Where will you find the flag?
$ strings reversing1(略)QUFBQUFBQUFBQUFBQUFBQQ==Hello! I bet you are looking for the flag..I really like basic encoding.. can you tell what kind I used??RkxBR2ZsYWdGTEFHZmxhZ0ZMQUdmbGFnQ2FuIHlvdSByZWNvZ25pemUgYmFzZTY0Pz8=Z2lnZW17M2E1eV9SM3YzcjUxTjYhfQ==WW91IGp1c3QgbWlzc2VkIHRoZSBmbGFn(略)
gigem{3a5y_R3v3r51N6!}
What kind of file is this?
LOAD_CONSTの数値をASCII文字に変換するとフラグになります。$ pythonPython 2.7.12 (default, Nov 12 2018, 14:36:49)[GCC 5.4.0 20160609] on linux2Type "help", "copyright", "credits" or "license" for more information.>>> import dis, marshal>>> code = open("reversing2.pyc", "rb").read()[8:]>>> code = marshal.loads(code)>>> dis.dis(code)1 0 LOAD_CONST 0 (-1)3 LOAD_CONST 1 (('datetime',))6 IMPORT_NAME 0 (datetime)9 IMPORT_FROM 0 (datetime)12 STORE_NAME 0 (datetime)15 POP_TOP3 16 LOAD_CONST 2 (102) #f19 LOAD_CONST 3 (108) #l22 LOAD_CONST 4 (97) #a25 LOAD_CONST 5 (103) #g28 LOAD_CONST 6 (123) #{31 LOAD_CONST 7 (100) #d34 LOAD_CONST 8 (101) #e37 LOAD_CONST 9 (99) #c40 LOAD_CONST 10 (111) #o43 LOAD_CONST 11 (109) #m46 LOAD_CONST 12 (112) #p49 LOAD_CONST 13 (105) #i52 LOAD_CONST 3 (108) #l55 LOAD_CONST 8 (101) #e58 LOAD_CONST 14 (125) #}61 BUILD_LIST 1564 STORE_NAME 1 (Fqaa)(略)
flag{decompile}
Time
50
All of you want is time and all you have is time.
$ file TimeTime: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, stripped
Dynamicリンクの場合ライブラリの場所を指定する必要があります。-Lオプションでライブラリの場所を指定して再度実行してみます。$ qemu-arm ./Time/lib/ld-linux.so.3: No such file or directory
$ qemu-arm -L /usr/arm-linux-gnueabi/lib/ ./Time/lib/ld-linux.so.3: No such file or directory
$ sudo ln -s /usr/arm-linux-gnueabi/lib/ld-linux.so.3 .$ sudo ln -s /usr/arm-linux-gnueabi/lib arm-linux-gnueabi
$ qemu-arm ./TimeYou sucessfully loaded the file :)Enter your Key123456Flag check failed
以下の箇所を見ると、アドレス0x1084cのデータと0x7とのxorを取っているようです。$ arm-linux-gnueabi-objdump -s -D Time > aaa.txt
8574: e59f3058 ldr r3, [pc, #88] ; 0x85d48578: e51b2008 ldr r2, [fp, #-8]857c: e7933102 ldr r3, [r3, r2, lsl #2]8580: e2233007 eor r3, r3, #78584: e1a00003 mov r0, r38588: ebffff8b bl 0x83bc(略)85d4: 0001084c andeq r0, r1, ip, asr #16
それでは、文字列"nidsa|So6tX&tXmRtsXso4XE4`niIni`z"を1文字ずつ0x7とxorを取ってみます。セクション .data の内容:10844 00000000 00000000 6e000000 69000000 ........n...i...10854 64000000 73000000 61000000 7c000000 d...s...a...|...10864 53000000 6f000000 36000000 74000000 S...o...6...t...10874 58000000 26000000 74000000 58000000 X...&...t...X...10884 6d000000 52000000 74000000 73000000 m...R...t...s...10894 58000000 73000000 6f000000 34000000 X...s...o...4...108a4 58000000 45000000 34000000 60000000 X...E...4...`...108b4 6e000000 69000000 49000000 6e000000 n...i...I...n...108c4 69000000 60000000 7a000000 98a9365a i...`...z.....6Z
s = "nidsa|So6tX&tXmRtsXso4XE4`niIni`z"a = ""for c in s:a = a + chr(ord(c) ^ 0b00000111)print a
inctf{Th1s_!s_jUst_th3_B3ginNing}
inctf{Th1s_!s_jUst_th3_B3ginNing}です。
