Reverse then ROT: Undoing String Reversal and ROT13
Le défi
Un crackme affiche cette chaîne brouillée quand on saisit la mauvaise clé. Le désassemblage montre qu'il construit la vraie valeur en inversant une chaîne stockée puis en appliquant ROT13 aux lettres. Annulez les deux étapes dans l'atelier et soumettez le flag (HDNA{...}).
Ce que tu vas apprendre
- Recognise ROT13 by which characters it leaves untouched
- Understand why ROT13 and string reversal are each their own inverse
- Order two symmetric transforms correctly to recover plaintext
- Rule out base64 and hex when the input has no such structure
- Explain why keyless scrambling is not encryption
Compétences testées
Prérequis
- Knowing what ROT13 and string reversal do
- Basic familiarity with reading a crackme's output
Comment ça marche
ROT13 rotates each letter 13 places through the alphabet. Because the alphabet has 26 letters, applying it twice returns the original - so ROT13 is its own inverse and needs no key. String reversal is the same idea: reverse twice and you are back where you started. Crackmes and lightweight 'protections' love these because they look obfuscated but cost nothing to apply.
The tell that this is a letter rotation and not a byte cipher is what it leaves alone. ROT only shifts a-z and A-Z; digits, braces and underscores pass through. In the scrambled string you can already see {, } and _ sitting among the letters, just in the wrong places because the whole thing is also reversed. That rules out base64 (no padding, mixed case structure) and hex (not all hex characters), and points you straight at reverse plus ROT.
Order matters when undoing stacked transforms: reverse what was done last, first. The crackme reversed the string and then ROT13'd it, so undo in the opposite order - add Reverse, then ROT with the default shift of 13. The flag resolves live. The other operations (atbash, base64, hex, Vigenere, XOR, URL-decode) are decoys; atbash is the closest trap, but it maps each letter to its mirror rather than rotating by 13, so it produces gibberish here.
Erreurs fréquentes
- Reaching for base64 or hex. The string is not valid base64 or hex - those operations only produce garbage.
- Using atbash instead of ROT. Atbash mirrors the alphabet; ROT13 rotates by 13. Only ROT13 recovers the flag here.
- Changing the ROT shift. ROT13 is the default and the right one - other shifts will not read as text.
- Applying the steps in the wrong order. Reverse and ROT13 commute on this data, but as a habit, undo the last-applied transform first.
Comment s'en protéger
For defenders and reverse engineers, the lesson is that keyless scrambling like ROT13 and reversal is recreational - it hides a string from a glance and nothing more. If a crackme or a real binary 'protects' a value this way, treat the value as plaintext and read it directly.
- Never use ROT13, reversal, or any keyless transform to hide secrets in code - they protect nothing.
- When reversing, recognise letter rotations instantly by the untouched non-letter characters.
- Try the cheapest transforms (reverse, ROT, atbash) first before assuming a real cipher.
- Store real secrets outside the binary, retrieved with proper authentication, not baked in obfuscated.