Partial Encryption

Author: 0xIDA
Platform: HTB · Category: rev · Difficulty: Easy

Solvers

• solve.py

Summary

Windows x64 PE that stores multiple shellcode blobs in .data, each encrypted with a partial AES (AESKEYGENASSIST + AESDECLAST only) keyed by the 16-byte broadcast of the block index. Decrypting the blobs recovers shellcode that validates each character of argv[1] and prints ./chal <flag> / Nope.

Solution

Step 1: Identify encryption

fcn.140001050 VirtualAlloc's a buffer, then for each 16-byte block i:

1. Build key = bytes([i])*16 via movd/punpck/pshufd
2. kA = AESKEYGENASSIST(key, 0)
3. kB = AESKEYGENASSIST(key, 0x10)
4. plaintext_block = AESDECLAST(ct ^ kB, kA)
5. VirtualProtect RWX and call the shellcode

Step 2: Decrypt all blobs and recover flag checks

Decrypted shellcode compares argv[1][i] against fixed ASCII values:

Index	Char
0-3	HTB{
4-9	W3iRd_
10-17	RUnT1m3_
18-20	DEC
21	}

Step 3: Submit

HTB{W3iRd_RUnT1m3_DEC}

Verified via HTB MCP flag submission (Congratulations).

Flag

HTB{W3iRd_RUnT1m3_DEC}

Tools Used

• radare2
• custom Python AESKEYGENASSIST/AESDECLAST reimplementation (validated against gcc -maes)
• mcp_htb_submit_challenge_flag