Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google CTF 2019

capturetheflag.withgoogle.com

Post reply on HN
Print view View original

131–140 of 140 posts

Re: Google CTF 2019

#131

Post by tntn »

archgoon wrote: post #127
tntn wrote: post #126

Earlier quoted context omitted.

> My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?

Yeah, I put labels corresponding to the original IP throughout and used a jump table.

Re: Google CTF 2019

#132

Post by aereal »

clashmeifyoucan wrote: post #124
chris92de wrote: post #100

Earlier quoted context omitted.

i ended up using fold. theres also has to be a way to read the ORME.flag by modifying the file permissions but i haven't figured that one out yet.

I bypassed the shell by executing the binary straight from the loader so I was able to do a chmod +r and cat to get it.

how did you do this? amazing

Re: Google CTF 2019

#133

Post by aereal »

tntn wrote: post #126
ehsankia wrote: post #109

Earlier quoted context omitted.

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

> My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

would you mind sharing this? I'd love to check it out :)

Re: Google CTF 2019

#134

Post by forgot-my-pw »

AJRF wrote: post #48

Dig at Apple from the third stage of the beginners' quest; "Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"

Google also sells expensive stands: https://cloud.withgoogle.com/hardware/

Though it does more (rolls) and actually made by BenQ.

Re: Google CTF 2019

#135

Post by archgoon »

tntn wrote: post #131
archgoon wrote: post #127

Earlier quoted context omitted.

How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?

Yeah, I put labels corresponding to the original IP throughout and used a jump table.

That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing.

Was your method fast enough to get all three parts of the URL?

Re: Google CTF 2019

#136

Post by tntn »

archgoon wrote: post #135
tntn wrote: post #131

Earlier quoted context omitted.

Yeah, I put labels corresponding to the original IP throughout and used a jump table.

That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing. Was your method fast enough to get all three parts of the URL?

It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.

Re: Google CTF 2019

#137

Post by tntn »

aereal wrote: post #133
tntn wrote: post #126

Earlier quoted context omitted.

> My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

would you mind sharing this? I'd love to check it out :)

https://pastebin.com/eEuJcy18

Re: Google CTF 2019

#138

Post by clashmeifyoucan »

aereal wrote: post #132
clashmeifyoucan wrote: post #124

Earlier quoted context omitted.

I bypassed the shell by executing the binary straight from the loader so I was able to do a chmod +r and cat to get it.

how did you do this? amazing

/lib/ld-musl-x86_64.so.1 /bin/busybox chmod +r ORME.flag /lib/ld-musl-x86_64.so.1 /bin/busybox cat ORME.flag

Re: Google CTF 2019

#139

Post by gctfthroaway »

aereal wrote: post #111
koyote wrote: post #82

Earlier quoted context omitted.

It's calculating prime numbers which is why it's slow. Now if only I was to work out which prime numbers it wants... :)

have you guys figured it out? I got stuck here too.

I'm having a hard time even getting it to run.

"python vm.py program" results in "SyntaxError: Non-ASCII character '\xf0' in file vm.py on line 19, but no encoding declared;"

adding the relevant encoding (# -- coding: utf-8 --) then results in "RuntimeError: Unknown instruction ''\xf0\x9f\x96\x8b\xf0\x9f\x92\xa0\xf0\x9f\x94\xb6\xf0\x9f\x8e\x8c\xf0\x9f\x9a\xa9\xf0\x9f\x8f\x81'' at 370"

I assume debugging the program is part of the challenge? Or is it just supposed to work?

Re: Google CTF 2019

#140

Post by grafporno »

gctfthroaway wrote: post #139
aereal wrote: post #111

Earlier quoted context omitted.

have you guys figured it out? I got stuck here too.

I'm having a hard time even getting it to run. "python vm.py program" results in "SyntaxError: Non-ASCII character '\xf0' in file vm.py on line 19, but no encoding declared;" adding the relevant encoding (# - - coding: utf-8 - -) then results in "RuntimeError: Unknown instruction ''\xf0\x9f\x96\x8b\xf0\x9f\x92\xa0\xf0\x9f\x94\xb6\xf0\x9f\x8e\x8c\xf0\x9f\x9a\xa9\xf0\x9f\x8f\x81'' at 370" I assume debugging the program…

Run it with python3, not 2.7X
Post reply on HN