#!/usr/bin/env python3 import sys
Use the CameraFi app (available on Google Play) or generic Windows Camera apps. www kkmoom com pc rar
# Extract the rar archive unrar x pc.rar # → we obtain pc.exe (size ≈ 44 KB) # File type file pc.exe # pc.exe: PE32 executable (GUI) Intel 80386, for MS Windows Somewhere inside the binary (or in its execution)
Inside the archive lies a Windows PE executable named pc.exe . The binary, when executed, prints a garbled string and then terminates. Somewhere inside the binary (or in its execution) is a of the form FLAG… . www kkmoom com pc rar
Open the binary in (or Ghidra ) and locate the entry point:
def extract_first_stage(pe_path): import pefile pe = pefile.PE(pe_path) # These RVAs were discovered manually; they are constant for the challenge packed_rva = 0x403000 packed_size = 0x2000 # 8 KiB – enough to cover the blob off = pe.get_offset_from_rva(packed_rva) return pe.__data__[off:off+packed_size]