cscg is loooong

2026/cscg/rev/connivance/.gdb_history

@@ -0,0 +1,25 @@
+b main
+vmmap
+b _start
+b main
+r
+b main
+checksec main
+checksec
+b *0x403550
+r
+b *0x4035DD
+r
+n
+n
+n
+c
+b *0x4035DD
+r ./hello_world.tfl 
+b *0x4035DA
+b *0x4035DA
+r ./hello_world.tfl 
+b *0x4035DA
+r
+b *0x4035DA
+r

2026/cscg/rev/connivance/Decrypt_obfuscated_blob.py

@@ -0,0 +1,17 @@
+import idc
+import struct
+
+addr = here()  # or replace with the actual address e.g. 0x47F240
+
+data    = bytes([idc.get_wide_byte(addr + i) for i in range(39)])
+flag    = idc.get_wide_byte(addr + 39)
+key     = idc.get_qword(addr + 40)
+
+print(f"Data:      {data.hex()}")
+print(f"Decrypted: {flag}")
+print(f"Key:       {key:#018x}")
+
+# Decrypt it immediately
+decrypted = bytes(~(b ^ ((key >> (8 * (i % 8))) & 0xFF)) & 0xFF for i, b in enumerate(data))
+print(f"Plaintext: {decrypted}")
+print(f"As string: {decrypted.decode('utf-8', errors='replace')}")

2026/cscg/rev/connivance/dump_after_410450.gdb

@@ -0,0 +1,12 @@
+break *0x4035da
+run flag_checker.tfl AAAA
+printf "sub_410450 result: %d\n", $r15b
+set $r15b = 0
+break *0x40365e
+continue
+printf "At main VM call\n"
+set $wrapper = *(long long*)$rsi
+set $bc_base = *(long long*)($wrapper+0x10)
+set $bc_size = *(long long*)($wrapper+0x18)
+printf "bc_base=%p size=%d\n", $bc_base, $bc_size
+dump binary memory /tmp/bc_main.bin $bc_base ($bc_base+$bc_size)

2026/cscg/rev/connivance/dump_main_bc.gdb

@@ -0,0 +1,11 @@
+break *0x40356f
+run flag_checker.tfl AAAA
+set $eax = 0
+break *0x40365e
+continue
+printf "At main sub_405120 call\n"
+set $wrapper = *(long long*)$rsi
+set $bc_base = *(long long*)($wrapper+0x10)
+set $bc_size = *(long long*)($wrapper+0x18)
+printf "bc_base=%p size=%d\n", $bc_base, $bc_size
+dump binary memory /tmp/bc_main.bin $bc_base ($bc_base+$bc_size)

2026/cscg/rev/connivance/hash_trace.gdb

@@ -0,0 +1,9 @@
+break *0x40356f
+run flag_checker.tfl AAAA
+set $eax = 0
+break *0x404010
+commands 2
+  printf "HASH pc=%lld\n", *(long long*)$rdx
+  continue
+end
+continue