Reverse Engineering on Locus Solus | Nagi's Blog

Fixing A Rust Binary (Hack-A-Sat 2022 Once Unop a Djikstar)

Mon, 06 Jun 2022 01:34:24 -0400

Description

The challenge is a Dijkstra algorithm problem. We are given 3 CSV files which contain distances between the stars, and we are asked to find a path from our ship “ShippyMcShipFace” to the destination “Honolulu”. Normal Dijkstra seems not to work on this challenge; perhaps the cost is not simply the sum of all distances.

Introduction to Intel AES-NI

Mon, 22 Nov 2021 11:01:50 +0800

Notice

This article was originally published on Anquanke: original article

AES-NI is Intel’s x86-64 SIMD extension for accelerating AES. Anyone familiar with SIMD probably knows it exists, but AES’s asymmetric structure and AES-NI’s unusual design require considerable detail and theory to use correctly. Using easyRE from N1CTF 2021 as an example, this article summarizes my understanding; corrections are welcome.

TCTF 2021 0bf: Emulating Obfuscated Code with Unicorn

Sun, 10 Oct 2021 22:11:48 +0800

Notice

This article was originally published on Anquanke: original article

Introduction

With tremendous help from my teammates, we won the Rising Star division of the TCTF 2021 Finals. The challenge from which I learned the most was 0bf, a ten-round cipher hidden beneath extensive code obfuscation. The official post-event solution deobfuscated it first, but during the competition we lacked time to study the obfuscation pattern and had to analyze it directly. This was also my first use of Unicorn to emulate function logic.

An Introduction to Reversing mruby Bytecode

Mon, 27 Sep 2021 21:17:11 +0800

Notice

This article was originally published on Anquanke: original article

Introduction to mruby

mruby is a lightweight implementation of Ruby. It works much like CPython: Ruby source is compiled to bytecode, which is then interpreted by a virtual machine.

I first encountered mruby bytecode in the DEF CON 2021 Finals. The barb-metal challenge used mruby bytecode to run simulated IoT firmware. A few months later, another mruby reversing challenge appeared in the Fifth Space online competition, so I decided to summarize the characteristics of mruby bytecode.

PlaidCTF 2021 Watness 3

Wed, 25 Aug 2021 21:59:22 +0800

In PlaidCTF 2021, I solved the challenge The Watness III, then I spent my time on another challenge dr. Unfortunately, the regular expression algorithm in dr is too complex to understand, thus I failed to solve it.

There was a similar challenge in PlaidCTF 2020, The Watness II. I solved that last year when I was a member of A*0*E; it was a reverse challenge of a HyperCard game on the m68k platform. I thought that this challenge had the same game logic as the previous one, so I spent some time finding the color logic used in The Watness II. But the result shows that this challenge is different from that one.

DEF CON CTF 2021 Finals Retrospective

Fri, 13 Aug 2021 00:04:08 +0800

Hangzhou was rainy again today, making it difficult to feel energetic. I swore long ago that I would stop procrastinating, but nothing has changed after several years. After both the DEF CON CTF 2020 Finals and the 2021 Qualifiers, I confidently planned to publish something, only to abandon it each time. I could not postpone it again, so here is an account of my two days in Shanghai.

CTF 2021 Reverse5

Tue, 19 Jan 2021 09:02:47 +0800

The endless exams finally ended, and after half a year I returned to competing with my AAA teammates—and to staying up all night. We solved five of the six reverse-engineering challenges. The remaining one, RL_Env, appeared to involve machine learning; I did not even understand what it was asking us to do.

TCTF 2020 Finals Writeup

Mon, 28 Sep 2020 17:53:02 +0800

I realized that the blog had not been updated for a year, so it was time to fill in one of the gaps.

TCTF 2020 began at 10 a.m. and lasted 24 hours. My teammates and I spent the entire day competing in room 108, until I could no longer stay awake and fell asleep at 4 a.m. We ultimately placed second in the Rising Star division. In KoH, we lost to NeSE because we could not determine how to wire an S-box efficiently from logic gates.

SECCON 2019 Finals Writeup: bad mouse & 四.3

Fri, 27 Dec 2019 12:52:57 +0800

bad mouse

The challenge provided a small USB circuit board. Once connected, it behaved like an emulated mouse and drew the flag one character at a time. Its drawing speed continually decreased, so it clearly could not finish before the competition ended.

First convert the supplied firmware to binary with a tool such as hex2bin. Open it in IDA, select Atmel AVR as the processor and ATmega32 (or another suitable model) as the device, and the firmware can be disassembled.

The 5th USTC Information Security Contest

Wed, 17 Oct 2018 22:45:30 +0800

Check-in

Press F12 in Chrome to open Developer Tools. The input field has the following attribute:

1

<p>Key: <input type="text" name="key" maxlength="13"/></p>

Remove the maxlength attribute, then enter hackergame2018.

flag: flag{Hackergame2018_Have_Fun!}

MeePwn 2018: image-crackme

Wed, 17 Oct 2018 22:43:16 +0800

image-crackme

I tried to reverse the challenge with IDA Pro, but IDA crashed halfway through loading it, so I had to work by inference. After running image-crackme.exe several times, I found that it always generated a MeePwn.ascii containing a 160×160 block of seemingly random characters. The directory also contained a 160×160 MeePwn.jpg, without which the program would not run. I suspected a relationship between the image pixels and the output. I replaced the original with a completely white 160×160 image so every pixel was identical, then entered 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} (ASCII 48–126) as the key. The output had a very regular pattern:

SCTF 2018 Writeup

Wed, 17 Oct 2018 20:20:02 +0800

Reverse Script In Script
Reverse Where is my 13th count?
Reverse simple
Misc Welcome to SCTF 2018
Misc Mysterious Transaction
Misc Otaku’s Happy Challenge
Misc Introduction to Side Channels
Web easiest web - phpmyadmin

Reverse Engineering on Locus Solus | Nagi's Blog

Fixing A Rust Binary (Hack-A-Sat 2022 Once Unop a Djikstar)

Description

Introduction to Intel AES-NI

TCTF 2021 0bf: Emulating Obfuscated Code with Unicorn

Introduction

An Introduction to Reversing mruby Bytecode

Introduction to mruby

PlaidCTF 2021 Watness 3

DEF CON CTF 2021 Finals Retrospective

*CTF 2021 Reverse*5

TCTF 2020 Finals Writeup

SECCON 2019 Finals Writeup: bad mouse & 四.3

bad mouse

The 5th USTC Information Security Contest

Check-in

MeePwn 2018: image-crackme

image-crackme

SCTF 2018 Writeup

CTF 2021 Reverse5