Beacon Override

beacon_override is a stripped x86-64 ELF that unlocks a beacon only when the right override phrase is typed. The checker runs each input byte through (byte ^ 0x13) + index and compares against a 23-byte target in .rodata. The transform is per-index and fully invertible.

Solve

1. Disassemble and find the transform at 0x401166 and the checker at 0x401184.

$ objdump -d -M intel beacon_override | grep -A12 '401166:'
  401177:  xor    eax,0x13      ; byte ^ 0x13
  401180:  add    eax,edx       ; + index

The checker requires length 0x17 (23) and transform(input[i], i) == expected[i].

2. Dump the 23-byte target at 0x402130:

$ objdump -s -j .rodata beacon_override | grep -A1 402130
 402130 40465c54 58466e78 287b7a2e 89593174
 402140 30727335 8b3584

3. Invert input[i] = ((expected[i] - i) & 0xFF) ^ 0x13:

expected = [0x40,0x46,0x5c,0x54,0x58,0x46,0x6e,0x78,0x28,0x7b,0x7a,0x2e,
            0x89,0x59,0x31,0x74,0x30,0x72,0x73,0x35,0x8b,0x35,0x84]
print("".join(chr(((expected[i] - i) & 0xFF) ^ 0x13) for i in range(len(expected))))

4. Confirm against the binary:

$ echo "SVIBGR{b3ac0n_0v3rr1d3}" | ./beacon_override
=== Beacon Override Console ===
override> Beacon online. Distress repeater restored.

Flag: SVIBGR{b3ac0n_0v3rr1d3}