void __attribute__()

in reversing/SOMBRERO_ROJO/ctf_main/main.c [207:301]

• 80 lines of code
• 10 McCabe index (conditional complexity)

void __attribute__ ((constructor)) premain()
{
	#ifdef DEBUG
		char b64_flag_enc[] = "\xa9\x90\x83\xb9\xa9\xc8\x88\xc8\x9a\xbf\xaa\xc8\xa3\xca\x98\xcb\x98\xc9\xcf\xc8\xa3\xca\xb6\x8c\xa3\xcb\x9c\xcb\xae\x96\xa9\xc2";
		int b64_flag_enc_size = 32;
		char b64_flag_dec[] = "\x9d\x99\x80\xcc\x93\xcf\xcc\xa4\xac\xcf\x88\x95\xcc\xa4\xa8\xcb\xa4\xb3\xcf\xa9\x9f\x86";
		int b64_flag_dec_size = 22;

		pretty_print_bytes(b64_flag_enc, b64_flag_enc_size );
		printf("%s\n",b64_flag_enc );
		pretty_print_bytes(b64_flag_dec, b64_flag_dec_size );
		printf("%s\n",b64_flag_dec );

	#else
		char b64_flag_enc[] = "\xa9\x90\x83\xb9\xa9\xc8\x88\xc8\x9a\xbf\xaa\xc8\xa3\xca\x98\xcb\x98\xc9\xcf\xc8\xa3\xca\xb6\x8c\xa3\xcb\x9c\xcb\xae\x96\xa9\xc2";
		int b64_flag_enc_size = 32;
		char b64_flag_dec[] = "\x9d\x99\x80\xcc\x93\xcf\xcc\xa4\xac\xcf\x88\x95\xcc\xa4\xa8\xcb\xa4\xb3\xcf\xa9\x9f\x86";
		int b64_flag_dec_size = 22;
	#endif

	unsigned char *tkek;
	char dec_buffer_ascii[256];
	char *mypath;
	// Checking for a debugger
	if (ptrace(PTRACE_TRACEME, 0, 1, 0) != -1) 
	{
		char file[] = "\xd4\x8f\x96\x8b\xd4\x90\x9e\x82\xd5\x99\x92\x95"; // XOR key is 0xfb - /tmp/key.bin
		int counter = 0;
		while (counter < strlen(file))
		{
			file[counter] = file[counter] ^ 0xfb;
			counter++;
		}
		if( access( file, F_OK ) != -1 ) {
			// Format of key file:
			// 0x00: 0xFB - Facebook :)
			// 0x01: Length of key
			// 0x02: Decryption Key
			FILE *fp;
			char buff[255];
			fp = fopen(file, "r");
			fgets(buff, 255, (FILE*)fp);
			fclose(fp);
			if (buff[0] == 0xfffffffb) {
				if (buff[2] == 0xffffff95) {
					if (buff[3] == 0x17) {
						if (buff[4] == 0xffffff90) {
							if (buff[5] == 0xfffffff4) {
								char key[5];
								key[0] = buff[5];
								key[1] = buff[4];
								key[2] = buff[3];
								key[3] = buff[2];
								char encrypted[255] = "\xa6\xfb\x6f\xd7\xa6\xa3\x64\xa6\x95\xd4\x46\xa6\xac\xa1\x74\xa5\x97\xa2\x23\xa6\xac\xa1\x5a\xe2\xac\xa0\x70\xa5\xa1\xfd\x45\xac\xfe"; 
								// XOR Key: 0x4f 0x90 0x17 0x95
								char *s = encrypted;
								size_t length = strlen(key), i = 0;
								while (*s) {
									*s++ ^= key[i++ % length];						
								}	
								
								#ifdef DEBUG
									printf("\nDebug no questions asked\n");
									pretty_print_bytes(s, strlen(s));
									pretty_print_bytes(encrypted, 32);
									printf("\n");
									fb_decode(b64_flag_dec,b64_flag_dec_size );
								#else
									fb_decode(b64_flag_dec,b64_flag_dec_size );
									printf(b64_flag_dec);

									char nex_chall [] = "\xa9\x9e\x9a\x9f\x82\xdb\x9d\x94\x89\xdb\x8f\x93\x9e\xdb\x95\x9e\x83\x8f\xdb\x98\x93\x9a\x97\x97\x9e\x95\x9c\x9e\xc4\xd5\xd5\xd5\xdb\x8b\x89\x9e\x88\x88\xdb\x9e\x95\x8f\x9e\x89\00";
									int nex_chall_size = 44;
									fb_decode(nex_chall, nex_chall_size);
									printf("\n");
									printf("%s", nex_chall);
									gets();
								#endif

								fb_decode(b64_flag_enc,b64_flag_enc_size );
								tkek = gen_kek_key(b64_flag_enc, b64_flag_dec);
								mypath = where_ami();
								get_appended(mypath, tkek);
								exit(0);
							}
						}
					}
				}

			}


		}
	}
}