---
# System prepended metadata

title: Awaken
tags: [writeup]

---

######
# Awaken

Bài cho một file asm

```asm=
.LC0:
        .string "Enter The Flag:"
.LC1:
        .string "%s"
.LC2:
        .string "Wrong Flag"
.LC3:
        .string "Correct Flag"
flag_check():
        push    rbp
        mov     rbp, rsp
        sub     rsp, 464
        mov     QWORD PTR [rbp-112], 0
        mov     QWORD PTR [rbp-104], 0
        mov     QWORD PTR [rbp-96], 0
        mov     QWORD PTR [rbp-88], 0
        mov     QWORD PTR [rbp-80], 0
        mov     QWORD PTR [rbp-72], 0
        mov     QWORD PTR [rbp-64], 0
        mov     QWORD PTR [rbp-56], 0
        mov     QWORD PTR [rbp-48], 0
        mov     QWORD PTR [rbp-40], 0
        mov     QWORD PTR [rbp-32], 0
        mov     QWORD PTR [rbp-24], 0
        mov     DWORD PTR [rbp-16], 0
        mov     edi, OFFSET FLAT:.LC0
        call    puts
        lea     rax, [rbp-112]
        mov     rsi, rax
        mov     edi, OFFSET FLAT:.LC1
        mov     eax, 0
        call    __isoc99_scanf
        movabs  rax, -871222578553387942
        movabs  rdx, -3456440840989770153
        mov     QWORD PTR [rbp-368], rax
        mov     QWORD PTR [rbp-360], rdx
        movabs  rax, -6917285895965957581
        movabs  rdx, 2096695603964784419
        mov     QWORD PTR [rbp-352], rax
        mov     QWORD PTR [rbp-344], rdx
        movabs  rax, 4501421280245125089
        movabs  rdx, -5989732096912246845
        mov     QWORD PTR [rbp-336], rax
        mov     QWORD PTR [rbp-328], rdx
        movabs  rax, -7641474145812966946
        movabs  rdx, 5943263215614115999
        mov     QWORD PTR [rbp-320], rax
        mov     QWORD PTR [rbp-312], rdx
        movabs  rax, 3346881274156629838
        movabs  rdx, -4046563652848771978
        mov     QWORD PTR [rbp-304], rax
        mov     QWORD PTR [rbp-296], rdx
        movabs  rax, 1600213061547397258
        movabs  rdx, -7907006450299616387
        mov     QWORD PTR [rbp-288], rax
        mov     QWORD PTR [rbp-280], rdx
        movabs  rax, 2641250925692849876
        movabs  rdx, 5764027888120773659
        mov     QWORD PTR [rbp-272], rax
        mov     QWORD PTR [rbp-264], rdx
        movabs  rax, -2708211178971868809
        movabs  rdx, -1437889653997315907
        mov     QWORD PTR [rbp-256], rax
        mov     QWORD PTR [rbp-248], rdx
        movabs  rax, -1790267167538066993
        movabs  rdx, 6751799815650390725
        mov     QWORD PTR [rbp-240], rax
        mov     QWORD PTR [rbp-232], rdx
        movabs  rax, -7155949167227380485
        movabs  rdx, -240513889820188763
        mov     QWORD PTR [rbp-224], rax
        mov     QWORD PTR [rbp-216], rdx
        movabs  rax, 8430573516374475283
        movabs  rdx, 7014569824855873983
        mov     QWORD PTR [rbp-208], rax
        mov     QWORD PTR [rbp-200], rdx
        movabs  rax, -1194317526320485479
        movabs  rdx, -2635243135622213470
        mov     QWORD PTR [rbp-192], rax
        mov     QWORD PTR [rbp-184], rdx
        movabs  rax, 3816607778456458796
        movabs  rdx, 7739645478794557909
        mov     QWORD PTR [rbp-176], rax
        mov     QWORD PTR [rbp-168], rdx
        movabs  rax, 2239858223738625365
        movabs  rdx, 6262919446888351940
        mov     QWORD PTR [rbp-160], rax
        mov     QWORD PTR [rbp-152], rdx
        movabs  rax, 5359968574739497219
        movabs  rdx, -5945185636638990574
        mov     QWORD PTR [rbp-144], rax
        mov     QWORD PTR [rbp-136], rdx
        movabs  rax, 4289602485438450409
        movabs  rdx, -4136753309120802266
        mov     QWORD PTR [rbp-128], rax
        mov     QWORD PTR [rbp-120], rdx
        movabs  rax, 3689636007142570038
        movabs  rdx, 7149575679097845041
        mov     QWORD PTR [rbp-400], rax
        mov     QWORD PTR [rbp-392], rdx
        movabs  rax, 3544442000607754086
        movabs  rdx, 58494055442021
        mov     QWORD PTR [rbp-390], rax
        mov     QWORD PTR [rbp-382], rdx
        movabs  rax, -6712584965997026559
        movabs  rdx, 5818345077617353901
        mov     QWORD PTR [rbp-464], rax
        mov     QWORD PTR [rbp-456], rdx
        movabs  rax, -1172694937141806812
        movabs  rdx, -4970398359911696349
        mov     QWORD PTR [rbp-448], rax
        mov     QWORD PTR [rbp-440], rdx
        movabs  rax, -7528756344694355204
        movabs  rdx, -880185776627970324
        mov     QWORD PTR [rbp-432], rax
        mov     QWORD PTR [rbp-424], rdx
        mov     WORD PTR [rbp-416], -4294
        mov     BYTE PTR [rbp-1], 0
        mov     BYTE PTR [rbp-2], 0
        mov     BYTE PTR [rbp-9], 0
        mov     DWORD PTR [rbp-8], 0
        jmp     .L2
.L7:
        mov     eax, DWORD PTR [rbp-8]
        cdqe
        movzx   eax, BYTE PTR [rbp-112+rax]
        mov     BYTE PTR [rbp-9], al
        movzx   eax, BYTE PTR [rbp-9]
        cdqe
        movzx   eax, BYTE PTR [rbp-368+rax]
        mov     BYTE PTR [rbp-1], al
        mov     ecx, DWORD PTR [rbp-8]
        movsx   rax, ecx
        imul    rax, rax, 715827883
        shr     rax, 32
        mov     edx, eax
        sar     edx, 2
        mov     eax, ecx
        sar     eax, 31
        sub     edx, eax
        mov     eax, edx
        add     eax, eax
        add     eax, edx
        sal     eax, 3
        sub     ecx, eax
        mov     edx, ecx
        movsx   rax, edx
        movzx   eax, BYTE PTR [rbp-400+rax]
        mov     BYTE PTR [rbp-2], al
        mov     ecx, DWORD PTR [rbp-8]
        movsx   rax, ecx
        imul    rax, rax, 715827883
        shr     rax, 32
        mov     edx, eax
        sar     edx, 2
        mov     eax, ecx
        sar     eax, 31
        sub     edx, eax
        mov     eax, edx
        add     eax, eax
        add     eax, edx
        sal     eax, 3
        sub     ecx, eax
        mov     edx, ecx
        mov     eax, edx
        and     eax, 1
        test    eax, eax
        je      .L3
        not     BYTE PTR [rbp-2]
.L3:
        movzx   eax, BYTE PTR [rbp-2]
        xor     BYTE PTR [rbp-1], al
        movzx   eax, BYTE PTR [rbp-1]
        cdqe
        movzx   eax, BYTE PTR [rbp-368+rax]
        mov     BYTE PTR [rbp-1], al
        movzx   eax, BYTE PTR [rbp-1]
        and     eax, 1
        test    eax, eax
        je      .L4
        xor     BYTE PTR [rbp-1], 66
.L4:
        not     BYTE PTR [rbp-1]
        mov     eax, DWORD PTR [rbp-8]
        cdqe
        movzx   eax, BYTE PTR [rbp-464+rax]
        cmp     BYTE PTR [rbp-1], al
        je      .L5
        mov     edi, OFFSET FLAT:.LC2
        mov     eax, 0
        call    printf
        mov     eax, 1
        jmp     .L8
.L5:
        add     DWORD PTR [rbp-8], 1
.L2:
        cmp     DWORD PTR [rbp-8], 49
        jle     .L7
        mov     edi, OFFSET FLAT:.LC3
        mov     eax, 0
        call    printf
        mov     eax, 0
.L8:
        leave
        ret
```

Sửa lại file một chút để file compile được:

```asm=
section .data
    .LC0:
    db "Enter The Flag:", 0
    .LC1:
    db "%s", 0
    .LC2:
    db "Wrong Flag", 0
    .LC3:
    db "Correct Flag", 0

section .text
    global _start
    extern printf, puts, __isoc99_scanf
_start:	
    ; Your main code logic here

    ; Call the flag_check function
    call flag_check

    ; Exit the program
    mov eax, 60       ; System call number for exit
    xor edi, edi      ; Exit status code (0)
    syscall
flag_check:
        push    rbp
        mov     rbp, rsp
        sub     rsp, 464
        mov     QWORD [rbp-112], 0
        mov     QWORD [rbp-104], 0
        mov     QWORD [rbp-96], 0
        mov     QWORD [rbp-88], 0
        mov     QWORD [rbp-80], 0
        mov     QWORD [rbp-72], 0
        mov     QWORD [rbp-64], 0
        mov     QWORD [rbp-56], 0
        mov     QWORD [rbp-48], 0
        mov     QWORD [rbp-40], 0
        mov     QWORD [rbp-32], 0
        mov     QWORD [rbp-24], 0
        mov     DWORD [rbp-16], 0
        mov     edi, .LC0
        call    puts
        lea     rax, [rbp-112]
        mov     rsi, rax
        mov     edi, .LC1
        mov     eax, 0
        call    __isoc99_scanf
        mov  rax, -871222578553387942
        mov  rdx, -3456440840989770153
        mov     QWORD [rbp-368], rax
        mov     QWORD [rbp-360], rdx
        mov  rax, -6917285895965957581
        mov  rdx, 2096695603964784419
        mov     QWORD [rbp-352], rax
        mov     QWORD [rbp-344], rdx
        mov  rax, 4501421280245125089
        mov  rdx, -5989732096912246845
        mov     QWORD [rbp-336], rax
        mov     QWORD [rbp-328], rdx
        mov  rax, -7641474145812966946
        mov  rdx, 5943263215614115999
        mov     QWORD [rbp-320], rax
        mov     QWORD [rbp-312], rdx
        mov  rax, 3346881274156629838
        mov  rdx, -4046563652848771978
        mov     QWORD [rbp-304], rax
        mov     QWORD [rbp-296], rdx
        mov  rax, 1600213061547397258
        mov  rdx, -7907006450299616387
        mov     QWORD [rbp-288], rax
        mov     QWORD [rbp-280], rdx
        mov  rax, 2641250925692849876
        mov  rdx, 5764027888120773659
        mov     QWORD [rbp-272], rax
        mov     QWORD [rbp-264], rdx
        mov  rax, -2708211178971868809
        mov  rdx, -1437889653997315907
        mov     QWORD [rbp-256], rax
        mov     QWORD [rbp-248], rdx
        mov  rax, -1790267167538066993
        mov  rdx, 6751799815650390725
        mov     QWORD [rbp-240], rax
        mov     QWORD [rbp-232], rdx
        mov  rax, -7155949167227380485
        mov  rdx, -240513889820188763
        mov     QWORD [rbp-224], rax
        mov     QWORD [rbp-216], rdx
        mov  rax, 8430573516374475283
        mov  rdx, 7014569824855873983
        mov     QWORD [rbp-208], rax
        mov     QWORD [rbp-200], rdx
        mov  rax, -1194317526320485479
        mov  rdx, -2635243135622213470
        mov     QWORD [rbp-192], rax
        mov     QWORD [rbp-184], rdx
        mov  rax, 3816607778456458796
        mov  rdx, 7739645478794557909
        mov     QWORD [rbp-176], rax
        mov     QWORD [rbp-168], rdx
        mov  rax, 2239858223738625365
        mov  rdx, 6262919446888351940
        mov     QWORD [rbp-160], rax
        mov     QWORD [rbp-152], rdx
        mov  rax, 5359968574739497219
        mov  rdx, -5945185636638990574
        mov     QWORD [rbp-144], rax
        mov     QWORD [rbp-136], rdx
        mov  rax, 4289602485438450409
        mov  rdx, -4136753309120802266
        mov     QWORD [rbp-128], rax
        mov     QWORD [rbp-120], rdx
        mov  rax, 3689636007142570038
        mov  rdx, 7149575679097845041
        mov     QWORD [rbp-400], rax
        mov     QWORD [rbp-392], rdx
        mov  rax, 3544442000607754086
        mov  rdx, 58494055442021
        mov     QWORD [rbp-390], rax
        mov     QWORD [rbp-382], rdx
        mov  rax, -6712584965997026559
        mov  rdx, 5818345077617353901
        mov     QWORD [rbp-464], rax
        mov     QWORD [rbp-456], rdx
        mov  rax, -1172694937141806812
        mov  rdx, -4970398359911696349
        mov     QWORD [rbp-448], rax
        mov     QWORD [rbp-440], rdx
        mov  rax, -7528756344694355204
        mov  rdx, -880185776627970324
        mov     QWORD [rbp-432], rax
        mov     QWORD [rbp-424], rdx
        mov     WORD [rbp-416], -4294
        mov     BYTE [rbp-1], 0
        mov     BYTE [rbp-2], 0
        mov     BYTE [rbp-9], 0
        mov     DWORD [rbp-8], 0
        jmp     .L2
.L7:
        mov     eax, DWORD [rbp-8]
        cdqe
        movzx   eax, BYTE [rbp-112+rax]
        mov     BYTE [rbp-9], al
        movzx   eax, BYTE [rbp-9]
        cdqe
        movzx   eax, BYTE [rbp-368+rax]
        mov     BYTE [rbp-1], al
        mov     ecx, DWORD [rbp-8]
        movsx   rax, ecx
        imul    rax, rax, 715827883
        shr     rax, 32
        mov     edx, eax
        sar     edx, 2
        mov     eax, ecx
        sar     eax, 31
        sub     edx, eax
        mov     eax, edx
        add     eax, eax
        add     eax, edx
        sal     eax, 3
        sub     ecx, eax
        mov     edx, ecx
        movsx   rax, edx
        movzx   eax, BYTE [rbp-400+rax]
        mov     BYTE [rbp-2], al
        mov     ecx, DWORD [rbp-8]
        movsx   rax, ecx
        imul    rax, rax, 715827883
        shr     rax, 32
        mov     edx, eax
        sar     edx, 2
        mov     eax, ecx
        sar     eax, 31
        sub     edx, eax
        mov     eax, edx
        add     eax, eax
        add     eax, edx
        sal     eax, 3
        sub     ecx, eax
        mov     edx, ecx
        mov     eax, edx
        and     eax, 1
        test    eax, eax
        je      .L3
        not     BYTE [rbp-2]
.L3:
        movzx   eax, BYTE [rbp-2]
        xor     BYTE [rbp-1], al
        movzx   eax, BYTE [rbp-1]
        cdqe
        movzx   eax, BYTE [rbp-368+rax]
        mov     BYTE [rbp-1], al
        movzx   eax, BYTE [rbp-1]
        and     eax, 1
        test    eax, eax
        je      .L4
        xor     BYTE [rbp-1], 66
.L4:
        not     BYTE [rbp-1]
        mov     eax, DWORD [rbp-8]
        cdqe
        movzx   eax, BYTE [rbp-464+rax]
        cmp     BYTE [rbp-1], al
        je      .L5
        mov     edi, .LC2
        mov     eax, 0
        call    printf
        mov     eax, 1
        jmp     .L8
.L5:
        add     DWORD [rbp-8], 1
.L2:
        cmp     DWORD [rbp-8], 49
        jle     .L7
        mov     edi, .LC3
        mov     eax, 0
        call    printf
        mov     eax, 0
.L8:
        leave
        ret
```

Compile file 

```
nasm -f elf64 test.asm
ld -o test test.o -lc
```

Ta được một file ELF64, load vào ida64:

![](https://hackmd.io/_uploads/HyGKrYI2n.png)

Mở hàm `flag_check`:

![](https://hackmd.io/_uploads/BJFarFLh3.png)


![](https://hackmd.io/_uploads/Hk5nBtL3h.png)

Chương trình yêu cầu chúng ta nhập flag và mã hoá cuối cùng check với v1. 

## Script

```python=
data = [0x5A, 0x84, 0x06, 0x45, 0xAE, 0xCB, 0xE8, 0xF3, 0x57, 0xFE,
  0xA6, 0x3D, 0x5E, 0x41, 0x08, 0xD0, 0x33, 0x22, 0x21, 0x81, 
  0x20, 0xDD, 0x00, 0xA0, 0x23, 0xAF, 0x71, 0x04, 0x8B, 0xF5, 
  0x18, 0x1D, 0xE1, 0x0F, 0x65, 0x09, 0xCE, 0x42, 0x78, 0x3E, 
  0xC3, 0x37, 0xCA, 0x8F, 0x64, 0x32, 0xE0, 0xAC, 0xDE, 0x91, 
  0x7C, 0x2A, 0xC0, 0x07, 0xF4, 0x95, 0x9F, 0x40, 0x53, 0xE5, 
  0x67, 0xB6, 0x7A, 0x52, 0x4E, 0x3F, 0x83, 0x4B, 0xC9, 0x82, 
  0x72, 0x2E, 0x76, 0x1C, 0xF1, 0x1E, 0xCC, 0xB7, 0xD7, 0xC7, 
  0x8A, 0x10, 0x79, 0x1A, 0x4D, 0x19, 0x35, 0x16, 0x7D, 0x43, 
  0x2B, 0xCD, 0x86, 0xAB, 0x44, 0x92, 0xD4, 0x0E, 0x98, 0x14, 
  0xB9, 0x9B, 0xA7, 0x24, 0x1B, 0x3C, 0xE2, 0x3A, 0xD3, 0xF0, 
  0xFD, 0x4F, 0x77, 0xD1, 0xA3, 0x0C, 0x48, 0x80, 0x6A, 0xDA, 
  0xBD, 0xD8, 0x47, 0x5B, 0xFA, 0x96, 0x0B, 0xEC, 0xCF, 0x49, 
  0xD9, 0x11, 0x7F, 0xB1, 0x27, 0xE7, 0xC5, 0xB2, 0x63, 0xE6, 
  0x28, 0x36, 0xB3, 0x5D, 0xFB, 0xDC, 0xA8, 0x70, 0x25, 0xF6, 
  0xB0, 0x9C, 0xA5, 0x5F, 0xB8, 0x39, 0xE4, 0x85, 0xA9, 0xFC, 
  0x13, 0x02, 0x51, 0x30, 0xF2, 0x69, 0xFF, 0x74, 0xBF, 0x59, 
  0xB5, 0x46, 0x17, 0xC2, 0x58, 0x61, 0x99, 0xEB, 0xA4, 0x9E, 
  0x89, 0xEE, 0x6C, 0xEF, 0xA2, 0x90, 0x73, 0x8C, 0x54, 0xBC, 
  0x6D, 0xDB, 0x2C, 0xD6, 0xE3, 0xA1, 0x8D, 0x50, 0xF7, 0x34, 
  0xD5, 0xF9, 0x01, 0x7B, 0x8E, 0xBE, 0x68, 0x6B, 0x55, 0x9D, 
  0x2D, 0xED, 0x2F, 0x93, 0x15, 0x1F, 0xC4, 0x88, 0xAA, 0xF8, 
  0x0D, 0x5C, 0xEA, 0x56, 0x03, 0xC1, 0x9A, 0x38, 0x05, 0x6F, 
  0x62, 0x4A, 0x12, 0xDF, 0x60, 0x94, 0x29, 0x75, 0x7E, 0xAD, 
  0xE9, 0x0A, 0x31, 0xB4, 0xBB, 0xBA, 0x87, 0x3B, 0x26, 0xD2, 
  0x6E, 0x66, 0xC8, 0x4C, 0x97, 0xC6 ]
data2= b"689df84315f73e8c01efe535"
cipher =[0x01, 0xA3, 0x1E, 0xC9, 0x89, 0x1B, 0xD8, 0xA2, 0xAD, 0x64, 
  0x06, 0x6C, 0x05, 0xEA, 0xBE, 0x50, 0x24, 0x79, 0xC3, 0xF9, 
  0x2A, 0xC0, 0xB9, 0xEF, 0x23, 0x78, 0x47, 0xA5, 0x06, 0x99, 
  0x05, 0xBB, 0xFC, 0x4A, 0x06, 0x5A, 0xFE, 0x7B, 0x84, 0x97, 
  0xEC, 0x0E, 0xBD, 0x17, 0xB3, 0xF3, 0xC8, 0xF3, 0x3A, 0xEF]

for i in range(len(cipher)):
    cipher[i]=(~cipher[i])&0xff
    if(((cipher[i]^0x42)&1)!=0):
        cipher[i]=cipher[i]^0x42
    for k in range(len(data)):
        if(cipher[i]==data[k]):
            cipher[i]=k
            break
    temp = data2[i%24]
    if ( ((i % 24) & 1) != 0 ):
      temp = (~temp)&0xff
    cipher[i]=cipher[i]^temp
    for h in range(len(data)):
        if(cipher[i]==data[h]):
            cipher[i]=h
            break
    print(chr(cipher[i]),end="")
```

## flag

`ASCWG{What_do_you_see_before_it_is_over?_998bd0d4}`


