Squashed older blog files

1 files changed, 52 insertions, 0 deletions

diff --git a/trees/blog/archive/umdctf-2024-cmsc430.md b/trees/blog/archive/umdctf-2024-cmsc430.md
new file mode 100644
index 0000000..33fd708
--- /dev/null
+++ b/trees/blog/archive/umdctf-2024-cmsc430.md
@@ -0,0 +1,52 @@
+---
+title: "umdctf2024 - cmsc430"
+date: 2024-04-28T19:19:27-03:00
+draft: false
+description: ""
+tags: ["rev", "ctf"]
+---
+
+### Description
+
+> This binary was compiled by an hand-crafted, artisan racket compiler, courtesy of UMD's very own CMSC430 class.
+
+### Reversing
+
+The attachment was an standard x64 ELF file. After opening it in my
+decompiler, and going to the main function, everything seemed pretty
+straight.
+
+![](/img/umdctf2024-0.png)
+
+
+Investigating this `sub_17e0` function we see that it has a lot of deep nested conditionals, where in each step it calls `read_byte()` and then compares it to a byte.
+
+
+![](/img/umdctf2024-1.png)
+
+To me this seemed like a pretty easy crack by using symbolic execution to find which input passess all of those conditionals. I tried using a simbolic execution engine inside Binary Ninja, but I never did it before and couldn't make it work.
+So I ended up copying those bytes by hand and writing them to a python script to write them to a new file.
+
+At first this didn't work because I didn't realize that the `read_byte()` function multiples by two the bytes that I reads, so I had to halve them.
+
+### Flag
+
+```python3
+a = bytes([0xaa, 0x9a, 0x88, 0x86, 0xa8, 0x8c, 0xf6, 0xe6, 0xd0, 0xde, 0xea, 0xe8,
+     0xbe, 0xde, 0xea, 0xe8, 0xbe, 0xe8, 0xde, 0xbe, 0xd4, 0xde, 0xe6, 0xca,
+     0xfa])
+
+# Added later
+b = bytes([x // 2 for x in a])
+
+with open('sol.bin', "wb") as file:
+    file.write(b)
+
+```
+
+```console
+└─$ hexdump sol.bin
+00000000  55 4d 44 43 54 46 7b 73  68 6f 75 74 5f 6f 75 74  |UMDCTF{shout_out|
+00000010  5f 74 6f 5f 6a 6f 73 65  7d                       |_to_jose}|
+00000019
+```