Re:Google CTF 2019
by ehsankia on Sunday June 23, 2019 @05:09PM
(#20258683)
Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.
[ Parent
| on HN ]
> My other option was to translate it into real assembly
I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.
How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?
Yeah, I put labels corresponding to the original IP throughout and used a jump table.
That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing.
Was your method fast enough to get all three parts of the URL?
It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.
would you mind sharing this? I'd love to check it out :)
I guessed the URL, but found nothing on it.
I'm guessing the flag may be in the rest of the message to be decoded.
Check the pngs across the domain. There is something special in at least one of them.
Already checked them out, for EXIF data, visually and also inverted colors. What I am missing?
I scrapped and downloaded around 55 pngs.
Yeah, I found 55 profiles/pngs. Tried ordering the profiles by the image # (from 2 to 56). Noticed the profile names are also a variation of two emojis, so tried looking into binary/morse, but nothing.
As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess
I might be going the wrong way with that then. Using stegoveritas I noticed that PNG has a bunch of "ISO-8859 text, with very long lines, with no line terminators" files which isn't normal for PNGs.
If you'd like to whine a bit with me, join me at:
##ctfcompetition @ freenode, I'm currently under the nick caulifl0wer