BM03 - 250pts - NCS Competition 2021 Writeup

Briefing
Download the file and find a way to get the flag. Contents: flag
Challenge Files:
​bm03.zip​
Solution
1.Decompiling the binary shows an output() function and a line in output() that stops printing the flag if the rows argument is less than 6.
output function:
1
 void output(int rows,int cols)
2
​
3
 {
4
     long lVar1;
5
     undefined8 *puVar2;
6
     undefined8 *puVar3;
7
     long in_FS_OFFSET;
8
     int i;
9
     int j;
10
     int flag [6] [85];
11
     char flagChars [11];
12
     long local_10;
13
​
14
     local_10 = *(long *)(in_FS_OFFSET + 0x28);
15
     lVar1 = 0xff;
16
     puVar2 = &DAT_00100a00;
17
     puVar3 = (undefined8 *)flag;
18
     while (lVar1 != 0) {
19
         lVar1 = lVar1 + -1;
20
         *puVar3 = *puVar2;
21
         puVar2 = puVar2 + 1;
22
         puVar3 = puVar3 + 1;
23
     }
24
     flagChars[0] = ' ';
25
     flagChars[1] = '_';
26
     flagChars[2] = '/';
27
     flagChars[3] = '\\';
28
     flagChars[4] = '(';
29
     flagChars[5] = ')';
30
     flagChars[6] = '`';
31
     flagChars[7] = ',';
32
     flagChars[8] = '|';
33
     flagChars[9] = '.';
34
     flagChars[10] = '\0';
35
     i = 0;
36
     while (i < rows) {
37
         j = 0;
38
         while (j < cols) {
39
         putchar((int)flagChars[flag[(long)i * 0x55 + (long)j] / 100]);
40
         j = j + 1;
41
         }
42
         putchar(10);
43
         i = i + 1;
44
     }
45
     if (rows < 6) {
46
         puts("\x1b[31m Error displaying rest of flag\x1b[0m");
47
     }
48
     if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
49
                         /* WARNING: Subroutine does not return */
50
         __stack_chk_fail();
51
     }
52
     return;
53
 }
Copied!
2.Launch the program in GDB then do the following:
1.Breakpoint at output: b output
2.Call output but will the rows argument set to 6: call output(6,0x55)
3.Continue past the breakpoint: c
4.The flag is printed:
1
    __       __                          _                      ____ __           
2
____/ /___   / /_   __  __ ____ _ ____ _ (_)____   ____ _       / __// /_ _      __
3
/ __  // _ \ / __ \ / / / // __ `// __ `// // __ \ / __ `/      / /_ / __/| | /| / /
4
/ /_/ //  __// /_/ // /_/ // /_/ // /_/ // // / / // /_/ /      / __// /_  | |/ |/ / 
5
\__,_/ \___//_.___/ \__,_/ \__, / \__, //_//_/ /_/ \__, /______/_/   \__/  |__/|__/  
6
                       /____/ /____/           /____//_____/
Copied!
Flag
debugging_ftw

BM02 - 250pts

BX01 - 1000pts

Last modified 1yr ago

Copy link

Contents

Briefing

Solution

Flag