Challenge Context#

This was a 500-point reverse-engineering challenge by Jst3r. The challenge description was:

1
nsit nasi7a d lwalid

The final solve was accepted as first blood.

Evidence Preserved#

The browser submission showed Correct, and the session recorded:

1
tbarkallah 3lek awldi katchfi lghalil:
2
leet{Y4r81_yrj33_1t7553b_l0g_71m3_Dl0ckScr33n_fL1NuX}

Core Idea#

The exact reversing path was not preserved as a local solution.md. The accepted flag text references log time and lock screen behavior, which likely maps to the binary’s validation logic.

For a public post, rebuild the technical trail from:

1
/home/lain/ctf/1337-local/challenges/rev/tbarkallah/

Minimum reconstruction checklist:

1
file extracted/chall
2
strings -a extracted/chall
3
objdump -d -M intel extracted/chall

Then identify the validation function and show exactly how the flag is derived.

Flag#

1
leet{Y4r81_yrj33_1t7553b_l0g_71m3_Dl0ckScr33n_fL1NuX}

Lesson Learned#

A first blood still needs a reproducible explanation. Capture the derivation immediately, not only the final accepted flag.

Cover: Wallhaven gw52yd.