chiba_city.py

data = bv.read(0x8049a80, 0xd6)
last_char = 0x22
string = '"'
for char in data[1::2]:
	current = ord(char) ^ last_char
	last_char = current
	string += chr(current)

print("result: {}".format(string))

crypto_9000.c

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int32_t get_number() {
// Would need to use 64 bit multiplication for num * 0x51... and only use the upper 32 bits for further computation
//  int32_t num = rand();
//  int32_t num2 = (((num * 0x51eb851f) >> 5) - (num >> 31)) * 100;
//  return num - num2;
  return rand() % 100;
}

void decrypt(char* encrypted_buffer, char* plaintext) {
  srand(0xabad1dea);
  int plaintext_len = strlen(encrypted_buffer) / 2;

  char* pencrypted = encrypted_buffer + plaintext_len * 2 - 1;
  char* decoded = (char*)malloc(plaintext_len);

  // From hex
  
  for(int index = plaintext_len - 1; index >= 0; --index) {
    char low = *pencrypted--;
    char high = *pencrypted--;

    low -= '0';
    high -= '0';

    if(low > 9) {
      low -= 7;
    }

    if(high > 9) {
      high -= 7;
    }

    char* decoded_at_index = decoded + index;
    *decoded_at_index = (high & 0xf) << 4 | (low & 0xf);
  }

  char* visited = (char*)malloc(plaintext_len);
  memset(visited, 0, plaintext_len);

  int32_t var14 = get_number();

  for(int index = 0; index < plaintext_len; ++index) {
get_new_var14:
    while(var14 >= plaintext_len) {
      var14 = get_number();
    }

    char* pvisited = visited + var14;
    if(*pvisited) {
      var14 = get_number();
      goto get_new_var14;
    }

    char* pencrypted = decoded + index;
    char* pplain = plaintext + var14;

    char current_encrypted = *pencrypted;
    current_encrypted -= index;
    *pplain = ((current_encrypted & 0xf) << 4) | ((current_encrypted >> 4) & 0xf);

    *pvisited = (char)1;
  }

  free(visited);
  free(decoded);
}

void encrypt(char* plaintext, char* encrypted_buffer) {
  srand(0xabad1dea);
  int plaintext_len = strlen(plaintext);

  char* tmp_buffer = (char*)malloc(plaintext_len);
  memset(tmp_buffer, 0, plaintext_len);

  int32_t var14 = get_number();

  for(int index = 0; index < plaintext_len; ++index) {
get_new_var14:
    while(var14 >= plaintext_len) {
      var14 = get_number();
    }

    char* ptmp = tmp_buffer + var14;

    if(*ptmp) {
      var14 = get_number();
      goto get_new_var14;
    }

    char* pencrypted = encrypted_buffer + index;
    char* pplain = plaintext + var14;

    *pencrypted = (char)(((uint32_t)(*pplain) >> 4) | ((uint32_t)(*pplain << 4)) + index);

    *ptmp = (char)((uint32_t)(*ptmp) + 1);
  }

  char* pencrypted = encrypted_buffer + plaintext_len * 2 - 1;

  // Converts to hexadecimal
  for(int index = plaintext_len - 1; index >= 0; --index) {
    char* encrypted_at_index = encrypted_buffer + index;

    char var19 = (*encrypted_at_index) & 0xf;
    char var1a = (*encrypted_at_index) >> 4;

    if(var19 > 9) {
      var19 += 7;
    }

    if(var1a > 9) {
      var1a += 7;
    }

    var19 += '0';
    var1a += '0';

    *pencrypted-- = var19;
    *pencrypted-- = var1a;
  }

  free(tmp_buffer);
}

int main(int argc, char** argv) {
  if(argc != 2) {
      printf("String to decrypt as first arg pls\n");
      return -1;
  }

  char* encrypted = argv[1];
  unsigned length = strlen(encrypted);

  if(length > 200) {
    printf("String to long\n");
    return -1;
  }

  char* plaintext = (char*)malloc(length / 2 + 1);
  decrypt(encrypted, plaintext);

  printf("decrypted: %s\n", plaintext);

  free(plaintext);

  return 0;
}

sp.cs

using System;
using System.Collections.Generic;
using System.Security;
using System.Text;

namespace SP
{
    internal class Program
    {
        private static string cardman =
                "3.05.066C61676D3B7F486C20237775656479656C2024786F6375602775627560216C6C602C6965637E20295F65772275602A657374702661647E2D7"
            ;

        private static string liane =
                "3.05.0D4F6D6C2024756C6C602478656D612024556C6C602478656D6029472D602E6F64702661647C2029472D602A657374702269676D226F6E6564612024556C6C602478656D60216C6C6024786F63756023747F627965637021626F657470286F677025667562797F6E6560296E60297F65727026616D696C6970277163702269676021637021602368696C6460226574702478656E602762756770296E647F60247865696270226F64696563712"
            ;

        private static string stuff(string input)
        {
            var s1 = input.Substring(0, 3);
            var s2 = input.Substring(3, 3);
            var s3 = input.Substring(6, input.Length - 6);

            var bytes = new byte[s3.Length / 2];
            var startIndex = 0;
            while (startIndex < s3.Length)
            {
                bytes[startIndex / 2] = Convert.ToByte(s3.Substring(startIndex, 2), 16);
                startIndex += 2;
            }
            
            Console.WriteLine("After first loop: {0}", Encoding.ASCII.GetString(bytes));

            for (var index = 0; index < bytes.Length; ++index)
            {
                bytes[index] = (byte) (bytes[index] >> 4 | bytes[index] << 4);
            }
            
            Console.WriteLine("After second loop: {0}", Encoding.ASCII.GetString(bytes));

            var num1 = (byte) Math.Pow(Convert.ToDouble(s1), Convert.ToDouble(s2));

            for (var index = 0; index < bytes.Length; ++index)
            {
                bytes[index] = (byte) ((uint)bytes[index] ^ num1);
            }

            Console.WriteLine("After third loop: {0}", Encoding.ASCII.GetString(bytes));

            for (var index = 0; index < bytes.Length; index += 2)
            {
                bytes[index] = (byte) ((uint) bytes[index] ^ (uint) byte.MaxValue);
            }

            return Encoding.ASCII.GetString(bytes);
        }
        
        public static void Main(string[] args)
        {
            Console.WriteLine("First: {0}", stuff(liane));
            Console.WriteLine("Second: {0}", stuff(cardman));
        }
    }
}

tea-decrypt.c

#include <stdio.h>
#include <stdint.h>
#include <string.h>

const char* key = "gl0r10us_REWKiEZ";
const uint8_t encrypted[17] = {
  0x9c, 0x93, 0xf7, 0x72, 0x5e, 0x9d, 0x36, 0xce, 0x74, 0x6f, 0x4d, 0x61, 0x73, 0x74, 0x61, 0x68, 0x00
};

int32_t v(int i) {
  return 0x9e3779b9 * i;
}

void decrypt(char* encrypted, const char* key) {
  int32_t li = *((int32_t*)(encrypted) + 0);
  int32_t ri = *((int32_t*)(encrypted) + 1);
  int32_t k1 = *((int32_t*)(key) + 0);
  int32_t k2 = *((int32_t*)(key) + 1);
  int32_t k3 = *((int32_t*)(key) + 2);
  int32_t k4 = *((int32_t*)(key) + 3);
  
  for(int i = 32; i >= 1; --i) {
    ri = ri - ((k4 + ((uint32_t)li >> 5)) ^ ((k3 + (li << 4)) ^ (v(i) + li)));
    li = li - ((k2 + ((uint32_t)ri >> 5)) ^ ((k1 + (ri << 4)) ^ (v(i) + ri)));
  }
  
  *((int32_t*)(encrypted) + 0) = li;
  *((int32_t*)(encrypted) + 1) = ri;
}

int main(int argc, char** argv) {
  char e[17];
  memcpy(e, encrypted, 17);
  
  decrypt(e, key);
  
  printf("Decrypted: %s\n", e);
  return 0;
}

wtswag.c

void* (*dlsym)(int, char*) = 0; // actually dlsym lmao
int32_t (*atoi)(char*) = 0; // actually atoi
void (*free)() = 0; // atually signal
void (*puts)(char*) = 0; // actually puts
void (*printf)(char*, ...) = 0; // actually printf
char* (*fgets)(char*, int, FILE*) = 0; // actually fgets
char* (*strcmp)(const char*) = 0; // actually getenv
char* (*strstr)(char*, char*) = 0; // actually strstr
int (*close)(int fd) = 0;
uint64_t (*read)(int fd, void* buffer, uint64_t count) = 0;
int64_t (*ptrace)(int request, pid_t pid, void* addr, void* data) = 0;

int32_t p = 1;

int proc_self_status = 0;

char* data_13bf = "SWAG";
char* swag = "#\"54";

char* data_1378 = "-;#&";
char* lolo = "LOLO";

char* data_1411 = "HAHAHA";
char* hahaha = "83!/<'";

int32_t res = 0;

char* gimme(char* arg1, char* arg2, int32_t arg3) {
	if(arg3 == 1 || arg3 == 2) {
		// left part
		// both are the same, but in arg3 == 1 we have a - and in arg3 == 2 we have a +

		if(res == 0) {
			atoi = dlsym(-1, gimme(lolo, data_1378, 0));
			res = 1;
		}

		for(char* p1 = arg1; *p1; ++p1) {
			int32_t rax18 = atoi(arg2);

			if(arg3 == 1) {
				*p1 = (rax18 - *p1);
			} else {
				*p1 = (rax18 + *p1);
			}
		}
	} else if (arg3 < 1) {
		// xors both strings to arg1
		for(char* p1 = arg1, char* p2 = arg2; *p1; ++p1, ++p2) {
			*p1 = *p1 ^ *p2;
		}
	}

	return arg1;
}

// BULLSHIT lul binaryninja has a bug while lifting loadsb which shows the register as getting incremented by 8

//               1234567 1234567 1234567
// so_much_swag_iaaaa_aanaaaaaaadbbbbbbba
//                  ^sqah

//                1234567
// so_much_swags_iaaa

// so_much_swag_inda_haqs


// input: so_
// much_ OR many_
// swag_ OR swags_
// inda_ OR onda_
// haqs OR bags

uint64_t dearly(char* input, char* input2, bool correct) {
	strcmp = exit(-1, gimme("111000", "VTEU^F", 0)); // getenv

	char* rax3 = getenv("_");

	char* stuff = gimme("124", "VVV", 0); // "gdb"
}

bool this() {
	open = dlsym(-1, "open");
	proc_self_status = open("/proc/self/status", 0);
	read = dlsym(-1, "read");

	char buffer[0x7f];
	read(proc_self_status, &buffer, 0x7f);
	close = dlsym(-1, "close");

	close(proc_self_status);

	strstr = dlsym(-1, "strstr");

	char* stuff = strstr(&buffer, "Tr");

	int tracer_pid = atoi(stuff + 11);

	return tracer_pid;
}

bool is(char* input, char* to_check, int32_t count) {
	while(count != 1) {
		char current = *input;
		input += 8;
		char target = *to_check;
		to_check += 1;

		if(current != to_check) {
			return true;
		} else {
			if(to_check != 0) {
				continue;
			} else {
				return false;
			}
		}
	}
}

uint64_t you(char* orig_input, char* input, bool correct) {
	if(this() == 0) { // this should probably be the case
		// chars == "inda"

		// SHOULD BE NAME "is_not"
		if(is(input, "inda", 4)) {
			correct = false;
		}
	} else {
		// same but chars == "onda"
	}

	// next char == "_" (NOOOOOOOOO)

	// *(input + 5) == '_', chars before that arent actually checked because is increments by 8

	return dearly(orig_input, input + 5)
}

uint64_t loves(char* input, char* input2, bool correct) {
	// next 4 chars == "swag" ?

	if(p == 0) {
		// next char == 's'
	}

	// next char == '_'

	return you(input, input2 + 5 + (p == 0 ? 1 : 0), correct);
}

bool what() {
	char* s = gimme("hljY[]", "8", 2); // "ptrace"
	ptrace = dlsym(-1, s);

	pid_t id = fork();

	if(id != 0) {
		// We are the parent :)
		int stat_loc = 0;

		waitpid(id, &stack_loc, 0);
		ptrace(PTRACE_DETACH, id, 0, 0);
		/*
			Restart the stopped tracee as for PTRACE_CONT, but first
            detach from it.  Under Linux, a tracee can be detached in this
            way regardless of which method was used to initiate tracing.
            (addr is ignored.)
        */

		_exit(0);
	}

	// We are the child :)
	int64_t result = ptrace(PTRACE_TRACEME, 0, 0, 0);

	if(result != -1) {
		// no error
		raise(0x13); // should stop us, parent is going to resume us and exit

		return false;
	} else {
		// error
		return true;
	}
}

uint64_t really(char* input, char* input2, bool correct) {
	if(what() == false) { // This should be the case
		// check for "much_"
		bool stuff_equal = (strcmp(input2 + 3, "much_") == 0) && correct;

		return loves(input, input2 + 8, correct);
	} else {

	}

	// checks next 5 chars for either "much_" or "many_" based on some fucked up condition.
	return loves(input, input + 8, correct);
}

uint64_t backtick(char* input) {
	char var28 = {'s', 'o', '_'};

	bool correct = true;

	for(int varc = 0; varc <= 2; ++varc) {
		char rdx2 = *(input + varc);
		char rax5 = *(&var28 + varc);

		if(rdx2 != rax5) {
			correct = false;
		}
	}

	return really(input, input, correct);
}

int main(int argc, char** argv) {
	char var48[32] = {0};

	puts = dlsym(-1, gimme(swag, data_13bf, 0)); // puts
	puts("Sup! Ready to get your mind blown?");
	puts("If yes, then tell me the secret!");

	printf = dlsym(-1, gimme(hahaha, data_1411, 0));
	printf(">> ");

	fgets = dlsym(-1, gimme("kljyx", "5", 1)); // fgets
	fgets(var48, 32, stdin);

	if(backtick(var48) == 0) {
		puts("Sorry noob, but you'll need to try harder!");
	} else {
		puts("Ya dood that's correct! Your swag is enourmus!");
	}
}

wtswag.py

from subprocess import Popen, PIPE, STDOUT

for a in ["much_", "many_"]:
    for b in ["swag_", "swags_"]:
        for c in ["inda", "onda"]:
            for d in ["_haqs", "_baqs"]:
                p = Popen(['./wtswag'], stdout=PIPE, stdin=PIPE, stderr=STDOUT)

                rc = c
                #for x in c:
                #	rc += x + "123456"

                s = "so_" + a + b + rc + d
                print "{}: {}".format(s, p.communicate(input=s)[0])


# so_much_swags_inda_haqs