Reverse Engineering
beginners_rev_2023 (189 pts)
Description
Let's just deal with them one by one, shall we?
Solution
Given PE32+ executable, open it using IDA
We can see that there are some unknown function such as sub_140001020 and sub_140001000. Take a look on each function we can know what is those function do
To help us carry out static analysis, we rename those function.
We can see the program receive our input on line 28 using scanf function, but there is a function that executed before our input received which is sub_140001480.
Function sub_140001480 is custom function and the result from that function is static.
So basically we can dump the values and use it for next step without reimplement the function. After receiving our input, the program processed our input with custom algorithm again.
So there is little obfuscation regarding the index of input, but we can easily analyze it
So basically it loop from index 0 until index 31 (32 iteration), but since v8 value is 2 so it do iteration for index 0 until index 63 (64 iteration). Here is the implementation on python.
Next, we take a look on function sub_1400010E0.
The algorithm has pattern, so we just need to deobfuscate the first part then just loop the rest.
To validate the last part (xor part), we can debug the executable and breakpoint on instruction below
After we know how the algorithm processed our input and static values now we just need to reimplement it on python
Back to main function, returned values from sub_7FF7293A10E0 processed with the same algorithm like previous part.
Since we've reimplement it on python we can reuse the code. Here is the final script to implement the whole algorithm.
Now, we assume that those algorhtm encrypt our input. So the next step we do is figuring out how to implement the decryption routine.
sub_7FF671F610E0
Encryption routine : xor processed input (a2) with static values (a1/SBOX)
Decyption routine : xor processed input (a2) with static values (a1/SBOX)
Xor shift part
Encryption routine : the algorithm looks like grey code but with shift 12
Decryption routine : implement rev grey code with shift 12 (https://github.com/hellman/libnum/blob/master/libnum/stuff.py#L10)
Last step just implement decryption routine with above information then decrypt ciphertext of flag. Here is the implementation in python.
Flag : TSGCTF{y0u_w0uld_und3r57and_h0w_70_d3cryp7_arc4_and_h0w_70_d3cryp7_7h3_l3ak3d_5af3_l1nk1ng_p01n73r}
T the weakest (215 pts)
Description
TγAHHHHHH!γ SγLOOKS LIKE T IS DEFEATEDγ GγHEH. HE'S ALWAYS THE WEAKEST OF THE BIG ONE HUNDRED.γ CγLOSING TO A MERE MORTAL. WHAT A DISGRANCE TO TSG-ER.γ
Solution
Given ELF 64 bit, open it using IDA
So IDA cant decompile it and when i try to edit the stack IDA still cant decompile it. Next, i try to open it using ghidra. Looking at start function, we found the main address which is LAB_001010a0.
From pseudocode we can see the big picture of the program but there still some part that easier to analyze on assembly part. Here is the big picture of the whole executable
FUN_00101255(), print "ng" then exit
If there is no argument provided, the program will exit by calling FUN_00101255
If argv[1] (first argument) is not "T" the program will exit by calling FUN_00101255.
Program will call memfd_create using syscall then write data to it. After write done, execute the written data on fd/x using execv function with the next byte of our first argument (argv[1] + 1).
From above information, i tried to implement automation using gdb scripting. In this case i try to implement flow below automatically with my script.
Check the main address is correct by analyzing the first instruction
Set pie breakpoint and delete pie breakpoint
If input is correct, it will call write function that has known pattern in assembly. So dump the new executable if it call write function then move to new executable.
Check if char has been found or not, if char not found so there is something different with the new executable
Last flag we got is TSGCTF{hint_do_script, so check the newest executable then decompile it using ghidra.
main function on t21 is on address 001010b0.
t21 check environment variable LINES and COLUMNS, if there is environment variable LINES and COLUMNS it will automatically exit the program by calling FUN_0010285 function. So to bypass this validation we need to add unset environment command in our automation script. Besides that we need to add address 0x001010b0 in list of main function. Here is the modified script
Okay, t26 is different. Open it using ghidra
There is new validation which compare (returned values from malloc) - rdx with 0x20000. To bypass this we just need to set rax value to > 0x20000 on address 0x1010d8. Here is the modified script
Open t41 using ghidra.
It use LAB_001010c0 as main address, open main function
It calls signal function that will exit program in particular time. So to bypass this we can just skip the call process of signal function. We can skip it by set the rip register to next instruction which has different 0x5 with call signal address.
Open t59 using ghidra.
t59 use LAB_001010e0 as main function, open main function.
It compare the return of ptrace function with 0 after incremented it. So to bypass it we just need to set the rax value to valid value, such as for INC RAX -> JNZ we can set RAX to 0xffffffffffffffff, for INC RAX -> JZ we can set RAX to 0x0. Here is the modified script
Open t60 using ghidra
t60 only has diffeerent on main address. So just add 0x1100 in poss_main array.
t64 also has different in main address, so just add 0x10f0 in poss_main array.
Got sigsegv on t84, open it using ghidra
It use 0x1010d0 as main address, so add it to poss_main array.
Here is the final script
Flag : TSGCTF{hint_do_scripting_RdJ5GNjKkUidxjcGN4o7j5Wxz1Feo19Q0_hop3_you_did_no7_s0lve_manu4l1y_vNbwVTKw}
Conduit (470 pts)
Description
Solution
Natural Flag Processing 2 (470 pts)
Description
Solution
Nets (500 pts)
Description
Solution
mimetic_cycle (500 pts)
Description
Solution
Frictionless (500 pts)
Description
Solution
Last updated