DEFCON 2018 Qual ELF Crumble

crumble.rb

Encoding.default_external = 'binary'
Encoding.default_internal = 'binary'
c = File.open('pieces/broken', 'r:binary').read
p c[0x5b0-3...0x8d4].size

frags = (1..8).map{|i|File.read("pieces/fragment_#{i}.dat")}
p frags.map{|f|f.size}.inject(:+)

[*0..7].permutation.each do |a|
  ff = ''
  a.each do |i|
    ff += frags[i]
  end
  cc = c * 1
  cc[0x5b0-3...0x8d4] = ff
  File.write('try', cc)
  File.chmod(0755, 'try')
  system('./try')
end