چالش Vault 2¶

$ file challenge1
challenge1: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d15aa18d88517442ed4cf7a958d61093c455c645, for GNU/Linux 3.2.0, not stripped

__int64 __fastcall mysteryFunction(__int64 a1)
{
  __int64 result;
  int i;

  for ( i = 0; ; ++i )
  {
    result = *(unsigned __int8 *)(i + a1);
    if ( !(_BYTE)result )
      break;
    *(_BYTE *)(i + a1) ^= (unsigned __int8)(i % 5) + 1;
  }
  return result;
}

_BOOL8 __fastcall checkFlag(const char *a1)
{
  char dest[128];
  char s2[32];
  qmemcpy(s2, "hawb~w6q5dcn0[n2", 16);
  *(_QWORD *)&s2[15] = 0x7F73357C5C7B32LL;
  strncpy(dest, a1, 0x80uLL);
  mysteryFunction((__int64)dest);
  return strncmp(dest, s2, 0x17uLL) == 0;
}


int __fastcall main(int argc, const char **argv, const char **envp)
{
  char v4[128];
  puts("Enter the flag:");
  if ( (unsigned int)__isoc99_scanf("%127s", v4) )
  {
    if ( checkFlag(v4) )
      puts("Congratulations! You've solved the challenge.");
    else
      puts("Incorrect flag. Try again!");
  }
  return 0;
}

uint64_t checkFlag(char* arg1)
{
    int64_t var_28;
    __builtin_strcpy(&var_28, "hawb~w6q5dcn0[n2{\\|5s\x7f");
    void var_a8;
    strncpy(&var_a8, arg1, 0x80);
    mysteryFunction(&var_a8);
    int32_t rax;
    rax = strncmp(&var_a8, &var_28, 0x17) == 0;
    return rax;
}

#s = b"hawb~w6q5dcn0[n" + bytes.fromhex('7F73357C5C7B32')[::-1]
s = b"hawb~w6q5dcn0[n2{\\|5s\x7f"
for i, c in enumerate(s):
    print(chr(c^(i%5+1) ), end='')