Slaying the Dragon - CSAW 2015 REV 500 writeup

.text:000000000040E1DF 1C8 mov     esi, 101h       ; n
.text:000000000040E1E4 1C8 mov     rdi, rcx        ; s
.text:000000000040E1E7 1C8 mov     [rbp+var_180], rax
.text:000000000040E1EE 1C8 mov     [rbp+var_188], rcx
.text:000000000040E1F5 1C8 call    _fgets          ; Call Procedure		//User input with limit 0x101(257)
.text:000000000040E1F5
.text:000000000040E1FA 1C8 lea     rcx, [rbp+var_120] ; Load Effective Address
.text:000000000040E201 1C8 mov     rdi, rcx
.text:000000000040E204 1C8 mov     [rbp+var_190], rax
.text:000000000040E20B 1C8 mov     [rbp+var_198], rcx
.text:000000000040E212 1C8 call    __ZNSaIcEC1Ev   ; std::allocator<char>::allocator(void)	//Creating string object using user input
.text:000000000040E217 1C8 lea     rdi, [rbp+var_118] ; Load Effective Address


.text:000000000040E242 1C8 lea     rdi, [rbp+var_138] ; this
.text:000000000040E249 1C8 lea     rsi, [rbp+var_118] ; std::string *
.text:000000000040E250 1C8 call    __ZNSsC1ERKSs   ; std::string::string(std::string const&)	//Initialize another string object with user string object 


.text:000000000040E25A 1C8 lea     rdi, [rbp+var_138]
.text:000000000040E261 1C8 call    _Z11start_questSs ; start_quest(std::string)		//Calling function start_quest with the string object containing user input
.text:000000000040E266 1C8 mov     [rbp+var_19C], eax		//Return value is stored in [rbp+var_19C]


.text:000000000040E271 1C8 mov     eax, [rbp+var_19C]
.text:000000000040E277 1C8 sub     eax, 1337h      ; Integer Subtraction	
.text:000000000040E27C 1C8 setz    cl              ; Set Byte if Zero (ZF=1)	//If eax==0x1337, cl is set
.text:000000000040E27F 1C8 lea     rdi, [rbp+var_138] ; this
.text:000000000040E286 1C8 mov     [rbp+var_1A0], eax
.text:000000000040E28C 1C8 mov     [rbp+var_1A1], cl		//cl is stored in [rbp+var_1A1]


.text:000000000040E29C 1C8 mov     al, [rbp+var_1A1]
.text:000000000040E2A2 1C8 test    al, 1           ; Logical Compare
.text:000000000040E2A4 1C8 jnz     loc_40E2AF      ; Jump if Not Zero (ZF=0)	//If cl is not set, jump to loc_40E2AF

.text:000000000040E2AA 1C8 jmp     loc_40E36C      ; Jump

.text:000000000040E36C 1C8 mov     eax, offset _ZSt4cout@@GLIBCXX_3_4
.text:000000000040E371 1C8 mov     edi, eax
.text:000000000040E373 1C8 mov     eax, offset aYouHaveFailed_ ; "\n[-] You have failed. The dragon's pow"...
.text:000000000040E378 1C8 mov     esi, eax
.text:000000000040E37A 1C8 call    __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator<<<std::char_traits<char>>(std::basic_ostream<char,std::char_traits<char>> &,char const*)		//Output failed.

.text:000000000040E2AF 1C8 lea     rdi, [rbp+var_140]
.text:000000000040E2B6 1C8 lea     rsi, [rbp+var_118] ; std::string *	//Initialise another object with user input
.text:000000000040E2BD 1C8 call    __ZNSsC1ERKSs   ; std::string::string(std::string const&)

.text:000000000040E2C7 1C8 lea     rdi, [rbp+var_140]
.text:000000000040E2CE 1C8 call    _Z15reward_strengthSs ; reward_strength(std::string)	//User input string object is passed to_reward strength
.text:000000000040E2CE									//reward_strength prints flag is flag{\%s},userinput

#include<stdio.h>

static void calc_flag(int* arr,char* result){
	int accumulator=0,i=0;
	for(i=0;i<28;i++){
		result[i]=arr[i]-accumulator;
		accumulator = accumulator+result[i];
	}
	return;
}

int main(){
	int arr[28]={
			100,214,266,369,417,527,622,733,847,
			942,1054,1106,1222,1336,1441,1540,
			1589,1686,1796,1891,1996,2112,2165,
			2260,2336,2412,2498,2575
		},i=0;
	char result[28];
	calc_flag(arr,result);
	printf("Flag is :: ");
	for(i=0;i<28;i++){
		printf("%c",result[i]);
	}
	printf("\n");
	return 0;
}