BM02 - 250pts - NCS Competition 2021 Writeup

Briefing
Download the file and find a way to get the flag. Contents: program
Challenge Files:
​bm02.zip​
Solution
1.Running the program simply outputs I'm not going to make it that easy for you..
2.Decompiling the binary using Ghidra reveals a printFlag() function that prints the flag if it is called with 0x539 as an argument.
printFlag function:
1
 void printFlag(int param_1)
2
​
3
 {
4
     byte bVar1;
5
     byte bVar2;
6
     long in_FS_OFFSET;
7
     uint local_2c;
8
     byte local_28 [24];
9
     long local_10;
10
​
11
     local_10 = *(long *)(in_FS_OFFSET + 0x28);
12
     if (param_1 == 0x539) {
13
         local_28[0] = 0x15;
14
         local_28[1] = 0x70;
15
         local_28[2] = 0xe5;
16
         local_28[3] = 100;
17
         local_28[4] = 0x7a;
18
         local_28[5] = 0xd4;
19
         local_28[6] = 0x6d;
20
         local_28[7] = 0x75;
21
         local_28[8] = 0xeb;
22
         local_28[9] = 0xf4;
23
         local_28[10] = 0x6a;
24
         local_28[11] = 0xd1;
25
         local_28[12] = 0xfa;
26
         local_28[13] = 0xd1;
27
         local_28[14] = 0xf9;
28
         local_28[15] = 0xe8;
29
         local_28[16] = 0x9d;
30
         local_28[17] = 0x7c;
31
         local_28[18] = 0x41;
32
         local_2c = 0;
33
         while (local_2c < 0x13) {
34
         bVar2 = (byte)local_2c;
35
         bVar1 = ~-((~local_28[local_2c] + bVar2 ^ 0x48) - bVar2);
36
         bVar2 = ((bVar1 << 3 | bVar1 >> 5) - bVar2 ^ 0x5d) - 0x23 ^ bVar2;
37
         bVar1 = (bVar2 * '\x02' | bVar2 >> 7) + 0xbf;
38
         local_28[local_2c] = (bVar1 * ' ' | bVar1 >> 3) ^ 0x65;
39
         local_2c = local_2c + 1;
40
         }
41
         puts((char *)local_28);
42
     }
43
     if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
44
                         /* WARNING: Subroutine does not return */
45
         __stack_chk_fail();
46
     }
47
     return;
48
 }
Copied!
3.We run the program using GDB and do the following:
1.Breakpoint at puts: b puts
2.Run: r
3.Call printFlag with the correct argument: call (char *) printFlag(0x539)
4.The flag is shown as Flag: patchItFixIt.
Flag
patchItFixIt

BM01 - 250pts

BM03 - 250pts

Last modified 1yr ago

Copy link

Contents

Briefing

Solution

Flag