rooted

The brief

my roommate changed the wifi password and replaced the login with a custom binary. she's a botany major who took one (1) programming and maths class each. she left a sticky note on the fridge saying "the answer is in the roots :)" with a little flower doodled next to it, and apparently left for a two-week field study on alpine moss. she is unreachable. typing this from a McRonald's, pls help

• rooted.tar.gz, 2.8 KB

In short

The wifi login is one 64-bit Linux program that wants a 35 character password. Each character is checked against the root of a quadratic whose coefficients sit in the binary as plain doubles, so the password can be solved instead of guessed.

A wifi login in 14,720 bytes

The handout is one 64-bit Linux program with two named functions, photosynthesize and water_plants. It takes the password as its only argument and wants exactly 35 characters, or it complains about the wrong number of petals.

A function that finds roots

photosynthesize takes a sum and a product and returns the root of the quadratic they define that lies between 0 and 127. For sum 222 and product 11,165 the roots are 77 and 145, so it returns 77.

35 equations in the data section

The read only data holds 35 such pairs as doubles, one per character, from address 0x2140. Position 1 stores 293 and 20,910 for a root of 123, position 2 stores 229 and 6,790 for 35. Nothing is hashed.

A four byte key, built from roots too

Before the compare, each input byte is XORed with a key byte. The key repeats every four positions, 55, 19, 66 and 85, and three of the four are again the smaller root of a quadratic stored in the binary.

Solved by algebra, not by guessing

So each character is the key byte XOR the root. 55 XOR 77 is 122, the letter z. All 35 positions give the password, and rooted accepts it as the wifi password. About a minute in all.

The insight

Every value the check compares against is a constant in the binary, so the password is the answer to 35 small equations, not a secret.

The flag

zhaw{ph0t0synth3s1z3_th1s_y0u_n3rd}