DEFCON Chennai CORE Dump 0x1 Prelims

Challenge 101 Reverse Engineering

By, Prajit Janakiraman

Initially I downloaded the file from the google drive and found the file type then, I changed it’s permission and executed in my kali linux vm and found that it asks for 35 character code to unlock so i tried a simple buffer overflow but it failed so then, I used IDA decompiler in my windows host to check. I loaded the binary into IDA and started by exploring the function list.

Now, i started checking all the functions and saw that vm_run,vm_step, vm_init, etc..

So i checked the execution from “main” function and it finally uses call for “vm_run” so then i gone through that function. And it led to “vm_step” function, where i was able to find many jump case in the function.

And while scrolling through strings of the binary i got “D3fc0nCh3nn41_Dc9144D3fc0nCh” prints multiple times, so i got it interesting and looked carefully into it and finally found that particularly this “1824” uses “xor” cmd in it’s instruction set so, i traced every addresses where “xor” cmd is used,

So, this instruction says that it xor the “ecx” and “edx” and store it back to rA where it stored it’s value in edx so, simply the instruction is

“reg[rA] = reg[rA] ^ reg[rB]”

Now, i understood the disassembly makes the validation algorithm using xor so, And found that it converts our input string in 4 byte chucks but, final chunk is not of 4 byte instead it is 3 byte as it is 35 character is in input. So,I manually wrote down the address and got the mapping for easy decoding, I wrote a python script to xor it back

But, i got “1664698929” so i researched and got the formatting for the string to decode

“print(f”{i}: {keys[i]:08x} ^ {targets[i]:08x} = {result:08x}”)”

So, i got

0: 63663344 ^ 1312472c = 70747468

1: 68436e30 ^ 476c5443 = 2f2f3a73

2: 346e6e33 ^ 591c0155 = 6d726f66

3: 63445f31 ^ 0f237142 = 6c672e73

4: 34343139 ^ 5f511e5c = 6b652f65

5: 63663344 ^ 0c534435 = 6f357771

6: 68436e30 ^ 25352847 = 4d764677

7: 346e6e33 ^ 032d1672 = 37437841

8: 63445f31 ^ 007d1500 = 63394a31

Using this formatting for the iteration wise result in the for loop itself

Now, we have to combine these chunks together and find the bytes so it’ll lead to the input string which we have to provide as the unlock code. So, we can use struct in python for combining,

And the output is “https://forms.gle/ekqw5owFvMAxC71J9”

Finally we got the google form link!!!!!!!!!!!!!!!!!

🙂🙂🙂