{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-seccon-2024-en","result":{"data":{"markdownRemark":{"id":"fe5ee947-d6dc-5771-8f9b-7ecad594be80","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in SECCON CTF 13 with the team 0nePadding.

\n

Individually I solved 2 Rev challenges, finishing 34th domestically and 89th overall.

\n

\n \n \n \n \n \n \n \n \n

\n

However, the unpacked binary was implemented to always display a Wrong error without ever validating the input, so it was not useful for identifying the correct flag.

\n

\n \n \n \n \n \n \n \n \n

\n

In other words, I suspected the binary had been modified in some way so that part of the code is not included in the UPX-unpacked output.

\n

I couldn’t immediately think of exactly what kind of modification was applied, so I decided to skip unpacking and analyze the binary dynamically as-is.

\n

After passing the input-length check, the binary appears to XOR each input character against a hardcoded key.

\n

\n \n \n \n \n \n \n \n \n

\n

The key used here can be easily retrieved with gdb.

\n

The hardcoded byte array ultimately used for comparing against the correct flag was also easy to read out with gdb.

\n

\n \n \n \n \n \n \n \n \n

\n

From there, the following solver decrypts the XOR cipher to obtain the correct flag.

\n
key = [0xe8,0x4a,0x00,0x00,0x00,0x83,0xf9,0x49,0x75,0x44,0x53,0x57,0x48,0x8d,0x4c,0x37,0xfd,0x5e,0x56,0x5b,0xeb,0x2f,0x48,0x39,0xce,0x73,0x32,0x56,0x5e,0xac,0x3c,0x80,0x72,0x0a,0x3c,0x8f,0x77,0x06,0x80,0x7e,0xfe,0x0f,0x74,0x06,0x2c,0xe8,0x3c,0x01]\ntarget = [0xbb,0x0f,0x43,0x43,0x4f,0xcd,0x82,0x1c,0x25,0x1c,0x0c,0x24,0x7f,0xf8,0x2e,0x68,0xcc,0x2d,0x09,0x3a,0xb4,0x48,0x78,0x56,0xaa,0x2c,0x42,0x3a,0x6a,0xcf,0x0f,0xdf,0x14,0x3a,0x4e,0xd0,0x1f,0x37,0xe4,0x17,0x90,0x39,0x2b,0x65,0x1c,0x8c,0x0f,0x7c]\n\nfor i in range(0x30):\n    print(chr(key[i]^target[i]),end=\"\")\n\n# SECCON{UPX_s7ub_1s_a_g0od_pl4c3_f0r_h1din6_c0d3}
\n

Jump (Rev)

\n
\n

Who would have predicted that ARM would become so popular?

\n

※ We confirmed the binary of Jump accepts multiple flags. The SHA-1 of the correct flag is c69bc9382d04f8f3fbb92341143f2e3590a61a08 We’re sorry for your patience and inconvenience

\n
\n

I analyzed the ARM binary provided as the challenge binary using Binary Ninja.

\n

The jumper function called from main checks whether command-line arguments are present, and if so, executes a RET to the execution address loaded onto the stack.

\n

\n \n