# NTU Computer Security HW2
###### tags: `NTU`
## dropper
* it loads API by ```gs:0x60``` but not regular ways
* use xor & not operation to encrypt library strings and API strings
* initialized crypto context then encrypt string in data, then write result to ```HKLM\CS_2022```
* just patch the sleep instruction and execute the binary again then you will see the flag in registry
## ooxx
* use xref to find main logic with strings on the title and console
* inside main logic, it use xor cipher to decrypt ```MessageBoxA```
* invert the comparison operator to makes ```O Win!```
* execute the executable then will see the flag
## pwn_myself
* it has a stack-based buffer overflow in main function which will result in return to ```0x668BF``` in main function
* buffer size: 24
* overflow location: write 56 bytes
* 0x66B51 - 658 = 0x668bf
* the function will keep reading keyboard input. after receive 44 key input, it will use it doing some calculation later
* to recognize what function it acutally use, we can create our openssl 3.0.2 flirt signature with ida sigmake tool
* ref:
* https://www.freebuf.com/articles/endpoint/235070.html
* discussion with [oalieno](https://github.com/oalieno)
* functions can be recover with our self-created signature and exception messages near ```ERR_new```
* after recover back the logic, we know that the server use our user input to encrypt then compare to to some bytes in memory. if the comparison goes true, it will then decrypt something and send back with socket
* as a result, we can simply patches the check and the items to be decrypted, and we can obtain the flag with wireshark

## trace
* it firstly drop a binary to ```/tmp/cs_2022_fall_ouo```
* then it will fork out and execute with debugging mode
* after fork out, child process will start running with single step mode. if the next instruction bytes is ```0xE8CBCCDEADBEEFE8```, parent process will patch them with ```nop```s
* as a result, we can craft a patched binary will all occurance ```0xE8CBCCDEADBEEFE8``` patched with ```nop```s. then we can easily see the xoring flag decryption logic with IDA
* decrypt the memory back then we will obtain the flag
## trojan
* it opens a tcp socket on localhost
* after service is up, it will try to recv first
* then send back a magic string
* after that, it will send a int to indicate the payload size
* then send the payload with xoring encryption
* to solve this, we can extract the payload and xor with ```0vCh8RrvqkrbxN9Q7Ydx``` then we will obtain the flag as png