ch1se
  • Home
  • CERTIFICATES AND PARTICIPATIONS
    • HackTheBox - Cyber Apocalypse CTF 2025: Tales from Eldoria
    • The SecOps Group
  • bitsctf-2025-writeups
    • HotPause
  • BRONCOCTF-2025-WRITEUPS
    • theflagishere!
  • ACECTF-2025-WRITEUPS
    • The Mysterious Building
    • Social Circles
    • Broken Secrets
    • Cryptic Pixels
    • Tabs&Spaces
  • PEARLCTF-2025-WRITEUPS
    • Hidden Marker
    • SentMail
    • Van Gogh's GARBAGE hunt
  • 1753CTF-2025-WRITEUPS
    • Dude where is my car
    • Happy New Year!
    • Somewhere in Space
  • CITCTF-2025-WRITEUPS
    • Timesink
    • Throwback to the Future
    • No Country for Old Keys
  • BYUCTF-2025
    • Universal-ty
  • OSINT-WRITEUPS
    • gralhix
Powered by GitBook
On this page
  • Introduction
  • Steps
  • Step 1: Decompiling the .pyc file
  • Step 2: Identifying Issues in the Code
  • Step 3: Extracting the Flag
  1. BRONCOCTF-2025-WRITEUPS

theflagishere!

CATEGORY - REVERSING

PreviousHotPauseNextThe Mysterious Building

Last updated 3 months ago

Introduction

In this reversing challenge, I was given a Python compiled .pyc file. The description hinted that the program was supposed to determine the flag, but it didn't explicitly display it. My task was to reverse-engineer the file and extract the correct flag.

Steps

Step 1: Decompiling the .pyc file

Step 2: Identifying Issues in the Code

After analyzing the decompiled code, I noticed a few issues:

  • The what_do_i_do function contained a return inside a loop that would never execute properly.

  • There were several unnecessary function calls that seemed misleading.

  • Some of the flag extraction logic seemed obfuscated but could be simplified

I corrected the function:

def what_do_i_do(whoKnows):
    a_st = {}
    for a in whoKnows:
        if a not in a_st:
            a_st[a] = 1
        else:
            a_st[a] += 1

    variable_name = 0
    not_a_variable_name = None
    for a in a_st:
        if a_st[a] > variable_name:
            not_a_variable_name = a
            variable_name = a_st[a]

    return (not_a_variable_name, variable_name)

Step 3: Extracting the Flag

After fixing the logic, I reconstructed the flag by calling the appropriate functions in sequence:

# Construct the flag
flag = (
    char_0() + char_1_4_6() + char_2_5_9() + char_3() +
    char_1_4_6() + char_2_5_9() + char_1_4_6() + char_7() +
    char_8() + char_2_5_9() + char_10()
)

print("Extracted flag: bronco{" + flag + "}")

Running the script printed the final flag:

flag: bronco{i_am_a_flag}

That’s how I solved this challenge. Thanks for reading!

Since a .pyc file is a compiled Python file, I needed to decompile it back to readable Python code. To do this, I used an online tool: . I uploaded the .pyc file, and it provided me with the following Python script:

lddgo.net Python Decompiler