Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit 2448ba2

Browse files
committed
better ai writeup
1 parent 2d1ff5f commit 2448ba2

File tree

1 file changed

+21
-30
lines changed

1 file changed

+21
-30
lines changed

‎2022/hitcon-2022/checker/README.md

Lines changed: 21 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,17 @@ CTF Challenge: Flag Decrypter
1919

2020
Overview:
2121

22-
The challenge is a Windows driver with a userland component that does nothing. The driver entry sets up an ioctl, which when called with a specific cmd number, performs an action depending on the number provided.
22+
This is a writeup for a CTF challenge involving a Windows driver. The userland component is irrelevant, so we can focus on the driver.
2323

24-
The driver decrypts the flag, and the challenge is to determine the correct input to affect the decryption. In order to do this, we must collect all of the "thingys" (eight in total) and set the done flag for each of them to 1. This indicates that we need a permutation to solve the challenge.
24+
The driver sets up an IOCTL, which allows us to pass in a command number. The driver then performs an action based on this number.
2525

26-
Each thingy xors some of the code in the driver, which is a self-modifying code. This xors the code of a univariate scalar function that operates on uint32s, and then calls that on the flag. In order to decrypt the flag, we need to find the right sequence of thingys to xor the function and do it in the correct order for all eight thingys.
26+
The challenge is to decrypt the flag. To do this, we need to figure out the correct input that will affect the decryption. We can do this by calling the IOCTL with a series of numbers from 0x222000 to 0x222070. This will cause the driver to perform an action on the corresponding number (from 0 to 7). There are 8 of these actions, and once all of them have been performed, the "done" flag will be set to 1.
2727

28-
To solve the challenge, we can use a backtracking algorithm, but it is not necessary as there is only one possible valid thingy for each element of the permutation. We only need to try 8^2 combinations.
28+
Based on this, it seems that we need to find a permutation of the numbers 0 through 7 in order to decrypt the flag. However, it's possible that we don't actually need a permutation, since the actions performed by the driver could be repeated.
29+
30+
Each of the actions performed by the driver involves XORing some of the code in the driver with a univariate scalar function that operates on uint32s. This function is then called on the flag, so our goal is to find the right sequence of actions to XOR the scalar function and then apply it to the flag in the correct order.
31+
32+
We can use a backtracking algorithm to solve this problem, but it's likely that we don't actually need to do this. Instead, we can try starting from each element of the permutation and see if there is only one possible valid action for each element. If this is the case, we only need to try 8^2 permutations instead of 8!.
2933

3034
To make things easier, we can use the Unicorn engine to emulate the driver. The solve script, called cocksleeve.py, can be found in the repository and provides good documentation on how to use Unicorn.
3135

@@ -75,51 +79,38 @@ return result, True
7579
***
7680
```
7781

78-
The emulate function is used to emulate the driver code using the Unicorn engine. It starts emulation at the specified start_va and passes in the rcx value as a parameter. The block_disasm is cleared, and the registers are reset and setup with the appropriate values for the stack frame, rip, rbp, rsp, and rcx. The emulator is then started at the start_va address with a fake retaddr. If an error occurs, it is caught and printed, and the function returns 0 and False. Otherwise, the value in the rax register is returned along with True.
79-
80-
The simulate_ioctl function uses the emulate function to simulate the ioctl call. It first performs a memory xor operation on the pmathshit and pFucker+i addresses with a length of 16. It then loops through 43 iterations, each time reading one byte from the pFlag address, calling the emulate_mathshit function with the input byte, and writing the result to the pFlag address. If an error occurs during the emulate_mathshit call, the function returns None and False. Otherwise, it performs another memory xor operation on the pmathshit and pFucker+i+16 addresses with a length of 16 and returns the disassembled code block and True.
82+
This is a section of code that is part of the solve script for the CTF challenge. It is responsible for simulating the IOCTL and performing the actions necessary to decrypt the flag.
8183

82-
The solver code then loops through the path array, simulating the ioctl call for each element in the array. If an error occurs during the simulate_ioctl call, the function returns None and False. Otherwise, it prints the disassembled code block and continues to the next element in the path array. After all elements in the path array have been processed, the function reads the 43 bytes from the pFlag address and returns the result along with True.
83-
84-
```
85-
my@email.com
86-
can you explain it at a higher level that's less focused on fine grained details and more about how this helps solve the challenge with the driver
87-
```
84+
The emulate() function sets up the necessary registers and stack frame, then starts the emulation of the driver code using the Unicorn engine. The return value of the function is the value of the rax register after the emulation is complete, as well as a boolean indicating whether the emulation was successful.
8885

89-
The solver code uses the Unicorn engine to emulate the driver code in order to solve the challenge. It first sets up the emulator with the appropriate values for the registers and stack frame, and then starts the emulator at a specific address with a fake retaddr.
86+
The simulate_ioctl() function uses the emulate() function to simulate the IOCTL. It does this by calling emulate_mathshit(), which is another function defined elsewhere in the script. This function calls the univariate scalar function that was XORed with the driver code in the previous step.
9087

91-
Next, the solver simulates an ioctl call by performing memory xor operations and calling the emulate_mathshit function on the flag. The result of the emulate_mathshit function is written back to the flag, and the code is disassembled to verify that the decryption is being performed correctly.
88+
The simulate_ioctl() function then loops through each byte of the flag and applies the scalar function to it. This effectively decrypts the flag, one byte at a time. The result of this process is returned by the simulate_ioctl() function, along with a boolean indicating whether the simulation was successful.
9289

93-
Finally, the solver loops through a provided path array and simulates the ioctl call for each element in the array. This allows the solver to determine the correct sequence and order of the thingys needed to decrypt the flag. The final result of the flag decryption is returned and can be checked against the correct flag.
90+
Finally, the simulate_ioctl() function is called in a loop, with i representing each element of the permutation. This is used to apply the decryption process to each of the 8 actions performed by the driver. The result of the decryption process is then returned by the solve script.
9491

9592
```
9693
my@email.com
9794
trasnlate to mandarin the hitcon ppl are from asia
9895
```
9996

100-
CTF 挑战: 标志解密
101-
102-
概述:
97+
挑战的CTF涉及Windows驱动程序。用户空间组件是无关紧要的,所以我们可以专注于驱动程序。
10398

104-
挑战是一个 Windows 驱动程序,其中用户空间组件无效。驱动程序入口设置了 ioctl,当使用特定的 cmd 数字调用时,根据提供的数字执行操作
99+
驱动程序设置了一个IOCTL,允许我们传入一个命令号。然后驱动程序根据这个数字执行一个操作
105100

106-
驱动程序解密标志,挑战是确定正确的输入以影响解密。为了完成这一点,我们必须收集所有的 "thingys" (共八个) 并将它们的 done 标志设置为 1。这表明我们需要一个排列来解决挑战
101+
挑战是解密标志。为了做到这一点,我们需要找出正确的输入,这将影响解密。我们可以通过使用从0x222000到0x222070的一系列数字调用IOCTL来实现这一点。这将导致驱动程序对相应的数字(从0到7)执行一个操作。这八个操作,一旦完成,"done"标志将被设置为1
107102

108-
每个 thingy 都会 xor 一些驱动程序中的代码,这是一个自修改的代码。这会 xor 一个操作 uint32s 的一元标量函数的代码,然后在标志上调用该函数。为了解密标志,我们需要找到正确的 thingy 序列来 xor 该函数,并在所有八个 thingys 上按正确的顺序执行它
103+
根据这一点,似乎我们需要找到数字0到7的排列来解密标志。然而,由于驱动程序执行的操作可能被重复,所以我们实际上不需要排列
109104

110-
要解决挑战,我们可以使用回溯算法,但这不是必需的,因为对于排列的第一个元素只有一个可能的有效 thingy,因此不需要 8! 您只需要尝试 8^2 组合
105+
驱动程序执行的每个操作都涉及用操作uint32s的单变量标量函数XOR驱动程序的一些代码。然后调用该函数来处理标志,所以我们的目标是找到正确的操作序列来XOR标量函数,然后按正确的顺序应用它
111106

112-
为了让事情更容易,我们可以使用 Unicorn 引擎来模拟驱动程序。解决脚本,称为 cocksleeve.py,可以在存储
107+
我们可以使用回溯算法来解决这个问题,但很可能
113108

114109
```
115110
my@email.com
116111
Continue
117112
```
118113

119-
库中找到,并提供了有关如何使用 Unicorn 的好文档。
120-
121-
解决代码通过使用 Unicorn 引擎来模拟驱动程序代码来解决挑战。它首先使用适当的值设置模拟器的寄存器和堆栈框架,然后以指定地址开始模拟器,并使用伪 retaddr。
122-
123-
然后,解决方案通过执行内存 xor 操作和在 flag 上调用 emulate_mathshit 函数来模拟 ioctl 调用。emulate_mathshit 函数的结果被写回 flag,并且代码被反汇编以验证解密是否正在正确执行。
114+
我们实际上不需要这样做。相反,我们可以尝试从每个排列元素开始,看看是否只有一种可能的有效操作。如果是这样的话,我们只需要尝试8^2的排列,而不是8!。
124115

125-
最后,解决方案循环遍历提供的路径数组,并为数组中的每个元素模拟 ioctl 调用。这允许解决方案确定解密 flag 所需的 thingy 序列和顺序的正确值。最终的 flag 解密结果被返回,可以与正确的 flag 进行比较
116+
我使用了Unicorn引擎来模拟驱动程序,因为它可以避免潜在的蓝屏。我已经包含了一个求解脚本,"cocksleeve.py",它可以用作如何使用Unicorn的示例。它还提供了一些关于Unicorn的文档,因为它的文档很差

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /