Post cover image

July 12, 2026

TryHackMe CCT2019 Write-Up: Reverse Engineering Walkthrough Using ilspycmd

Hey everyone! 👋 In this TryHackMe walkthrough, we’ll tackle the reverse engineering challenge from the CCT2019 room, a collection of…

By A. AntorCSE404

7 min read

Hey everyone! 👋 In this TryHackMe walkthrough, we'll tackle the reverse engineering challenge from the CCT2019 room, a collection of legacy challenges originally created for the U.S. Navy Cyber Competition Team (CCT) 2019 Assessment and sponsored by U.S. TENTH Fleet****. We'll analyze the target binary, uncover its logic, and walk through the steps required to solve the challenge.

Room Link: https://tryhackme.com/room/cct2019

None

Task #2:

At first we have to download the file re3.exe. Then we have to check whether this file is really .exe. For this, we have to use the command:

$ file re3.exe
re3.exe: PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections

re3.exe is a 32‑bit Windows graphical application written in .NET, which can likely be decompiled back into readable C# code." Unlike native C/C++ binaries, .NET programs contain intermediate language (IL) code that can often be decompiled almost back into the original source code. This is exactly the hint you need for solving the reverse engineering challenge.

Before decompiling, we should run the exe file to understand its behavior. For my case, I will use my Windows machine.

None

I assumed that it's a sliders game. If you move the slider to the correct value and check, maybe it will reveal the flag. But we will not do it. Because guessing the correct value is too difficult. Instead of guessing, we will try to see its source code and game logic. To do this, we will use the tool ilspycmd.

$ ilspycmd re3.exe
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Drawing;
using System.Globalization;
using System.Reflection;
using System.Resources;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;
using System.Text;
using System.Windows.Forms;

[assembly: RuntimeCompatibility(WrapNonExceptionThrows = true)]
[assembly: AssemblyTitle("RE3  ")]
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
[assembly: TargetFramework(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")]
[assembly: Dotfuscator("000:0:2:5.0.2300.0", 2)]
[assembly: AssemblyDescription("")]
[assembly: AssemblyTrademark("")]
[assembly: CompilationRelaxations(8)]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("RE3  ")]
[assembly: AssemblyCopyright("Navy Cyber Competition Team 2019     ")]
[assembly: AssemblyConfiguration("")]
[assembly: ComVisible(false)]
[assembly: Guid("cd7ec975-154d-4ef3-bfd6-2983fc44ae86")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyVersion("0.0.0.0")]
[ComVisible(false)]
[AttributeUsage(AttributeTargets.Assembly)]
public sealed class DotfuscatorAttribute : Attribute
{
        private string a;

        private int c;

        public string A => a;

        public int C => c;

        public DotfuscatorAttribute(string a, int c)
        {
                this.a = a;
                this.c = c;
        }
}
namespace RE3  ;

[CompilerGenerated]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
internal sealed class Settings : ApplicationSettingsBase
{
        private static Settings a = (Settings)(object)SettingsBase.Synchronized((SettingsBase)(object)new Settings());

        public static Settings Default => a;
}
[CompilerGenerated]
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
[DebuggerNonUserCode]
internal class Resources
{
        private static ResourceManager a;

        private static CultureInfo b;

        [EditorBrowsable(EditorBrowsableState.Advanced)]
        internal static CultureInfo Culture
        {
                get
                {
                        return b;
                }
                set
                {
                        b = value;
                }
        }

        [EditorBrowsable(EditorBrowsableState.Advanced)]
        internal static ResourceManager ResourceManager
        {
                get
                {
                        if (object.ReferenceEquals(a, null))
                        {
                                ResourceManager resourceManager = new ResourceManager("RE3  \0\0\0\0\0\0\0.Properties.Resources", typeof(Resources).Assembly);
                                a = resourceManager;
                        }
                        return a;
                }
        }

        internal Resources()
        {
        }
}
internal static class b
{
        [STAThread]
        private static void Main()
        {
                Application.EnableVisualStyles();
                Application.SetCompatibleTextRenderingDefault(false);
                Application.Run((Form)(object)new a());
        }
}
public class a : Form
{
        private byte[] byteA = new byte[32]
        {
                20, 22, 100, 23, 21, 99, 100, 97, 99, 98,
                21, 97, 100, 97, 16, 21, 16, 23, 22, 17,
                98, 21, 102, 16, 23, 18, 19, 101, 17, 99,
                102, 18
        };

        private byte[] byteB = new byte[32]
        {
                125, 92, 93, 86, 19, 64, 91, 82, 95, 95,
                19, 67, 82, 64, 64, 18, 19, 114, 84, 82,
                90, 93, 12, 19, 116, 90, 69, 86, 19, 70,
                67, 12
        };

        private int c = 177;

        private int d = 51;

        private IContainer e;

        private GroupBox groupBox1;

        private Button checkButton;

        private HScrollBar bar1;

        private HScrollBar bar2;

        private HScrollBar bar3;

        private HScrollBar bar4;

        private Label bar1Label;

        private Label bar2Label;

        private Label bar3Label;

        private Label bar4Label;

        public a()
        {
                classA();
        }

        private void classA()
        {
                //IL_0001: Unknown result type (might be due to invalid IL or missing references)
                //IL_000b: Expected O, but got Unknown
                //IL_000c: Unknown result type (might be due to invalid IL or missing references)
                //IL_0016: Expected O, but got Unknown
                //IL_0017: Unknown result type (might be due to invalid IL or missing references)
                //IL_0021: Expected O, but got Unknown
                //IL_0022: Unknown result type (might be due to invalid IL or missing references)
                //IL_002c: Expected O, but got Unknown
                //IL_002d: Unknown result type (might be due to invalid IL or missing references)
                //IL_0037: Expected O, but got Unknown
                //IL_0038: Unknown result type (might be due to invalid IL or missing references)
                //IL_0042: Expected O, but got Unknown
                //IL_0043: Unknown result type (might be due to invalid IL or missing references)
                //IL_004d: Expected O, but got Unknown
                //IL_004e: Unknown result type (might be due to invalid IL or missing references)
                //IL_0058: Expected O, but got Unknown
                //IL_0059: Unknown result type (might be due to invalid IL or missing references)
                //IL_0063: Expected O, but got Unknown
                //IL_0064: Unknown result type (might be due to invalid IL or missing references)
                //IL_006e: Expected O, but got Unknown
                //IL_0377: Unknown result type (might be due to invalid IL or missing references)
                //IL_0381: Expected O, but got Unknown
                //IL_03d4: Unknown result type (might be due to invalid IL or missing references)
                //IL_03de: Expected O, but got Unknown
                //IL_0431: Unknown result type (might be due to invalid IL or missing references)
                //IL_043b: Expected O, but got Unknown
                //IL_0491: Unknown result type (might be due to invalid IL or missing references)
                //IL_049b: Expected O, but got Unknown
                groupBox1 = new GroupBox();
                bar1Label = new Label();
                bar2Label = new Label();
                bar3Label = new Label();
                bar4Label = new Label();
                bar1 = new HScrollBar();
                bar2 = new HScrollBar();
                bar3 = new HScrollBar();
                bar4 = new HScrollBar();
                checkButton = new Button();
                ((Control)groupBox1).SuspendLayout();
                ((Control)this).SuspendLayout();
                ((Control)groupBox1).Controls.Add((Control)(object)bar1Label);
                ((Control)groupBox1).Controls.Add((Control)(object)bar2Label);
                ((Control)groupBox1).Controls.Add((Control)(object)bar3Label);
                ((Control)groupBox1).Controls.Add((Control)(object)bar4Label);
                ((Control)groupBox1).Controls.Add((Control)(object)bar1);
                ((Control)groupBox1).Controls.Add((Control)(object)bar2);
                ((Control)groupBox1).Controls.Add((Control)(object)bar3);
                ((Control)groupBox1).Controls.Add((Control)(object)bar4);
                ((Control)groupBox1).Location = new Point(12, 12);
                ((Control)groupBox1).Name = "groupBox1";
                ((Control)groupBox1).Size = new Size(713, 240);
                ((Control)groupBox1).TabIndex = 0;
                groupBox1.TabStop = false;
                ((Control)groupBox1).Text = "Sliders";
                ((Control)bar1Label).AutoSize = true;
                ((Control)bar1Label).Location = new Point(423, 31);
                ((Control)bar1Label).Name = "valueText1";
                ((Control)bar1Label).Size = new Size(11, 12);
                ((Control)bar1Label).TabIndex = 3;
                ((Control)bar1Label).Text = "0";
                ((Control)bar2Label).AutoSize = true;
                ((Control)bar2Label).Location = new Point(423, 68);
                ((Control)bar2Label).Name = "valueText2";
                ((Control)bar2Label).Size = new Size(11, 12);
                ((Control)bar2Label).TabIndex = 4;
                ((Control)bar2Label).Text = "0";
                ((Control)bar3Label).AutoSize = true;
                ((Control)bar3Label).Location = new Point(423, 106);
                ((Control)bar3Label).Name = "valueText3";
                ((Control)bar3Label).Size = new Size(11, 12);
                ((Control)bar3Label).TabIndex = 5;
                ((Control)bar3Label).Text = "0";
                ((Control)bar4Label).AutoSize = true;
                ((Control)bar4Label).Location = new Point(423, 148);
                ((Control)bar4Label).Name = "valueText4";
                ((Control)bar4Label).Size = new Size(11, 12);
                ((Control)bar4Label).TabIndex = 5;
                ((Control)bar4Label).Text = "0";
                ((Control)bar1).Location = new Point(3, 26);
                ((Control)bar1).Name = "valueBar1";
                ((Control)bar1).Size = new Size(401, 17);
                ((Control)bar1).TabIndex = 0;
                ((ScrollBar)bar1).Scroll += new ScrollEventHandler(scrollEventHandlerA);
                ((Control)bar2).Location = new Point(3, 63);
                ((Control)bar2).Name = "valueBar2";
                ((Control)bar2).Size = new Size(401, 17);
                ((Control)bar2).TabIndex = 1;
                ((ScrollBar)bar2).Scroll += new ScrollEventHandler(scrollEventHandlerB);
                ((Control)bar3).Location = new Point(3, 101);
                ((Control)bar3).Name = "valueBar3";
                ((Control)bar3).Size = new Size(401, 17);
                ((Control)bar3).TabIndex = 2;
                ((ScrollBar)bar3).Scroll += new ScrollEventHandler(scrollEventHandlerC);
                ((Control)bar4).Location = new Point(3, 143);
                ((Control)bar4).Name = "valueBar4";
                ((Control)bar4).Size = new Size(401, 17);
                ((Control)bar4).TabIndex = 1;
                ((ScrollBar)bar4).Scroll += new ScrollEventHandler(scrollEventHandlerD);
                ((Control)checkButton).Location = new Point(394, 197);
                ((Control)checkButton).Name = "checkButton";
                ((Control)checkButton).Size = new Size(75, 23);
                ((Control)checkButton).TabIndex = 1;
                ((Control)checkButton).Text = "Check!";
                ((ButtonBase)checkButton).UseVisualStyleBackColor = true;
                ((Control)checkButton).Click += eventHandlerA;
                ((ContainerControl)this).AutoScaleDimensions = new SizeF(7f, 12f);
                ((ContainerControl)this).AutoScaleMode = (AutoScaleMode)1;
                ((Form)this).ClientSize = new Size(481, 243);
                ((Control)this).Controls.Add((Control)(object)checkButton);
                ((Control)this).Controls.Add((Control)(object)groupBox1);
                ((Control)this).Name = "RE3  ";
                ((Control)this).Text = "RE3  ";
                ((Form)this).Load += eventHandlerB;
                ((Control)groupBox1).ResumeLayout(false);
                ((Control)groupBox1).PerformLayout();
                ((Control)this).ResumeLayout(false);
        }

        private void eventHandlerA(object A_0, EventArgs A_1)
        {
                //IL_009b: Unknown result type (might be due to invalid IL or missing references)
                //IL_007a: Unknown result type (might be due to invalid IL or missing references)
                int value = ((ScrollBar)bar1).Value;
                int value2 = ((ScrollBar)bar2).Value;
                int value3 = ((ScrollBar)bar3).Value;
                int value4 = ((ScrollBar)bar4).Value;
                int num = 711;
                int num2 = 711000000;
                if (value + value2 + value3 + value4 == num && value * value2 * value3 * value4 == num2 && value > value2 && value2 > value3 && value3 > value4)
                {
                        MessageBox.Show(goodBoy(value, value2, value3, value4, (byte[])byteA.Clone()));
                }
                else
                {
                        MessageBox.Show(badBoy(value, value2, value3, value4, (byte[])byteA.Clone()));
                }
        }

        private void scrollEventHandlerA(object A_0, ScrollEventArgs A_1)
        {
                ((Control)bar1Label).Text = ((ScrollBar)bar1).Value.ToString();
        }

        private string badBoy(int A_0, int A_1, int A_2, int A_4, byte[] A_3)
        {
                for (int i = 0; i < A_3.Length; i++)
                {
                        A_3[i] = (byte)(byteB[i] ^ d);
                }
                return Encoding.ASCII.GetString(A_3);
        }

        private void eventHandlerB(object A_0, EventArgs A_1)
        {
                ((ScrollBar)bar1).Maximum = 1032;
                ((ScrollBar)bar2).Maximum = 1032;
                ((ScrollBar)bar3).Maximum = 1032;
                ((ScrollBar)bar4).Maximum = 1032;
        }

        private void scrollEventHandlerB(object A_0, ScrollEventArgs A_1)
        {
                ((Control)bar2Label).Text = ((ScrollBar)bar2).Value.ToString();
        }

        private string goodBoy(int A_0, int A_1, int A_2, int A_4, byte[] A_3)
        {
                for (int i = 0; i < A_3.Length; i++)
                {
                        A_3[i] ^= (byte)(c ^ A_1);
                }
                return Encoding.ASCII.GetString(A_3);
        }

        private void scrollEventHandlerC(object A_0, ScrollEventArgs A_1)
        {
                ((Control)bar3Label).Text = ((ScrollBar)bar3).Value.ToString();
        }

        private void scrollEventHandlerD(object A_0, ScrollEventArgs A_1)
        {
                ((Control)bar4Label).Text = ((ScrollBar)bar4).Value.ToString();
        }

        protected override void Dispose(bool disposing)
        {
                if (disposing && e != null)
                {
                        e.Dispose();
                }
                ((Form)this).Dispose(disposing);
        }
}
You are not using the latest version of the tool, please update.
Latest version is '10.1.0.8386' (yours is '8.2.0.7535-95108c96')

Analyze the Validation Logic. The program contains four sliders:

bar1
bar2
bar3
bar4

When the Check! button is pressed, the program checks the following:

int value  = bar1.Value;
int value2 = bar2.Value;
int value3 = bar3.Value;
int value4 = bar4.Value;

if (
    value + value2 + value3 + value4 == 711 &&
    value * value2 * value3 * value4 == 711000000 &&
    value > value2 &&
    value2 > value3 &&
    value3 > value4
)
{
    MessageBox.Show(goodBoy(...));
}
else
{
    MessageBox.Show(badBoy(...));
}

Therefore, we need to find four slider values satisfying:

a + b + c + d = 711

a × b × c × d = 711000000

a > b > c > d

The constraints can be solved using Python:

from itertools import permutations

target_sum = 711
target_product = 711000000

for values in permutations(range(1,1033),4):
    a,b,c,d = values

    if (
        a+b+c+d == target_sum and
        a*b*c*d == target_product and
        a>b>c>d
    ):
        print(values)
        break

The valid slider values are:

bar1 = 316
bar2 = 150
bar3 = 125
bar4 = 120

These satisfy:

316 + 150 + 125 + 120 = 711

316 × 150 × 125 × 120 = 711000000

Analyze the Flag Generation Function:

private string goodBoy(
    int A_0,
    int A_1,
    int A_2,
    int A_4,
    byte[] A_3
)
{
    for (int i = 0; i < A_3.Length; i++)
    {
        A_3[i] ^= (byte)(c ^ A_1);
    }

    return Encoding.ASCII.GetString(A_3);
}

The important variables:

private int c = 177;

and

byte[] byteA =
{
    20,22,100,23,21,99,100,97,
    99,98,21,97,100,97,16,21,
    16,23,22,17,98,21,102,16,
    23,18,19,101,17,99,102,18
};

The XOR key is:

key = c ^ bar2

Substituting the correct bar2 value:

key = 177 ^ 150

key = 59

Decode the Hidden Value:

byteA[i] XOR 59

Using Python:

byteA = [
20,22,100,23,21,99,100,97,
99,98,21,97,100,97,16,21,
16,23,22,17,98,21,102,16,
23,18,19,101,17,99,102,18
]

key = 59

flag = ''.join(chr(x ^ key) for x in byteA)

print(flag)

**Flag: ******CF727016E2A7

This challenge highlighted the importance of understanding application logic during reverse engineering. By decompiling the .NET executable, analyzing the validation conditions, and reversing the XOR-based encoding mechanism, we were able to uncover the hidden flag successfully. This demonstrates how static analysis can reveal the inner workings of compiled applications and simplify the process of solving reverse engineering challenges.

If you enjoyed this write-up, consider following me (A. AntorCSE404) for more CTF challenges, and feel free to leave feedback — I'd love to learn and improve!