Www Kkmoom Com Pc Rar Updated | Direct |

# 2. Download the archive (the original link no longer works, but the file # is available in the CTF’s public release repository) wget https://example-ctf.org/files/kkmoom_pc.rar -O pc.rar

dd if=payload.bin bs=1 skip=$((0x00406000-0x400000)) count=0x100 \ of=encrypted.bin dd if=payload.bin bs=1 skip=$((0x00407000-0x400000)) count=0x0C \ of=key.bin #!/usr/bin/env python3 enc = open('encrypted.bin','rb').read() key = open('key.bin','rb').read() out = bytes([enc[i] ^ key[i % len(key)] for i in range(len(enc))]) print(out.decode()) Running the script prints: www kkmoom com pc rar

def decompress(src): src = memoryview(src) dst = bytearray() i = 0 while i < len(src): flags = src[i]; i += 1 for b in range(8): if flags & (1 << b): # literal dst.append(src[i]); i += 1 else: # back‑reference lo = src[i]; hi = src[i+1]; i += 2 offset = ((hi & 0xF0) << 4) | lo length = (hi & 0x0F) + 3 for _ in range(length): dst.append(dst[-offset]) if i >= len(src): break return bytes(dst) 'rb').read() key = open('key.bin'

def get_rva_to_offset(pe_path, rva): # Use pefile to translate import pefile pe = pefile.PE(pe_path) return pe.get_offset_from_rva(rva) len(src): flags = src[i]

#!/usr/bin/env python3 import sys

r2 -A pc.exe [0x00401000]> s entry0 [0x00401000]> pd 30 The first 30 instructions look like this (pseudo‑assembly):

# Convert RVA to file offset (using PE headers) r2 -qc "ie 0x403000" pc.exe # → 0x00120000 (example)