Emulation on Locus Solus | Nagi's Blog

TCTF 2021 0bf: Emulating Obfuscated Code with Unicorn

Sun, 10 Oct 2021 22:11:48 +0800

Notice

This article was originally published on Anquanke: original article

Introduction

With tremendous help from my teammates, we won the Rising Star division of the TCTF 2021 Finals. The challenge from which I learned the most was 0bf, a ten-round cipher hidden beneath extensive code obfuscation. The official post-event solution deobfuscated it first, but during the competition we lacked time to study the obfuscation pattern and had to analyze it directly. This was also my first use of Unicorn to emulate function logic.

An Introduction to Reversing mruby Bytecode

Mon, 27 Sep 2021 21:17:11 +0800

Notice

This article was originally published on Anquanke: original article

Introduction to mruby

mruby is a lightweight implementation of Ruby. It works much like CPython: Ruby source is compiled to bytecode, which is then interpreted by a virtual machine.

I first encountered mruby bytecode in the DEF CON 2021 Finals. The barb-metal challenge used mruby bytecode to run simulated IoT firmware. A few months later, another mruby reversing challenge appeared in the Fifth Space online competition, so I decided to summarize the characteristics of mruby bytecode.

SECCON 2019 Finals Writeup: bad mouse & 四.3

Fri, 27 Dec 2019 12:52:57 +0800

bad mouse

The challenge provided a small USB circuit board. Once connected, it behaved like an emulated mouse and drew the flag one character at a time. Its drawing speed continually decreased, so it clearly could not finish before the competition ended.

First convert the supplied firmware to binary with a tool such as hex2bin. Open it in IDA, select Atmel AVR as the processor and ATmega32 (or another suitable model) as the device, and the firmware can be disassembled.