SUPER
Decoding an XOR-encoded file gives us an MS-DOS VHD
HOT
author: WhiteHoodHacker
The file is encrypted with a repeating XOR cipher
The file, when opened, shows the string "SUPERHOT" repeated over and over again in some parts, like the beginning of the file.
In other parts, however, there appears to be some scrambled data.
This was the major gatekeeper, but as the hint stated, the file is encrypted with a repeating XOR cipher. This explains the repeated "SUPERHOT"s, since
. Thus, null bytes (zeros) XOR-ed with "SUPERHOT" would yield "SUPERHOT".
Using "SUPERHOT" as the XOR key, we decode the file.
def repeating_key_xor(text: bytes, key: bytes) -> bytes:
repetitions = 1 + (len(text) // len(key))
key = key * repetitions
key = key[:len(text)]
return bytes([b ^ k for b, k in zip(text, key)])
with open("SUPERHOT", 'rb') as f:
text = f.read()
decoded = repeating_key_xor(text, b"SUPERHOT")
print(decoded[:50])
with open("decoded", 'wb') as f:
f.write(decoded)
It turns out the key was indeed "SUPERHOT", as the decoded file was a valid disk image.
Indeed, the large portions of zeroes were encoded into repeating "SUPERHOT"s.
Checking the magic bytes at the beginning of the file allows us to fingerprint the file type.
Mounting the VHD with
guestmount -a decoded -i ./mnt -v, I started exploring the filesystem. The first thing we can try to find out is the OS version. This was easily found to be MS-DOS 6.22 - really old!$ cat mnt/DOS/README.TXT
README.TXT
NOTES ON MS-DOS 6.22
====================
This file provides important information not included in the
MICROSOFT MS-DOS USER'S GUIDE or in MS-DOS Help.
...
In the filesystem root, there was an interesting
LOG1.IRC file. It hints at a superhot.exe that requires "changing directories many times to reach".$ cat mnt/LOG1.IRC
[13:33] *** Joins: white (whitehoodhacker@sigpwny)
[13:33] <white> Dude, you should play SUPERHOT, it's the most innovative game I've played in years!
[13:33] <white> I'll send it to your file server
[13:35] <someradgamer> epic I'll check it out
[13:38] <someradgamer> why does the setup create so many folders?
[13:38] <someradgamer> I have to change directories so many times to reach superhot.exe
[13:39] <white> Have you tried it yet?
[13:40] <someradgamer> yeah, it's just some dumb title screen, how do I play?
[13:40] <white> That *is* the game
[13:40] <white> you just keep repeating the title
[13:45] <white> oh I almost forgot to mention
[13:46] <white> there's a bug where if you SUPERHOT too much, it will SUPERHOT your entire PC
[13:47] <someradgamer> wait what
[13:48] <someradgamer> that doesn't sound HOT
[13:48] <someradgamer> I'm SUPER deleting this now
[13:48] <someradgamer> what the HOT is happening to my SUPER computer!?
[13:48] <SUPERHOT> SUPERHOT SUPERHOT SUPERHOT
[SU:PE] <RHOT> SUPERHOT SUPERHOT SU
PERHOT SUPERHOT
SUPER
HOT▒
This referred to an interesting
SUPER directory in the filesystem root.It only contains a directory named
HOT, which then contains a SUPER directory again. This continues until we have SUPER/HOT/SUPER/HOT/SUPER/HOT/SUPER/HOT/SUPER/HOT. However, superhot.exe was nowhere to be found.The chat logs did suggest that
someradgamer might have deleted the file ("I'm SUPER deleting this now") before his computer started malfunctioning.I looked around a little more, and I guess I "lucked out" when at the corner of my eye, I noticed an
UNDELETE.EXE executable in the DOS directory.
I did not know the existence of this command, but I had a feeling that it must have had something to do with it - we're looking for a deleted file, after all. It appears that the UNDELETE command exists on MS-DOS 5.0 to 6.22, allowing users to recover deleted files if no new files or changes have been made on the disk since the deletion.
Perhaps we can recover the deleted
superhot.exe? Let's find out!Create a new VM on VirtualBox, selecting "DOS" as the OS.
When prompted to add a virtual hard disk, select the decoded VHD file.
Click on Create, and we have our very own MS-DOS VM! To test our theory, let's navigate to the
C:\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOT folder and run UNDELETE.EXE.This indeed finds a recoverable file, and we are prompted to enter the first character of
?UPERHOT.EXE. This would obviously be the character S.
The file is successfully "undeleted", and we can run
superhot.exe to get the flag.
Last modified 1yr ago