> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/some-assembly-required-4.md).

# Some Assembly Required 4

we download the `.wasm` file (`ZoRd23o0wd`) and start with basic recon using `strings`. this immediately gives us useful symbols like `check_flag`, `strcmp`, and `input`, which tells us the binary is doing some kind of **input transformation + comparison**.

next step is decompilation using `wasm-decompile`. this gives us readable pseudo-C logic, and now the whole challenge becomes clear.

#### core logic — `check_flag()`

the function processes the user input stored at memory offset `1072`. it loops over each byte until it hits a null byte, meaning it’s iterating over the entire input string.

inside this loop, the program applies **multiple transformations on each byte**, in this exact order:

first, every byte is XORed with `20`:

```
buf[i] ^= 20
```

then, if the index is greater than 0, it XORs with the previous byte:

```
buf[i] ^= buf[i-1]
```

then, if index > 2, it XORs with the byte 3 positions before:

```
buf[i] ^= buf[i-3]
```

after that, it XORs with `(i % 10)`:

```
buf[i] ^= (i % 10)
```

then a conditional XOR based on even/odd index:

```
if i % 2 == 0: buf[i] ^= 9
else:          buf[i] ^= 8
```

then another conditional XOR based on modulo 3:

```
if i % 3 == 0: buf[i] ^= 7
elif i % 3 == 1: buf[i] ^= 6
else: buf[i] ^= 5
```

#### second phase — swapping

after transforming all bytes, there’s another loop that swaps adjacent characters:

```
for i in range(0, n-1, 2):
    swap(buf[i], buf[i+1])
```

this means the final transformed buffer is slightly shuffled.

#### final check

after all transformations, the function compares the result with a hardcoded byte array stored at memory offset `1024`.

this is done using:

```
strcmp(1024, 1072)
```

if both match → correct flag.

#### reversing the logic (exploit)

our exploit code

```
target = [
    0x18,0x6a,0x7c,0x61,0x11,0x38,0x69,0x37,
    0x1f,0x59,0x79,0x59,0x3e,0x1c,0x56,0x63,
    0x0d,0x42,0x1d,0x7e,0x6c,0x39,0x1c,0x5a,
    0x21,0x5d,0x63,0x11,0x00,0x62,0x05,0x49,
    0x4b,0x7e,0x61,0x34,0x1c,0x57,0x28,0x0f,
    0x52,0x00
]

n = len(target) - 1  # last byte is null terminator, ignore

# Step 1: Undo the swap pass (swap even/odd pairs back)
buf = target[:n]
for i in range(0, n-1, 2):
    if i + 1 < n:
        buf[i], buf[i+1] = buf[i+1], buf[i]

# Step 2: Undo XOR transforms in reverse order
# The transforms were applied left to right, and each step depends
# on PREVIOUS bytes' already-transformed values.
# So we undo right to left... but steps 2 & 3 use already-modified neighbors.
# Actually all XORs are applied to buf[i] sequentially using buf as it stands
# during forward pass. So we reverse all XORs on each byte in reverse order,
# then undo the neighbor dependencies right-to-left.

for i in range(n-1, -1, -1):
    # Undo step 6
    if i % 3 == 0:   buf[i] ^= 7
    elif i % 3 == 1: buf[i] ^= 6
    else:             buf[i] ^= 5
    # Undo step 5
    if i % 2 == 0:   buf[i] ^= 9
    else:             buf[i] ^= 8
    # Undo step 4
    buf[i] ^= (i % 10)
    # Undo step 3
    if i > 2: buf[i] ^= buf[i-3]
    # Undo step 2
    if i > 0: buf[i] ^= buf[i-1]
    # Undo step 1
    buf[i] ^= 20

print(''.join(chr(b) for b in buf))

```

we can’t guess the input, so we reverse the process.

the binary gives us the **target transformed bytes**:

```
data section:
"\18j|a\118i7\1fYyY>..."
```

we extract those bytes and store them in Python (`target` array in your script).

now we reverse everything step by step:

first, undo the swap:

```
swap(buf[i], buf[i+1]) → same operation again reverses it
```

then reverse transformations **in reverse order** (very important):

for each byte from end → start:

* undo mod 3 XOR
* undo even/odd XOR
* undo `(i % 10)`
* undo dependency on `i-3`
* undo dependency on `i-1`
* undo initial XOR with 20

this works because XOR is reversible:

```
x ^ k ^ k = x
```

***

#### result

after reversing everything, we convert bytes back to characters:

```
picoCTF{1c4abb877272112e39233c05ade7abbb}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/some-assembly-required-4.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.