[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6},"actionData","errors","routes/custom-page",{"_7":8},"page",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":22,"_24":25,"_26":27},"id","aeb78ecf-fdc9-4f2b-997c-b3cda7cef533","title","Rolling Silence Wrietup","slug","rolling-silence","html_content","

Rolling Silence — CTF Writeup

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Details
Challenge	Rolling Silence
Category	Crypto / Reverse Engineering
Platform	BPCTF (Mallareddy CTF)
Flag Format	`BPCTF{ ... }`
Difficulty	Medium
Date	14 Feb 2026

Challenge Description

\n
ChallengeCrypto2 – Rolling Silence
\n
A stripped ELF64 binary that seems silent and harmless — no input, no visible output, no stored key. But something does happen at runtime. The flag is hidden behind a rolling transformation where each step depends on the last — it's not as quiet as it looks. Reverse it, follow the state changes, and uncover the flag. Good luck!
\n

TL;DR

A 26-byte ciphertext blob at .rodata is XOR-decrypted in-place by a rolling key that starts at 0x89 and mutates every iteration via ADD → ROL → XOR. The binary never outputs the plaintext—it just processes and exits. Reversing the key schedule and applying it to the ciphertext yields the flag:

bpctf{registers_are_state}\n

Step 1 — Initial Reconnaissance

File Identification

$ file rollingsilence\nrollingsilence: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped\n\n$ ls -la rollingsilence\n-rw-r--r-- 1 bash0x1 bash0x1 8504 Feb 14 11:08 rollingsilence\n

Key observations:

Stripped — no symbol names, no debug info
Statically linked — no shared libraries; entirely self-contained
Tiny — only 8.5 KB, strongly suggesting a hand-crafted assembly binary

Strings Check

$ strings rollingsilence\n        - b\n.shstrtab\n.text\n.rodata\n

No readable strings, no flag fragments, no format strings. The binary is intentionally "silent."

Running It

$ chmod +x rollingsilence\n$ ./rollingsilence\n$   # (no output, exits immediately)\n

The binary exits cleanly with zero output. This confirms the challenge description — it processes data internally but never prints anything.

Step 2 — Binary Structure Analysis

Section Headers (via `readelf -a`)

Section Headers:\n  [Nr] Name       Type       Address            Offset   Size\n  [ 1] .text      PROGBITS   0x0000000000401000 0x1000   0x28  (40 bytes)\n  [ 2] .rodata    PROGBITS   0x0000000000402000 0x2000   0x1a  (26 bytes)\n

Only two meaningful sections:

.text — 40 bytes of executable code (the entire program logic)
.rodata — 26 bytes of read-only data (the encrypted flag)

The binary has no .data, no .bss, no imports. It's pure hand-written x86-64 assembly with embedded encrypted data.

Step 3 — Full Disassembly & Analysis

Complete Disassembly

$ objdump -d rollingsilence\n

0000000000401000 <.text>:\n  401000:   48 31 ff              xor    %rdi,%rdi          ; i = 0\n  401003:   b0 89                 mov    $0x89,%al           ; key = 0x89\n\n  ; ─── Loop Entry ────────────────────────────────────\n  401005:   48 83 ff 1a           cmp    $0x1a,%rdi          ; if (i >= 26)\n  401009:   7d 14                 jge    0x40101f             ;     goto exit\n\n  ; ─── Decryption Step ───────────────────────────────\n  40100b:   8a 9f 00 20 40 00     mov    0x402000(%rdi),%bl  ; bl = data[i]\n  401011:   30 c3                 xor    %al,%bl             ; bl ^= key   (decrypt)\n\n  ; ─── Key Evolution ─────────────────────────────────\n  401013:   40 00 f8              add    %dil,%al            ; key += i\n  401016:   d0 c0                 rol    $1,%al              ; key = ROL(key, 1)\n  401018:   34 a5                 xor    $0xa5,%al           ; key ^= 0xa5\n\n  ; ─── Loop Increment ───────────────────────────────\n  40101a:   48 ff c7              inc    %rdi                ; i++\n  40101d:   eb e6                 jmp    0x401005             ; continue loop\n\n  ; ─── Clean Exit ────────────────────────────────────\n  40101f:   b8 3c 00 00 00        mov    $0x3c,%eax          ; syscall = exit\n  401024:   31 ff                 xor    %edi,%edi           ; status = 0\n  401026:   0f 05                 syscall                    ; exit(0)\n

Pseudocode Reconstruction

void _start() {\n    uint8_t key = 0x89;\n    uint8_t *data = (uint8_t *)0x402000;  // .rodata: 26 encrypted bytes\n\n    for (int i = 0; i < 26; i++) {\n        uint8_t plaintext = data[i] ^ key;   // XOR decrypt\n        // key evolution (rolling transformation):\n        key = (key + i) & 0xFF;\n        key = ROL8(key, 1);                  // rotate left 1 bit\n        key = key ^ 0xA5;\n    }\n    exit(0);  // syscall 60\n}\n

Key Observations

Decryption happens before the key update — plaintext = data[i] ^ key, then the key mutates.
The key state is rolling — each key depends on the previous key and the loop counter i, making each byte's key unique and order-dependent.
The plaintext is never stored or output — bl gets the decrypted value but it's never written to memory or printed via a syscall. The "silence" is literal.
No stored key — the initial seed 0x89 is encoded directly in the instruction stream (mov $0x89, %al), not in .rodata.

Step 4 — Extracting the Ciphertext

Hex Dump of `.rodata`

$ xxd -s 0x2000 -l 0x1a rollingsilence\n00002000: ebc6 a948 bd61 e983 19c1 b570 de58 b849  ...H.a.....p.X.I\n00002010: 8e28 16f1 55a5 092d 2062                 .(..U..- b\n

26 encrypted bytes:

eb c6 a9 48 bd 61 e9 83 19 c1 b5 70 de 58 b8 49\n8e 28 16 f1 55 a5 09 2d 20 62\n

Step 5 — Writing the Solver

Understanding the Key Schedule

The "rolling" key transformation operates on an 8-bit register (al):

Initial: key = 0x89\n\nFor each iteration i (0 to 25):\n  1. plaintext[i] = ciphertext[i] XOR key\n  2. key = key + i           (mod 256)\n  3. key = ROL(key, 1)       (8-bit rotate left by 1)\n  4. key = key XOR 0xA5\n

ROL(x, 1) rotates the 8-bit value left by 1 position:

ROL(x, 1) = ((x << 1) | (x >> 7)) & 0xFF\n

For example: ROL(0x89, 1) → 0x89 = 10001001 → 00010011 = 0x13

Python Solver

#!/usr/bin/env python3\n\"\"\"Solver for Rolling Silence CTF challenge\"\"\"\n\ndef rol8(val, n):\n    \"\"\"Rotate left an 8-bit value by n bits\"\"\"\n    val &= 0xFF\n    return ((val << n) | (val >> (8 - n))) & 0xFF\n\n# Encrypted data from .rodata at 0x402000\ndata = bytes([\n    0xeb, 0xc6, 0xa9, 0x48, 0xbd, 0x61, 0xe9, 0x83,\n    0x19, 0xc1, 0xb5, 0x70, 0xde, 0x58, 0xb8, 0x49,\n    0x8e, 0x28, 0x16, 0xf1, 0x55, 0xa5, 0x09, 0x2d,\n    0x20, 0x62\n])\n\nkey = 0x89  # Initial key from: mov $0x89, %al\nflag = []\n\nfor i in range(0x1a):  # 26 iterations\n    plaintext = data[i] ^ key\n    flag.append(plaintext)\n    # Key evolution\n    key = (key + i) & 0xFF\n    key = rol8(key, 1)\n    key ^= 0xA5\n\nprint(bytes(flag).decode('ascii'))\n

Step 6 — Full Key Schedule Trace

Below is the complete trace of the rolling key and decryption, showing every state change:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

`i`	Ciphertext	Key (before XOR)	Plaintext	Char	Key Update Steps
0	`0xEB`	`0x89`	`0x62`	`b`	`0x89 + 0 = 0x89` → `ROL = 0x13` → `^ 0xA5 = 0xB6`
1	`0xC6`	`0xB6`	`0x70`	`p`	`0xB6 + 1 = 0xB7` → `ROL = 0x6F` → `^ 0xA5 = 0xCA`
2	`0xA9`	`0xCA`	`0x63`	`c`	`0xCA + 2 = 0xCC` → `ROL = 0x99` → `^ 0xA5 = 0x3C`
3	`0x48`	`0x3C`	`0x74`	`t`	`0x3C + 3 = 0x3F` → `ROL = 0x7E` → `^ 0xA5 = 0xDB`
4	`0xBD`	`0xDB`	`0x66`	`f`	`0xDB + 4 = 0xDF` → `ROL = 0xBF` → `^ 0xA5 = 0x1A`
5	`0x61`	`0x1A`	`0x7B`	`{`	`0x1A + 5 = 0x1F` → `ROL = 0x3E` → `^ 0xA5 = 0x9B`
6	`0xE9`	`0x9B`	`0x72`	`r`	`0x9B + 6 = 0xA1` → `ROL = 0x43` → `^ 0xA5 = 0xE6`
7	`0x83`	`0xE6`	`0x65`	`e`	`0xE6 + 7 = 0xED` → `ROL = 0xDB` → `^ 0xA5 = 0x7E`
8	`0x19`	`0x7E`	`0x67`	`g`	`0x7E + 8 = 0x86` → `ROL = 0x0D` → `^ 0xA5 = 0xA8`
9	`0xC1`	`0xA8`	`0x69`	`i`	`0xA8 + 9 = 0xB1` → `ROL = 0x63` → `^ 0xA5 = 0xC6`
10	`0xB5`	`0xC6`	`0x73`	`s`	`0xC6 + A = 0xD0` → `ROL = 0xA1` → `^ 0xA5 = 0x04`
11	`0x70`	`0x04`	`0x74`	`t`	`0x04 + B = 0x0F` → `ROL = 0x1E` → `^ 0xA5 = 0xBB`
12	`0xDE`	`0xBB`	`0x65`	`e`	`0xBB + C = 0xC7` → `ROL = 0x8F` → `^ 0xA5 = 0x2A`
13	`0x58`	`0x2A`	`0x72`	`r`	`0x2A + D = 0x37` → `ROL = 0x6E` → `^ 0xA5 = 0xCB`
14	`0xB8`	`0xCB`	`0x73`	`s`	`0xCB + E = 0xD9` → `ROL = 0xB3` → `^ 0xA5 = 0x16`
15	`0x49`	`0x16`	`0x5F`	`_`	`0x16 + F = 0x25` → `ROL = 0x4A` → `^ 0xA5 = 0xEF`
16	`0x8E`	`0xEF`	`0x61`	`a`	`0xEF + 10 = 0xFF` → `ROL = 0xFF` → `^ 0xA5 = 0x5A`
17	`0x28`	`0x5A`	`0x72`	`r`	`0x5A + 11 = 0x6B` → `ROL = 0xD6` → `^ 0xA5 = 0x73`
18	`0x16`	`0x73`	`0x65`	`e`	`0x73 + 12 = 0x85` → `ROL = 0x0B` → `^ 0xA5 = 0xAE`
19	`0xF1`	`0xAE`	`0x5F`	`_`	`0xAE + 13 = 0xC1` → `ROL = 0x83` → `^ 0xA5 = 0x26`
20	`0x55`	`0x26`	`0x73`	`s`	`0x26 + 14 = 0x3A` → `ROL = 0x74` → `^ 0xA5 = 0xD1`
21	`0xA5`	`0xD1`	`0x74`	`t`	`0xD1 + 15 = 0xE6` → `ROL = 0xCD` → `^ 0xA5 = 0x68`
22	`0x09`	`0x68`	`0x61`	`a`	`0x68 + 16 = 0x7E` → `ROL = 0xFC` → `^ 0xA5 = 0x59`
23	`0x2D`	`0x59`	`0x74`	`t`	`0x59 + 17 = 0x70` → `ROL = 0xE0` → `^ 0xA5 = 0x45`
24	`0x20`	`0x45`	`0x65`	`e`	`0x45 + 18 = 0x5D` → `ROL = 0xBA` → `^ 0xA5 = 0x1F`
25	`0x62`	`0x1F`	`0x7D`	`}`	— (final iteration)

Decrypted Flag

b  p  c  t  f  {  r  e  g  i  s  t  e  r  s  _  a  r  e  _  s  t  a  t  e  }\n

Flag

bpctf{registers_are_state}\n

Technical Deep Dive

Why Is It "Silent"?

The challenge title is "Rolling Silence" — and the binary literally produces no output. Looking at the code:

The xor %al, %bl instruction at 0x401011 computes the plaintext into register bl.
But bl is never written back to memory and never passed to a write/print syscall.
The only syscall is exit(0) at the end.

The decrypted flag exists only ephemerally in a CPU register during execution — registers truly are the state. This is the meta-message of the flag itself: registers_are_state.

The Rolling Key Cipher

This is a stream cipher with a non-linear key schedule. The three key update operations create a non-trivial evolution:

key = (key + i) mod 256     ← linear, counter-dependent\nkey = ROL(key, 1)           ← non-linear bit permutation\nkey = key XOR 0xA5          ← constant masking\n

Each transformation alone is trivially reversible, but their composition creates a key stream that looks pseudo-random without analysis. Critically:

The ADD i makes the key schedule position-dependent
The ROL creates bit diffusion (a single-bit change propagates)
The XOR 0xA5 adds a constant perturbation

Despite this, the cipher is deterministic with no secret — the initial key 0x89 is embedded in plaintext in the instruction stream. Reversing only requires reading the code.

Why Statically Linked & Stripped?

Stripped: Removes all symbol names, preventing easy identification of functions
Statically linked: No dependency on libc; the entire program is pure syscalls, making it look more intimidating and harder to trace with typical library-level tools (ltrace fails, strace shows only exit(0))

Tools Used