> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/some-assembly-required-4.md).

# Some Assembly Required 4

we download the `.wasm` file (`ZoRd23o0wd`) and start with basic recon using `strings`. this immediately gives us useful symbols like `check_flag`, `strcmp`, and `input`, which tells us the binary is doing some kind of **input transformation + comparison**.

next step is decompilation using `wasm-decompile`. this gives us readable pseudo-C logic, and now the whole challenge becomes clear.

#### core logic — `check_flag()`

the function processes the user input stored at memory offset `1072`. it loops over each byte until it hits a null byte, meaning it’s iterating over the entire input string.

inside this loop, the program applies **multiple transformations on each byte**, in this exact order:

first, every byte is XORed with `20`:

```
buf[i] ^= 20
```

then, if the index is greater than 0, it XORs with the previous byte:

```
buf[i] ^= buf[i-1]
```

then, if index > 2, it XORs with the byte 3 positions before:

```
buf[i] ^= buf[i-3]
```

after that, it XORs with `(i % 10)`:

```
buf[i] ^= (i % 10)
```

then a conditional XOR based on even/odd index:

```
if i % 2 == 0: buf[i] ^= 9
else:          buf[i] ^= 8
```

then another conditional XOR based on modulo 3:

```
if i % 3 == 0: buf[i] ^= 7
elif i % 3 == 1: buf[i] ^= 6
else: buf[i] ^= 5
```

#### second phase — swapping

after transforming all bytes, there’s another loop that swaps adjacent characters:

```
for i in range(0, n-1, 2):
    swap(buf[i], buf[i+1])
```

this means the final transformed buffer is slightly shuffled.

#### final check

after all transformations, the function compares the result with a hardcoded byte array stored at memory offset `1024`.

this is done using:

```
strcmp(1024, 1072)
```

if both match → correct flag.

#### reversing the logic (exploit)

our exploit code

```
target = [
    0x18,0x6a,0x7c,0x61,0x11,0x38,0x69,0x37,
    0x1f,0x59,0x79,0x59,0x3e,0x1c,0x56,0x63,
    0x0d,0x42,0x1d,0x7e,0x6c,0x39,0x1c,0x5a,
    0x21,0x5d,0x63,0x11,0x00,0x62,0x05,0x49,
    0x4b,0x7e,0x61,0x34,0x1c,0x57,0x28,0x0f,
    0x52,0x00
]

n = len(target) - 1  # last byte is null terminator, ignore

# Step 1: Undo the swap pass (swap even/odd pairs back)
buf = target[:n]
for i in range(0, n-1, 2):
    if i + 1 < n:
        buf[i], buf[i+1] = buf[i+1], buf[i]

# Step 2: Undo XOR transforms in reverse order
# The transforms were applied left to right, and each step depends
# on PREVIOUS bytes' already-transformed values.
# So we undo right to left... but steps 2 & 3 use already-modified neighbors.
# Actually all XORs are applied to buf[i] sequentially using buf as it stands
# during forward pass. So we reverse all XORs on each byte in reverse order,
# then undo the neighbor dependencies right-to-left.

for i in range(n-1, -1, -1):
    # Undo step 6
    if i % 3 == 0:   buf[i] ^= 7
    elif i % 3 == 1: buf[i] ^= 6
    else:             buf[i] ^= 5
    # Undo step 5
    if i % 2 == 0:   buf[i] ^= 9
    else:             buf[i] ^= 8
    # Undo step 4
    buf[i] ^= (i % 10)
    # Undo step 3
    if i > 2: buf[i] ^= buf[i-3]
    # Undo step 2
    if i > 0: buf[i] ^= buf[i-1]
    # Undo step 1
    buf[i] ^= 20

print(''.join(chr(b) for b in buf))

```

we can’t guess the input, so we reverse the process.

the binary gives us the **target transformed bytes**:

```
data section:
"\18j|a\118i7\1fYyY>..."
```

we extract those bytes and store them in Python (`target` array in your script).

now we reverse everything step by step:

first, undo the swap:

```
swap(buf[i], buf[i+1]) → same operation again reverses it
```

then reverse transformations **in reverse order** (very important):

for each byte from end → start:

* undo mod 3 XOR
* undo even/odd XOR
* undo `(i % 10)`
* undo dependency on `i-3`
* undo dependency on `i-1`
* undo initial XOR with 20

this works because XOR is reversible:

```
x ^ k ^ k = x
```

***

#### result

after reversing everything, we convert bytes back to characters:

```
picoCTF{1c4abb877272112e39233c05ade7abbb}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/some-assembly-required-4.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.