GoogleCTF 2016 - Audio Visual Receiver Writeup (RE)
Can you find the code?
This is another 64bits executable. This one just read characters from stdin and handles them as buttons. If the character entered is different from the expected charset, the function will just skip it.
The charset represents a gamepad:
In every function, a
state globale variable is modified in some way, along with
some other variables used to keep state of the position in the input buffer. When
a is pressed, a check is made regarding the value of
state. It should be called
3 times, and have the values 0x25, 0x68, and 0xef respectively.
If one of them fail, the game is ‘reset’ (but the reset() function does nothing).
If the check is passed for each value, the input sequence is xored with a hardcoded
buffer in memory.
The pass is supposed to be between 29 and 32 chars long.
At this point, I was going to give it to z3 again when Gaby
'have you tried the konami code ?'
For those who don’t know, the Konami code is a famous 10 buttons long cheat code using only the buttons we are waiting for:
Up Up Down Down Left Right Left Right B A
With GDB, I saw that inputing it actually matched the first check, but I thought that it was lucky guess. We needed to determine the two other checks, so Gaby went on simplifying the code to reduce it to a simple function:
But, before trying to go further, I actually tried another
konami code after
the first check, which… worked. Another one maybe ? Good too. And here goes the
So yes, if we had just played dumb we would probably have solved it in 2 minutes. Three konami codes, 150 pts. Hell of a cheat !
Audio visual executable and simplification