The - Khatrimaza-org-mkv

Our job is to that the challenge author has concealed somewhere inside the container. 2. Initial Recon $ file khatrimaza-org.mkv khatrimaza-org.mkv: Matroska data, video (V_MPEG4/ISO/AVC), audio (A_AAC), subtitle (S_TEXT/UTF8), 720p, 30 fps The file is a normal MKV with video, audio, and a subtitle track . Next we get a quick look at the container’s structure:

if __name__ == '__main__': if len(sys.argv) != 4: print(f'Usage: sys.argv[0] <input.bin> <key> <output.bin>') sys.exit(1) The Khatrimaza-org-mkv

ffprobe -show_streams video.h264 ffprobe -show_streams audio.aac Both streams look clean (no extra data or unusual codec parameters). We also run strings on them, but no flag‑like patterns appear. Our job is to that the challenge author

def xor(data, key): return bytes(b ^ k for b, k in zip(data, itertools.cycle(key))) Next we get a quick look at the

$ hexdump -C hidden.bin | head 00000000 42 49 4e 41 52 59 20 66 69 6c 65 20 73 69 67 6e |BINARY file sign| 00000010 61 74 75 72 65 20 70 72 6f 74 65 63 74 65 64 20 |ature protected | ... The first bytes read – looks like a custom marker added by the challenge creator. 5.2 Entropy check – is it compressed / encrypted? $ ent hidden.bin Entropy = 7.998997 bits per byte. Very high entropy (~8 bits/byte) – it is either compressed or encrypted. 5.3 Try common decompression tools We test a few common formats with binwalk :