Skip to content

Instantly share code, notes, and snippets.

@Lala5th
Lala5th / FlagLockerWriteup.md
Last active April 10, 2022 00:12
ICTF FlagLocker Writeup

Decompilation

We can start by decompiling the binary. The symbols have been stripped, so after locating main and some deobfuscation we can get:

int8_t main(void){
  char cVar1;
  undefined aux_buffer [48];
  undefined flag_buffer [40];
 int current_char;
0:
5c 50 34 56 74 86 f6 ac 76 c0 9a 2c 46 23 1e 98 1f 4a 47 2e 73 8a 84 29 3a 21 20 c2 19 10 a3 75 4e cf fe 1 64 a5 7a 2c 9a 56 f7 2b f9 7 b3 f9 e9 5e 14 3e 50 f0 76 eb f2 6a 4a b5 bb 74 34 99 e8 5 ea 5e 8d 98 ea 43 91 7d de ad da e1 36 41 86 ef 1 1 a7 33 25 47 9e 5e e7 3f 36 b3 a4 90 8 c9 b9 c9 a7 83 3f 86 b4 9a 32 52 80 12 c9 20
1:
94 51 c9 b1 7c 5a f9 ea ba ee a1 2c 46 23 1e 98 1f 4a 47 2e 73 8a 84 29 b9 7d 56 ac 19 10 a3 75 ae b2 f0 56 98 89 7a 2c ec 44 fd 9d 44 7 b3 f9 aa 55 75 7b 72 32 35 48 1c 52 6a cc 6f 34 3f 99 2e 3d 15 e9 d db c3 53 2c 31 93 72 f9 75 83 62 ef 1f 9c e4 2 ac d b4 b2 78 c3 cc 53 bb 7d 53 5f af 4e 4d 8d 97 19 f3 47 fc e1 40 52 f1 a3 bc 26 56 90 bf
2:
99 2f f7 1c ef c1 34 86 1b f8 a1 2c 46 23 1e 98 1f 4a 47 2e 73 8a 84 29 e9 7b 63 e1 19 10 a3 75 e3 ad 14 b9 d3 e1 cf e2 49 d3 23 b7 ab 45 6f 78 7b c9 c7 48 a5 b2 e5 be 1a 31 63 ef 8b 5 bc 2c 8a 35 5c 65 59 c8 1b ae b3 d4 7c 79 68 e 5b 80 b9 17 bf 64 f8 66 eb 87 dd f7 37 c7 bc ca a4 40 43 9b 29 4f 8 c fe 8d f4 b2
@Lala5th
Lala5th / crib_drag_glyphs.py
Created March 24, 2021 15:42
Noita glyph updated crib drag
glyphs = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrtsuvwxyz0123456789!?\"#%^'()☼+,-./:;<=> " #@[\\]^_`"
modulo = len(glyphs)
glyph_LUT = { glyphs[i] : chr(i) for i in range(modulo)}
c0 = "Rb%P^-k=8]Jfb^@.q(/n\"=-Q!prH_q53 HSa:.5fOLPJ3P-O3Qh?%8#K[cAQI\\5:>%94g+jX$j3g$SIKphV_oq/0L?>,AY<-`KP"
c1 = "pb%P^-k=8]Jfb^@.q(/n\"=-Q!=+>Tq53 9:V4.5fOLPJ3P-O3QL:[m`Ko<h`!>i7c&A9`qdN1D-15d-)NcYB^r/*i^\"+ahEL*Kd^)B2"
c2 = "Db%P^-k=8]Jfb^@.q(/n\"=-Q!elT)Pbp6`YHQn#0X3OHp&-`=Q`_&Q?-0*M8:m*\\q]BVf5/$bmJE>6 +IhY47YaI72hJ%#:n(%VMm9`]0LVS4_9+:MU\\FB"
c3 = "lb%QkVeN@!J\\:PRp@8W]O,5,QVB9D/XW4)(^-r)L=\\UrJp%Kg#pmOnB9^2*Q^`Tq+b^-O1Tf:7@?`7C@R&!9(EOK:ladp1'M_.U_\\0"
c4 = "_b%QkV\"\\=HnO\kcg\\\"a'O.Mj[Ip-\\-q6CRHG\"[P?l\"pk!Xc+5(HaMkWG\\J-#6Y\"&Z)f!ZX_d9o'43`\"bi>g0,>aE4-6_2N`[Iqr6nDO1$&1%Do_!`e/K$ZX?.`Z2Lne! N4gi9C(8"
c5 = "Bb%QkV7j+-<:3PcYE\\B<j*1@+23K3qJ$^)NQ@SlZ$KO1co5@L0>E:<IdYBS*ef(&NK2GOK/-A>C^E E%FWE-H9)5+`%oJd+g+P#c]H6.CR]G+\"bQSU1iDkjV8>Vf"
@Lala5th
Lala5th / crib_drag.py
Created March 23, 2021 23:26
Noita mod 83 crib dragger
modulo = 83
c0 = "Rb%P^-k=8]Jfb^@.q(/n\"=-Q!prH_q53 HSa:.5fOLPJ3P-O3Qh?%8#K[cAQI\\5:>%94g+jX$j3g$SIKphV_oq/0L?>,AY<-`KP"
c1 = "pb%P^-k=8]Jfb^@.q(/n\"=-Q!=+>Tq53 9:V4.5fOLPJ3P-O3QL:[m`Ko<h`!>i7c&A9`qdN1D-15d-)NcYB^r/*i^\"+ahEL*Kd^)B2"
c2 = "Db%P^-k=8]Jfb^@.q(/n\"=-Q!elT)Pbp6`YHQn#0X3OHp&-`=Q`_&Q?-0*M8:m*\\q]BVf5/$bmJE>6 +IhY47YaI72hJ%#:n(%VMm9`]0LVS4_9+:MU\\FB"
c3 = "lb%QkVeN@!J\\:PRp@8W]O,5,QVB9D/XW4)(^-r)L=\\UrJp%Kg#pmOnB9^2*Q^`Tq+b^-O1Tf:7@?`7C@R&!9(EOK:ladp1'M_.U_\\0"
c4 = "_b%QkV\"\\=HnO\kcg\\\"a'O.Mj[Ip-\\-q6CRHG\"[P?l\"pk!Xc+5(HaMkWG\\J-#6Y\"&Z)f!ZX_d9o'43`\"bi>g0,>aE4-6_2N`[Iqr6nDO1$&1%Do_!`e/K$ZX?.`Z2Lne! N4gi9C(8"
c5 = "Bb%QkV7j+-<:3PcYE\\B<j*1@+23K3qJ$^)NQ@SlZ$KO1co5@L0>E:<IdYBS*ef(&NK2GOK/-A>C^E E%FWE-H9)5+`%oJd+g+P#c]H6.CR]G+\"bQSU1iDkjV8>Vf"
c6 = ";b%QkV\"\\=H\"W)/[2d#D%OmLF!2<l$B\\_Zp1VokPVW3^`.OSfk%+OMZdeo9FMiOdRBMn:oY$X6\\2kK\\[c_JQAHaom'#:^?n:YeH$7:-cJFh+Ga\\9&pbdm[n3"