rev-basic 4~6 write-up

rev-basic-4~6 write up

See more

https://dreamhack.io/wargame/challenges/18/

https://dreamhack.io/wargame/challenges/19/

https://dreamhack.io/wargame/challenges/20/

---

rev-basic-4 write up

Programs used: radare2, ida7.2, python3

Like last time, main is the same. Let's analyze "section..text".

It seems to be a reverse-computation problem just like the previous one. This time I'll analyze it directly with IDA and write it in Python.

Taking the value the user inputs as a1, to analyze that code:

1. a1[i] >> 4: taking the input as a, 61 -> 6

2. (16 * a1[i]) & 240: 16 * a1[i] is the same as a left shift. 61 -> 610

240(0xf0) & 610: 0001 0110 0010(610) & 1111 0000(240) => the trailing digits will disappear.

3. 0001 0000 or 0000 0110 => 0001 0110: the front and back of the hex value got swapped!!

So without even needing to compute, I'll just port IDA's code as-is into Python.

a1 = [0x24,0x27,0x13,0xC6,0xC6,0x13,0x16, 0xE6,0x47, 0xF5,
  0x26, 0x96, 0x47, 0xF5, 0x46, 0x27, 0x13, 0x26,0x26, 0xC6,
  0x56, 0xF5, 0xC3,0xC3, 0xF5, 0xE3,0xE3]

for i in range(0, len(a1)):
    print(chr(16 * a1[i] & 0xF0 | a1[i] >> 4), end='')

It comes out fine!!

---

rev-basic-5 write up

Programs used: ida7.2, python3

Since it seems only reverse-computation problems keep coming up, I'll solve this with the nicer-looking IDA.

To analyze that code, taking the variable the user inputs as a1,

it seems a1[i+1] + a[i] = flag[i].

To reverse this, it seems you have to start from the back and do a1[i] - a1[i-1].

Because if you have 1 2 3 4 5 6 7 8 9, the result values would be 3 5 7 9 11 13 15 17 9.

Repeatedly subtracting the value of 17 - 9 from the back into 15 will bring it back to 1 2 3 4 5 6 7 8 9.

So the code is as below.

values = [0xAD, 0xD8, 0xCB, 0xCB, 0x9D, 0x97, 0xCB, 0xC4, 0x92,
          0xA1, 0xD2, 0xD7, 0xD2, 0xD6, 0xA8, 0xA5, 0xDC, 0xC7,
          0xAD, 0xA3, 0xA1, 0x98, 0x4C, 0x00]
flag = [0x00, ] * len(values)

values.reverse()

for i in range(1, len(values)):
    flag[i] = values[i] - flag[i-1]

flag.reverse()

for i in range(len(flag)):
    print(chr(flag[i]), end='')

I made a hex-value list the same size as the flag values, reversed it, stored a1[i] - a[i-1] into flag, then reversed it again and printed it.

---

rev-basic-6 write up

Programs used: ida7.2, python3

Oh, this seems like a very simple problem. It seems it just needs key[ai[i]] == flag[i] to match.

Argh! Checking the flag and key values, there are a lot of key values. The Python code is as below.

flag  = [0x00, 0x4D, 0x51, 0x50, 0xEF, 0xFB, 0xC3, 0xCF, 0x92, 0x45, 0x4D, 0xCF, 0xF5, 0x04, 0x40, 0x50, 0x43, 0x63, 0x0E]
key = [0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16]

for i in range(0, len(flag)):
    for j in range(0, len(key)):
        if  flag[i] == key[j]:
            print(chr(j), end='')

---

Original (Korean): tistory — published 2021-07-14, migrated to this blog. This translation was generated with the help of AI.