# [zer0pts CTF 2020] QR Puzzle
###### tags: `zer0pts CTF 2020`

## overview

We're given 64bit ELF `chall` and `encrypted.qr`, `key`. Obviously, `chall` used `key` to encrypt QR

## analysis

`chall` is straitforwarded, being easy to reversing.

1. read QR code
2. read key
3. encryption
4. save

We focus to `read key` and `encryption`.

### read key

There may be a struct like `struct key {int B; int C; int A; struct key* prev; };`. Reading `key` and constructing linked list.

### encryption

My decompile

int encrypt(int *qr_ptr, Key *key) {
    while (key != 0) {
        int B = key->B, C = key->C;
        int rax, rcx, rdx, r8;
        switch (key->A) {
            case 0:
                rdx = B-1;
                r8 = C;
                break;
            case 1:
                rdx = B+1;
                r8 = C;
                break;
            case 2:
                rdx = B;
                r8 = C-1;
                break;
            case 3:
                rdx = B;
                r8 = C+1;
                break;
            default:
                break;
        }

        qr_ptr[rcx + rax] += qr_ptr[r8 + rdx];
        qr_ptr[r8 + rax] = qr_ptr[rcx + rax - (r8 + rax)];
        qr_ptr[rax + rcx] -= qr_ptr[r8 + rdx];
        
        key = key->prev;
    }
}

`0123` is corresponding up / down / move left / move right. this function swap the QR bit following `0123`.

## solution

To decrypt, just swap from bottom to top. To create reverse key like `tac key > rev_key`.

Then just get the flag.