Zer0xFF

	asm(
        "mov %0, %%rsi\n\t"
        "mov %1, %%rdi\n\t"
        "call _trumpoline\n\t"
         :
         :
            "r" (m_code), "g"(context)
         : "rsi", "rdi"
    );

arget13

PlaidCTF 2020 : reee

Reversing (150 pts)

Story

Tired from all of the craziness in the Inner Sanctum, you decide to venture out to the beach to relax. You doze off in the sand only to be awoken by the loud “reee” of an osprey. A shell falls out of its talons and lands right where your head was a moment ago. No rest for the weary, huh? It looks a little funny, so you pick it up and realize that it’s backwards. I guess you’ll have to reverse it.

Problem details

Hint: The flag format is pctf{$FLAG}. This constraint should resolve any ambiguities in solutions.

icecr4ck

IDAPython CTREE

Important links

• Hex-Rays Decompiler Primer
• hexrays.hpp

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

NeatMonster

import uuid

import ida_bytes
import ida_hexrays
import ida_idaapi
import ida_kernwin

from PyQt5.Qt import QApplication

class Plugin(ida_idaapi.plugin_t):

NeatMonster

"""
@file patmake.py
@brief Creates a pattern file from a database
@author neat
"""
import os

import idautils
import ida_bytes
import ida_funcs

clarkb7

A guide to character encoding aware development

By Branden Clark - https://clark.re

• Intro
  • What are character encodings
  • Why does the encoding matter
  • Why do these examples work fine with English
  • How do I tell what encoding a file is in
• Windows

0xAcid

import pyqbdi
import ctypes

MAPPING_DIFF = 0

def get_binary_mapping(lib, region):
    mapped = region.range[0] # mapped to _init
    binary = idaapi.get_segm_by_name(".init").start_ea
    return mapped - binary

n005

Progamming language:
Julia
Java
GNU Octave
Scilab
Matlab - Simulink
Anaconda / Python (+ Jupyter)
R / R Studio
Wolfram Mathematica
ROOT

pawlos

from z3 import *

zero = 0

reg0 = BitVec('r0', 32*8)
reg1 = BitVec('r1', 32*8)
reg2 = BitVec('r2', 32*8)
reg3 = BitVec('r3', 32*8)
reg4 = BitVec('r4', 32*8)
reg5 = BitVec('r5', 32*8)

mubix

Infrastructure

https://github.com/integrity-sa/burpcollaborator-docker - Docker instance of Burp Collaborator

Linux

https://github.com/andrew-d/static-binaries - Statically compiled binaries for use when those binaries aren't available on the systme