matthw

DiceCTF not-baby-parallelism

totally overengineered solution

1. Generate an execution trace with qemu magic

#!/bin/bash

matthw

Useless code:

#include <stdio.h>


void nop(void)
{
    asm("nop");
}

matthw

LACTF 2023

1 rev/universal

Open class file in jadx

package p000;

import java.nio.charset.Charset;
import java.util.Scanner;

matthw

from base64 import b64decode
from Crypto.Cipher import ARC4

#s = "mpntingadxedMTBjMDc2NGZiNDNiOTYzMjk3NjhkZTRmM2ZlOWMyMGE5NDAwMGUwMzFmMmQ0ZGIxMDdlOGY3ODE4ZWJlMGVhNzlhNTQ="
s = "wfycyqhbrwfxMWFjMWYxOGM1MjljZDI1M2UxNjUzNDY2ZTRlNDYwNDk5MWUxYjc2OTVjODc2YWYxOTI0YTgxYzUwMWQ4NGUzZGIxZjYwMGVjZWViNDhkYTYyMTkyNjQ0MjllYzhhMDUyZjg2MGM3NGEyYjZkYmU="

def decrypt_string(s):
    key = s[:12].encode()
    data = bytes.fromhex(b64decode(s[12:]).decode())
    c = ARC4.new(key=key)

matthw

XPacker

1. Quick Peek

We get 2 PE files evil.exe and mypacker.exe. Looking at evil.exe, we can follow the invoke_main() function up to

undefined8 FUN_1400117f0(void)

matthw

from unicorn import *
from unicorn.x86_const import *
from capstone import *
from pwn import *
import copy
from z3 import *
import sys
import time

UINT_MAX = 0xffffffffffffffff

matthw

from z3 import *
from pwn import *
from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.analysis.binary import Container
from miasm.jitter.csts import *
from miasm.expression.expression import *
from miasm.ir.symbexec import SymbolicExecutionEngine
from miasm.ir.translators.z3_ir import TranslatorZ3
from miasm.arch.x86.lifter_model_call import LifterModelCall_x86_64

matthw

#!/usr/bin/env python3
# unpacker for nanobits (PWNME 2023)

import io
import struct
import sys
import zlib
import enum
import os

matthw

>->>>>>,[----------[++++++++++>>>>>,>]<]>---<+[-<+]->>>>>[<+++++++++++++++++++++
+++++++++++[>>[-]+>[-]<<-<->[>-]>[-<<[-]>>>]<<<]>+++++++++++++++++++++++++++++++
++++++++++++++++>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++<[>->+<[>]>[<+>-]<<[<]>-]>[-]>[-<<+>>]>>>]+[-<+]-
>>>>>-------------------------------[[-]--+[-<+]-<[-]+>++[-->++]]>>>>>----------
-----------------------------------------------------[[-]--+[-<+]-<[-]+>++[-->++
]]>>>>>---------------------------------------------------------------[[-]--+[-<
+]-<[-]+>++[-->++]]>>>>>-------------------[[-]--+[-<+]-<[-]+>++[-->++]]>>>>>---
----------------------------------------[[-]--+[-<+]-<[-]+>++[-->++]]>>>>>------

matthw

import sys
sys.path.append("/data/opt/triton/lib/python3.11/site-packages/")
from triton import *


BASE_ARGV  = 0x20000000
BASE_STACK = 0x9ffffff0

FLAG_LEN = 0x30