search
TwitterGithub

Reverse Engineering

Challenge
Link

rox (464 pts)

Here

hashtag
rox (464 pts)

hashtag
Description

I'm trying to find the password in a sea of flags... something's weird about this file.

Note: please enclose the flag in csawctf{} before submitting, i.e. csawctf{fake_flag}

hashtag
Solution

We need freebsd operating system to debug the binary. Since i don't have freebsd virtual machine i just do static analysis to solve the challenge. Taking a look on main function

Verify function processed our input with some algorithm and at the end it compared our processed input with static value which is "flag{ph3w...u finaLly g0t it! jump into cell wHen U g3t t0 the next cha11}"

We know v28 values but there are data variable that we don't know the value since the variable not initialized in verify function. By clicking the data variable we will go to the bss section that stored data variable

There are some functions that use data as operand, take a look on corss reference we will see list like below

We can see that there is function __static_initialization_and_destruction_0 that use data variable, go to that function

memcpy function copy values from asc_403740 to data variable, so for now we have all values needed for the algorithm. Next we just need to reconstruct the code in python

Analyzing the input and output we can confirm that the algorithm processed our input each byte and validated it each byte. So to get the correct values we can just bruteforce each byte. Here is the solver

Flag : csawctf{aN0ther_HeRRing_or_iS_tHis_iT}

PreviousCSAW QualsNextSECCON Quals

Last updated