\n\nThis page has been machine-translated from the original page.
\n
I will work through the Rev challenges from the SECCON qualifiers one by one.
\nI plan to add the other challenges later.
\nFor the challenges and write-ups, refer to the following official repository.
\nReference: GitHub - SECCON/SECCON2022onlineCTF
\n\n\n\nbaby_mode = 1 👶
\n
When I decompiled the challenge binary in Ghidra, it turned out to be a simple password-checking program.
\nI was able to recover the flag with a template angr script.
\nimport angr\nimport claripy\n\nproj = angr.Project(\"chall.baby\", auto_load_libs=False)\nobj = proj.loader.main_object\nprint(\"Entry\", hex(obj.entry))\n\nfind = 0x4012c9\navoids = 0x40127a\n\nflag = claripy.BVS(\"flag\", 0x23 * 8)\nstate = proj.factory.entry_state(args=[\"./chall.baby\", flag])\nfor i in range(0x23):\n state.solver.add(flag.get_byte(i) >= 0x21)\n state.solver.add(flag.get_byte(i) <= 0x7f)\n\nsimgr = proj.factory.simgr(state)\nsimgr.explore(find=find, avoid=avoids)\n\n# Output\nsimgr.found[0].solver.eval(flag, cast_to=bytes)\n\n# SECCON{y0u_f0und_7h3_baby_flag_YaY}\n\nCrack me.
\n
Running the binary shows that it is a GUI program that performs license verification, as shown below.
\nI started by decompiling it with Ghidra.
\nBecause it is a GUI program, locating the actual verification logic takes a bit of work, but searching for the string Invalid license let me identify the relevant code.
The onClick function below appears to be the one called when the Check button is pressed.
For this kind of pattern, I think you could recover the flag by describing the constraints in Z3Py, but I could not quite write an appropriate script. In cases like this, it is better to patiently read through the logic. First, in the following snippet, I investigated with GDB and found that In other words, the flag string length must be Next, consider the following snippet. Here, it appears to compare the beginning and end of the input string against hard-coded values. As shown below, these values correspond to the flag prefix, so this section is checking the flag format. Next, this part is a little long, but let us go through it. The region after Inside the However, if you look closely, every byte of the input string is always greater than 0, so the code inside Let us continue following the logic. In the next lines, it extracts the character from Let us continue with the following logic. Here, it resets Although various operations are defined inside the The pattern should be clear by now. Including the logic so far, if we remove the lines that can be ignored, the code looks like this. In other words, these 176 lines of code are simply checking the flag prefix and whether the characters at specific positions are Now that we have read this far, let us look at the second half of the code. Ghidra’s decompilation did not seem to recover the arguments correctly, but it is calling the After checking the actual behavior in GDB, it turned out to create a collection by extracting a 12-character substring starting at index 7. In other words, it extracts the substring between It then uses Reference: from_iter - Rust Reference: Rust: Convert a base-n string to a number Reference: u64 - Rust At that point, I expected the later patterns to be the same. When I actually lined up the decompiled output below, it became clear that the program extracts each hyphen-separated segment of a flag in the format In other words, despite how complicated this code looks, almost all of the actual flag validation comes down to the following part. However, because I had renamed variables rather roughly in Ghidra, it became hard to tell what this code was doing. The result decompiled in IDA looked like this. Using these as constraints, I created the following solver. Running the script above yields the correct flag and also passes the program’s verification. Clam Devil; Asari no Akuma The challenge provides the following shell script and CBC file. The CBC file appears to be a compiled ClamAV custom detection signature. Reference: Bytecode Signatures - ClamAV Documentation This suggests that the flag should be a file that satisfies the detection condition when running For CBC files, it seems that the In this challenge, the I did not fully understand how to read it at first, but it seems that each function is assigned a Function id and the output lists opcodes together with operands. This is more of an educated guess, but it seems to first call So it looks like we want the return value of Next, let us look at function It is fairly long—about 100 lines—so I thought I might be able to brute-force my way through it, but I could not really understand how to read it. Referring to the official write-up, it seems that the following solver can recover the flag, so I used it as a clue while trying to understand the logic. I found a suspicious process named “araiguma.exe” running on my computer. Before removing it, I captured my network and dumped the process memory. Could you investigate what the malware is doing? doroboh The program is a malware. Do not run it unless you understand its behavior. TODO baby_mode = 0 👴 chall.elder TODOrdi + 0x90 stores the length of the input string.0x2b.if (*(long *)(rdi + 0x90) != 0x2b) {\n return false;\n}rdi + 0x80 stored the input string.input = *(uint **)(rdi + 0x80);\nif ((*(uint *)((long)input + 3) ^ 0x7b4e4f43 | *input ^ 0x43434553) != 0) {\n return false;\n}\nif (*(byte *)((long)input + 0x2a) != 0x7d) {\n return false;\n}input + 0x2b should not contain any meaningful values yet, so I renamed it to buf.do-while loop, it performs various operations while decrementing i, which starts at 0x13.if ((char)c < 0x0) never runs. The loop simply increments input_ptr 0x13 times and then ends.buf = (uint *)((long)input + 0x2b);\ni = 0x13;\ninput_ptr = input;\ndo {\n if (input_ptr == buf) goto FAIL;\n c = *(byte *)input_ptr;\n if ((char)c < 0x0) {\n if (c < 0xe0) {\n input_ptr = (uint *)((long)input_ptr + 2);\n }\n else if (c < 0xf0) {\n input_ptr = (uint *)((long)input_ptr + 3);\n }\n else {\n if ((*(byte *)((long)input_ptr + 3) & 0x3f |\n (*(byte *)((long)input_ptr + 2) & 0x3f) << 6 |\n (*(byte *)((long)input_ptr + 1) & 0x3f) << 0xc | (c & 7) << 0x12) == 0x110000)\n goto FAIL;\n input_ptr = input_ptr + 1;\n }\n }\n else {\n input_ptr = (uint *)((long)input_ptr + 1);\n }\n i = i + -1;\n} while (i != 0);input_ptr after advancing by 0x13, stores it in i_x13, and compares it. Since this value also never becomes less than 0, in practice it is only checking whether i_x13 equals 0x2d (-).c = *(byte *)input_ptr;\ni_x13 = (uint)c;\nif ((char)c < '\\0') {\n uVar2 = c & 0x1f;\n uVar5 = *(byte *)((long)input_ptr + 1) & 0x3f;\n if (c < 0xe0) {\n uVar5 = uVar2 << 6 | uVar5;\n }\n else {\n uVar5 = *(byte *)((long)input_ptr + 2) & 0x3f | uVar5 << 6;\n if (c < 0xf0) {\n uVar5 = uVar5 | uVar2 << 0xc;\n }\n else {\n uVar5 = *(byte *)((long)input_ptr + 3) & 0x3f | uVar5 << 6 | (c & 7) << 0x12;\n if (uVar5 == 0x110000) goto FAIL;\n }\n }\n}\nif (i_x13 != 0x2d) {\n return false;\n}input_ptr back to the beginning of the input string.do-while loop, the input characters still never become less than 0 here, so it effectively just advances the index to 0x1a.i = 0x1a;\ninput_ptr = input;\ndo {\nif (input_ptr == buf) goto LAB_5555555b436f;\nc = *(byte *)input_ptr;\nif ((char)c < '\\0') {\n if (c < 0xe0) {\n input_ptr = (uint *)((long)input_ptr + 2);\n }\n else if (c < 0xf0) {\n input_ptr = (uint *)((long)input_ptr + 3);\n }\n else {\n if ((*(byte *)((long)input_ptr + 3) & 0x3f |\n (*(byte *)((long)input_ptr + 2) & 0x3f) << 6 |\n (*(byte *)((long)input_ptr + 1) & 0x3f) << 0xc | (c & 7) << 0x12) == 0x110000)\n goto LAB_5555555b436f;\n input_ptr = input_ptr + 1;\n }\n}\nelse {\n input_ptr = (uint *)((long)input_ptr + 1);\n}\ni = i + -1;\n} while (i != 0);buf = (uint *)((long)input + 0x2b);\n\ni = 0x13;\ninput_ptr = input;\nc = *(byte *)input_ptr;\nif (c != 0x2d) {\n return false;\n}\n\ni = 0x1a;\ninput_ptr = input;\nc = *(byte *)input_ptr;\nif (c != 0x2d) {\n return false;\n}\n\ni = 0x21;\ninput_ptr = input;\nc = *(byte *)input_ptr;\nif (c != 0x2d) {\n return false;\n}-.A = 7;\nB = 0;\nC = 0xc;\nD = 0;\ninput_ptr2 = input;\nbuf2 = buf;\n<>::from_iter(&input_arr,&input_ptr2);\n\ninput_arr_ptr = input_arr;\ncore::num::<impl_u64>::from_str_radix(&input_ptr2,input_arr,local_38,0x10);\ninput_ptr = buf2;\n\nif ((char)input_ptr2 != '\\0') {\n input_ptr = (uint *)0x0;\n}\nif (local_40 != 0) {\n __rust_dealloc(input_arr_ptr);\n}from_iter function.SECCON{ and the first -.from_str_radix to convert that string to a number.SECCON{ABCDEFGHIJKL-NOPQRS-UVWXYZ-bcdefghi} and converts each segment to a number.A = 7;\nB = 0;\nC = 0xc;\nD = 0;\ninput_ptr2 = input;\nbuf2 = buf;\n<>::from_iter(&input_arr,&input_ptr2);\ninput_arr_ptr = input_arr;\ncore::num::<impl_u64>::from_str_radix(&input_ptr2,input_arr,local_38,0x10);\ninput_ptr = buf2;\nif ((char)input_ptr2 != '\\0') {\n input_ptr = (uint *)0x0;\n}\nif (local_40 != 0) {\n __rust_dealloc(input_arr_ptr);\n}\n\nA = 0x14;\nB = 0;\nC = 6;\nD = 0;\ninput_ptr2 = input;\nbuf2 = buf;\n<>::from_iter(&input_arr,&input_ptr2);\ninput_arr_ptr = input_arr;\ncore::num::<impl_u64>::from_str_radix(&input_ptr2,input_arr,local_38,0x10);\npuVar5 = buf2;\nif ((char)input_ptr2 != '\\0') {\n puVar5 = (uint *)0x0;\n}\nif (local_40 != 0) {\n __rust_dealloc(input_arr_ptr);\n}\n\nA = 0x1b;\nB = 0;\nC = 6;\nD = 0;\ninput_ptr2 = input;\nbuf2 = buf;\n<>::from_iter(&input_arr,&input_ptr2);\ninput_arr_ptr = input_arr;\ncore::num::<impl_u64>::from_str_radix(&input_ptr2,input_arr,local_38,0x10);\npuVar3 = buf2;\nif ((char)input_ptr2 != '\\0') {\n puVar3 = (uint *)0x0;\n}\nif (local_40 != 0) {\n __rust_dealloc(input_arr_ptr);\n}\n\nA = 0x22;\nB = 0;\nC = 8;\nD = 0;\ninput_ptr2 = input;\nbuf2 = buf;\n<>::from_iter(&input_arr,&input_ptr2);\ncore::num::<impl_u64>::from_str_radix(&input_ptr2,input_arr,local_38,0x10);\ninput = buf2;\nif ((char)input_ptr2 != '\\0') {\n input = (uint *)0x0;\n}\nif (local_40 != 0) {\n __rust_dealloc(input_arr);\n}if ((byte *)((long)input_ptr + (long)puVar5) != (byte *)0x8b228bf35f6a) {\n return false;\n}\nif ((byte *)((long)puVar3 + (long)puVar5) != (byte *)0xe78241) {\n return false;\n}\nif ((byte *)((long)input + (long)puVar3) == (byte *)0xfa4c1a9f) {\n if ((byte *)((long)input_ptr + (long)input) == (byte *)0x8b238557f7c8) {\n return ((ulong)puVar3 ^ (ulong)puVar5 ^ (ulong)input) == 0xf9686f4d;\n }\n return false;\n}if ( v21 + v24 == 0x8B228BF35F6ALL\n&& v24 + v26 == 15172161\n&& v28 + v26 == 4199291551LL\n&& v28 + v21 == 0x8B238557F7C8LL )\n{\n return (v28 ^ v24 ^ v26) == 4184371021LL;\n}from z3 import *\n\ns = Solver()\ni1 = BitVec('i1', 64)\ni2 = BitVec('i2', 64)\ni3 = BitVec('i3', 64)\ni4 = BitVec('i4', 64)\n\ns.add(i1 + i2 == 0x8b228bf35f6a)\ns.add(i2 + i3 == 0xe78241)\ns.add(i4 + i3 == 0xfa4c1a9f)\ns.add(i4 + i1 == 0x8B238557F7C8)\ns.add(i4 ^ i2 ^ i3 == 0xf9686f4d)\n\nif s.check() == sat:\n model = s.model()\n parts = [f\"{model[key].as_long():x}\"for key in [i1, i2, i3, i4]]\n flag = \"SECCON{\" + \"-\".join(parts) + \"}\"\n print(flag)\nelse:\n print(\"unsat\")Devil Hunter(Rev)
\n\n
\n#!/bin/sh\nif [ -z \"$1\" ]\nthen\n echo \"[+] ${0} <flag.txt>\"\n exit 1\nelse\n clamscan --bytecode-unsigned=yes --quiet -dflag.cbc \"$1\"\n if [ $? -eq 1 ]\n then\n echo \"Correct!\"\n else\n echo \"Wrong...\"\n fi\nfiClamBCafhaio`lfcf|aa```c``a```|ah`cnbac`cecnb`c``beaacp`clamcoincidencejb:4096\nSeccon.Reversing.{FLAG};Engine:56-255,Target:0;0;0:534543434f4e7b\nTeddaaahdabahdacahdadahdaeahdafahdagahebdeebaddbdbahebndebceaacb`bbadb`baacb`bb`bb`bdaib`bdbfaah\nEaeacabbae|aebgefafdf``adbbe|aecgefefkf``aebae|amcgefdgfgifbgegcgnfafmfef``\nG`ad`@`bdeBceBefBcfBcfBofBnfBnbBbeBefBfgBefBbgBcgBifBnfBgfBnbBfdBldBadBgd@`bad@Aa`bad@Aa`\nA`b`bLabaa`b`b`Faeac\nBaa``b`abTaa`aaab\nBb`baaabbaeAc`BeadTbaab\nBTcab`b@dE\nA`aaLbhfb`dab`dab`daahabndabad`bndabad`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`aa`b`d`b`b`aa`ah`aa`aa`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`b`b`b`d`b`d`b`b`b`b`bad`b`b`bad`b`d`aa`b`b`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`d`b`d`aa`Fbcgah\nBbadaedbbodad@dbadagdbbodaf@db`bahabbadAgd@db`d`bb@habTbaab\nBaaaiiab`dbbaBdbhb`d`bbbbaabTaaaiabac\nBb`dajbbabajb`dakh`ajB`bhb`dalj`akB`bhb`bamn`albadandbbodad@dbadaocbbadanamb`bb`aabbabaoAadaabaanab`bb`aAadb`dbbaa`ajAahb`d`bb@h`Taabaaagaa\nBb`bbcaabbabacAadaabdakab`bbca@dahbeabbacbeaaabfaeaahbeaBmgaaabgak`bdabfab`d`bb@h`Taabgaadag\nBb`bbhaabbabacAadaabiakab`bbha@db`d`bb@haab`d`bb@h`Taabiaagae\nBb`dbjabbaabjab`dbkah`bjaB`bhb`dblaj`bkaB`bhb`bbman`blabadbnadbbodad@dbadboacbbadbnabmab`bb`bgbboab`bbab`baacb`bb`dbbbh`bjaBnahb`dbcbj`bbbB`bhb`bbdbn`bcbb`bbebc`Add@dbadbfbcbbadagbebb`bbgbc`Addbdbbadbhbcbbadbfbbgbb`b`fbbabbhbb`dbiba`bjaAdhaabjbiab`dbibBdbhb`d`bbbibaaTaabjbaeaf\nBb`bbkbgbagaablbeab`bbkbHbj`hnicgdb`bbmbc`Add@dbadbnbcbbadagbmbb`bbobc`AddAadbadb`ccbbadbnbbobb`bbacgbb`caabbceab`bbacHcj`hnjjcdaabcck`blbbbcb`bbdcc`Add@dbadbeccbbadagbdcb`bbfcc`AddAbdbadbgccbbadbecbfcb`bbhcgbbgcaabiceab`bbhcHoigndjkcdaabjck`bccbicb`bbkcc`Add@dbadblccbbadagbkcb`bbmcc`AddAcdbadbnccbbadblcbmcb`bbocgbbncaab`deab`bbocHcoaljkhgdaabadk`bjcb`db`bbbdc`Add@dbadbcdcbbadagbbdb`bbddc`AddAddbadbedcbbadbcdbddb`bbfdgbbedaabgdeab`bbfdHcoalionedaabhdk`badbgdb`bbidc`Add@dbadbjdcbbadagbidb`bbkdc`AddAedbadbldcbbadbjdbkdb`bbmdgbbldaabndeab`bbmdHoilnikkcdaabodk`bhdbndb`bb`ec`Add@dbadbaecbbadagb`eb`bbbec`AddAfdbadbcecbbadbaebbeb`bbdegbbceaabeeeab`bbdeHdochfheedaabfek`bodbeeb`bbgec`Add@dbadbhecbbadagbgeb`bbiec`AddAgdbadbjecbbadbhebieb`bbkegbbjeaableeab`bbkeHdiemjoeedaabmek`bfebleb`bbnec`Add@dbadboecbbadagbneb`bb`fc`AddAhdbadbafcbbadboeb`fb`bbbfgbbafaabcfeab`bbbfHoimmoklfdaabdfk`bmebcfb`dbefo`bdfb`d`bbbef`Tbaag\nBb`dbffbb`bffaabgfn`bffTcaaabgfE\nAab`bLbaab`b`b`dab`dab`d`b`d`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`aa`b`d`b`d`Fbfaac\nBb`d`bb@habb`d`bbG`lckjljhaaTbaaa\nBb`dacbbaaacb`dadbbabadb`baen`acb`bafn`adb`bagh`afAcdb`bahi``agb`baik`ahBoodb`bajm`aiaeb`bakh`ajAhdb`bali`aeBhadb`baml`akalb`bana`afAadaaaoeab`banAddb`db`ao`anb`dbaao`amb`d`bbb`aabb`d`bbbaaaaTaaaoabaa\nBTcab`bamE\nSnfofdg`bcgof`befafcgig`bjc`ej`clamscan --bytecode-unsigned=yes --quiet -dflag.cbc flag.txt.clambc command can use the --printsrc and --printbcir options to obtain the original source or the disassembled intermediate representation.--printsrc option did not work properly, so I used --printbcir to obtain the disassembly.clambc --printbcir flag.cbc > decomp.txt########################################################################\n####################### Function id 0 ################################\n########################################################################\nfound a total of 4 globals\nGID ID VALUE\n------------------------------------------------------------------------\n 0 [ 0]: i0 unknown\n 1 [ 1]: [22 x i8] unknown\n 2 [ 2]: i8* unknown\n 3 [ 3]: i8* unknown\n------------------------------------------------------------------------\nfound 2 values with 0 arguments and 2 locals\nVID ID VALUE\n------------------------------------------------------------------------\n 0 [ 0]: i1\n 1 [ 1]: i32\n------------------------------------------------------------------------\nfound a total of 2 constants\nCID ID VALUE\n------------------------------------------------------------------------\n 0 [ 2]: 21(0x15)\n 1 [ 3]: 0(0x0)\n------------------------------------------------------------------------\nfound a total of 4 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.0 -> NUMINSTS 5\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n 0 0 OP_BC_CALL_DIRECT [32 /160/ 0] 0 = call F.1 ()\n 0 1 OP_BC_BRANCH [17 / 85/ 0] br 0 ? bb.1 : bb.2\n\n 1 2 OP_BC_CALL_API [33 /168/ 3] 1 = setvirusname[4] (p.-2147483645, 2)\n 1 3 OP_BC_JMP [18 / 90/ 0] jmp bb.2\n\n 2 4 OP_BC_RET [19 / 98/ 3] ret 3\n------------------------------------------------------------------------\n########################################################################call F.1 () and then branch with br 0 ? bb.1 : bb.2 depending on the result.bb probably corresponds to the number in the leftmost column. If execution jumps to bb.1, it reaches 1 = setvirusname[4] (p.-2147483645, 2), which seems to register the file’s detection information.F.1 to be 0.F.1.------------------------------------------------------------------------\nFUNCTION ID: F.1 -> NUMINSTS 115\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n 0 0 OP_BC_GEPZ [36 /184/ 4] 5 = gepz p.4 + (104)\n 0 1 OP_BC_GEPZ [36 /184/ 4] 7 = gepz p.6 + (105)\n 0 2 OP_BC_CALL_API [33 /168/ 3] 8 = seek[3] (106, 107)\n 0 3 OP_BC_COPY [34 /174/ 4] cp 108 -> 2\n 0 4 OP_BC_JMP [18 / 90/ 0] jmp bb.2\n\n 1 5 OP_BC_ICMP_ULT [25 /129/ 4] 9 = (18 < 109)\n 1 6 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n 1 7 OP_BC_BRANCH [17 / 85/ 0] br 9 ? bb.2 : bb.3\n\n 2 8 OP_BC_COPY [34 /174/ 4] cp 2 -> 10\n 2 9 OP_BC_SHL [8 / 44/ 4] 11 = 10 << 110\n 2 10 OP_BC_ASHR [10 / 54/ 4] 12 = 11 >> 111\n 2 11 OP_BC_TRUNC [14 / 73/ 3] 13 = 12 trunc ffffffffffffffff\n 2 12 OP_BC_GEPZ [36 /184/ 4] 14 = gepz p.4 + (112)\n 2 13 OP_BC_GEP1 [35 /179/ 4] 15 = gep1 p.14 + (13 * 65)\n 2 14 OP_BC_CALL_API [33 /168/ 3] 16 = read[1] (p.15, 113)\n 2 15 OP_BC_ICMP_SLT [30 /153/ 3] 17 = (16 < 114)\n 2 16 OP_BC_ADD [1 / 9/ 0] 18 = 10 + 115\n 2 17 OP_BC_COPY [34 /174/ 4] cp 116 -> 0\n 2 18 OP_BC_BRANCH [17 / 85/ 0] br 17 ? bb.7 : bb.1\n\n 3 19 OP_BC_CALL_API [33 /168/ 3] 19 = read[1] (p.3, 117)\n 3 20 OP_BC_ICMP_SGT [27 /138/ 3] 20 = (19 > 118)\n 3 21 OP_BC_COPY [34 /171/ 1] cp 3 -> 21\n 3 22 OP_BC_ICMP_EQ [21 /106/ 1] 22 = (21 == 119)\n 3 23 OP_BC_AND [11 / 55/ 0] 23 = 20 & 22\n 3 24 OP_BC_COPY [34 /174/ 4] cp 120 -> 0\n 3 25 OP_BC_BRANCH [17 / 85/ 0] br 23 ? bb.4 : bb.7\n\n 4 26 OP_BC_CALL_API [33 /168/ 3] 24 = read[1] (p.3, 121)\n 4 27 OP_BC_ICMP_SGT [27 /138/ 3] 25 = (24 > 122)\n 4 28 OP_BC_COPY [34 /174/ 4] cp 123 -> 1\n 4 29 OP_BC_COPY [34 /174/ 4] cp 124 -> 0\n 4 30 OP_BC_BRANCH [17 / 85/ 0] br 25 ? bb.7 : bb.5\n\n 5 31 OP_BC_COPY [34 /174/ 4] cp 1 -> 26\n 5 32 OP_BC_SHL [8 / 44/ 4] 27 = 26 << 125\n 5 33 OP_BC_ASHR [10 / 54/ 4] 28 = 27 >> 126\n 5 34 OP_BC_TRUNC [14 / 73/ 3] 29 = 28 trunc ffffffffffffffff\n 5 35 OP_BC_GEPZ [36 /184/ 4] 30 = gepz p.4 + (127)\n 5 36 OP_BC_GEP1 [35 /179/ 4] 31 = gep1 p.30 + (29 * 65)\n 5 37 OP_BC_LOAD [39 /198/ 3] load 32 <- p.31\n 5 38 OP_BC_CALL_DIRECT [32 /163/ 3] 33 = call F.2 (32)\n 5 39 OP_BC_SHL [8 / 44/ 4] 34 = 26 << 128\n 5 40 OP_BC_ASHR [10 / 54/ 4] 35 = 34 >> 129\n 5 41 OP_BC_TRUNC [14 / 73/ 3] 36 = 35 trunc ffffffffffffffff\n 5 42 OP_BC_MUL [3 / 18/ 0] 37 = 130 * 131\n 5 43 OP_BC_GEP1 [35 /179/ 4] 38 = gep1 p.7 + (37 * 65)\n 5 44 OP_BC_MUL [3 / 18/ 0] 39 = 132 * 36\n 5 45 OP_BC_GEP1 [35 /179/ 4] 40 = gep1 p.38 + (39 * 65)\n 5 46 OP_BC_STORE [38 /193/ 3] store 33 -> p.40\n 5 47 OP_BC_ADD [1 / 9/ 0] 41 = 26 + 133\n 5 48 OP_BC_ICMP_ULT [25 /129/ 4] 42 = (41 < 134)\n 5 49 OP_BC_COPY [34 /174/ 4] cp 41 -> 1\n 5 50 OP_BC_BRANCH [17 / 85/ 0] br 42 ? bb.5 : bb.6\n\n 6 51 OP_BC_LOAD [39 /198/ 3] load 43 <- p.7\n 6 52 OP_BC_ICMP_EQ [21 /108/ 3] 44 = (43 == 135)\n 6 53 OP_BC_MUL [3 / 18/ 0] 45 = 136 * 137\n 6 54 OP_BC_GEP1 [35 /179/ 4] 46 = gep1 p.7 + (45 * 65)\n 6 55 OP_BC_MUL [3 / 18/ 0] 47 = 138 * 139\n 6 56 OP_BC_GEP1 [35 /179/ 4] 48 = gep1 p.46 + (47 * 65)\n 6 57 OP_BC_LOAD [39 /198/ 3] load 49 <- p.48\n 6 58 OP_BC_ICMP_EQ [21 /108/ 3] 50 = (49 == 140)\n 6 59 OP_BC_AND [11 / 55/ 0] 51 = 44 & 50\n 6 60 OP_BC_MUL [3 / 18/ 0] 52 = 141 * 142\n 6 61 OP_BC_GEP1 [35 /179/ 4] 53 = gep1 p.7 + (52 * 65)\n 6 62 OP_BC_MUL [3 / 18/ 0] 54 = 143 * 144\n 6 63 OP_BC_GEP1 [35 /179/ 4] 55 = gep1 p.53 + (54 * 65)\n 6 64 OP_BC_LOAD [39 /198/ 3] load 56 <- p.55\n 6 65 OP_BC_ICMP_EQ [21 /108/ 3] 57 = (56 == 145)\n 6 66 OP_BC_AND [11 / 55/ 0] 58 = 51 & 57\n 6 67 OP_BC_MUL [3 / 18/ 0] 59 = 146 * 147\n 6 68 OP_BC_GEP1 [35 /179/ 4] 60 = gep1 p.7 + (59 * 65)\n 6 69 OP_BC_MUL [3 / 18/ 0] 61 = 148 * 149\n 6 70 OP_BC_GEP1 [35 /179/ 4] 62 = gep1 p.60 + (61 * 65)\n 6 71 OP_BC_LOAD [39 /198/ 3] load 63 <- p.62\n 6 72 OP_BC_ICMP_EQ [21 /108/ 3] 64 = (63 == 150)\n 6 73 OP_BC_AND [11 / 55/ 0] 65 = 58 & 64\n 6 74 OP_BC_MUL [3 / 18/ 0] 66 = 151 * 152\n 6 75 OP_BC_GEP1 [35 /179/ 4] 67 = gep1 p.7 + (66 * 65)\n 6 76 OP_BC_MUL [3 / 18/ 0] 68 = 153 * 154\n 6 77 OP_BC_GEP1 [35 /179/ 4] 69 = gep1 p.67 + (68 * 65)\n 6 78 OP_BC_LOAD [39 /198/ 3] load 70 <- p.69\n 6 79 OP_BC_ICMP_EQ [21 /108/ 3] 71 = (70 == 155)\n 6 80 OP_BC_AND [11 / 55/ 0] 72 = 65 & 71\n 6 81 OP_BC_MUL [3 / 18/ 0] 73 = 156 * 157\n 6 82 OP_BC_GEP1 [35 /179/ 4] 74 = gep1 p.7 + (73 * 65)\n 6 83 OP_BC_MUL [3 / 18/ 0] 75 = 158 * 159\n 6 84 OP_BC_GEP1 [35 /179/ 4] 76 = gep1 p.74 + (75 * 65)\n 6 85 OP_BC_LOAD [39 /198/ 3] load 77 <- p.76\n 6 86 OP_BC_ICMP_EQ [21 /108/ 3] 78 = (77 == 160)\n 6 87 OP_BC_AND [11 / 55/ 0] 79 = 72 & 78\n 6 88 OP_BC_MUL [3 / 18/ 0] 80 = 161 * 162\n 6 89 OP_BC_GEP1 [35 /179/ 4] 81 = gep1 p.7 + (80 * 65)\n 6 90 OP_BC_MUL [3 / 18/ 0] 82 = 163 * 164\n 6 91 OP_BC_GEP1 [35 /179/ 4] 83 = gep1 p.81 + (82 * 65)\n 6 92 OP_BC_LOAD [39 /198/ 3] load 84 <- p.83\n 6 93 OP_BC_ICMP_EQ [21 /108/ 3] 85 = (84 == 165)\n 6 94 OP_BC_AND [11 / 55/ 0] 86 = 79 & 85\n 6 95 OP_BC_MUL [3 / 18/ 0] 87 = 166 * 167\n 6 96 OP_BC_GEP1 [35 /179/ 4] 88 = gep1 p.7 + (87 * 65)\n 6 97 OP_BC_MUL [3 / 18/ 0] 89 = 168 * 169\n 6 98 OP_BC_GEP1 [35 /179/ 4] 90 = gep1 p.88 + (89 * 65)\n 6 99 OP_BC_LOAD [39 /198/ 3] load 91 <- p.90\n 6 100 OP_BC_ICMP_EQ [21 /108/ 3] 92 = (91 == 170)\n 6 101 OP_BC_AND [11 / 55/ 0] 93 = 86 & 92\n 6 102 OP_BC_MUL [3 / 18/ 0] 94 = 171 * 172\n 6 103 OP_BC_GEP1 [35 /179/ 4] 95 = gep1 p.7 + (94 * 65)\n 6 104 OP_BC_MUL [3 / 18/ 0] 96 = 173 * 174\n 6 105 OP_BC_GEP1 [35 /179/ 4] 97 = gep1 p.95 + (96 * 65)\n 6 106 OP_BC_LOAD [39 /198/ 3] load 98 <- p.97\n 6 107 OP_BC_ICMP_EQ [21 /108/ 3] 99 = (98 == 175)\n 6 108 OP_BC_AND [11 / 55/ 0] 100 = 93 & 99\n 6 109 OP_BC_SEXT [15 / 79/ 4] 101 = 100 sext 1\n 6 110 OP_BC_COPY [34 /174/ 4] cp 101 -> 0\n 6 111 OP_BC_JMP [18 / 90/ 0] jmp bb.7\n\n 7 112 OP_BC_COPY [34 /174/ 4] cp 0 -> 102\n 7 113 OP_BC_TRUNC [14 / 70/ 0] 103 = 102 trunc ffffffffffffffff\n 7 114 OP_BC_RET [19 / 95/ 0] ret 103\n------------------------------------------------------------------------from z3 import *\n\nhashlist = [\n 0x739e80a2, 0x3aae80a3, 0x3ba4e79f, 0x78bac1f3,\n 0x5ef9c1f3, 0x3bb9ec9f, 0x558683f4, 0x55fad594,\n 0x6cbfdd9f\n]\n\nflag = [BitVec(f'flag_{i}', 32) for i in range(len(hashlist))]\n\ns = Solver()\nfor hashvalue, block in zip(hashlist, flag):\n h = 0xacab3c0\n for i in range(4):\n h = RotateLeft(h ^ ((block >> (i*8)) & 0xff), 8)\n s.add(h == hashvalue)\n\nr = s.check()\nif r != sat:\n print(r)\n exit(1)\n\nm = s.model()\ns_flag = b\"\"\nfor block in flag:\n s_flag += int.to_bytes(m[block].as_long(), 4, 'little')\nprint(\"SECCON{\" + s_flag.decode() + \"}\")DoroboH(Rev)
\n\n
\neldercmp(Rev)
\n\n
\n\n
\n