TL;DR. The source program attempts to deocde a ROP chain from an input key; the correct ROP chain reads an input and calculates the distance from that input to the key that generated it. Use the range of plausible `libc` offsets to determine the gadget and the ROP chain. Find properties of the encoded ROP chain stream that will allow for easy key extraction given a new source program.

Original writeup (http://nave1337.herokuapp.com/index.html#bbf2021_turing).