0x0000000055bd7d7f
$rdx: 0x00000000aaaf7ca3
$rdi: 0x0000000000000000
$rsi: 0x0000000000000000
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0x3ad14697f68546bc     ← $rsp
0x7100008|+0x0008: 0x00000000aa428281
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

──── Result ──────────────────────────────────────────────────────
[O] $eax = 0x31568d53
[O] $ebx = 0xbbb40025
[O] $ecx = 0x55bd7d7f
[O] $edx = 0xaaaf7ca3
[+] CORRECT :)

──── Challenge Info ──────────────────────────────────────────────

# Modify register value
RAX += 0x87
RBX -= 0x63
RCX, RDX = RDX, RCX

# Modify memory value
MEM[RSP+0x0:RSP+0x4] += 0xdeadbeef
MEM[RSP+0x4:RSP+0x8] -= 0xfaceb00c
MEM[RSP+0x8:RSP+0xc], MEM[RSP+0xc:RSP+0x10] = MEM[RSP+0xc:RSP+0x10], MEM[RSP+0x8:RSP+0xc]

Give me your base64 of your assembly code!
>
──── Your Assembly ───────────────────────────────────────────────
; Modify register value
add rax, 0x87
sub rbx, 0x63
mov r8, rcx
mov rcx, rdx
mov rdx, r8



; MEM[RSP+0x0:RSP+0x4] += 0xdeadbeef
mov r8d, dword [rsp]
add r8d, 0xdeadbeef
mov dword [rsp], r8d

; MEM[RSP+0x4:RSP+0x8] -= 0xfaceb00c
mov r8d, dword [rsp+4]
sub r8d, 0xfaceb00c
mov dword [rsp+4], r8d

; MEM[RSP+0x8:RSP+0xc], MEM[RSP+0xc:RSP+0x10] = MEM[RSP+0xc:RSP+0x10], MEM[RSP+0x8:RSP+0xc]
mov r8d, dword [rsp+8]
mov r9d, dword [rsp+0xc]
mov dword [rsp+8], r9d
mov dword [rsp+0xc], r8d
([72, 5, 135, 0, 0, 0, 72, 131, 235, 99, 73, 137, 200, 72, 137, 209, 76, 137, 194, 68, 139, 4, 36, 65, 129, 192, 239, 190, 173, 222, 68, 137, 4, 36, 68, 139, 68, 36, 4, 65, 129, 232, 12, 176, 206, 250, 68, 137, 68, 36, 4, 68, 139, 68, 36, 8, 68, 139, 76, 36, 12, 68, 137, 76, 36, 8, 68, 137, 68, 36, 12], 47)
[ Initial Context ]

──── register ────────────────────────────────────────────────────
$rax: 0xd9efd9c16a5bc322
$rbx: 0xb9cf8db36cbfc14a
$rcx: 0x938ee6ed0bf25e63
$rdx: 0xead92779318623a4
$rdi: 0x0000000000000000
$rsi: 0x0000000000000000
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0xfc969827aea7be89     ← $rsp
0x7100008|+0x0008: 0x6482df8494b54caf
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

[ Final Context ]

──── register ────────────────────────────────────────────────────
$rax: 0xd9efd9c16a5bc3a9
$rbx: 0xb9cf8db36cbfc0e7
$rcx: 0xead92779318623a4
$rdx: 0x938ee6ed0bf25e63
$rdi: 0x0000000000000000
$rsi: 0x0000000000000000
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0x01c7e81b8d557d78     ← $rsp
0x7100008|+0x0008: 0x94b54caf6482df84
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

──── Result ──────────────────────────────────────────────────────
[O] $rax = 0xd9efd9c16a5bc3a9
[O] $rbx = 0xb9cf8db36cbfc0e7
[O] $rcx = 0xead92779318623a4
[O] $rdx = 0x938ee6ed0bf25e63
[O] [0x077100000] = 0x8d557d78
[O] [0x077100004] = 0x1c7e81b
[O] [0x077100008] = 0x6482df84
[O] [0x07710000c] = 0x94b54caf
[+] CORRECT :)

──── Challenge Info ──────────────────────────────────────────────

let a = MEM[RSP+0x0:RSP+0x4]
let b = MEM[RSP+0x4:RSP+0x8]
let c = MEM[RSP+0x8:RSP+0xc]
let d = MEM[RSP+0xc:RSP+0x10]

# a, b -> signed 4 btyes integer
if a >= b:
    EAX = a
else:
    EAX = b

# c, d -> unsigned 4 btyes integer
if c < d:
    EBX = c
else:
    EBX = d

if c is an odd number:
    ECX = c // 8
else:
    ECX = c * 4

Give me your base64 of your assembly code!
>
──── Your Assembly ───────────────────────────────────────────────
; if a >= b:
;     EAX = a
; else:
;     EAX = b
    mov     eax, DWORD [rsp]
    cmp     eax, DWORD [rsp+4]
    jl      L2
    mov     eax, DWORD [rsp]
    jmp     L3
L2:
    mov     eax, DWORD [rsp+4]


; if c < d:
;     EBX = c
; else:
;     EBX = d
L3:
        mov     edi, DWORD [esp+0x8]
        mov     esi, DWORD [esp+0xc]
    cmp     edi, esi
    jae     L4
    mov     ebx, DWORD [esp+0x8]
    jmp     L5
L4:
    mov     ebx, DWORD [esp+0xc]


; if c is an odd number:
;     ECX = c // 8
; else:
;     ECX = c * 4
L5:
        mov     edi, DWORD [esp+0x8]
        and     edi, 1
        cmp     edi, 1
        jne     L6
        mov     ecx, dword [esp+0x8]
        sar     ecx, 3
        jmp     L7
L6:
        mov     ecx, dword [esp+0x8]
        sal     ecx, 2

L7:
([139, 4, 36, 59, 68, 36, 4, 124, 5, 139, 4, 36, 235, 4, 139, 68, 36, 4, 103, 139, 124, 36, 8, 103, 139, 116, 36, 12, 57, 247, 115, 7, 103, 139, 92, 36, 8, 235, 5, 103, 139, 92, 36, 12, 103, 139, 124, 36, 8, 131, 231, 1, 131, 255, 1, 117, 10, 103, 139, 76, 36, 8, 193, 249, 3, 235, 8, 103, 139, 76, 36, 8, 193, 225, 2], 89)
[ Initial Context ]

──── register ────────────────────────────────────────────────────
$rax: 0x0000000000000000
$rbx: 0x0000000000000000
$rcx: 0x0000000000000000
$rdx: 0x0000000000000000
$rdi: 0x0000000000000000
$rsi: 0x0000000000000000
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0x21bd1f6bf4090a3a     ← $rsp
0x7100008|+0x0008: 0xfd382fd2ccd74eca
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

[ Final Context ]

──── register ────────────────────────────────────────────────────
$rax: 0x0000000021bd1f6b
$rbx: 0x00000000ccd74eca
$rcx: 0x00000000335d3b28
$rdx: 0x0000000000000000
$rdi: 0x0000000000000000
$rsi: 0x00000000fd382fd2
$rbp: 0x0000000000000000
$rsp: 0x0000000007100000

──── stack ───────────────────────────────────────────────────────
0x7100000|+0x0000: 0x21bd1f6bf4090a3a     ← $rsp
0x7100008|+0x0008: 0xfd382fd2ccd74eca
0x7100010|+0x0010: 0x0000000000000000
0x7100018|+0x0018: 0x0000000000000000
0x7100020|+0x0020: 0x0000000000000000
0x7100028|+0x0028: 0x0000000000000000
0x7100030|+0x0030: 0x0000000000000000
0x7100038|+0x0038: 0x0000000000000000

──── Result ──────────────────────────────────────────────────────
[O] $eax = 0x21bd1f6b
[O] $ebx = 0xccd74eca
[O] $ecx = 0x335d3b28
[+] CORRECT :)

──── Your Flag ───────────────────────────────────────────────────
Congrats! You passed all challenges! Here is your flag:  FLAG{c0d1Ng_1n_a5s3mB1y_i5_sO_fun!}

:::

Flag: FLAG{c0d1Ng_1n_a5s3mB1y_i5_sO_fun!}