> For the complete documentation index, see [llms.txt](https://codingmace.gitbook.io/masterward/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codingmace.gitbook.io/masterward/ctf/2019/picoctf/re.md).
# Reverse Engineering
### vault-door-training \[50 pts]
> **Description**
>
> Your mission is to enter Dr. Evil's laboratory and retrieve the blueprints for his Doomsday Project. The laboratory is protected by a series of locked vault doors. Each door is controlled by a computer and requires a password to open. Unfortunately, our undercover agents have not been able to obtain the secret passwords for the vault doors, but one of our junior agents obtained the source code for each vault's computer! You will need to read the source code for each level to figure out what the password is for that vault door. As a warmup, we have created a replica vault in our training facility. The source code for the training vault is here: [VaultDoorTraining.java](https://jupiter.challenges.picoctf.org/static/1afdf83322ee9c0040f8e3a3c047e18b/VaultDoorTraining.java)
**Solution**
Looking at the bottom with the Check Password Method is the flag
**Flag: picoCTF{w4rm1ng\_Up\_w1tH\_jAv4\_eec0716b713}**
### vault-door-1 \[100 pts]
> **Description**
>
> This vault uses some complicated arrays! I hope you can make sense of it, special agent. The source code for this vault is here: [VaultDoor1.java](https://jupiter.challenges.picoctf.org/static/29b91e638ccbd76aaa8c0462d1c64d8d/VaultDoor1.java)
**Solution**
It gave a lot of things to check and not wanting to do anything by hand created a quick python script by replacing the charAt with brackets and easily prints out the result.
```
password = []
for i in range(0, 32):
password.append('')
password[0]='d'
password[29]='3'
password[4]='r'
password[2]='5'
password[23]='r'
password[3]='c'
password[17]='4'
password[1]='3'
password[7]='b'
password[10]='_'
password[5]='4'
password[9]='3'
password[11]='t'
password[15]='c'
password[8]='l'
password[12]='H'
password[20]='c'
password[14]='_'
password[6]='m'
password[24]='5'
password[18]='r'
password[13]='3'
password[19]='4'
password[21]='T'
password[16]='H'
password[27]='f'
password[30]='b'
password[25]='_'
password[22]='3'
password[28]='6'
password[26]='f'
password[31]='0'
result = ""
for a in password:
result += a
print(result)
```
**Flag: picoCTF{d35cr4mbl3\_tH3\_cH4r4cT3r5\_ff63b0}**
### asm1 \[200 pts]
> **Description**
>
> What does asm1(0x6fa) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/b41e08fc19ceb9d0466ebd68d36c5630/test.S)
**Solution**
```
asm1:
<+0>: push ebp
<+1>: mov ebp,esp
<+3>: cmp DWORD PTR [ebp+0x8],0x3a2 ; Compare 0x6fa to 0x3a2
<+10>: jg 0x512 ; Jump taken
<+12>: cmp DWORD PTR [ebp+0x8],0x358
<+19>: jne 0x50a
<+21>: mov eax,DWORD PTR [ebp+0x8]
<+24>: add eax,0x12
<+27>: jmp 0x529
<+29>: mov eax,DWORD PTR [ebp+0x8]
<+32>: sub eax,0x12
<+35>: jmp 0x529
<+37>: cmp DWORD PTR [ebp+0x8],0x6fa ; Compare 0x6fa to 0x6fa
<+44>: jne 0x523 ; Jump not taken (0x6fa == 0x6fa)
<+46>: mov eax,DWORD PTR [ebp+0x8] ; eax = 0x6fa
<+49>: sub eax,0x12 ; eax = 0x6fa - 0x12 = 0x6e8
<+52>: jmp 0x529 ; Jump
<+54>: mov eax,DWORD PTR [ebp+0x8]
<+57>: add eax,0x12
<+60>: pop ebp ; Finished
<+61>: ret
```
**Flag: 0x6e8**
### vault-door-3 \[200 pts]
> **Description**
>
> This vault uses for-loops and byte arrays. The source code for this vault is here: [VaultDoor3.java](https://jupiter.challenges.picoctf.org/static/a648ca6dd275b9454c5d0de6d0f6efd3/VaultDoor3.java)
**Solution**
Given the check password function, I take that and use the password objective as the input which will print out the flag. This is done by modifying to start with our output jU5t\_a\_sna\_3lpm18gb41\_u\_4\_mfr340 and printing out buffer once done.
```java
public boolean checkPassword() {
password = "jU5t_a_sna_3lpm18gb41_u_4_mfr340";
char[] buffer = new char[32];
for (int i=0; i<8; i++) {
buffer[i] = password.charAt(i);
}
for (; i<16; i++) {
buffer[i] = password.charAt(23-i);
}
for (; i<32; i+=2) {
buffer[i] = password.charAt(46-i);
}
for (i=31; i>=17; i-=2) {
buffer[i] = password.charAt(i);
}
String s = new String(buffer);
System.out.println(buffer);
return s.equals("jU5t_a_sna_3lpm18gb41_u_4_mfr340");
}
```
**Flag: picoCTF{jU5t\_a\_s1mpl3\_an4gr4m\_4\_u\_1fb380}**
### asm2 \[250 pts] \[Not Solved]
> **Description**
>
> What does asm2(0x4,0x21) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/7e3eb2f90200ac88126f62ceb4bc3948/test.S)
**Solution**
a
**Flag:**
### vault-door-4 \[250 pts]
> **Description**
>
> This vault uses ASCII encoding for the password. The source code for this vault is here: [VaultDoor4.java](https://jupiter.challenges.picoctf.org/static/09d3002ae349631324a17e2255ae8df2/VaultDoor4.java)
**Solution**
I love when I am given source code because all I have to do most of the time is insert a little bit of code and print kind of like what breakpoints do when debugging code.
```java
public class MyClass {
public static void main(String args[]) {
checkPassword("This");
}
public static boolean checkPassword(String password) {
byte[] myBytes = {
106 , 85 , 53 , 116 , 95 , 52 , 95 , 98 ,
0x55, 0x6e, 0x43, 0x68, 0x5f, 0x30, 0x66, 0x5f,
0142, 0131, 0164, 063 , 0163, 0137, 0143, 061 ,
'9' , '4' , 'f' , '7' , '4' , '5' , '8' , 'e' ,
};
String ans = "";
for (int i=0; i<32; i++) {
ans += (char)myBytes[i];
}
System.out.println(ans);
return true;
}
}
```
**Flag: picoCTF{jU5t\_4\_bUnCh\_0f\_bYt3s\_c194f7458e}**
### droids0 \[300 pts] \[Not Solved]
> **Description**
>
> Where do droid logs go. Check out this [file](https://jupiter.challenges.picoctf.org/static/02bcd73e630f50ef0b12bcdad9d84e0d/zero.apk).
**Solution**
First, since it was an APK I had to decompile it which I choose to do through `ApkTool d zero.apk -o outs`. I think I have to actually install it so that will be for another time. Based on the code I just have to click the button.
**Flag:**
### asm3 \[300 pts] \[Not Solved]
> **Description**
>
> What does asm3(0xd2c26416,0xe6cf51f0,0xe54409d5) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/df999527eaecf46f259c4337a820856c/test.S)
**Solution**
a
**Flag:**
### vault-door-5 \[300 pts]
> **Description**
>
> In the last challenge, you mastered octal (base 8), decimal (base 10), and hexadecimal (base 16) numbers, but this vault door uses a different change of base as well as URL encoding! The source code for this vault is here: [VaultDoor5.java](https://jupiter.challenges.picoctf.org/static/0a53bf0deaba6919f98d8550c35aa253/VaultDoor5.java)
**Solution**
Starting from the end it was expecting a base64 encoded URL encoded password. So I ran that through [CyberChef ](https://gchq.github.io/CyberChef/#recipe=From_Base64\('A-Za-z0-9%2B/%3D',true\)URL_Decode\(\))and the flag just popped right out.
**Flag: picoCTF{c0nv3rt1ng\_fr0m\_ba5e\_64\_0b957c4f}**
### reverse\_cipher \[300 pts] \[Not Solved]
> **Description**
>
> We have recovered a [binary](https://jupiter.challenges.picoctf.org/static/31c9b832d036a10daeef52d8b4290ef0/rev) and a [text file](https://jupiter.challenges.picoctf.org/static/31c9b832d036a10daeef52d8b4290ef0/rev_this). Can you reverse the flag.
**Solution**
It says binary file and wasn't sure if that was 1 and 0 or an actual file and after checking it is an ELF file so I went to **disassemble** it online. Running it by itself gives the error code segmentation fault.
**Flag:**
### droids1 \[350 pts] \[Not Solved]
> **Description**
>
> Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/b12c6d058c7f52eb1fd2015cfd291716/one.apk).
**Solution**
a
**Flag:**
### vault-door-6 \[350 pts]
> **Description**
>
> This vault uses an XOR encryption scheme. The source code for this vault is here: [VaultDoor6.java](https://jupiter.challenges.picoctf.org/static/cdb33ffba609e2521797aac66320ec65/VaultDoor6.java)
**Solution**
Xor is really cool as when using it you can mix the variables around. In this case, let's say a is my password Byte and b is a guess byte. It calculates a ^ 0x55 - b = 0 which can also be displayed b ^ 0x55 - a = 0.
```java
public boolean checkPassword() {
byte[] myBytes = {
0x3b, 0x65, 0x21, 0xa , 0x38, 0x0 , 0x36, 0x1d,
0xa , 0x3d, 0x61, 0x27, 0x11, 0x66, 0x27, 0xa ,
0x21, 0x1d, 0x61, 0x3b, 0xa , 0x2d, 0x65, 0x27,
0xa , 0x6c, 0x60, 0x37, 0x30, 0x60, 0x31, 0x36,
};
String ans = "";
for (int i=0; i<32; i++) {
ans += (char)(0x55 ^ myBytes[i]);
}
System.out.println(ans);
return true;
}
```
**Flag: picoCTF{n0t\_mUcH\_h4rD3r\_tH4n\_x0r\_95be5dc}**
### asm4 \[400 pts] \[Not Solved]
> **Description**
>
> What will asm4("picoCTF\_724a2") return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/14acd1667eb7ce6f16355b2256c945b7/test.S)
**Solution**
a
**Flag:**
### Need For Speed \[400 pts] \[Not Solved]
> **Description**
>
> The name of the game is [speed](https://www.youtube.com/watch?v=8piqd2BWeGI). Are you quick enough to solve this problem and keep it above 50 mph? [need-for-speed](https://jupiter.challenges.picoctf.org/static/cd51b2c95be9f3626db6fe6665afb5a3/need-for-speed).
**Solution**
a
**Flag:**
### B1ll\_Gat35 \[400 pts] \[Not Solved]
> **Description**
>
> Can you reverse this [Windows Binary](https://jupiter.challenges.picoctf.org/static/0ef5d0d6d552cd5e0bd60c2adbddaa94/win-exec-1.exe)?
**Solution**
a
**Flag:**
### droids2 \[400 pts] \[Not Solved]
> **Description**
>
> Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/b7d30de6eaaf83e685aea7c10c5bdea8/two.apk).
**Solution**
a
**Flag:**
### vault-door-7 \[400 pts]
> **Description**
>
> This vault uses bit shifts to convert a password string into an array of integers. Hurry, agent, we are running out of time to stop Dr. Evil's nefarious plans! The source code for this vault is here: [VaultDoor7.java](https://jupiter.challenges.picoctf.org/static/89b8065d19ee9830ae548d27a40ca757/VaultDoor7.java)
**Solution**
The program is validating a 32 set of characters by splitting the 32 into 8 groups of 4 characters. Those 4 characters are then converted to hex and concatenating the binaries to create 1 integer. This reminds me of a hash, which at first I was tempted to just brute force and try each attempt of 4 characters as that is only 26 ^4, not that long but I realize, it can be way shorter so I got to work on the code. I wasn't getting at first so I wrote this down and it all became clear. I need to turn the integers -> Binary -> Hex -> Characters.
```java
key = [1096770097,1952395366, 1600270708, 1601398833, 1716808014, 1734291511, 960049251, 1681089078]
ans = ""
for i in key:
b = format(i, "b")
x = hex(int(b, 2))
for o in range(1, 5):
cur = int(x[o * 2: (o + 1) * 2], 16)
ans += chr(cur)
print(ans)
```
**Flag: picoCTF{A\_b1t\_0f\_b1t\_sh1fTiNg\_07990cd3b6}**
### vault-door-8 \[450 pts] \[Not Solved]
> **Description**
>
> Apparently Dr. Evil's minions knew that our agency was making copies of their source code, because they intentionally sabotaged this source code in order to make it harder for our agents to analyze and crack into! The result is a quite mess, but I trust that my best special agent will find a way to solve it. The source code for this vault is here: [VaultDoor8.java](https://jupiter.challenges.picoctf.org/static/87f4f8ce117f80ab7b809f161661ce6a/VaultDoor8.java)
**Solution**
a
**Flag:**
### droids3 \[450 pts] \[Not Solved]
> **Description**
>
> Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/06318765139795831859f843dd56ce60/three.apk).
**Solution**
a
**Flag:**
### droids4 \[500 pts] \[Not Solved]
> **Description**
>
> Reverse the pass, patch the file, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/926d4bfd7030b13dbc98ca26e608c740/four.apk).
**Solution**
a
**Flag:**
### Forky \[500 pts] \[Not Solved]
> **Description**
>
> In [this program](https://jupiter.challenges.picoctf.org/static/78c5ee78a6593e52ba5e5b08bc9f13c1/vuln), identify the last integer value that is passed as parameter to the function doNothing().
**Solution**
a
**Flag:**
###