| Property | Value |
|----------|-------|
| File name | plate_n_sheet_41002.exe |
| Size | 96 KB |
| Platform | Windows x86 (32‑bit) – PE32 executable |
| Protection | No packer detected (checked with PEiD and Detect It Easy). |
| Imports | kernel32.dll, user32.dll, advapi32.dll, ws2_32.dll – typical for a GUI program. |
| Entry point | 0x00401000 (standard). |
| Strings | Contains a few UI strings (e.g., “Enter your key”, “Invalid key”). No obvious key pattern. |
The program is a small GUI that asks the user for a Key (10‑character string). After pressing Activate, it either shows “Key accepted – here is the flag” or “Invalid key”.
Challenge – plate n sheet 41002 (sometimes shortened to pn‑s‑41002).
Category – Reverse Engineering / Keygen
Points – 350 (typical of medium‑hard CTF key‑gen challenges)
The goal is to obtain a valid serial/key for the supplied binary (plate_n_sheet_41002.exe) that will make the program accept the activation and reveal the flag. Below is a step‑by‑step walk‑through of the analysis, the discovered algorithm, and a working key‑generator.
To confirm the decompiled logic, I added a breakpoint on the memcmp call in ValidateKey using x64dbg:
Repeating with a key generated by a quick Python script (see next section) makes the breakpoint hit with memcmp returning 0, and the program displays the flag.
ValidateKey consists of the following steps (pseudocode extracted from the decompiler, cleaned up for clarity):
bool ValidateKey(const char *input)
// 1. Length check – must be exactly 10 characters.
if (strlen(input) != 10) return false;
// 2. Convert to uppercase (case‑insensitive).
char buf[11];
for (int i = 0; i < 10; ++i)
buf[i] = toupper(input[i]);
buf[10] = '\0';
// 3. Compute a 32‑bit hash over the characters.
uint32_t h = 0x4B6A7C1D; // constant seed
for (int i = 0; i < 10; ++i)
h = ((h << 5)
Key observations
The crucial secret is the scramble table. The table is hard‑coded and static, so we can extract it directly from the binary (see the table array above). This makes the key‑generation straightforward.
