Jump to content











Photo

Challenge #18 - Reverse engineering


  • Please log in to reply
13 replies to this topic

#1 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 13 September 2011 - 09:23 PM

Here's a custom compiled program that was supposed to decrypt a message and write the decrypted key to a file in current directory. But someone changed the program so it does not work the way it should. Can you modify the program to make it write the decrypted key?

Note:
The size of the executable is so big because it is a compiled AutoIt script. But hey that is the whole fun in this task. It is not a very difficult challenge and by solving this you will get a better understanding of how compiled AutoIt scripts work (at least I did when creating the challenge). The correct key will be of 10 alpha characters.

Try it here.

Attached Files



#2 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 13 September 2011 - 09:37 PM

Just beware that I made custom pe-header, and it turns out some anti-virus (Symantec in this case) don't like it. :blink: How stupid is anti-virus really?

Do you want me to reupload the file with a more anti-virus friendly pe-header?


Edit: It turn out I need to rewrite most of the challenge (so it's no challenge any longer), so I hope you can live with this or trust me. Sorry.

#3 Holmes.Sherlock

Holmes.Sherlock

    Gold Member

  • Team Reboot
  • 1444 posts
  • Location:Santa Barbara, California
  •  
    United States

Posted 14 September 2011 - 12:05 AM

Edit: It turn out I need to rewrite most of the challenge (so it's no challenge any longer), so I hope you can live with this or trust me. Sorry.

Sure, we trust you. :)

#4 Holmes.Sherlock

Holmes.Sherlock

    Gold Member

  • Team Reboot
  • 1444 posts
  • Location:Santa Barbara, California
  •  
    United States

Posted 14 September 2011 - 12:14 AM

Original post updated with a a link to try out the challenge.

#5 Icecube

Icecube

    Gold Member

  • Team Reboot
  • 1062 posts
  •  
    Belgium

Posted 15 September 2011 - 09:35 PM

I get this warning:

I have my doubts that the output file is decrypted.. Please change strategy.

Does this mean that the first step I did, shouldn't be done or does it just mean that additional modifications are necessary?

#6 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 15 September 2011 - 09:59 PM

I get this warning:

Does this mean that the first step I did, shouldn't be done or does it just mean that additional modifications are necessary?

By first step, I suppose you mean decompress. That's a must. Then that messagebox was just meant as an indication that something more or different must be done in order to activate the decryption of.... Think of this executable as somewhat similar to the one you had in your first challenge, but don't forget this is AutoIt. Do not (yet) try disassembling. Try other tools instead.

#7 Icecube

Icecube

    Gold Member

  • Team Reboot
  • 1062 posts
  •  
    Belgium

Posted 15 September 2011 - 10:34 PM

Is the way to activate the decryption inside the binary? At what I currently have, there is not much code.

#8 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 15 September 2011 - 10:45 PM

Is the way to activate the decryption inside the binary? At what I currently have, there is not much code.

Good question. If by binary you mean the exe itself, then yes. If you complain about little code, then maybe something is not initialized.. ;)

#9 Icecube

Icecube

    Gold Member

  • Team Reboot
  • 1062 posts
  •  
    Belgium

Posted 15 September 2011 - 11:30 PM

I didn't understand the program I was using. Now I get more than 2 lines of code :).

#10 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 15 September 2011 - 11:34 PM

When properly decrypting, it certainly is more than 2 lines of code..

#11 Icecube

Icecube

    Gold Member

  • Team Reboot
  • 1062 posts
  •  
    Belgium

Posted 16 September 2011 - 04:02 PM

When properly decrypting, it certainly is more than 2 lines of code..

Yeah. But the program with which you can retrieve it, was not very intuitive, IMHO.

BTW, I found the solution. I could have solved it yesterday if I stayed awake a few minutes longer. It took only five minutes today to solve it.

P.S.: Nice challenge

#12 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 16 September 2011 - 05:36 PM

Very good! :cheerleader:

#13 Icecube

Icecube

    Gold Member

  • Team Reboot
  • 1062 posts
  •  
    Belgium

Posted 15 January 2012 - 12:53 AM

Was nobody else able to solve it? Should I post the solving steps?

#14 Holmes.Sherlock

Holmes.Sherlock

    Gold Member

  • Team Reboot
  • 1444 posts
  • Location:Santa Barbara, California
  •  
    United States

Posted 15 January 2012 - 06:39 AM

Was nobody else able to solve it?

Answer to these type of queries will be made available in the challenge portal by few days. :good:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users