pcm0.py

# http://crackmes.de/users/pancake/pcme0/

# This is not perfect, it fails to recover one specific char in the flag
# Idk what's going on there, but found it out anyway :)
# (In the final flag, the non-printable char '\0x18' should be '0'. Flag is 10 chars long.)

import sys,r2pipe

r2profile = '#!/usr/bin/rarun2\nprogram=./pcme0\nstdin=stdin.txt\nstdout='
with open('profile.rr2', 'w') as f:
        f.write(r2profile)

with open('stdin.txt','w') as f:
        f.write('')

reopen_patch = 'ood; s 0x08048a1b; wx 9090909090; s 0x08048a88; wx 90909031c0; s 0x08048b41; wx b801000000; s 0x08048b61; wx 90909031c0; s 0x08048837; wx 90; db 0x08048865;'

r2 = r2pipe.open('./pcme0')
r2.cmd('e dbg.profile=profile.rr2')
r2.cmd('aaa;' + reopen_patch)

for i in range(0xff):   
        try:
                r2.cmd('dc;'*(i+1))
                flagchar = chr(r2.cmdj('drj eax')['eax'] ^ 0x3a)
                with open('stdin.txt', 'a') as f:
                        f.write(flagchar)
                r2.cmd(reopen_patch)
        except:
                break

with open('stdin.txt','r') as f:
        print(f.read())