{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-idek-2022-en","result":{"data":{"markdownRemark":{"id":"691db3eb-9471-502d-9e95-59cad79d738a","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Idek CTF 2022, which was held in January 2023.

\n

Despite the contest being held in 2023, the name remained “2022.”

\n

I retired early on the very first problem and ended up with 0 solves, but I decided to write up the challenges I couldn’t finish as a review exercise.

\n\n

Table of Contents

\n\n

Polyglot

\n

This challenge provided a small binary named polyglot, and the goal was to extract information about two flags embedded inside it.

\n

The word “polyglot” itself means “a person who speaks multiple languages,” but in programming it more commonly refers to code that can be executed by multiple interpreters or compilers in the same way.

\n

Reference: Polyglot Programming

\n

The file command reported the file as “DOS executable (COM),” so I suspected it might be a polyglot source file compiled as a DOS binary.

\n
$ file polyglot\npolyglot: DOS executable (COM)
\n

However, I was unable to run it even with emulators such as DOSBox, and after looking into it I still couldn’t figure out what the file actually was — so I gave up and moved on.

\n

Reading the Binary

\n

Examining the binary’s hex dump produces the following output.

\n
$ xxd polyglot\n00000000: eb7e 9090 0002 0010 0370 0091 0200 80d2  .~.......p......\n00000010: ff83 00d1 0168 6238 6468 6238 4204 0091  .....hb8dhb8B...\n00000020: 2100 044a e16b 2238 5f70 00f1 41ff ff54  !..J.k\"8_p..A..T\n00000030: 0808 80d2 2000 80d2 e107 0091 8203 80d2  .... ...........\n00000040: 0100 00d4 afbc f06b 0482 05a4 56b6 1648  .......k....V..H\n00000050: c093 ae51 788f b5b8 4e31 b5ed 9fa5 b3a0  ...Qx...N1......\n00000060: c6d8 9500 7fdd 5af3 3ecf 497d f0cc c365  ......Z.>.I}...e\n00000070: 16d6 ea8c 3c52 ddd8 c0c9 82cb 4bfd d484  ....<R......K...\n00000080: e88b 0100 0066 0f6f 0514 0200 0049 89d2  .....f.o.....I..\n00000090: 31c9 4531 c00f 1147 0266 0f6f 0510 0200  1.E1...G.f.o....\n000000a0: 000f 1147 1266 0f6f 0514 0200 000f 1147  ...G.f.o.......G\n000000b0: 2266 0f6f 0518 0200 000f 1147 3266 0f6f  \"f.o.......G2f.o\n000000c0: 051c 0200 000f 1147 4266 0f6f 0520 0200  .......GBf.o. ..\n000000d0: 000f 1147 5266 0f6f 0524 0200 000f 1147  ...GRf.o.$.....G\n000000e0: 6266 0f6f 0528 0200 000f 1147 7266 0f6f  bf.o.(.....Grf.o\n000000f0: 052c 0200 000f 1187 8200 0000 660f 6f05  .,..........f.o.\n00000100: 2d02 0000 0f11 8792 0000 0066 0f6f 052e  -..........f.o..\n00000110: 0200 000f 1187 a200 0000 660f 6f05 2f02  ..........f.o./.\n00000120: 0000 0f11 87b2 0000 0066 0f6f 0530 0200  .........f.o.0..\n00000130: 000f 1187 c200 0000 660f 6f05 3102 0000  ........f.o.1...\n00000140: 0f11 87d2 0000 0066 0f6f 0532 0200 000f  .......f.o.2....\n00000150: 1187 e200 0000 660f 6f05 3302 0000 0f11  ......f.o.3.....\n00000160: 87f2 0000 0066 c707 0000 4889 c831 d244  .....f....H..1.D\n00000170: 0fb6 4c0f 0249 f7f2 0fb6 0416 4401 c841  ..L..I......D..A\n00000180: 01c0 410f b6c0 0fb6 5407 0288 540f 0248  ..A.....T...T..H\n00000190: 83c1 0144 884c 0702 4881 f900 0100 0075  ...D.L..H......u\n000001a0: c9c3 0fb7 0741 5449 89fa 5553 0fb6 dc48  .....ATI..US...H\n000001b0: 85d2 7453 4189 c049 89d3 89c5 4883 c702  ..tSA..I....H...\n000001c0: 4129 f04c 8d0c 1641 83c0 0141 8d14 300f  A).L...A...A..0.\n000001d0: b6d2 4801 fa0f b602 01c3 0fb6 cb48 01f9  ..H..........H..\n000001e0: 440f b621 4488 2288 0144 01e0 0fb6 c00f  D..!D.\"..D......\n000001f0: b604 0730 0648 83c6 0149 39f1 75cd 410f  ...0.H...I9.u.A.\n00000200: b6c3 4000 e888 dc5b 5d66 4189 0241 5cc3  ..@....[]fA..A\\.\n00000210: 4881 ec58 0100 0066 0f6f 0582 0100 00ba  H..X...f.o......\n00000220: 2000 0000 48b8 80aa 0ab4 418e 7b1b 488d   ...H.....A.{.H.\n00000230: 7c24 4048 8d74 2420 0f29 4424 2066 0f6f  |$@H.t$ .)D$ f.o\n00000240: 056c 0100 000f 2944 2430 660f 6f05 6f01  .l....)D$0f.o.o.\n00000250: 0000 0f29 0424 4889 4424 0fe8 25fe ffff  ...).$H.D$..%...\n00000260: 4889 e6ba 1700 0000 e835 ffff ff48 c7c0  H........5...H..\n00000270: 0100 0000 48c7 c701 0000 0048 89e6 48c7  ....H......H..H.\n00000280: c217 0000 000f 05e8 0000 0000 31c0 4881  ............1.H.\n00000290: c458 0100 0048 c7c0 3c00 0000 4831 ff0f  .X...H..<...H1..\n000002a0: 0500 0102 0304 0506 0708 090a 0b0c 0d0e  ................\n000002b0: 0f10 1112 1314 1516 1718 191a 1b1c 1d1e  ................\n000002c0: 1f20 2122 2324 2526 2728 292a 2b2c 2d2e  . !\"#$%&'()*+,-.\n000002d0: 2f30 3132 3334 3536 3738 393a 3b3c 3d3e  /0123456789:;<=>\n000002e0: 3f40 4142 4344 4546 4748 494a 4b4c 4d4e  ?@ABCDEFGHIJKLMN\n000002f0: 4f50 5152 5354 5556 5758 595a 5b5c 5d5e  OPQRSTUVWXYZ[\\]^\n00000300: 5f60 6162 6364 6566 6768 696a 6b6c 6d6e  _`abcdefghijklmn\n00000310: 6f70 7172 7374 7576 7778 797a 7b7c 7d7e  opqrstuvwxyz{|}~\n00000320: 7f80 8182 8384 8586 8788 898a 8b8c 8d8e  ................\n00000330: 8f90 9192 9394 9596 9798 999a 9b9c 9d9e  ................\n00000340: 9fa0 a1a2 a3a4 a5a6 a7a8 a9aa abac adae  ................\n00000350: afb0 b1b2 b3b4 b5b6 b7b8 b9ba bbbc bdbe  ................\n00000360: bfc0 c1c2 c3c4 c5c6 c7c8 c9ca cbcc cdce  ................\n00000370: cfd0 d1d2 d3d4 d5d6 d7d8 d9da dbdc ddde  ................\n00000380: dfe0 e1e2 e3e4 e5e6 e7e8 e9ea ebec edee  ................\n00000390: eff0 f1f2 f3f4 f5f6 f7f8 f9fa fbfc fdfe  ................\n000003a0: ff62 5a46 8aaa 47b6 8784 bf1b e6da 0ad7  .bZF..G.........\n000003b0: 4081 0e14 6af7 6e2b f119 d52e 33a8 b6d1  @...j.n+....3...\n000003c0: 7618 2537 37f5 1470 6359 1d85 0ea5 d9db  v.%77..pcY......
\n

At first glance it is hard to make sense of this, but since file recognized it as a COM program, I tried disassembling it as x86.

\n

The leading bytes appear to be Intel-architecture shellcode that jumps to 0x80 and makes some function calls.

\n
$ objdump -M intel -D -b binary -m i386 polyglot\n00000000 <.data>:\n   0:   eb 7e                   jmp    0x80\n   2:   90                      nop\n   3:   90                      nop\n{{ (abbreviated) }}\n  80:   e8 8b 01 00 00          call   0x210\n  85:   66 0f 6f 05 14 02 00    movdqa xmm0,XMMWORD PTR ds:0x21
\n

On the other hand, the output frequently contains (bad) entries.

\n

In objdump, (bad) is recorded when an opcode cannot be decoded correctly.

\n

Since the challenge description stated that “two flags are embedded,” I inferred that the binary also contained a second architecture beyond x86_64.

\n

I wanted to isolate the x86_64 portion, but unfortunately Ghidra couldn’t handle this kind of binary well. (IDA Pro reportedly can, but the free version didn’t support it.)

\n

Analyzing the Shellcode with Binary Ninja

\n

So I turned to Binary Ninja.

\n

After specifying the x8664 architecture and opening the [Linear] view, Binary Ninja neatly decompiled only the x8664 shellcode section.

\n

\n \n \n \n \n \n \n \n \n

\n

I wrote the following solver that uses Unicorn to run the code up to 0x285 and dump everything on the stack at that point.

\n
from unicorn import *\nfrom unicorn.x86_const import *\n\n# code to be emulated\ncode = open(\"polyglot\", \"rb\").read()\n\n# memory address where emulation starts\nADDRESS = 0x0\n\nprint(\"Emulate x86 code\")\ntry:\n    mu = Uc(UC_ARCH_X86, UC_MODE_64)\n\n    # map 2MB memory for this emulation\n    mu.mem_map(ADDRESS,  0x100000)\n\n    # write machine code to be emulated to memory\n    mu.mem_write(ADDRESS, code)\n\n    # initialize machine registers\n    mu.reg_write(UC_X86_REG_RSP, 0x0 + 0x100000)\n    mu.reg_write(UC_X86_REG_RBP, 0x0 + 0x100000)\n\n    # emulate code in infinite time & unlimited instructions\n    mu.emu_start(ADDRESS, ADDRESS + 0x285)\n\n    # now print out some registers\n    print(\"Emulation done. Below is the CPU context\")\n\n    rsp = mu.reg_read(UC_X86_REG_RSP)\n    rbp = mu.reg_read(UC_X86_REG_RBP)\n    print(mu.mem_read(rsp, rbp-rsp).split(b'\\x00')[0])\n\nexcept UcError as e:\n    print(\"ERROR: %s\" % e)
\n

Running this outputs bytearray(b'3_X86_N_4rM_1n_0n3_biN}'), giving us the second half of the flag.

\n

Decompiling the ARM64 Shellcode with Capstone

\n

Now let’s recover the first half of the flag.

\n

I tried every architecture Binary Ninja supports, but none of them produced a usable analysis.

\n

\n \n \n \n \n \n \n \n \n

\n

According to writeups, IDA Pro supports this, but it’s far too expensive for personal use.

\n

The following video showed me a technique using Capstone to write a custom ARM64 disassembler script.

\n

Reference: Using Unicorn Engine for emulation | Polyglot - IdekCTF 2023 - YouTube

\n

The code itself is very simple — just load the binary with the ARM64 architecture specified.

\n
import capstone\n\nwith open(\"polyglot\", \"rb\") as fp:\n    bytecode = fp.read()\n\nengine = capstone.Cs(capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM)\ndisasm = engine.disasm(bytecode[4:], 0x10000)\n\nfor item in disasm:\n    print(f\"{item.address:#08x}: {item.mnemonic:8} {item.op_str}\")
\n

True to its name “polyglot,” this binary is a polyglot of x86_64 and ARM64.

\n

Running the script produces the following assembly.

\n
0x010000: adr      x0, #0x10040\n0x010004: add      x3, x0, #0x1c\n0x010008: mov      x2, #0\n0x01000c: sub      sp, sp, #0x20\n0x010010: ldrb     w1, [x0, x2]\n0x010014: ldrb     w4, [x3, x2]\n0x010018: add      x2, x2, #1\n0x01001c: eor      w1, w1, w4\n0x010020: strb     w1, [sp, x2]\n0x010024: cmp      x2, #0x1c\n0x010028: b.ne     #0x10010\n0x01002c: mov      x8, #0x40\n0x010030: mov      x0, #1\n0x010034: add      x1, sp, #1\n0x010038: mov      x2, #0x1c\n0x01003c: svc      #0
\n

The code is short enough to solve by hand, but let’s use Unicorn again.

\n

I based the ARM64 emulation script on the following sample.

\n

Reference: unicorn/sample_arm64eb.py at master · unicorn-engine/unicorn

\n

The flow is almost the same as for x86_64, but this time the disassembly tells us the decrypted flag string is stored in the x1 register.

\n

So I ran emulation up to 0x3c and then read 0x1c bytes from x1.

\n
#!/usr/bin/env python\n# Sample code for ARM64 of Unicorn. Nguyen Anh Quynh <aquynh@gmail.com>\n# Python sample ported by Loi Anh Tuan <loianhtuan@gmail.com>\n# AARCH64 Python sample ported by zhangwm <rustydaar@gmail.com>\n\nfrom __future__ import print_function\nfrom unicorn import *\nfrom unicorn.arm64_const import *\n\n\n# code to be emulated\ncode = open(\"polyglot\", \"rb\").read()\n\n# memory address where emulation starts\nADDRESS = 0x0\n\n# Test ARM64\ndef arm64():\n    print(\"Emulate ARM64 Big-Endian code\")\n    try:\n        # Initialize emulator in ARM mode\n        mu = Uc(UC_ARCH_ARM64, UC_MODE_ARM | UC_MODE_BIG_ENDIAN)\n\n        mu.mem_map(ADDRESS, 0x100000)\n        mu.mem_write(ADDRESS, code)\n\n        mu.mem_map(ADDRESS + 0x100000, 0x100000)\n        mu.reg_write(UC_ARM64_REG_SP, 0x100000+0x100000)\n\n        # emulate machine code in infinite time\n        mu.emu_start(ADDRESS, ADDRESS + 0x3c)\n\n        x1 = mu.reg_read(UC_ARM64_REG_X1)\n        print(mu.mem_read(x1, 0x1c).split(b'\\x00')[0])\n\n    except UcError as e:\n        print(\"ERROR: %s\" % e)\n\nif __name__ == '__main__':\n    arm64()
\n

Running this solver outputs bytearray(b'idek{__Why_50_m4nY_4rch5_l1k'), giving us the first half of the flag.

\n

Summary

\n

It feels a little unfair that the difficulty changes so drastically depending on whether you have IDA Pro, but it was an extremely educational challenge.

\n

I want to get more proficient with both Unicorn and Capstone going forward.

","fields":{"slug":"/ctf-idek-2022-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/english/"]},"frontmatter":{"date":"2023-01-19","description":"Idek CTF 2022 Writeup","tags":["CTF (en)","Rev (en)","English"],"title":"Idek CTF 2022 Writeup","socialImage":{"publicURL":"/static/dc6fc9e2553de2a2f2c5c718f4700e38/ctf-idek-2023.png"}}}},"pageContext":{"slug":"/ctf-idek-2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}