Hard x64 Linux

A 690 KB static, stripped x86-64 ELF password checker littered with bogus call instructions (opaque-predicate junk). The check is a Blowfish-CTR stream cipher, so the flag is the embedded blob XORed with the keystream from emulating the cipher on zeros.

Solve

1. Read main (0x4016d0): if (argc==2 && check(argv[1])==1) puts("You beat the x64 Linux Hard binary!");. Throughout the code are xor eax,eax; je .next; call <junk>; .next: sequences. The je is always taken (ZF set by xor), so the call never runs; it only desyncs linear disassembly. Trace through the jump and ignore each call.
2. Reverse check (fcn.00401e80 -> fcn.004018d0). It builds a 52-byte expected blob from static constants (no literals), runs transform(input, 52, key=0x123456789abcdef0) in place, then compares 52 bytes.
3. Identify transform (0x4018d0) as textbook Blowfish: 18-entry P-array, four 256-entry S-boxes (generated at 0x4a7b00), round function F=((S0[a]+S1[b])^S2[c])+S3[d], 16 rounds. The tail encrypts the block counter and xor byte [rdx], cl into the data, so it is CTR/OFB mode. Keystream depends only on key + position, giving flag = blob XOR transform(zeros).
4. Emulate transform with Unicorn. Map the four PT_LOAD segments and point rdi at a 52-byte buffer. Zero the CPU-dispatch flag at 0x4a60d0 (file holds 1, which selects a scalar fallback) to force the SSE path:

mu.mem_write(0x4a60d0, b'\x00\x00\x00\x00')
keystream = run_transform(b'\x00'*52)
assert xor(run_transform(bytes(range(52))), bytes(range(52))) == keystream

5. Get the blob by emulating check with all calls stubbed (rax=0) and reading the compare buffer at the setup point 0x402006. Blob bytes are static movs, so stubbing libc/anti-debug calls leaves them intact. XOR blob with keystream to get the flag.
6. Confirm on the real binary:

$ ./Hard_x64_Linux 'SVIUSCG{It_L00ks_l1k3_U_Know_H0w_t0_P4tch_Binaries!}'
You beat the x64 Linux Hard binary!

Flag: SVIUSCG{It_L00ks_l1k3_U_Know_H0w_t0_P4tch_Binaries!}