1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
---
title: "umdctf2024 - cmsc430"
date: 2024-04-28T19:19:27-03:00
draft: false
description: ""
tags: ["rev", "ctf"]
---
### Description
> This binary was compiled by an hand-crafted, artisan racket compiler, courtesy of UMD's very own CMSC430 class.
### Reversing
The attachment was an standard x64 ELF file. After opening it in my
decompiler, and going to the main function, everything seemed pretty
straight.
Investigating this `sub_17e0` function we see that it has a lot of deep nested conditionals, where in each step it calls `read_byte()` and then compares it to a byte.
To me this seemed like a pretty easy crack by using symbolic execution to find which input passess all of those conditionals. I tried using a simbolic execution engine inside Binary Ninja, but I never did it before and couldn't make it work.
So I ended up copying those bytes by hand and writing them to a python script to write them to a new file.
At first this didn't work because I didn't realize that the `read_byte()` function multiples by two the bytes that I reads, so I had to halve them.
### Flag
```python3
a = bytes([0xaa, 0x9a, 0x88, 0x86, 0xa8, 0x8c, 0xf6, 0xe6, 0xd0, 0xde, 0xea, 0xe8,
0xbe, 0xde, 0xea, 0xe8, 0xbe, 0xe8, 0xde, 0xbe, 0xd4, 0xde, 0xe6, 0xca,
0xfa])
# Added later
b = bytes([x // 2 for x in a])
with open('sol.bin', "wb") as file:
file.write(b)
```
```console
└─$ hexdump sol.bin
00000000 55 4d 44 43 54 46 7b 73 68 6f 75 74 5f 6f 75 74 |UMDCTF{shout_out|
00000010 5f 74 6f 5f 6a 6f 73 65 7d |_to_jose}|
00000019
```
|
