You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
im making a CTF challenge writeup. im kind of drunk. can u please clean this up a bit for me? thanks
4
+
***
5
+
okkkkk this one is a windows driver, the userland component basically does nothing so just ignore it. just look at the driver, the driver entry basically sets up an ioctl, when you call the ioctl you can pass in some cmd number to the driver, then the driver does a thing depending on what the number is.
6
+
7
+
its a flag decrypter challenge . the binary decrpyt hte flag, figure out what right input is and that will affect the decrpyiton, make the decrpyiton happy to get the flag.
8
+
9
+
basically if u do some number from like 0x222000,0x222020,0x222030, ... 0x222070 etc it will do something with the corresponding number 0 thru 7. theres 8 of these thingys and then it will set the done flag for that thingy to 1. looks like we gotta collect all the thingys (atleast once) before it will let us do the needful. so this itself is a bit of a hint from the author that we need a permutation, strictly speaking we dont need a permutation because it could be one or more so whatever.
10
+
11
+
so anyways each of the thingys basically just xors some of the code in the driver so its some selfm odifying code, it xors the code of this univariate scalar function that operates on uint32s, then calls that on the flag so basically we gotta find the right sequence of things to xor the mathy scalary function on and then do it in the right order and do it for the 8 thingys to decrypt the flag, oh no what order is it? u can write a backdtracking algorithm to solve this but my hunch was right that theres no funny business backtracking needed since if u start from each element of the permutation theres actually only 1 possible valid thingy there so its not 8! u only have to do 8^2 tries.
12
+
13
+
also i used unicorn engine to emulate the thing since im lazy i had kdnet setup and all but i dont wanna fucking blue screen. i put the solve script in cocksleeve.py plz check it out its also good documentation on how to use unicorn because that shits really poorly documented
14
+
***
15
+
include all of the details. when u make the writeup make sure to organize it clearly with section headings and everything
16
+
```
17
+
18
+
CTF Challenge: Flag Decrypter
19
+
20
+
Overview:
21
+
22
+
The challenge is a Windows driver with a userland component that does nothing. The driver entry sets up an ioctl, which when called with a specific cmd number, performs an action depending on the number provided.
23
+
24
+
The driver decrypts the flag, and the challenge is to determine the correct input to affect the decryption. In order to do this, we must collect all of the "thingys" (eight in total) and set the done flag for each of them to 1. This indicates that we need a permutation to solve the challenge.
25
+
26
+
Each thingy xors some of the code in the driver, which is a self-modifying code. This xors the code of a univariate scalar function that operates on uint32s, and then calls that on the flag. In order to decrypt the flag, we need to find the right sequence of thingys to xor the function and do it in the correct order for all eight thingys.
27
+
28
+
To solve the challenge, we can use a backtracking algorithm, but it is not necessary as there is only one possible valid thingy for each element of the permutation. We only need to try 8^2 combinations.
29
+
30
+
To make things easier, we can use the Unicorn engine to emulate the driver. The solve script, called cocksleeve.py, can be found in the repository and provides good documentation on how to use Unicorn.
rax, ok = emulate_mathshit(inp) # call 0x140001B30
59
+
if not ok:
60
+
return None, False
61
+
al = rax&0xff
62
+
mu.mem_write(pFlag+j, bytes([al]))
63
+
64
+
mem_xor(pmathshit, pFucker+i+16, 16)
65
+
return block_disasm, True
66
+
67
+
for i in path:
68
+
print('i',hex(i))
69
+
result, ok = simulate_ioctl(i)
70
+
if not ok:
71
+
return None, False
72
+
print('code', result)
73
+
result=mu.mem_read(pFlag,43)
74
+
return result, True
75
+
***
76
+
```
77
+
78
+
The emulate function is used to emulate the driver code using the Unicorn engine. It starts emulation at the specified start_va and passes in the rcx value as a parameter. The block_disasm is cleared, and the registers are reset and setup with the appropriate values for the stack frame, rip, rbp, rsp, and rcx. The emulator is then started at the start_va address with a fake retaddr. If an error occurs, it is caught and printed, and the function returns 0 and False. Otherwise, the value in the rax register is returned along with True.
79
+
80
+
The simulate_ioctl function uses the emulate function to simulate the ioctl call. It first performs a memory xor operation on the pmathshit and pFucker+i addresses with a length of 16. It then loops through 43 iterations, each time reading one byte from the pFlag address, calling the emulate_mathshit function with the input byte, and writing the result to the pFlag address. If an error occurs during the emulate_mathshit call, the function returns None and False. Otherwise, it performs another memory xor operation on the pmathshit and pFucker+i+16 addresses with a length of 16 and returns the disassembled code block and True.
81
+
82
+
The solver code then loops through the path array, simulating the ioctl call for each element in the array. If an error occurs during the simulate_ioctl call, the function returns None and False. Otherwise, it prints the disassembled code block and continues to the next element in the path array. After all elements in the path array have been processed, the function reads the 43 bytes from the pFlag address and returns the result along with True.
can you explain it at a higher level that's less focused on fine grained details and more about how this helps solve the challenge with the driver
87
+
```
88
+
89
+
The solver code uses the Unicorn engine to emulate the driver code in order to solve the challenge. It first sets up the emulator with the appropriate values for the registers and stack frame, and then starts the emulator at a specific address with a fake retaddr.
90
+
91
+
Next, the solver simulates an ioctl call by performing memory xor operations and calling the emulate_mathshit function on the flag. The result of the emulate_mathshit function is written back to the flag, and the code is disassembled to verify that the decryption is being performed correctly.
92
+
93
+
Finally, the solver loops through a provided path array and simulates the ioctl call for each element in the array. This allows the solver to determine the correct sequence and order of the thingys needed to decrypt the flag. The final result of the flag decryption is returned and can be checked against the correct flag.
im making a CTF challenge writeup. im kind of drunk. can u please clean this up a bit for me? thanks
4
+
5
+
solution script in unfuck3.py
6
+
nice idb in the i64 idb
7
+
8
+
summary of the challenge: return to 64 bits heavens gate nonsense
9
+
do the far return switch cs selector to the 64 bits one
10
+
some wow64 shit. very classic trick in windows reversing.
11
+
i dont feel like describing right now, google heavens gate
12
+
13
+
rest is straightforward reversing . the 64 bits mode shit is all very repetitive so i just solve parsing the diosassembly in python lol. wasnt lying about that in the tweet about reversing with copy paste into sublime text
14
+
15
+
to make the shit nice to view in ida i wrote some idapython scripts to make segments between 64 bits and 32 bits and shit based on the call gates
16
+
17
+
this part is my favorite poart i think it's the most funny
18
+
19
+
from z3 import *
20
+
good_inp=b''
21
+
for i,ptr in enumerate(order):
22
+
unk = BitVec('flag_%d' % i, 8)
23
+
cl = BitVecVal(lilShitter[ptr],8)
24
+
is_add_or_sub, xor_key = wowies[ptr]
25
+
if is_add_or_sub:
26
+
cl += unk
27
+
else:
28
+
cl -= unk
29
+
cl ^= xor_key
30
+
s = Solver()
31
+
s.add(ciphert[i]==cl)
32
+
assert s.check()==sat
33
+
m=s.model()
34
+
inp = m[unk].as_long()
35
+
good_inp += bytes([inp])
36
+
print(good_inp)
37
+
38
+
39
+
lol
40
+
```
41
+
42
+
OpenAI
43
+
44
+
Here is a cleaned-up version of the writeup:
45
+
46
+
Summary
47
+
-------
48
+
49
+
The challenge is a Windows binary that uses the "Heaven's Gate" trick to switch from 32-bit mode to 64-bit mode. The solution involves reversing the binary and using a Python script to parse the disassembly. The script uses the `z3` library to solve the encryption used in the binary.
50
+
51
+
Reversing the Binary
52
+
--------------------
53
+
54
+
To reverse the binary, we can use IDA Pro and some IDAPython scripts to make the disassembly easier to read. In particular, we can use the scripts to segment the code into the different modes (32-bit and 64-bit) based on the call gates used in the "Heaven's Gate" trick.
55
+
56
+
Once we have the disassembly segmented, we can focus on the encryption used in the binary. It turns out that the encryption is a simple XOR cipher with an added or subtracted value, depending on the value of a flag. We can use the `z3` library to solve for the correct input that will decrypt the ciphertext.
57
+
58
+
Solution Script
59
+
---------------
60
+
61
+
Here is the Python script that solves the challenge:
62
+
63
+
```python
64
+
from z3 import*
65
+
66
+
# define the variables used in the cipher
67
+
good_inp =b''
68
+
for i, ptr inenumerate(order):
69
+
unk = BitVec('flag_%d'% i, 8)
70
+
cl = BitVecVal(lilShitter[ptr], 8)
71
+
is_add_or_sub, xor_key = wowies[ptr]
72
+
if is_add_or_sub:
73
+
cl += unk
74
+
else:
75
+
cl -= unk
76
+
cl ^= xor_key
77
+
78
+
# use z3 to solve for the correct input
79
+
s = Solver()
80
+
s.add(ciphert[i] == cl)
81
+
assert s.check() == sat
82
+
m = s.model()
83
+
inp = m[unk].as_long()
84
+
good_inp +=bytes([inp])
85
+
86
+
# print the decrypted input
87
+
print(good_inp)
88
+
```
89
+
90
+
This script will output the correct input that can be used to solve the challenge.
0 commit comments