Reverse then ROT: Undoing String Reversal and ROT13
O desafio
Um crackme imprime esta string embaralhada quando você digita a chave errada. A desmontagem mostra que ele constrói o valor real invertendo uma string armazenada e depois aplicando ROT13 às letras. Desfaça os dois passos na bancada e envie o flag (HDNA{...}).
O que você vai aprender
- Recognise ROT13 by which characters it leaves untouched
- Understand why ROT13 and string reversal are each their own inverse
- Order two symmetric transforms correctly to recover plaintext
- Rule out base64 and hex when the input has no such structure
- Explain why keyless scrambling is not encryption
Habilidades testadas
Pré-requisitos
- Knowing what ROT13 and string reversal do
- Basic familiarity with reading a crackme's output
Como funciona
ROT13 rotates each letter 13 places through the alphabet. Because the alphabet has 26 letters, applying it twice returns the original - so ROT13 is its own inverse and needs no key. String reversal is the same idea: reverse twice and you are back where you started. Crackmes and lightweight 'protections' love these because they look obfuscated but cost nothing to apply.
The tell that this is a letter rotation and not a byte cipher is what it leaves alone. ROT only shifts a-z and A-Z; digits, braces and underscores pass through. In the scrambled string you can already see {, } and _ sitting among the letters, just in the wrong places because the whole thing is also reversed. That rules out base64 (no padding, mixed case structure) and hex (not all hex characters), and points you straight at reverse plus ROT.
Order matters when undoing stacked transforms: reverse what was done last, first. The crackme reversed the string and then ROT13'd it, so undo in the opposite order - add Reverse, then ROT with the default shift of 13. The flag resolves live. The other operations (atbash, base64, hex, Vigenere, XOR, URL-decode) are decoys; atbash is the closest trap, but it maps each letter to its mirror rather than rotating by 13, so it produces gibberish here.
Erros comuns
- Reaching for base64 or hex. The string is not valid base64 or hex - those operations only produce garbage.
- Using atbash instead of ROT. Atbash mirrors the alphabet; ROT13 rotates by 13. Only ROT13 recovers the flag here.
- Changing the ROT shift. ROT13 is the default and the right one - other shifts will not read as text.
- Applying the steps in the wrong order. Reverse and ROT13 commute on this data, but as a habit, undo the last-applied transform first.
Como se proteger
For defenders and reverse engineers, the lesson is that keyless scrambling like ROT13 and reversal is recreational - it hides a string from a glance and nothing more. If a crackme or a real binary 'protects' a value this way, treat the value as plaintext and read it directly.
- Never use ROT13, reversal, or any keyless transform to hide secrets in code - they protect nothing.
- When reversing, recognise letter rotations instantly by the untouched non-letter characters.
- Try the cheapest transforms (reverse, ROT, atbash) first before assuming a real cipher.
- Store real secrets outside the binary, retrieved with proper authentication, not baked in obfuscated.