14 replies to this topic

[Holmes.Sherlock]

Our reboot fav, Wonko the Sane was able to download a file containing the key for Nuno's treasure chest. Unfortunately the download finished incorrectly and the file is corrupt. Help Wonko to recover the key.
Try it here.

Attached Files

•  Challenge #9.zip   43.94KB   27 downloads

[MichaelZ]

The first examination only led to

Spoiler

show that the file contains org.exe. The original file size and CRC are not the correct key.

No further luck yet.

Many Greetings
MichaelZ

[Icecube]

Step 1:

Spoiler

Fix the zip file:
zip -FF dump.zip --out dump-fixed.zip

You can get this zip program from: http://www.info-zip.org/

The fixed archive contains 1 file, 81408 bytes uncompressed, 44712 bytes compressed.

Step 2:

Spoiler

Extract the org.exe file with 7-zip (7-zip will complain because the whole file could not be extracted (only 81355 bytes), but it will extract enough):
7z e dump-fixed.zip

Step3:

Spoiler

Run the org.exe file in the console window and see the key.

Solution:

Spoiler

The Key is: 183808af

[Wonko the Sane]

Though no harm was made to Wonko in the making of this , Wonko (the Sane) DOES NOT approve the unmotivated and unrelated use of his name (like "in vain" ).

Particularly, Wonko will not hold him guiltless that taketh his name in vain ....

Spoiler

Wonko

[Holmes.Sherlock]

Though no harm was made to Wonko in the making of this..................

That's the point.
Practically one could complain when something like this takes place

Spoiler

[Wonko the Sane]

That's the point.

NOT really.
The point has been made, my dear Watson, up to you to catch the not-so-subtle hint or not...
... I think you are venturing on slippery ground...

Spoiler

Wonko

[Holmes.Sherlock]

The point has been made, my dear Watson, up to you to catch the not-so-subtle hint or not...

Can't play the dual role of the great detective & his helper at the same time. That "helper" post is still left vacant. Interested?

[Wonko the Sane]

Can't play the dual role of the great detective & his helper at the same time. That "helper" post is still left vacant. Interested?

Well, if you play Sherlock I pretend (in the sense of claim or demand) to play Mycroft .
http://en.wikipedia..../Mycroft_Holmes


Wonko

[Holmes.Sherlock]

Well, if you play Sherlock I pretend (in the sense of claim or demand) to play Mycroft .

Hmm, I know my big bro from the day I went through Conan Doyle's creations for the first time in class V.
As Wiki says,

Mycroft is nevertheless incapable of performing detective work similar to that of Sherlock.........

...he has no ambition and no energy

Now, still if you want to apply for the position, it's granted.

BTW, Bruce Partington is really a masterpiece.

[Wonko the Sane]

Well, well BEFORE that it says:

Possessing deductive powers exceeding even those of his younger brother

and LATER:

Again and again I have taken a problem to him, and have received an explanation which has afterwards proved to be the correct one.

and:

All other men are specialists, but his specialism is omniscience.

Wonko

[Holmes.Sherlock]

@Icecube
Great job done as you have correctly answered a challenge from a famous security related competition (will be disclosed later) & have earned 300 points.

Here I provide another complicated alternative to achieve the same.

• Open the corrupted archive with WinRAR & apply Tools -> Repair archive. Thus, you'll get a repaired archive of 44817 bytes.
• Extract org.exe from this repaired archive. During extraction, check "Keep broken files" checkbox as shown below.
  Spoiler

  
• Use PETools to repair the extracted org.exe which is initially corrupted.
• Run in console window get the answer.

[MichaelZ]

Use PETools to repair the extracted org.exe which is initially corrupted.

OK, that's the point I missed
My org.exe couldn't be started neither on Windows 7 or Windows XP nor on MS-DOS 6.22.

Congratulations Icecube

Many Greetings
MichaelZ

[Icecube]

I ran the org.exe in wine.
The first time, when I extracted the executable, I couldn't start it.
Later I extracted it with 7z and I got more bytes extracted, and then it worked.

[Holmes.Sherlock]

I ran the org.exe in wine.

May not be applicable in this case, but generally WINE is not a good platform to test such typical challenges. The API implementation of WINE is partial & therefore, it fails to load a subset of valid Windows executables.

[Wonko the Sane]

May not be applicable in this case, but generally WINE is not a good platform to test such typical challenges. The API implementation of WINE is partial & therefore, it fails to load a subset of valid Windows executables.

NOT only it is NOT applicable in this case, but the experience has shown how *somehow* Linux 7zip + WINE could extract and run the malformed PE without patching it.
In other words, the WINE appeared in this case as "more tolerant" than "real" DOS/Windows.

So the experience is that if it doesn't work in DOS/WINDOWS, trying in Linux+WINE is not that bad an idea...


Wonko