247CTF - Flag Errata

We stored the flag within this binary, but made a few errors when trying to print it. Can you make use of these errors to recover the flag?

Overview

❯ file flag_errata.exe
flag_errata.exe: PE32+ executable for MS Windows 5.02 (console), x86-64 (stripped to external PDB), 9 sections

A PE64 binary (GCC 7.3 / MinGW-w64) with a monstrous 53KB main function. It prompts for a 40-character password, validates each character through error-code accumulation, then returns -247 on any mismatch.

The core pattern repeats 40 times:

sub_401560();                    // intentionally failing WinAPI call
LastError = GetLastError();      // harvest the error code
sub_40159B();
v5 = GetLastError() + LastError; // accumulate
sub_4015D6();
v6 = GetLastError() + v5;
// ... N calls total ...
if ( Buffer[i] != (int)(accumulated) % 126 )
    return -247;                 // failure — 247CTF signature

The password is never stored anywhere. It’s implicitly encoded by the count and sequence of WinAPI calls whose error codes reconstruct each character.

The Error Code Cycle

13 functions form a fixed cycle, each designed to fail deterministically:

Each character block calls $N$ consecutive functions from this cycle, accumulates the error codes, then checks sum % 126 against the input.

Algebraic Solution

The key insight: since the error codes cycle deterministically, we can bypass the Windows environment entirely and solve this as pure modular arithmetic.

I use Arch BTW.

Let:

• $S = \sum_{k=0}^{12} e_k$, the sum of one full cycle (all 13 error codes)
• $P(r) = \sum_{k=0}^{r-1} e_k$, the partial sum of the first $r$ codes

For character $i$ with $n_i$ total API calls:

The flag format 247CTF{<flag-redacted>} gives us 8 known characters for free. Three of them — blocks 2, 3, 6 — share the same remainder $r = 9$: same position in the error-code cycle, different lap counts. Shared $P(9)$ cancels on subtraction.

Blocks 2, 3, 6 correspond to 7 (ASCII $55$, $q = 16$), C ($67$, $q = 10$), { ($123$, $q = 24$):

Subtracting $(2)$ from $(1)$ eliminates $P(9)$:

Since $\gcd(6, 126) = 6$ divides $114$, we may divide the entire congruence by $6$ (reducing the modulus to $126/6 = 21$):

Similarly, $(3) - (1)$ yields a second constraint:

To isolate $S$, multiply both sides by the modular inverse $4^{-1} \equiv 16 \pmod{63}$, since $4 \times 16 = 64 \equiv 1$:

Intersecting via CRT: $40 \bmod 21 = 19\;\checkmark$, so both congruences agree.

Back-substituting into $(1)$:

Same process with the remaining known characters fills all partial sums:

With $S$ and all $P(r)$ determined, every character computes directly:

All 40 characters land in the valid charset — 247CTF{<flag-redacted>} suffix — confirming the solution without ever running the binary.

Character-by-Character Breakdown

Anti-Analysis

• TLS Callbacks: Two callbacks (0x401C50, 0x401C20) execute before main — a common anti-debug vector.
• 53KB of bloat: Up to 321 API calls per character, making manual static analysis impractical without scripting.
• Environment sensitivity: Functions like CreateProcessA and SetConsoleDisplayMode return different error codes under a debugger, making dynamic analysis a trap. The algebraic approach sidesteps this entirely by reasoning at the mathematical level, independent of the Windows runtime.

247CTF{[flag redacted]}