Solution to QilingLabs from ShielderSec. from binascii import unhexlify from logging import getLogger from qiling import * from qiling.const import * from qiling.os import * from qiling.os.mapper import * from rev import * from pwn import *

Challenge Challenge Description We made a challenge assuming it would turn out good. But Oh No! The challenge turned out eerie, yes, eerie, not weird but eerie. We are currently on process of figuring out what changed overnight. It is true when people say your code can change overnight. Here is the challenge that we made, let's work together to figure out why the challenge turned out the way it is. sobing, in a corner Oh my poor chall, what have you become ? Solution

This vm challenge takes two values at a time from memory the first value acts as a opcode and second one as operands, the vm-function totally has 22 switch cases Binary takes an unsigned 32-bit integer as input and does some checks inside the vm-function and returns 4 if it has passed all the conditions inst is the instruction array values is the array which has our input along with zeros (length 280) each byte of the input is in values[18],values[19],values[20],values[21] Implementing the function in python

Here we have a function which does some comparisions on the input string passed to it, in each comparsion it xors three characters in the string passed to the function and compares it to a value in memory Getting those values in the memory and using Z3 to find the input we get the flag from z3 import * a=[0x67,0x65,0x22,0x32,0x39,0x39,0x2,0x4,0x44,0x44,0x1c,0xa,0x32,0x76] f = [ BitVec('a%s' % i, 8) for i in range(len(a)) ] s = Solver()

Securinets DOT challenge This is a small VM challenge, where the opcodes are fetched from a database at runtime. The operation happens on our input array, so eventually these operations change the value inside the array and then the array is UTF-8 encoded and then converted to a base-64 string We first get the base64 decoded array and then we can use Z3 to get our flag Reverse the base-64 string size(char) - 2 bytes in C# if the ASCII value of a character is more than 0x7f, UTF-8 encoding scheme adds 0xc2,0xc3 accordingly as the MSB

short writeup: The binary takes an integer through command line and passes it to the 2 functions check_1 and check_2 check_1 - Take each of the digits in number, raise it to No.Of digits, and then take their sum and compare it with the original number check_2 - Take each of the digits in number, square it, and then take their sum,repeat this operation, if the above transformation yeilds 1 the fn returns True After finding the number that satisfies check_1 and check_2 We then have a bunch of equations in func which can be solved using z3

challenge_file Given binary takes two command line arguments and makes sure that both the number's product %10 is 7 The following operations are done on Our input each character is Xored with a value from memory Then the input is sent to a function which shuffles 5 values from our input at a time in an order and the resultant string is again passed to the same function but to shuffle with a different order Then the resultant shuffled string is compared to a string in memory

The first script prints out the operations done inside the binary, redirecting the whole equations to a python file along with some necessary changes and solving the equations using Z3 gives the flag addr= [0x6,0x3,0x0,0x4,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x10,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x11,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x12,0xc,0x1,0x12,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x13,0xd,0x2,0x13,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x14,0xc,0x0,0x14,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x15,0xc,0x0,0x15,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x16,0x3,0x0,0x0,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x17,0xc,0x0,0x17,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x18,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x19,0xc,0x0,0x19,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x1a,0xc,0x0,0x1a,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x1b,0xc,0x0,0x1b,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x1c,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x1d,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x1e,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x1f,0xc,0x1,0x1f,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x20,0xd,0x2,0x20,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x21,0xe,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x22,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x23,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x24,0xc,0x0,0x24,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x25,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x26,0xc,0x1,0x26,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x27,0xd,0x2,0x27,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x4,0x0,0x28,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x29,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x2a,0xc,0x0,0x2a,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x2b,0xc,0x1,0x2b,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x2c,0xd,0x2,0x2c,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x2d,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x2e,0xc,0x1,0x2e,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x2f,0xd,0x2,0x2f,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x30,0xe,0x3,0x0,0xa,0x0,0x0,0x4,0x0,0x31,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x32,0xc,0x0,0x32,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x33,0xc,0x1,0x33,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x34,0xd,0x2,0x34,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x35,0xc,0x0,0x35,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x36,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x37,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x38,0xc,0x0,0x38,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x39,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x3a,0xc,0x0,0x3a,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x3b,0xc,0x1,0x3b,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x3c,0xd,0x2,0x3c,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x3d,0xc,0x0,0x3d,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x3e,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x3f,0xc,0x0,0x3f,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x0,0x40,0xc,0x1,0x40,0xb,0x1,0x1,0x5,0x2,0x1,0xe,0x1,0x0,0xe,0x2,0x0,0xc,0x1,0x41,0xd,0x2,0x41,0xe,0x1,0x2,0x5,0x0,0x1,0x5,0x3,0x1,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x42,0xc,0x0,0x42,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x43,0xe,0x3,0x0,0xa,0x0,0x0,0x5,0x1,0x0,0x4,0x1,0x44,0xc,0x0,0x44,0x1,0x0,0x2,0xe,0x0,0x1,0xe,0x3,0x0,0xa,0x0,0x0,0x3,0x0,0x0,0x4,0x0,0x45,0xe,0x3,0x0,0x5,0x0,0x3,0x7,0x42,0x0,0x6,0x0,0x46,0x8,0x0,0x0,0x6,0x0,0x47,0x8,0x0,0x0,0x6,0x0,0x48,0x8,0x0,0x0,0x6,0x0,0x49,0x8,0x0,0x0,0x6,0x0,0x4a,0x8,0x0,0x0,0x6,0x0,0x4b,0x8,0x0,0x0,0x6,0x0,0x4c,0x8,0x0,0x0,0x6,0x0,0x4d,0x8,0x0,0x0,0x6,0x0,0x4e,0x8,0x0,0x0,0x6,0x0,0x0,0x4,0x0,0x0,0x9,0x0,0x0,0x6,0x0,0x4f,0x8,0x0,0x0,0x6,0x0,0x50,0x8,0x0,0x0,0x6,0x0,0x51,0x8,0x0,0x0,0x6,0x0,0x52,0x8,0x0,0x0,0x6,0x0,0x53,0x8,0x0,0x0,0x6,0x0,0x54,0x8,0x0,0x0,0x6,0x0,0x55,0x8,0x0,0x0,0x6,0x0,0x56,0x8,0x0,0x0,0x6,0x0,0x57,0x8,0x0,0x0,0x6,0x0,0x58,0x8,0x0,0x0,0x6,0x0,0x0,0x9,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0xba,0x91,0x8b,0x9a,0x8d,0xdf,0x8b,0x97,0x9a,0xdf,0x99,0x93,0x9e,0x98,0xc5,0xdf,0x63,0x8b,0x8a,0x10,0x85,0x8a,0x1,0x8e,0x74,0x8b,0xcc,0x94,0x5f,0x92,0xcb,0xed,0xb0,0x97,0x69,0x91,0x9b,0x5f,0x50,0x40,0x72,0xcf,0x8c,0x1b,0x80,0x9c,0x3c,0x50,0x96,0x6f,0x92,0x40,0x61,0x97,0x8c,0xa0,0x8d,0x90,0x91,0x40,0x61,0xce,0xcf,0xcf,0x90,0x40,0xa1,0x87,0xbc,0x82,0x47,0x6f,0x6f,0x64,0x20,0x4a,0x6f,0x62,0xa,0x54,0x72,0x79,0x20,0x61,0x67,0x61,0x69,0x6e] values=[0xba,0x91,0x8b,0x9a,0x8d,0xdf,0x8b,0x97,0x9a,0xdf,0x99,0x93,0x9e,0x98,0xc5,0xdf,0x63,0x8b,0x8a,0x10,0x85,0x8a,0x1,0x8e,0x74,0x8b,0xcc,0x94,0x5f,0x92,0xcb,0xed,0xb0,0x97,0x69,0x91,0x9b,0x5f,0x50,0x40,0x72,0xcf,0x8c,0x1b,0x80,0x9c,0x3c,0x50,0x96,0x6f,0x92,0x40,0x61,0x97,0x8c,0xa0,0x8d,0x90,0x91,0x40,0x61,0xce,0xcf,0xcf,0x90,0x40,0xa1,0x87,0xbc,0x82,0x47,0x6f,0x6f,0x64,0x20,0x4a,0x6f,0x62,0xa,0x54,0x72,0x79,0x20,0x61,0x67,0x61,0x69,0x6e] res=0 num=0 char=[0]*4

challenge_file This challenge basically takes a string of length of 15 and left rotates each char by 1 and compares each character with a value So we break at the point where comparision happens and find with what value our left-rotated input string is getting compared to and then right-rotate the each character to get the actual input Initially we load the binary and set a breakpoint at the cmp instruction. Whenever the values in the rcx and r10 registers are different the value in rcx is right-rotated and appended into file.txt, after we do this for 15 times, we remove all breakpoints and run it with the new input. file.txt is initially empty import gdb

Workout chall We have 3000 elf's, the important thing to note here is all the 32-bit elf's have same instructions placed in the same memory location i.e have same addressses, the only difference between them is the values our input is getting compared to. Same is the thing with 64 bit elf's Each elf has 3 things to be found out The character Count of the character The 4/8 byte value getting compared with memcmp in 32/64 bit respectively Separating 32-bit and 64-bit elf's

challenge_file The disassembly of the binary seems very big but there are a very few functions which will give us the solution There are three goto's (jumps) which when jumped terminates the execution and doesn't give us the flag and there are also functions which return different values when we use a debugger Analysing carefully we can see that there is atleast one goto for most of the if/else blocks at the end, which means that irresepective of the statements inside the block the jump will definately execute and terminate the program Eliminating all such blocks we will be left with 6 conditions out of which one verifies that length of input is 44 and another one verifies that we aren't using a debugger and the rest 4 functions divide the input into 4 parts and does some operartions on it to make sure we've entered the correct string

challenge_file This challenge takes a string and an integer and does some checks on the inputs Using Z3 solver we can solve those constraints from z3 import * #Xyz #-------------------------------------------------------------------------------