r2pipe solver script for https://0x00sec.org/t/reverseme-recursion/21802

rec_solve.py

import r2pipe
import struct

password = ""
fname = "rec_pwd.txt"
f = open(fname, 'w')

with open('rec_profile.rr2', 'w') as prof:
        prof.write('#!/usr/bin/rarun2\nstdin="%s"\n'%('A'*80))

r = r2pipe.open('rec_crackme',flags=['-2'])
r.cmd("e dbg.profile=rec_profile.rr2")

r.cmd("doo ; aaa")
r.cmd("db ?v main+380 ; dc")
r.cmd("db ?v rdx+0x5c")

while True:
	r.cmd("dc ; db-*")
	edi = int(r.cmd("dr edi"),16)
	if edi == 0:
		break
	password += struct.pack('<I', edi)
	r.cmd("dr esi=edi")
	r.cmd("db ?v rax+0x5c")

f.write(password)
print "Password successfully saved at %s !!" % fname