Flow in main:

• Read password → crypto_blake2b(password) → sprintf("%02x", ...) loop builds a hex digest buffer.
• Parts of that hex are parsed back with hex_to_bytes to form AES key/IV.
• AES-CBC is used to decrypt the fixed 32-byte ciphertext and print the result.

Nibble handling shows only the first two bytes of AES key and IV vary, derived from the tail of the hex digest. Effective search space:

• key[0] == iv[0] in 0..255
• key[1] == iv[1] in {0,16,32,...,240}
• Remaining bytes are 0x00

Exploit (constrained brute-force)

• Ciphertext (from .rodata):

• Try 256×16 keys/IVs, decrypt with AES-CBC, check PKCS#7, and look for scriptCTF{.
• Runner:

Matching bytes: key0==iv0=254, key1==iv1=240.

🏴 Flag

scriptCTF{00p513_n07_4641n!}