Reverse Engineering

Last updated 3 years ago

Was this helpful?

Reverse Engineering

vault-door-training [50 pts]

Solution

Looking at the bottom with the Check Password Method is the flag

Flag: picoCTF{w4rm1ng_Up_w1tH_jAv4_eec0716b713}

vault-door-1 [100 pts]

Solution

It gave a lot of things to check and not wanting to do anything by hand created a quick python script by replacing the charAt with brackets and easily prints out the result.

password = []
for i in range(0, 32):
	password.append('')
password[0]='d'
password[29]='3'
password[4]='r'
password[2]='5'
password[23]='r'
password[3]='c'
password[17]='4'
password[1]='3'
password[7]='b'
password[10]='_'
password[5]='4'
password[9]='3'
password[11]='t'
password[15]='c'
password[8]='l'
password[12]='H'
password[20]='c'
password[14]='_'
password[6]='m'
password[24]='5'
password[18]='r'
password[13]='3'
password[19]='4'
password[21]='T'
password[16]='H'
password[27]='f'
password[30]='b'
password[25]='_'
password[22]='3'
password[28]='6'
password[26]='f'
password[31]='0'
result = ""
for a in password:
	result += a
print(result)

Flag: picoCTF{d35cr4mbl3_tH3_cH4r4cT3r5_ff63b0}

asm1 [200 pts]

Solution

asm1:
	<+0>:		push   ebp
	<+1>:		mov    ebp,esp
	<+3>:		cmp    DWORD PTR [ebp+0x8],0x3a2	; Compare 0x6fa to 0x3a2
	<+10>:	jg     0x512 <asm1+37>						; Jump taken
	<+12>:	cmp    DWORD PTR [ebp+0x8],0x358
	<+19>:	jne    0x50a <asm1+29>
	<+21>:	mov    eax,DWORD PTR [ebp+0x8]
	<+24>:	add    eax,0x12
	<+27>:	jmp    0x529 <asm1+60>
	<+29>:	mov    eax,DWORD PTR [ebp+0x8]
	<+32>:	sub    eax,0x12
	<+35>:	jmp    0x529 <asm1+60>
	<+37>:	cmp    DWORD PTR [ebp+0x8],0x6fa	; Compare 0x6fa to 0x6fa
	<+44>:	jne    0x523 <asm1+54>						; Jump not taken (0x6fa == 0x6fa)
	<+46>:	mov    eax,DWORD PTR [ebp+0x8]		; eax = 0x6fa
	<+49>:	sub    eax,0x12										; eax = 0x6fa - 0x12 = 0x6e8
	<+52>:	jmp    0x529 <asm1+60>						; Jump
	<+54>:	mov    eax,DWORD PTR [ebp+0x8]
	<+57>:	add    eax,0x12
	<+60>:	pop    ebp												; Finished
	<+61>:	ret

Flag: 0x6e8

vault-door-3 [200 pts]

Solution

Given the check password function, I take that and use the password objective as the input which will print out the flag. This is done by modifying to start with our output jU5t_a_sna_3lpm18gb41_u_4_mfr340 and printing out buffer once done.

    public boolean checkPassword() {
        password = "jU5t_a_sna_3lpm18gb41_u_4_mfr340";
        char[] buffer = new char[32];
        for (int i=0; i<8; i++) {
            buffer[i] = password.charAt(i);
        }
        for (; i<16; i++) {
            buffer[i] = password.charAt(23-i);
        }
        for (; i<32; i+=2) {
            buffer[i] = password.charAt(46-i);
        }
        for (i=31; i>=17; i-=2) {
            buffer[i] = password.charAt(i);
        }
        String s = new String(buffer);
        System.out.println(buffer);
        return s.equals("jU5t_a_sna_3lpm18gb41_u_4_mfr340");
    }

Flag: picoCTF{jU5t_a_s1mpl3_an4gr4m_4_u_1fb380}

asm2 [250 pts] [Not Solved]

Solution

Flag:

vault-door-4 [250 pts]

Solution

I love when I am given source code because all I have to do most of the time is insert a little bit of code and print kind of like what breakpoints do when debugging code.

public class MyClass {
    public static void main(String args[]) {
      checkPassword("This");

    }
    public static boolean checkPassword(String password) {
        byte[] myBytes = {
            106 , 85  , 53  , 116 , 95  , 52  , 95  , 98  ,
            0x55, 0x6e, 0x43, 0x68, 0x5f, 0x30, 0x66, 0x5f,
            0142, 0131, 0164, 063 , 0163, 0137, 0143, 061 ,
            '9' , '4' , 'f' , '7' , '4' , '5' , '8' , 'e' ,
        };
        String ans = "";
        for (int i=0; i<32; i++) {
            ans += (char)myBytes[i];
        }
        System.out.println(ans);
        return true;
    }
}

Flag: picoCTF{jU5t_4_bUnCh_0f_bYt3s_c194f7458e}

droids0 [300 pts] [Not Solved]

Solution

First, since it was an APK I had to decompile it which I choose to do through ApkTool d zero.apk -o outs. I think I have to actually install it so that will be for another time. Based on the code I just have to click the button.

Flag:

asm3 [300 pts] [Not Solved]

Solution

Flag:

vault-door-5 [300 pts]

Solution

Flag: picoCTF{c0nv3rt1ng_fr0m_ba5e_64_0b957c4f}

reverse_cipher [300 pts] [Not Solved]

Solution

It says binary file and wasn't sure if that was 1 and 0 or an actual file and after checking it is an ELF file so I went to disassemble it online. Running it by itself gives the error code segmentation fault.

Flag:

droids1 [350 pts] [Not Solved]

Solution

Flag:

vault-door-6 [350 pts]

Solution

Xor is really cool as when using it you can mix the variables around. In this case, let's say a is my password Byte and b is a guess byte. It calculates a ^ 0x55 - b = 0 which can also be displayed b ^ 0x55 - a = 0.

  public boolean checkPassword() {
        byte[] myBytes = {
            0x3b, 0x65, 0x21, 0xa , 0x38, 0x0 , 0x36, 0x1d,
            0xa , 0x3d, 0x61, 0x27, 0x11, 0x66, 0x27, 0xa ,
            0x21, 0x1d, 0x61, 0x3b, 0xa , 0x2d, 0x65, 0x27,
            0xa , 0x6c, 0x60, 0x37, 0x30, 0x60, 0x31, 0x36,
        };
        String ans = "";
        for (int i=0; i<32; i++) {
        	ans += (char)(0x55 ^ myBytes[i]);
        }
        System.out.println(ans);
        return true;
    }

Flag: picoCTF{n0t_mUcH_h4rD3r_tH4n_x0r_95be5dc}

asm4 [400 pts] [Not Solved]

Solution

Flag:

Need For Speed [400 pts] [Not Solved]

Solution

Flag:

B1ll_Gat35 [400 pts] [Not Solved]

Solution

Flag:

droids2 [400 pts] [Not Solved]

Solution

Flag:

vault-door-7 [400 pts]

Solution

The program is validating a 32 set of characters by splitting the 32 into 8 groups of 4 characters. Those 4 characters are then converted to hex and concatenating the binaries to create 1 integer. This reminds me of a hash, which at first I was tempted to just brute force and try each attempt of 4 characters as that is only 26 ^4, not that long but I realize, it can be way shorter so I got to work on the code. I wasn't getting at first so I wrote this down and it all became clear. I need to turn the integers -> Binary -> Hex -> Characters.

key = [1096770097,1952395366, 1600270708, 1601398833, 1716808014, 1734291511, 960049251, 1681089078]
ans = ""
for i in key:
	b = format(i, "b")
	x = hex(int(b, 2))
	for o in range(1, 5):
		cur = int(x[o * 2: (o + 1) * 2], 16)
		ans += chr(cur)
print(ans)

Flag: picoCTF{A_b1t_0f_b1t_sh1fTiNg_07990cd3b6}

vault-door-8 [450 pts] [Not Solved]

Solution

Flag:

droids3 [450 pts] [Not Solved]

Solution

Flag:

droids4 [500 pts] [Not Solved]

Solution

Flag:

Forky [500 pts] [Not Solved]

Solution

Flag:

PreviousForensics NextCryptography

Last updated 3 years ago

Was this helpful?