Rating:
See here : [https://berryberry.hatenablog.jp/](https://berryberry.hatenablog.jp/entry/2022/03/27/034315)
Opened with Ghidra for the first step.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327024910.png)
This program is similar to the Pascal. You can see that the ivar3 variable is compared with the input number in line 37.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025037.png)
In the function1, it calculates the greatest common divisor of local_20 variable and local_28 variable.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025047.png)
In the function2, it calculates the factorial of the ivar3 variable plus 3.
The solution is below.
```
import math
from pwn import *
elf = ELF("./decompile", checksec=False)
host = '143.198.224.219'
port = 21530
def func1(num1, num2):
return math.gcd(num1, num2)
def func2(num):
if (num == 0):
return 1
else:
return func2(num-1) * num
r = remote(host, port)
while (True):
# receive two numbers
now = r.recvline()
if (b"fun() took" in now):
break
a, b = map(str, now.decode('utf-8').split())
# send number which does func1 and func2
num = func2(func1(int(a), int(b))+3)
r.sendline(str(num).encode())
print(now.decode('utf-8'))
r.interactive()
```
You can get the FLAG.
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327025304.png)