Skip to content

Commit ca377c3

Browse files
HexRabbitHexRabbit
committed
Update Google CTF 2020
1 parent 4df4c54 commit ca377c3

File tree

3 files changed

+379
-0
lines changed

3 files changed

+379
-0
lines changed

‎2020/Google-CTF/sprint/interpret.py

+298
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
#!/usr/bin/python3
2+
import re
3+
from pwn import *
4+
context.arch = 'amd64'
5+
6+
compiled = '''
7+
mov r8, 0
8+
mov r9, 0
9+
mov r10, 0
10+
mov r11, 0
11+
mov r12, 0
12+
mov r13, 0
13+
mov r14, 0
14+
mov r15, 0
15+
mov rax, 0
16+
mov rbx, 0
17+
mov rcx, 0
18+
mov rdx, 0
19+
mov rdi, 0
20+
mov rsi, 0
21+
'''
22+
23+
s = '''%1$00038s%3$hn%1$65498s%1$28672s%9$hn
24+
%1$00074s%3$hn%1$65462s%1$*8$s%7$hn
25+
%1$00108s%3$hn%1$65428s%1$1s%6$hn
26+
%1$00149s%3$hn%1$65387s%1$*8$s%1$2s%7$hn
27+
%1$00183s%3$hn%1$65353s%1$1s%6$hn
28+
%1$00218s%3$hn%1$65318s%1$2s%11$hn
29+
%1$00264s%3$hn%1$65272s%1$*10$s%1$*10$s%17$hn
30+
%1$00310s%3$hn%1$65226s%1$28672s%1$*16$s%7$hn
31+
%1$00347s%3$hn%1$65189s%1$*5$s%15$hn
32+
%14$c%1$00419s%2$c%4$s%1$65499s%3$hn
33+
%1$00430s%3$hn%1$65106s%1$*10$s%1$*10$s%13$hn
34+
%1$00468s%3$hn%1$65068s%1$65519s%7$hn
35+
%1$00505s%3$hn%1$65031s%1$*12$s%6$hn
36+
%1$00543s%3$hn%1$64993s%1$65520s%7$hn
37+
%1$00580s%3$hn%1$64956s%1$*5$s%15$hn
38+
%14$c%1$00186s%2$c%4$s%1$00429s%3$hn
39+
%1$00663s%3$hn%1$64873s%1$*12$s%1$*12$s%17$hn
40+
%1$00709s%3$hn%1$64827s%1$28672s%1$*16$s%7$hn
41+
%1$00743s%3$hn%1$64793s%1$1s%6$hn
42+
%1$00789s%3$hn%1$64747s%1$*12$s%1$*10$s%13$hn
43+
%1$00430s%3$hn
44+
%1$00847s%3$hn%1$64689s%1$*10$s%1$1s%11$hn
45+
%10$c%1$64869s%2$c%4$s%1$01549s%3$hn
46+
%1$00922s%3$hn%1$64614s%1$57344s%9$hn
47+
%1$00957s%3$hn%1$64579s%1$0s%11$hn
48+
%1$00993s%3$hn%1$64543s%1$*8$s%7$hn
49+
%1$01030s%3$hn%1$64506s%1$*5$s%13$hn
50+
%12$c%1$00014s%2$c%4$s%1$01051s%3$hn
51+
%1$01185s%3$hn
52+
%1$01129s%3$hn%1$64407s%1$*10$s%1$65535s%11$hn
53+
%1$01170s%3$hn%1$64366s%1$*8$s%1$1s%9$hn
54+
%1$00957s%3$hn
55+
%1$01232s%3$hn%1$64304s%1$*10$s%1$00254s%17$hn
56+
%16$c%1$00014s%2$c%4$s%1$01253s%3$hn
57+
%1$01334s%3$hn
58+
%1$01319s%3$hn%1$64217s%1$5s%23$hn
59+
%1$05081s%3$hn
60+
%1$01368s%3$hn%1$64168s%1$0s%9$hn
61+
%1$01403s%3$hn%1$64133s%1$0s%11$hn
62+
%1$01441s%3$hn%1$64095s%1$61696s%7$hn
63+
%1$01478s%3$hn%1$64058s%1$*5$s%13$hn
64+
%1$01513s%3$hn%1$64023s%1$1s%15$hn
65+
%1$01548s%3$hn%1$63988s%1$0s%23$hn
66+
%1$01593s%3$hn%1$63943s%1$57344s%1$*8$s%7$hn
67+
%1$01630s%3$hn%1$63906s%1$*5$s%17$hn
68+
%16$c%1$00014s%2$c%4$s%1$01651s%3$hn
69+
%1$03479s%3$hn
70+
%1$01723s%3$hn%1$63813s%1$*8$s%1$1s%9$hn
71+
%1$01770s%3$hn%1$63766s%1$*16$s%1$65419s%19$hn
72+
%18$c%1$00053s%2$c%4$s%1$01752s%3$hn
73+
%1$01846s%3$hn%1$63690s%1$65520s%17$hn
74+
%1$02373s%3$hn
75+
%1$01908s%3$hn%1$63628s%1$*16$s%1$65422s%19$hn
76+
%18$c%1$00049s%2$c%4$s%1$01894s%3$hn
77+
%1$01980s%3$hn%1$63556s%1$1s%17$hn
78+
%1$02373s%3$hn
79+
%1$02042s%3$hn%1$63494s%1$*16$s%1$65436s%19$hn
80+
%18$c%1$00050s%2$c%4$s%1$02027s%3$hn
81+
%1$02115s%3$hn%1$63421s%1$16s%17$hn
82+
%1$02373s%3$hn
83+
%1$02177s%3$hn%1$63359s%1$*16$s%1$65428s%19$hn
84+
%18$c%1$00053s%2$c%4$s%1$02159s%3$hn
85+
%1$02253s%3$hn%1$63283s%1$65535s%17$hn
86+
%1$02373s%3$hn
87+
%1$02303s%3$hn%1$63233s%1$0s%15$hn
88+
%1$02338s%3$hn%1$63198s%1$0s%17$hn
89+
%1$02373s%3$hn%1$63163s%1$1s%23$hn
90+
%1$02419s%3$hn%1$63117s%1$*12$s%1$*16$s%13$hn
91+
%1$02457s%3$hn%1$63079s%1$65519s%7$hn
92+
%1$02494s%3$hn%1$63042s%1$*12$s%6$hn
93+
%1$02532s%3$hn%1$63004s%1$65520s%7$hn
94+
%1$02569s%3$hn%1$62967s%1$*5$s%17$hn
95+
%16$c%1$00822s%2$c%4$s%1$01782s%3$hn
96+
%1$02652s%3$hn%1$62884s%1$61440s%1$*12$s%7$hn
97+
%1$02689s%3$hn%1$62847s%1$*5$s%17$hn
98+
%1$02727s%3$hn%1$62809s%1$65519s%7$hn
99+
%1$02764s%3$hn%1$62772s%1$*16$s%6$hn
100+
%1$02802s%3$hn%1$62734s%1$65520s%7$hn
101+
%1$02836s%3$hn%1$62700s%1$0s%6$hn
102+
%1$02874s%3$hn%1$62662s%1$65519s%7$hn
103+
%1$02911s%3$hn%1$62625s%1$*5$s%17$hn
104+
%1$02957s%3$hn%1$62579s%1$*16$s%1$*16$s%17$hn
105+
%1$03003s%3$hn%1$62533s%1$28672s%1$*16$s%7$hn
106+
%1$03040s%3$hn%1$62496s%1$*5$s%17$hn
107+
%16$c%1$00266s%2$c%4$s%1$02809s%3$hn
108+
%1$03120s%3$hn%1$62416s%1$*10$s%1$1s%17$hn
109+
%1$03166s%3$hn%1$62370s%1$61698s%1$*16$s%7$hn
110+
%1$03203s%3$hn%1$62333s%1$*5$s%17$hn
111+
%1$03249s%3$hn%1$62287s%1$*16$s%1$*12$s%17$hn
112+
%16$c%1$00042s%2$c%4$s%1$03242s%3$hn
113+
%1$03329s%3$hn%1$62207s%1$*10$s%1$1s%11$hn
114+
%1$01548s%3$hn
115+
%1$03379s%3$hn%1$62157s%1$0s%15$hn
116+
%1$03414s%3$hn%1$62122s%1$2s%23$hn
117+
%1$01548s%3$hn
118+
%1$03464s%3$hn%1$62072s%1$4s%23$hn
119+
%1$65534s%3$hn
120+
%14$c%1$00014s%2$c%4$s%1$03500s%3$hn
121+
%1$05081s%3$hn
122+
%1$03578s%3$hn%1$61958s%1$*10$s%1$65527s%17$hn
123+
%16$c%1$00014s%2$c%4$s%1$03599s%3$hn
124+
%1$03680s%3$hn
125+
%1$03665s%3$hn%1$61871s%1$3s%23$hn
126+
%1$05081s%3$hn
127+
%1$03714s%3$hn%1$61822s%1$0s%9$hn
128+
%1$03749s%3$hn%1$61787s%1$0s%11$hn
129+
%1$03795s%3$hn%1$61741s%1$*8$s%1$65497s%13$hn
130+
%12$c%1$00014s%2$c%4$s%1$03816s%3$hn
131+
%1$04987s%3$hn
132+
%1$03882s%3$hn%1$61654s%1$4s%15$hn
133+
%1$03917s%3$hn%1$61619s%1$0s%13$hn
134+
%1$03963s%3$hn%1$61573s%1$*12$s%1$*12$s%13$hn
135+
%1$04009s%3$hn%1$61527s%1$*12$s%1$*12$s%13$hn
136+
%1$04055s%3$hn%1$61481s%1$57344s%1$*10$s%7$hn
137+
%1$04092s%3$hn%1$61444s%1$*5$s%17$hn
138+
%1$04139s%3$hn%1$61397s%1$*16$s%1$65419s%19$hn
139+
%18$c%1$00014s%2$c%4$s%1$04160s%3$hn
140+
%1$04632s%3$hn
141+
%1$04238s%3$hn%1$61298s%1$*16$s%1$65422s%19$hn
142+
%18$c%1$00057s%2$c%4$s%1$04216s%3$hn
143+
%1$04318s%3$hn%1$61218s%1$*12$s%1$1s%13$hn
144+
%1$04632s%3$hn
145+
%1$04380s%3$hn%1$61156s%1$*16$s%1$65436s%19$hn
146+
%18$c%1$00057s%2$c%4$s%1$04358s%3$hn
147+
%1$04460s%3$hn%1$61076s%1$*12$s%1$2s%13$hn
148+
%1$04632s%3$hn
149+
%1$04522s%3$hn%1$61014s%1$*16$s%1$65428s%19$hn
150+
%18$c%1$00057s%2$c%4$s%1$04500s%3$hn
151+
%1$04602s%3$hn%1$60934s%1$*12$s%1$3s%13$hn
152+
%1$04632s%3$hn
153+
%1$05081s%3$hn
154+
%1$04675s%3$hn%1$60861s%1$*10$s%1$1s%11$hn
155+
%1$04722s%3$hn%1$60814s%1$*14$s%1$65535s%15$hn
156+
%14$c%1$64693s%2$c%4$s%1$05600s%3$hn
157+
%1$04804s%3$hn%1$60732s%1$61708s%1$*8$s%7$hn
158+
%1$04841s%3$hn%1$60695s%1$*5$s%15$hn
159+
%1$04886s%3$hn%1$60650s%1$59392s%1$*8$s%7$hn
160+
%1$04931s%3$hn%1$60605s%1$*14$s%1$*12$s%6$hn
161+
%1$04972s%3$hn%1$60564s%1$*8$s%1$1s%9$hn
162+
%1$03749s%3$hn
163+
%1$05032s%3$hn%1$60504s%1$59392s%1$*8$s%7$hn
164+
%1$05066s%3$hn%1$60470s%1$0s%6$hn
165+
%1$65534s%3$hn
166+
%1$05119s%3$hn%1$60417s%1$59392s%7$hn
167+
%1$05153s%3$hn%1$60383s%1$0s%6$hn
168+
%1$65534s%3$hn
169+
'''
170+
171+
pc = 0
172+
for now in s.split('\n'):
173+
compiled += f'L{pc}:'
174+
cnt = 0
175+
for sub_str in now.split('%')[1:]:
176+
reg_idx, length_idx, length, action = re.match('^([0-9]*\$)?(\*[0-9]*\$)?([0-9]*)?([schn]*)', sub_str).groups()
177+
reg_idx = int(reg_idx[:-1])
178+
179+
if action[-1] == 's':
180+
if length_idx:
181+
# *???$
182+
idx = int(length_idx[1:-1])
183+
# access stack registers
184+
if idx >= 8:
185+
if idx % 2:
186+
raise
187+
else:
188+
reg_num = (idx-8)//2
189+
# compiled += f'movzx stack_reg{reg_num}, stack_reg{reg_num}w\n'
190+
cnt = f'{cnt}+stack_reg{reg_num}'
191+
# access *ptr
192+
elif idx == 5:
193+
compiled += 'mov tmpw, WORD PTR [ptr]\n'
194+
cnt = f'{cnt}+tmp'
195+
# access ptr
196+
elif idx == 6:
197+
raise NotImplemented
198+
# access &ptr
199+
elif idx == 7:
200+
raise NotImplemented
201+
else:
202+
raise NotImplemented
203+
elif length:
204+
if type(cnt) == int:
205+
cnt = (cnt + int(length)) & 0xffff
206+
else:
207+
cnt = f'{cnt}+{int(length)}'
208+
else:
209+
if reg_idx == 4:
210+
# fix it on %hn part
211+
cnt = f'{cnt}+BRANCH'
212+
else:
213+
raise NotImplemented
214+
215+
elif action[-1] == 'c':
216+
if reg_idx >= 8:
217+
reg_num = (reg_idx-8)//2
218+
compiled += f'test stack_reg{reg_num}b, stack_reg{reg_num}b\n'
219+
if type(cnt) == int:
220+
cnt = (cnt + 1) & 0xffff
221+
else:
222+
cnt += '+1'
223+
224+
elif action[-1] == 'n':
225+
if type(cnt) == str:
226+
if reg_idx == 3:
227+
# %14$c%1$00419s%2$c%4$s%1$65499s%3$hn
228+
# if 14$ != 0:
229+
# # %2$c will put a \0 on output buffer so %4$s outputs 420 bytes
230+
# jmp 1(%14$c) + 419(%1$00419s) + 1(%2$c) + 420(%4$s) + 65499
231+
# else:
232+
# jmp 1 + 419 + 1 + 0 + 65499
233+
matched = re.match('([0-9]*)\+BRANCH\+([0-9]*)', cnt)
234+
if matched:
235+
a, b = matched.groups()
236+
set_pc = f'jnz L{(int(a)*2-1+int(b)) & 0xffff}\n' # TRUE
237+
# set_pc = f'jz L{(int(a)+int(b)) & 0xffff}\n' # FALSE always fall through
238+
else:
239+
set_pc = f'FIX PC = {cnt}\n' # manually deal with this case
240+
241+
# access ptr
242+
elif reg_idx == 6:
243+
compiled += f'lea tmp, [{cnt}]\n'
244+
compiled += f'mov WORD PTR [ptr], tmpw\n'
245+
246+
# access &ptr
247+
elif reg_idx == 7:
248+
compiled += f'lea ptr, [{cnt}]\n'
249+
250+
# access stack registers
251+
elif reg_idx >= 8:
252+
reg_num = (reg_idx-8)//2
253+
if reg_idx % 2:
254+
compiled += f'lea stack_reg{reg_num}, [{cnt}]\n'
255+
compiled += f'movzx stack_reg{reg_num}, stack_reg{reg_num}w\n'
256+
else:
257+
compiled += f'lea tmp, [{cnt}]\n'
258+
compiled += f'mov WORD PTR [stack_reg{reg_num}], tmpw\n'
259+
else:
260+
compiled += f'FIX {reg_idx=} = {cnt}\n'
261+
else:
262+
if reg_idx == 3:
263+
set_pc = f'jmp L{cnt}\n'
264+
elif reg_idx == 6:
265+
compiled += f'mov WORD PTR [ptr], {cnt}\n'
266+
elif reg_idx == 7:
267+
compiled += f'mov ptr, {cnt}\n'
268+
elif reg_idx >= 8:
269+
reg_num = (reg_idx-8)//2
270+
if reg_idx % 2:
271+
compiled += f'mov stack_reg{reg_num}w, {cnt & 0xffff}\n'
272+
else:
273+
compiled += f'mov WORD PTR [stack_reg{reg_num}], {cnt & 0xffff}\n'
274+
else:
275+
compiled += f'FIX {reg_idx=} = {cnt}\n'
276+
else:
277+
raise NotImplemented
278+
compiled += set_pc
279+
pc += len(now) + 1
280+
281+
compiled += '''
282+
L65534:
283+
ret
284+
'''
285+
286+
compiled = compiled.replace('stack_reg0', 'r8')
287+
compiled = compiled.replace('stack_reg1', 'r9')
288+
compiled = compiled.replace('stack_reg2', 'r10')
289+
compiled = compiled.replace('stack_reg3', 'r11')
290+
compiled = compiled.replace('stack_reg4', 'r12')
291+
compiled = compiled.replace('stack_reg5', 'r13')
292+
# compiled = compiled.replace('stack_reg6', 'r14') not used
293+
compiled = compiled.replace('stack_reg7', 'r14')
294+
compiled = compiled.replace('tmp', 'r15')
295+
compiled = compiled.replace('ptr', 'rax')
296+
297+
assert(not 'FIX' in compiled)
298+
open('./compiled', 'wb').write(make_elf(asm(compiled)))

‎2020/Google-CTF/sprint/print_map.py

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#!/usr/bin/python3
2+
from pwn import *
3+
4+
mapp = [
5+
0xcc,0xb0,0xe7,0x7b,0xbc,0xc0,0xee,0x3a,0xfc,0x73,0x81,0xd0,0x7a,0x69,0x84,0xe2,
6+
0x48,0xe3,0xd7,0x59,0x11,0x6b,0xf1,0xb3,0x86,0x0b,0x89,0xc5,0xbf,0x53,0x65,0x65,
7+
0xf0,0xef,0x6a,0xbf,0x08,0x78,0xc4,0x2c,0x99,0x35,0x3c,0x6c,0xdc,0xe0,0xc8,0x99,
8+
0xc8,0x3b,0xef,0x29,0x97,0x0b,0xb3,0x8b,0xcc,0x9d,0xfc,0x05,0x1b,0x67,0xb5,0xad,
9+
0x15,0xc1,0x08,0xd0,0x45,0x45,0x26,0x43,0x45,0x6d,0xf4,0xef,0xbb,0x49,0x06,0xca,
10+
0x73,0x6b,0xbc,0xe9,0x50,0x97,0x05,0xe5,0x97,0xd3,0xb5,0x47,0x2b,0xad,0x25,0x8b,
11+
0xae,0xaf,0x41,0xe5,0xd8,0x14,0xf4,0x83,0xe6,0xf0,0xc0,0x98,0x0a,0xac,0xa1,0x95,
12+
0xf5,0xb5,0xd3,0x53,0xf0,0x97,0xef,0x9d,0xd4,0x3b,0x3b,0x0b,0xe7,0x17,0x07,0x1f,
13+
0x6c,0xf1,0x1e,0x44,0x92,0xb2,0x57,0x07,0xb7,0x36,0x8f,0x53,0xc9,0xea,0x10,0x90,
14+
0x62,0xdf,0x1d,0x07,0xb3,0x71,0x53,0x61,0x1a,0x2b,0x78,0xbf,0xc1,0xb5,0xc6,0x3b,
15+
0xea,0x2b,0x44,0x17,0xa0,0x84,0xca,0x8f,0xb7,0x3b,0x38,0x2f,0xe8,0x73,0x84,0xad,
16+
0x44,0xef,0xf8,0xad,0x8c,0x1f,0xea,0x7f,0xcd,0xc5,0xb3,0x49,0x05,0x03,0x95,0xa7,
17+
0x44,0xb5,0x91,0x69,0xf8,0x95,0x6c,0xe5,0x87,0x53,0x4e,0x47,0x92,0xbe,0x80,0xd0,
18+
0x80,0x1d,0xad,0xf1,0x3d,0xe3,0xdf,0x35,0x61,0xf1,0xe7,0x0d,0x71,0xc5,0x02,0x4f,
19+
0x20,0x5e,0xa2,0x8b,0xc4,0x61,0x32,0x0f,0xa8,0xbe,0x7e,0x29,0xd1,0x6d,0x2a,0xd9,
20+
0x55,0x47,0x07,0x83,0xea,0x2b,0x79,0x95,0x4f,0x3d,0xa3,0x11,0xdd,0xc1,0x1d,0x89
21+
]
22+
23+
mmmp = [
24+
1,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,
25+
1,0,1,0,1,0,0,0,1,0,0,0,1,0,1,0,
26+
1,0,0,0,1,0,0,0,1,0,1,0,1,0,0,0,
27+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,0,0,
28+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,1,0,
29+
1,0,0,0,1,0,0,0,1,0,1,0,1,0,0,0,
30+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,1,0,
31+
1,0,1,0,1,0,0,0,1,0,0,0,1,0,1,0,
32+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,0,
33+
1,0,0,0,1,0,1,0,1,0,1,0,1,0,0,0,
34+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0,
35+
1,0,0,0,1,0,1,0,1,0,1,0,1,0,1,0,
36+
1,0,0,0,1,0,1,0,1,0,0,0,1,0,0,0,
37+
1,0,1,0,1,0,0,0,1,0,0,0,1,0,1,0,
38+
1,0,0,0,1,0,1,0,1,0,1,0,1,0,1,0,
39+
1,0,1,0,1,0,1,0,1,0,1,0,1,0,0,0,
40+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0,
41+
1,0,0,0,1,0,0,0,1,0,1,0,1,0,1,0,
42+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,0,0,
43+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,1,0,
44+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,0,
45+
1,0,1,0,1,0,1,0,1,0,0,0,1,0,1,0,
46+
1,0,1,0,1,0,0,0,1,0,0,0,1,0,1,0,
47+
1,0,1,0,1,0,1,0,1,0,1,0,1,0,0,0,
48+
1,0,0,0,1,0,1,0,1,0,0,0,1,0,0,0,
49+
1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,
50+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0,
51+
1,0,1,0,1,0,1,0,1,0,1,0,1,0,0,0,
52+
1,0,1,0,1,0,0,0,1,0,0,0,1,0,1,0,
53+
1,0,0,0,1,0,1,0,1,0,1,0,1,0,0,0,
54+
1,0,0,0,1,0,1,0,1,0,1,0,1,0,1,0,
55+
1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0
56+
]
57+
58+
c = [0] * len(mapp)
59+
box = [0x83,0x01,0xaf,0x49,0xad,0xc1,0x0f,0x8b,0xe1]
60+
61+
for i in range(len(mapp)):
62+
target = 0x100 - i
63+
if target in box:
64+
idx = box.index(target)
65+
c[i] = idx+1
66+
elif mmmp[mapp[i] * 2]:
67+
c[i] = '█'
68+
else:
69+
c[i] = ' '
70+
71+
c[0x11] = 's'
72+
73+
for i in range(len(c)):
74+
if i and i % 16 == 0:
75+
print('█')
76+
print(c[i],end='')
77+
78+
print('█')
79+
80+
for i in range(16):
81+
print('█',end='')

‎2020/Google-CTF/sprint/sprint

76.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)