{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-tet-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"61100481-9af1-5ae1-a56d-9de23eda9fae","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in TetCTF, which started on 1/27, as a solo player.

\n

I only managed to solve one Rev challenge, but it seems this CTF was fairly difficult, and I ended up in 111th place.

\n

\n \n \n \n \n \n \n \n \n

\n\n

Table of Contents

\n\n

babyasm(Rev)

\n
\n

Description:

\n

Can you unlock it?

\n

Server: http://103.3.61.46/TetCTF2024-babyasm/babyasm.html

\n
\n

When you access the URL given in the problem statement, you can see that it runs a service that accepts input and validates it using logic implemented in WebAssembly.

\n
<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>baby-asm</title>\n  <style>\n    body {\n      font-family: 'Courier New', monospace;\n      margin: 0;\n      padding: 0;\n      background-color: #f0f0f0;\n      display: flex;\n      flex-direction: column;\n      height: 100vh;\n    }\n    #console {\n      flex-grow: 1;\n      width: 100%;\n      overflow: auto;\n      background-color: black;\n      color: white;\n      padding: 10px;\n      box-sizing: border-box;\n    }\n    #input {\n      width: 100%;\n      padding: 5px;\n      box-sizing: border-box;\n    }\n  </style>\n</head>\n<body>\n  <div id=\"console\"></div>\n  <input type=\"text\" id=\"input\" placeholder=\"Input your password\">\n  \n  <script>\n\n    code = [ 0,97,115,109,1,0,0,0,1,56,9,80,0,95,1,127,1,80,0,94,99,0,1,96,0,0,96,1,127,1,100,1,96,3,99,1,127,127,0,96,2,99,1,127,1,127,96,4,99,1,127,127,127,0,96,1,99,1,1,127,96,1,99,1,1,127,3,8,7,2,3,4,5,6,7,8,6,118,20,127,1,65,224,0,11,127,1,65,229,0,11,127,1,65,20,11,127,1,65,177,1,11,127,1,65,155,1,11,127,1,65,244,0,11,127,1,65,236,0,11,127,1,65,197,0,11,127,1,65,212,0,11,127,1,65,237,0,11,127,1,65,231,0,11,127,1,65,238,0,11,127,1,65,239,0,11,127,1,65,223,0,11,127,1,65,244,0,11,127,1,65,231,0,11,127,1,65,225,0,11,127,1,65,200,0,11,127,1,65,20,11,127,1,65,59,11,7,45,7,1,49,0,0,4,105,110,105,116,0,1,10,97,114,114,97,121,95,102,105,108,108,0,2,1,51,0,3,1,52,0,4,1,53,0,5,5,99,104,101,99,107,0,6,10,184,8,7,142,1,0,35,0,65,19,115,36,0,35,1,65,55,115,36,1,35,2,65,32,115,36,2,35,3,65,36,115,36,3,35,4,65,19,115,36,4,35,5,65,55,115,36,5,35,6,65,32,115,36,6,35,7,65,36,115,36,7,35,8,65,19,115,36,8,35,9,65,55,115,36,9,35,10,65,32,115,36,10,35,11,65,36,115,36,11,35,12,65,19,115,36,12,35,13,65,55,115,36,13,35,14,65,32,115,36,14,35,15,65,36,115,36,15,35,16,65,19,115,36,16,35,17,65,55,115,36,17,35,18,65,32,115,36,18,35,19,65,36,115,36,19,11,9,0,32,0,251,7,1,16,0,11,22,0,32,0,32,1,32,2,65,19,106,65,64,107,251,0,0,65,1,251,16,1,11,13,0,32,0,32,1,251,11,1,251,2,0,0,11,109,0,32,1,65,0,70,4,64,32,0,32,2,32,0,32,2,16,3,32,3,106,65,32,115,16,2,5,32,1,65,1,70,4,64,32,0,32,2,32,0,32,2,16,3,32,3,106,65,36,115,16,2,5,32,1,65,2,70,4,64,32,0,32,2,32,0,32,2,16,3,32,3,106,65,19,115,16,2,5,32,1,65,3,70,4,64,32,0,32,2,32,0,32,2,16,3,32,3,106,65,55,115,16,2,11,11,11,11,11,172,3,1,1,127,32,0,65,0,16,3,65,137,175,2,70,4,64,32,1,65,1,106,33,1,5,11,32,0,65,1,16,3,65,200,4,70,4,64,32,1,65,1,106,33,1,11,32,0,65,2,16,3,65,226,5,70,4,64,32,1,65,1,106,33,1,11,32,0,65,3,16,3,65,194,173,2,70,4,64,32,1,65,1,106,33,1,11,32,0,65,4,16,3,65,193,242,3,70,4,64,32,1,65,1,106,33,1,11,32,0,65,5,16,3,65,135,5,70,4,64,32,1,65,1,106,33,1,11,32,0,65,6,16,3,65,193,6,70,4,64,32,1,65,1,106,33,1,11,32,0,65,7,16,3,65,242,240,3,70,4,64,32,1,65,1,106,33,1,11,32,0,65,8,16,3,65,166,243,2,70,4,64,32,1,65,1,106,33,1,11,32,0,65,9,16,3,65,238,3,70,4,64,32,1,65,1,106,33,1,11,32,0,65,10,16,3,65,151,5,70,4,64,32,1,65,1,106,33,1,11,32,0,65,11,16,3,65,229,241,2,70,4,64,32,1,65,1,106,33,1,11,32,0,65,12,16,3,65,225,139,4,70,4,64,32,1,65,1,106,33,1,11,32,0,65,13,16,3,65,129,5,70,4,64,32,1,65,1,106,33,1,11,32,0,65,14,16,3,65,151,6,70,4,64,32,1,65,1,106,33,1,11,32,0,65,15,16,3,65,174,137,4,70,4,64,32,1,65,1,106,33,1,11,32,0,65,16,16,3,65,225,149,2,70,4,64,32,1,65,1,106,33,1,11,32,0,65,17,16,3,65,177,4,70,4,64,32,1,65,1,106,33,1,11,32,0,65,18,16,3,65,161,5,70,4,64,32,1,65,1,106,33,1,11,32,0,65,19,16,3,65,234,147,2,70,4,64,32,1,65,1,106,33,1,11,32,1,65,20,70,4,127,65,1,5,65,0,11,11,218,2,0,32,0,65,0,65,1,32,0,65,0,16,3,35,0,106,16,4,32,0,65,1,65,2,32,0,65,1,16,3,35,1,107,16,4,32,0,65,2,65,3,32,0,65,2,16,3,35,2,108,16,4,32,0,65,3,65,0,32,0,65,3,16,3,35,3,115,16,4,32,0,65,0,65,5,32,0,65,4,16,3,35,4,106,16,4,32,0,65,1,65,6,32,0,65,5,16,3,35,5,107,16,4,32,0,65,2,65,7,32,0,65,6,16,3,35,6,108,16,4,32,0,65,3,65,4,32,0,65,7,16,3,35,7,115,16,4,32,0,65,0,65,9,32,0,65,8,16,3,35,8,106,16,4,32,0,65,1,65,10,32,0,65,9,16,3,35,9,107,16,4,32,0,65,2,65,11,32,0,65,10,16,3,35,10,108,16,4,32,0,65,3,65,8,32,0,65,11,16,3,35,11,115,16,4,32,0,65,0,65,13,32,0,65,12,16,3,35,12,106,16,4,32,0,65,1,65,14,32,0,65,13,16,3,35,13,107,16,4,32,0,65,2,65,15,32,0,65,14,16,3,35,14,108,16,4,32,0,65,3,65,12,32,0,65,15,16,3,35,15,115,16,4,32,0,65,0,65,17,32,0,65,16,16,3,35,16,106,16,4,32,0,65,1,65,18,32,0,65,17,16,3,35,17,107,16,4,32,0,65,2,65,19,32,0,65,18,16,3,35,18,108,16,4,32,0,65,3,65,16,32,0,65,19,16,3,35,19,115,16,4,32,0,16,5,11,0,45,4,110,97,109,101,1,38,7,0,1,49,1,4,105,110,105,116,2,10,97,114,114,97,121,95,102,105,108,108,3,1,51,4,1,52,5,1,53,6,5,99,104,101,99,107 ];            const byte_code = new Uint8Array(code);\n\n    const wasmModule = new WebAssembly.Module(byte_code);\n    const wasmInstance = new WebAssembly.Instance(wasmModule, {});\n    const wasm = wasmInstance.exports;\n    \n    const consoleDiv = document.getElementById('console');\n    const inputField = document.getElementById('input');\n\n    inputField.addEventListener('keydown', function (event) {\n      if (event.key === 'Enter') {\n        const inputText = inputField.value;\n        processInput(inputText);\n        inputField.value = '';\n      }\n    });\n\n    function processInput(text) {\n      const p = document.createElement('p');\n      if (text.startsWith('TetCTF{') && text.endsWith('}') && text.length === 27) {\n\n        let array_size= 20;\n        let array_obj = wasm.init(array_size);\n        \n        for (var i = 0; i < array_size; i++) {\n          wasm.array_fill(array_obj, i, text.charCodeAt(i+7));\n        }\n        if (wasm.check(array_obj )){\n          p.textContent = '> Correct!';\n        } else {\n          p.textContent = '> Incorrect!';\n        }\n      } else {\n        p.textContent = '> Incorrect!';\n      }\n      consoleDiv.appendChild(p);\n      consoleDiv.scrollTop = consoleDiv.scrollHeight;\n    }\n  </script>\n</body>\n</html>
\n

The webpage looked like this.

\n

\n \n \n \n \n \n \n \n \n

\n

As a first step, I saved the byte sequence hardcoded in the HTML as a .wasm file so I could decompile the WebAssembly.

\n

\n \n \n \n \n \n \n \n \n

\n

However, I couldn’t analyze it properly with wabt, so I had no choice but to read the assembly code shown in the browser instead.

\n

For reference, Ghidra with the Wasm plugin installed also failed to decompile it.

\n

\n \n \n \n \n \n \n \n \n

\n

As you can see from the JavaScript implementation, the input string is first checked to see whether it is a 27-character text matching the flag format TetCTF{.*}. After initialization with wasm.init(array_size) and wasm.array_fill(array_obj, i, text.charCodeAt(i+7));, validation is then performed by wasm.check(array_obj).

\n
function processInput(text) {\n  const p = document.createElement('p');\n  if (text.startsWith('TetCTF{') && text.endsWith('}') && text.length === 27) {\n\n    let array_size= 20;\n    let array_obj = wasm.init(array_size);\n\n    for (var i = 0; i < array_size; i++) {\n      wasm.array_fill(array_obj, i, text.charCodeAt(i+7));\n    }\n    if (wasm.check(array_obj )){\n      p.textContent = '> Correct!';\n    } else {\n      p.textContent = '> Incorrect!';\n    }\n  } else {\n    p.textContent = '> Incorrect!';\n  }\n  consoleDiv.appendChild(p);\n  consoleDiv.scrollTop = consoleDiv.scrollHeight;\n}
\n

The wasm.array_fill() function was implemented as follows.

\n

Here, it stores at a specific index of the array given as the first argument the value obtained by adding 83 to the value received as the third argument.

\n

\n \n \n \n \n \n \n \n \n

\n

The decompiled output of this function looked like the following.

\n
undefined8 check_key(char *param_1)\n{\n  long lVar1;\n  int iVar2;\n  size_t len_flag;\n  undefined8 uVar3;\n  long in_FS_OFFSET;\n  uint k;\n  uint m;\n  uint l;\n  uint a;\n  uint b;\n  uint i;\n  long mem1 [22];\n  long mem2 [22];\n  long unk [22];\n  undefined8 local_38;\n  undefined8 local_30;\n  undefined4 local_28;\n  undefined2 local_24;\n  long local_20;\n  \n  local_20 = *(long *)(in_FS_OFFSET + 0x28);\n  len_flag = strlen(param_1);\n  if (len_flag == 0x54) {\n    local_38 = 0x6766656463615f21;\n    local_30 = 0x72706f6e6d6c6968;\n    local_28 = 0x77757473;\n    local_24 = 0x79;\n    for (k = 0; k < 0x54; k = k + 1) {\n      for (m = 0; (m < 0x15 && (*(char *)((long)&local_38 + (ulong)m) != param_1[k])); m = m + 1) {\n        if (m == 0x14) {\n          uVar3 = 0;\n          goto LAB_00101603;\n        }\n      }\n    }\n    memset(mem1,0,0xa8);\n    for (l = 0; l < 0x15; l = l + 1) {\n      iVar2 = hash_64_fnv1a(param_1 + (l << 2),4);\n      mem1[l] = (long)iVar2;\n    }\n    x = 0x75bcd15;\n    y = 0x159a55e5;\n    z = 0x1f123bb5;\n    w = 0xdeadbeef;\n    memset(mem2,0,0xa8);\n    for (a = 0; a < 0x15; a = a + 1) {\n      for (b = 0; b < 0x15; b = b + 1) {\n        lVar1 = mem1[b];\n        iVar2 = xorshift128();\n        mem2[a] = lVar1 * (iVar2 % 0x400) + mem2[a];\n      }\n    }\n    unk[0] = -0x90ee47fcb5;\n    unk[1] = 0x673420daf2;\n    unk[2] = 0x45eb817f02c;\n    unk[3] = 0xfffffe3099503945;\n    unk[4] = 0x18f8dce1227;\n    unk[5] = 0x26050ea6875;\n    unk[6] = 0x298599c4bf0;\n    unk[7] = 0xfffff8a356ce9e58;\n    unk[8] = 0xfffffed3c712cf36;\n    unk[9] = 0xfffffe96846d630f;\n    unk[10] = 0x58cb1ce3ff3;\n    unk[11] = 0xfffffccf182c2a63;\n    unk[12] = 0xfffffe57fdf3f1de;\n    unk[13] = 0xfffffa603f35f962;\n    unk[14] = 0xffffff7884570b57;\n    unk[15] = 0x4897c4d9c1;\n    unk[16] = 0xfffffeb9355e5cb4;\n    unk[17] = 0xdcedf7d094;\n    unk[18] = 0x3602e9cac47;\n    unk[19] = 0xfffffee3667219d6;\n    unk[20] = 0xfffffdc326c9b063;\n    for (i = 0; i < 0x15; i = i + 1) {\n      if (unk[i] != mem2[i]) {\n        uVar3 = 0;\n        goto LAB_00101603;\n      }\n    }\n    uVar3 = 1;\n  }\n  else {\n    uVar3 = 0;\n  }\nLAB_00101603:\n  if (local_20 == *(long *)(in_FS_OFFSET + 0x28)) {\n    return uVar3;\n  }\n                    /* WARNING: Subroutine does not return */\n  __stack_chk_fail();\n}
\n

This function can also be broken down into several steps.

\n

First, it compares against 0x15 pre-defined characters.

\n
  len_flag = strlen(param_1);\n  if (len_flag == 0x54) {\n    # 0x21,0x5F,0x61,0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6C,0x6D,0x6E,0x6F,0x70,0x72,0x73,0x74,0x75,0x77,0x79\n    # !_acdefghilmnoprstuwy\n    local_38 = 0x6766656463615f21;\n    local_30 = 0x72706f6e6d6c6968;\n    local_28 = 0x77757473;\n    local_24 = 0x79;\n    for (k = 0; k < 0x54; k = k + 1) {\n      for (m = 0; (m < 0x15 && (*(char *)((long)&local_38 + (ulong)m) != param_1[k])); m = m + 1) {\n        if (m == 0x14) {\n          uVar3 = 0;\n          goto LAB_00101603;\n        }\n      }\n    }
\n

I misread this part a bit during the contest, but what it is actually checking here is that every one of the 0x54 characters in the correct flag string is one of these 0x15 characters.

\n

In the next step, it uses a function called hash_64_fnv1a to convert the 0x54-character flag string into 8-byte hashes, four characters at a time.

\n
memset(mem1,0,0xa8);\nfor (l = 0; l < 0x15; l = l + 1) {\n  iVar2 = hash_64_fnv1a(param_1 + (l << 2),4);\n  mem1[l] = (long)iVar2;\n}
\n

In the next step, it updates the data in the mem2 region using the 8-byte value obtained from xorshift128, reduced modulo 0x400, together with the hash produced by hash_64_fnv1a.

\n
x = 0x75bcd15;\ny = 0x159a55e5;\nz = 0x1f123bb5;\nw = 0xdeadbeef;\nmemset(mem2,0,0xa8);\nfor (a = 0; a < 0x15; a = a + 1) {\n  for (b = 0; b < 0x15; b = b + 1) {\n    lVar1 = mem1[b];\n    iVar2 = xorshift128();\n    mem2[a] = lVar1 * (iVar2 % 0x400) + mem2[a];\n  }\n}
\n

This data is compared against hardcoded values in the final step, and if all values match, the validation passes and the input is accepted as the correct flag.

\n
for (i = 0; i < 0x15; i = i + 1) {\n  if (unk[i] != mem2[i]) {\n    uVar3 = 0;\n    goto LAB_00101603;\n  }\n}\nuVar3 = 1;
\n

Also, the xorshift128 function is implemented as follows.

\n
uint xorshift128(void)\n{\n  uint uVar1;\n  \n  uVar1 = x ^ x << 0xb;\n  x = y;\n  y = z;\n  z = w;\n  w = w ^ w >> 0x13 ^ uVar1 ^ uVar1 >> 8;\n  return w;\n}
\n

Since the initial values of x, y, z, and w used as the seed are hardcoded here, the output of xorshift128 is fixed.

\n

During the contest, I tried various ways to recover the flag with Z3, but I apparently mishandled the underlying byte values and never managed to obtain the flag.

\n

However, if you look closely at the implementation, the output of xorshift128, whose seed is explicit, can be computed as a fixed value.

\n

Also, the mem2 update performed by mem2[a] = lVar1 * (iVar2 % 0x400) + mem2[a]; can be solved as a system of 21 simultaneous equations in which the hashes (lVar1) obtained for each 4-character chunk of the flag string are the terms.

\n

So in the end, by using the following solver, I was able to determine that the correct flag was TetCTF{may_the_lanterns_of_the_lunar_new_year_light_up_your_path_to_success_and_happiness!!}.

\n
from ctypes import *\nimport numpy as np\nimport math\nfrom itertools import permutations,product\n\nans = [0 for i in range(0x15)]\nans[0] = 0xffffff6f11b8034b\nans[1] = 0x673420daf2\nans[2] = 0x45eb817f02c\nans[3] = 0xfffffe3099503945\nans[4] = 0x18f8dce1227\nans[5] = 0x26050ea6875\nans[6] = 0x298599c4bf0\nans[7] = 0xfffff8a356ce9e58\nans[8] = 0xfffffed3c712cf36\nans[9] = 0xfffffe96846d630f\nans[10] = 0x58cb1ce3ff3\nans[11] = 0xfffffccf182c2a63\nans[12] = 0xfffffe57fdf3f1de\nans[13] = 0xfffffa603f35f962\nans[14] = 0xffffff7884570b57\nans[15] = 0x4897c4d9c1\nans[16] = 0xfffffeb9355e5cb4\nans[17] = 0xdcedf7d094\nans[18] = 0x3602e9cac47\nans[19] = 0xfffffee3667219d6\nans[20] = 0xfffffdc326c9b063\n\ndef hash_64_fnv1a(data):\n    fnv_prime = 0x100000001b3\n    hash = 0xcbf29ce484222325\n    for byte in data:\n        hash = c_int32((hash ^ byte) * fnv_prime).value\n    return hash\n\nx = 0x75bcd15\ny = 0x159a55e5\nz = 0x1f123bb5\nw = 0xdeadbeef\n\ndef xorshift128():\n    global x, y, z, w\n    v1 = ((c_uint32(x<<11).value ^ c_uint32(x).value) >> 8)\n    v1 ^= c_uint32(x<<11).value ^ x\n    v1 = c_uint32(v1).value\n    x = y\n    y = z\n    z = w\n    w ^= c_uint32(w).value >> 19\n    w ^= v1\n    w = c_int32(w).value\n    return w\n\nhashes = {}\nwords = \"!_acdefghilmnoprstuwy\"\nfor chars in product(words,repeat=4):\n    A = ''.join(chars)\n    hashes[hash_64_fnv1a(A.encode())] = A\n\n\nX = []\nfor i in range(0x15):\n    X.append([int(math.fmod(xorshift128(), 1024)) for n in range(0x15)])\n\n# N1 = val[0]*X[i*0x15+0] + 0\n# N2 = val[1]*X[i*0x15+1] + N1\n# N3 = val[2]*X[i*0x15+2] + N2\n# N4 = val[3]*X[i*0x15+3] + N3\n# N5 = val[4]*X[i*0x15+4] + N4\n# N6 = val[5]*X[i*0x15+5] + N5\n# N7 = val[6]*X[i*0x15+6] + N6\n# N8 = val[7]*X[i*0x15+7] + N7\n# N9 = val[8]*X[i*0x15+8] + N8\n# N10 = val[9]*X[i*0x15+9] + N9\n# N11 = val[10]*X[i*0x15+10] + N10\n# N12 = val[11]*X[i*0x15+11] + N11\n# N13 = val[12]*X[i*0x15+12] + N12\n# N14 = val[13]*X[i*0x15+13] + N13\n# N15 = val[14]*X[i*0x15+14] + N14\n# N16 = val[15]*X[i*0x15+15] + N15\n# N17 = val[16]*X[i*0x15+16] + N16\n# N18 = val[17]*X[i*0x15+17] + N17\n# N19 = val[18]*X[i*0x15+18] + N18\n# N20 = val[19]*X[i*0x15+19] + N19\n# N21 = val[20]*X[i*0x15+20] + N20\n# ans が右辺ベクトル、X[i*0x15+j] が係数行列になるので上記の連立方程式を解く\n\nA = np.array(X)\nB = np.array([c_int64(n).value for n in ans])\nsolution = np.linalg.solve(A, B)\n\nfor s in solution:\n    v = c_int64(round(s)).value\n    print(hashes[v],end=\"\")
\n

Looking back, one clear mistake was that I only thought about blindly throwing the problem into Z3, and failed to notice that the structure could be solved as a system of simultaneous equations.

\n

I also got tripped up by handling things like the hashing step with normal Python integer variables, which caused incorrect results.

\n

I should have either written the solver in C from the start, or set the appropriate data types with ctypes based on the decompiled output.

\n

Another issue was that I used permutations when generating strings for the hash table.

\n

\n \n