The program asks questions, does the sha1 of the answer and uses it to decrypt a file using AES (encrypted files are embedded in the binary by means of xxd). Decrypted files are memes, and have the next answer written into them by means of steganography. The flag is in the last file. This creats a bootstrap problem: how to get the answer to the first question? Well, you can't. But the the first file is a bitmap encoded using AES ECB (the other two use CTR). So you can look through the encryption and see the answer. Binary was stripped and compressed with upx. Solution: $ ./memento Which question? 0 How to solve the chicken and egg problem? ^C $ ./memento Which question? 1 What have I been? ^C $ ./memento Which question? 2 What do I need to go ahead? ^C $ ./memento Which question? 3 $ Ok, 0, 1 and 2 produce a question. Reversing the binary and extracting the ECB-encrypted bmp one can get the first answer: Tro11d Using this as the answer to question 1 one gets a nyan cat audio file. Looking at the spectrum with audacity one gets: Thek3yt0th3n3xtl3v3l that is the answer to question 2. This gives you a jpeg with a trollface comics. Using steghide with an empty passphrase passphrase you finally get: $ steghide info 2.jpg "2.jpg": format: jpeg capacity: 6.1 KB Try to get information about embedded data ? (y/n) y Enter passphrase: embedded file "flag.txt": size: 62.0 Byte encrypted: rijndael-128, cbc compressed: yes $ steghide extract -sf 2.jpg Enter passphrase: wrote extracted data to "flag.txt". $ cat flag.txt MGZmMzE1MTI5YjkxNGYzZjk1NzFjNDc0ODIxYzI0ZmUxYzE3YTEzMiAgLQo= Key is in base64, last step is: $ cat flag.txt | base64 -d 0ff315129b914f3f9571c474821c24fe1c17a132 Hints: The file obtained through question N contains the answer of question N+1