XOR

Reversing a repeating-key XOR crackme that downloads the flag from catbox.moe.

Recovering a flag hidden via stack-string construction and XOR obfuscation.

A ‘pwn’ binary with no input is really a static-reversing puzzle: a fake usleep loop would take days and a fake integrity check always passes, so reading the constants and undoing a single-byte XOR yields the flag without ever waiting.

A homemade RSA-CRT signer leaks a correct and a faulted signature of the same message; gcd(s − spz, n) factors n (the Bellcore attack), while the trivial shortcut just recovers the message via s^e mod n — and the XOR ‘protection’ undoes itself.

A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password.