#import "./html_elements.typ": post
#show: post
// +++
// title = 'Googlectf 2025'
// date = 2025-06-30T17:45:28-03:00
// draft = false
// tags = ['rev', 'ctf']
// +++
= rev-multiarch-1 (126 points / 99 solves)
#box()[#html.frame()[#text(size: 8em, fill: rgb("#74c7ec").darken(10%))[T]]]
his challenge was solved by me and #link("https://lobisomem.gay")[Matt].
The challenge files were a Linux executable and a misterius `crackme.masm` file.
We worked together by him reversing the actual VM runtime and I was reversing
the binary file format and was writing some python code to interact with it.
In the first day we were actually sidetracked trying to solve `pwn-multiarch-2`,
it wasn't until the end of the day that then we realized that there's the
`rev-multiarch-1` and they're based on the same vm binary. It didn't change our
methodology to solve it, since we are still reversing it at that time, but this
time we had a valid program with the `crackme.masm`.
Below is the reversing of the main function, as you can see it's pretty straight
forward:
```c
__int64 __fastcall main(int a1, char **f, char **a3)
{
char *segments; // rax
__int64 v4; // rbp
char *stuff; // rbx
setbuf(stdin, 0);
setbuf(stdout, 0);
setbuf(stderr, 0);
if ( a1 <= 1 )
{
fprintf(stderr, "[E] usage: %s [path to .masm file]\n", *f);
return 2;
}
else
{
fwrite("[I] initializing multiarch emulator\n", 1u, 0x24u, stderr);
segments = (char *)parse_bin(f[1]);
v4 = (__int64)segments;
if ( segments )
{
stuff = build_vm_state(segments);
fwrite("[I] executing program\n", 1u, 0x16u, stderr);
while ( (unsigned __int8)run_vm((__int64)stuff) )
;
if ( stuff[48] )
{
fwrite("[E] execution failed\n", 1u, 0x15u, stderr);
debug_print_vm((__int64)stuff, 1);
}
else
{
fwrite("[I] done!\n", 1u, 0xAu, stderr);
}
sub_555555555427(stuff);
call_free(v4);
return 0;
}
else
{
fwrite("[E] couldn't load multiarch program\n", 1u, 0x24u, stderr);
return 1;
}
}
}
```
Note the `debug_print_vm` function, it was pretty useful to undestand the vm
state struct since it prints the stack and all four registers.
Below is the assembly code that prepares the arguments for the printf call,
note that all arguments are being read relative to `rdi`, which holds the
address of the vm state struct.
```asm
mov ecx, [rdi+3Bh]
mov edx, [rdi+37h]
mov esi, [rdi+33h]
mov eax, [rdi+47h]
push rax
mov r9d, [rdi+43h]
mov r8d, [rdi+3Fh]
lea rdi, debug_fmt_string ; " ---[ PC=0x%08x SP=0x%08x | A=0x%08x B"...
mov eax, 0
call _printf
add rsp, 10h
test bpl, bpl
jnz short loc_555555556A8F
```
At this point we had a good idea about the how the program worked, but we wanted
to understand what the `crackme.masm` does.
This is the hexdump of the whole file:
Just seeing the strings we can get a pretty good idea of what it does:
- It has four bytes at the start, being the magic bytes for the MASM file.
- It seems like it consists of three seperate challenges, seeing the strings
near the end.
At this step what I'd do would be to debug it in `gdb` to see what's happening,
i.e. where it reads input we control, and how it's used when deciding if a
challenge step is correct or not. The issue is that since this is a VM, for
every instruction executed by it, in `gdb` we see a lot of code and function
calls related to the implementation of the VM itself, doing the fetch, decode
and execute cycle.
> Given the amount of solves this challenge had, I believe most
> people just solved this manually on `gdb`, but I *really* wanted to try a
> new tool...
= libdebug
This is where #link("https://github.com/libdebug/libdebug")[libdebug] comes in, it's
basically a python library to automate `ptrace` debugging, it's pretty cool and
since I discovered it, I hadn't had the opportunity to use it yet.
With the script below I was able to debug the `crackme.masm` with an interactive
debugger, that I could even add breakpoints and single step instructions.
```python
from libdebug import debugger, libcontext
from pwn import u64, u32, u8
cur_vm = 'stackvm'
cur_cycle = 0
hit_vm_bp = False
vm_breakpoints = [
#0
#18, # challenge 1 ends
#49
]
vm_ip_breakpoints = [
# 0x131, # regvm loop cmp
#0x5a, # chal1 cmp
#0x7c,
0x88, # chal2 cmp
#0xcd, # chal3 cmp?
0xdd, # chal3 actual cmp?
0x10b, # chal3 actual actual idk?
#0x12d, # xor r1 r3
]
prev_input_dbg = ''
vm_stop = []
STACKVM_MNEMONICS = {
0xa0: 'S.SYSCALL',
0x10: 'S.LDB',
0x20: 'S.LDW',
0x30: 'S.LDD',
0x40: 'S.LDP',
0x50: 'S.POP',
0x60: 'S.ADD',
0x61: 'S.SUB',
0x62: 'S.XOR',
0x63: 'S.AND',
0x70: 'S.JMPI',
0x71: 'S.JMPI.EQ?',
0x72: 'S.JMPI.NE?',
0x80: 'S.SCMP',
0xff: 'S.HLT',
}
def stackvm_mnemonic(ins, is_ip=False):
opcode = ins & 0xff
dat = ins >> 8
mnemonic = hex(opcode)
if opcode in STACKVM_MNEMONICS:
mnemonic = STACKVM_MNEMONICS[opcode]
if (0x70 <= opcode <= 0x72) and is_ip:
print('DIDJMP!!!!!!!!!!!')
return f'{mnemonic} {hex(dat)}'
d = debugger(['./multiarch', './crackme.masm'], aslr=False)
io = d.run()
mem_access = d.breakpoint(0x00005555555554B3)
cycle_tick = d.breakpoint(0x0000555555556FFF)
d.cont()
io.sendline(b'2405061754')
io.sendline(b'\x46\x91')
io.sendline(f'{0x2b6043c}'.encode())
d.wait()
should_stop = False
def regvm_disasm(code_adr, ip):
# a lot of boring code...
# you can use your imagination for this function.
def stackvm_disasm(code_adr, ip):
for i in range(ip, ip + (8 * 5), 5):
ins = u64(d.memory.read(i + code_adr, 5).ljust(8, b'\x00'))
if i == ip:
print('>', end='')
print(f'{i:08x}\t{stackvm_mnemonic(ins, i==ip)}\t{ins:05x}')
def disasm(off, ip, code_adr):
if cur_vm == 'stackvm':
stackvm_disasm(code_adr, ip)
else:
raw_instr = u64(d.memory.read(code_adr+ip, 8))
print(f'raw: {raw_instr:016x}\n')
acc = ip
for i in range(0, 8):
s, bytes_read = regvm_disasm(code_adr, acc)
print(f'{acc:08x}\t{s}')
acc += bytes_read
print('')
def print_stack(sp, stack_adr):
print('-------stack sp: ', hex(sp), hex(stack_adr))
for i in range(sp - (4 * 5), sp + (4 * 5), 4):
cur = u32(d.memory.read(stack_adr + i, 4))
if i == sp:
print('>', end='')
print(f'{cur:08x}')
print('')
def calc_mode(ip):
i = ip >> 3
mode_ptr = u64(d.memory.read(d.regs.rbx + 0x18, 8))
mask = u8(d.memory.read(mode_ptr+i, 1))
bit_idx = ip & 7
return (mask >> bit_idx) & 1
while not should_stop:
if hit_vm_bp:
i = input('masmdbg> c/n/q: ')
match i:
case 'c':
hit_vm_bp = False
case 'n':
vm_breakpoints.append(cur_cycle)
hit_vm_bp = False
case '':
vm_breakpoints.append(cur_cycle)
hit_vm_bp = False
case 'q':
vm_stop.append(cur_cycle)
hit_vm_bp = False
case _:
continue
prev_input_dbg = i
if cycle_tick.hit_on(d):
ip = u32(d.memory.read(d.regs.rbx + 0x33, 4)) - 0x1000
if cur_cycle in vm_breakpoints or ip in vm_ip_breakpoints:
mode = calc_mode(ip)
if mode:
cur_vm = 'regvm'
else:
cur_vm = 'stackvm'
print(f'\n\n========masm debugger=== {cur_vm} {cur_cycle}\nip -> {ip:08x}')
r0 = u32(d.memory.read(d.regs.rbx + 0x3b, 4))
r1 = u32(d.memory.read(d.regs.rbx + 0x3f, 4))
r2 = u32(d.memory.read(d.regs.rbx + 0x43, 4))
r3 = u32(d.memory.read(d.regs.rbx + 0x47, 4))
sp = u32(d.memory.read(d.regs.rbx + 0x37, 4)) - 0x8000
code_adr_ptr = u64(d.memory.read(d.regs.rbx, 8))
stack_adr_ptr = u64(d.memory.read(d.regs.rbx+0x10, 8))
print(f'~~~ REGS\n\t{r0:08x}\n\t{r1:08x}\n\t{r2:08x}\n\t{r3:08x}\n~~~~~')
disasm(0, ip, code_adr_ptr)
print_stack(sp, stack_adr_ptr)
print('========cycle ended=====\n\n')
hit_vm_bp = True
if cur_cycle in vm_stop:
should_stop = True
continue
cur_cycle += 1
d.cont()
d.wait()
elif mem_access.hit_on(d):
pos = d.regs.rsi
sz = d.regs.rdx
d.cont()
d.wait()
elif not d.running:
io.interactive()
should_stop = True
```
Below is how it looks like in action:
```
masmdbg> c/n/q:
========masm debugger=== regvm 139
ip -> 000000bd
~~~ REGS
88c0ffee
7a213a1c
00000000
00000000
~~~~~
raw: 00631100ffffff10
000000bd PUSHI 0x00ffffff
000000c2 PUSH REG(0)
000000c3 JMPI.NE 0x00000000
000000c8 SUB REG(13), REG(13)
000000ca UNKNOWN(0xff)
000000cb UNKNOWN(0xc0)
000000cc NOP
000000cd CMPI REG(0), 0x00000000
-------stack sp: 0xee0 0x7ffff7fbc000
00000000
00000000
f2f2f2f2
88c0ffee
000010bd
>00009146
00000000
00000000
00000000
00000000
========cycle ended=====
```
As you can see the disassembler wasn't 100% complete, but it was enough to
manually reverse the `masm` file and solve it.