From 7c32657002fca2c7e2195d789b1b11e3071d79a2 Mon Sep 17 00:00:00 2001 From: Gabriel Schneider Date: Thu, 26 Mar 2026 16:23:24 -0300 Subject: Squashed older blog files --- trees/blog/archive/umdctf-2024-cmsc430.md | 52 +++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 trees/blog/archive/umdctf-2024-cmsc430.md (limited to 'trees/blog/archive/umdctf-2024-cmsc430.md') diff --git a/trees/blog/archive/umdctf-2024-cmsc430.md b/trees/blog/archive/umdctf-2024-cmsc430.md new file mode 100644 index 0000000..33fd708 --- /dev/null +++ b/trees/blog/archive/umdctf-2024-cmsc430.md @@ -0,0 +1,52 @@ +--- +title: "umdctf2024 - cmsc430" +date: 2024-04-28T19:19:27-03:00 +draft: false +description: "" +tags: ["rev", "ctf"] +--- + +### Description + +> This binary was compiled by an hand-crafted, artisan racket compiler, courtesy of UMD's very own CMSC430 class. + +### Reversing + +The attachment was an standard x64 ELF file. After opening it in my +decompiler, and going to the main function, everything seemed pretty +straight. + +![](/img/umdctf2024-0.png) + + +Investigating this `sub_17e0` function we see that it has a lot of deep nested conditionals, where in each step it calls `read_byte()` and then compares it to a byte. + + +![](/img/umdctf2024-1.png) + +To me this seemed like a pretty easy crack by using symbolic execution to find which input passess all of those conditionals. I tried using a simbolic execution engine inside Binary Ninja, but I never did it before and couldn't make it work. +So I ended up copying those bytes by hand and writing them to a python script to write them to a new file. + +At first this didn't work because I didn't realize that the `read_byte()` function multiples by two the bytes that I reads, so I had to halve them. + +### Flag + +```python3 +a = bytes([0xaa, 0x9a, 0x88, 0x86, 0xa8, 0x8c, 0xf6, 0xe6, 0xd0, 0xde, 0xea, 0xe8, + 0xbe, 0xde, 0xea, 0xe8, 0xbe, 0xe8, 0xde, 0xbe, 0xd4, 0xde, 0xe6, 0xca, + 0xfa]) + +# Added later +b = bytes([x // 2 for x in a]) + +with open('sol.bin', "wb") as file: + file.write(b) + +``` + +```console +└─$ hexdump sol.bin +00000000 55 4d 44 43 54 46 7b 73 68 6f 75 74 5f 6f 75 74 |UMDCTF{shout_out| +00000010 5f 74 6f 5f 6a 6f 73 65 7d |_to_jose}| +00000019 +``` -- cgit v1.3