rev-basic 0~3 write-up

rev-basic-0~3 write up

See more

https://dreamhack.io/wargame/challenges/14/

https://dreamhack.io/wargame/challenges/15/

https://dreamhack.io/wargame/challenges/16/

https://dreamhack.io/wargame/challenges/17/

---

rev-basic-0 write up

Programs used: radare2, ida7.2

When you look at main in assembly, right above the statement that says 'Correct' there's a 'test eax, eax'.

In x86 assembly, the TEST instruction performs AND, a bitwise operation on the two operands. So we need to analyze the "call section..text" right above it, which returns the eax value.

section..text's assembly is as follows. At a glance you can tell "Compar3_the_str1ng" is the answer.

Let's decompile it with IDA.

It's as follows, and for the if statement to be true, "sub_140001000" needs to return a nonzero number.

Decompiling "sub_140001000" shows it compares a1 (the user input) with "Compar3_the_str1ng".

---

rev-basic-1 write up

Programs used: radare2, ida7.2

This assembly code looks familiar. main is the same as 0, so like 0 let's analyze "section..text".

As above, you can see it keeps comparing against some number. Looking at the size of those numbers, they seem to be ASCII codes.

Doing it in Python or by hand is fine, but let's use IDA.

This is the decompile of "section..text". In IDA, hover over an ASCII code and press "r" to change it into Char form. And pressing "h" can change it into int and hex form. Through features like these I found rev-basic-1's flag.

You can confirm it's "Compar3_the_ch4ract3r".

---

rev-basic-2 write up

Programs used: radare2, ida7.2

main is the same. Likewise let's analyze section..text.

Hmm.... the flag seems to be visible there, but let me analyze anyway:

rsp is the stack pointer register. That is, a stack of 0x18 is created. It moves with jmp, and looking at what's next

0x14000101e      4883f812       cmp rax, 0x12              ; 18
0x140001022      7324           jae 0x140001048

you can see it seems to repeat 0x12 (18) times. It's a loop.

Reading the following assembly further, you can see it compares in 4-byte units with gaps. The array being compared seems to be

here, at "lea rcx, qword str.Comp4re_the_arr4y". Checking it,

you can see the flag spaced out by 4 bytes as above. Checking this too with IDA,

you can confirm it repeats 0x12 (18) times and compares 4 bytes at a time, just as we analyzed. Checking the aC array,

you can see the flag exists. "Comp4re_the_arr4y"

---

rev-basic-3 write up

Programs used: radare2, ida7.2, python3

Main is the same again so I'll skip it and analyze "section..text".

This too, like the previous problem,

0x14000101e      4883f818       cmp rax, 0x18              ; 24
0x140001022      732f           jae 0x140001053

you can see has a loop, and taking the loop's condition as i,

0x14000102f      movzx eax, byte [rcx + rax] //eax = [rcx = compared string + rax = [rsp] stack pointer]
0x140001033      movsxd rcx, dword [rsp] //rcx = [[rsp] stack pointer]
0x140001037      mov rdx, qword [arg_8h] //rdx = [user input]
0x14000103c      movzx ecx, byte [rdx + rcx] //ecx = [user input + rcx : here the loop's i value]
0x140001040      xor ecx, dword [rsp] //ecx ^ rsp : XORs (user input + i) with i.
0x140001043      mov edx, dword [rsp] //edx = rsp : put the i value into edx
0x140001046      lea ecx, dword [rcx + rdx*2] //ecx = rcx + rdx*2 : rcx = the XORed value + rdx = i value * 2
0x140001049      cmp eax, ecx //compare eax and ecx : compares the flag with (rcx = XORed value + rdx = i value * 2)

("str.I_gtcgBf"[i]) == ((*input[i]) ^ i) + i * 2

it seems to compare like this. This is way too tedious to do...

If rdx, edx and such confuse you, please see [Hacking] - [Hacking] Registers.

Anyway, since I predicted it this way, I could write it as Python code, but let me check once with IDA.

It looks like it might be off, but it's exactly what we predicted!!! So shall we write the operation in Python?

values = [0x49, 0x60, 0x67, 0x74, 0x63, 0x67, 0x42, 0x66, 
        0x80, 0x78, 0x69, 0x69, 0x7b, 0x99, 0x6d, 0x88, 0x68,
        0x94, 0x9f, 0x8d, 0x4d, 0xa5, 0x9d, 0x45]

for i in range(0, len(values)):
    print(chr((values[i] - 2 * i) ^ i), end='')

I reversed the expression ((*input[i]) ^ i) + i * 2 and computed it as (input[i] - i * 2) ^ i.

Flag: "I_am_X0_xo_Xor_eXcit1ng"

---

Original (Korean): tistory — published 2021-07-14, migrated to this blog. This translation was generated with the help of AI.