DEV Community: Ata Kuyumcu

I did a few things at STM CTF 2018 Prelims

Ata Kuyumcu — Mon, 17 Jan 2022 16:45:49 +0000

Here are a few challenges I chose to write about from the preliminary for STM CTF 2018 which will take place in Ankara at Oct 31. I want to thank the STM team for a fun and smooth CTF experience. I started competing in CTFs about half a year ago and I heard good things about STM CTF 2017. I hope I can attend this year :)

DiEfAyAr

We are given a yara file and a binary data file. The yara rule matches the file. It looks like this:

rule APT58_Temp_Watercity {

    meta:
        description = "Detects malware from notorious hacker group supported by Sivas"
        in_the_wild = true

    strings:
        <snip, irrelevant>

    condition:
        all of them and
        $s7 at 0 and
        uint16(uint8(uint8(uint8(uint8(uint8(0x79)))))) == 0x6c66 and
        uint16(uint8(uint8(uint8(uint8(uint8(0x69)))))) == 0x6761 and
        uint8(0x2aa) == 0x7d and
        filesize == 792

The uint16(uint8(uint8(uint8(uint8(uint8( syntax is basically nested Load Effective Address instructions with specified word length.

uint16( 0x666c
    uint8( 0x5f _
        uint8( 0x6d m
            uint8( 0x61 a
                uint8( 0x72 r
                    uint8(0x79 y)))))) 0x34 4

uint16( 0x6167
    uint8( 0x65 e
        uint8( 0x44 D
            uint8( 0x52 R
                uint8( 0x33 3
                    uint8(0x69 i)))))) 0x63 c

So the flag is STMCTF{y4ram_ic3Rde}.

Rengarenk String

We are given an image and told that the color values have a meaning.

It doesn't have any transparency so we extract RGB data in order, with GIMP.

atak@silver ~>xxd rengarenk_string.dat
00000000: acab b2bc abb9 84ad cc91 98cb 8d9a 9194  ................
00000010: a0bd 968d a0bb 8a91 869e a0b6 9c96 91a0  ................
00000020: b79a 8da0 ac9a 919a a0ad 9a91 9493 96a0  ................
00000030: bd96 8da0 ac90 8d8a a0ac 908d 9e93 9692  ................
00000040: a0ac 9685 a0bb 9aa0 bc90 858a 91a0 ba98  ................
00000050: 939a 9196 91a0 bb9a 9b96 94a0 b686 96a0  ................
00000060: a69e 8f8b 9694 a092 96a0 c0a0 cecd cccb  ................
00000070: cac9 c8c7 c6a0 cecd cccb cac9 c8c7 c6a0  ................
00000080: cecd cccb cac9 c8c7 c6a0 cecd cccb cac9  ................
00000090: c8c7 c6a0 a69e 9391 9685 a0b1 9aa0 aa85  ................
000000a0: 8a91 a0b9 939e 98a0 b093 9b8a a0bd 8aa0  ................
000000b0: bd90 8693 9aa0 b19a 868c 9aa0 b796 9ca0  ................
000000c0: bb9a 9896 938c 9aa0 b2bb caa0 be93 9686  ................
000000d0: 908d 8a85 a0aa 858a 9193 8a94 a0be 8691  ................
000000e0: 96a0 b49e 9396 8690 8da0 c4d6 a0c5 d682  ................

It doesn't look very human-friendly yet it doesn't look completely random either. Let's check the distribution of byte values.

atak@silver ~>xxd -p -c 1 rengarenk_string.data | sort | uniq -c | sort -n
      1 82
<snip, too long>
      6 9e
      7 86
      8 8d
      9 8a
     11 93
     13 91
     14 9a
     17 96
     39 a0

Assuming this is a flag, 0xA0 probably corresponds to underscore since it's used to break words in STM CTF flags. 0xA0 also happens to be the one's complement of 0x5F which is the ASCII value of the underscore character. Let's try to flip every bit in that file.

>>> data = open("rengarenk_string.dat","rb").read()
>>> "".join(map(lambda b: chr(ord(b) ^ 0xFF), data))
'STMCTF{R3ng4renk_Bir_Dunya_Icin_Her_Sene_Renkli_Bir_Soru_Soralim_Siz_De_Cozun_Eglenin_Dedik_Iyi_Yaptik_mi_?_123456789_123456789_123456789_123456789_Yalniz_Ne_Uzun_Flag_Oldu_Bu_Boyle_Neyse_Hic_Degilse_MD5_Aliyoruz_Uzunluk_Ayni_Kaliyor_;)_:)}'

And voila, there's the flag.

Matruşka

We are given an executable, named matruşka.exe.

atak@silver Matruşka>file matruşka.exe
matruşka.exe: PE32 executable (console) Intel 80386, for MS Windows

If we try to run it with wine because who runs Windows in the year of the Linux Desktop, we run into a Python stacktrace. I'm pretty sure that was not intended but that's okay, we learned that this is a "compiled" Python script. So we unpack it with python-exe-unpacker.

atak@silver Matruşka>./python_exe_unpack.py -i ./matruşka.exe
[*] On Python 2.7
[*] Processing ./matruşka.exe
[*] Pyinstaller version: 2.1+
[*] This exe is packed using pyinstaller
[*] Unpacking the binary now
[*] Python version: 27
[*] Length of package: 3224163 bytes
[*] Found 18 files in CArchive
[*] Beginning extraction...please standby
[*] Found 194 files in PYZ archive
[*] Successfully extracted pyinstaller exe.
atak@silver Matruşka>cd unpacked/matruşka.exe/
atak@silver matruşka.exe>ls
 bz2.pyd                       pyimod02_archive
 _hashlib.pyd                  pyimod03_importers
 Microsoft.VC90.CRT.manifest  'pyi-windows-manifest-filename rev.exe.manifest'
 msvcm90.dll                   python27.dll
 msvcp90.dll                   rev
 msvcr90.dll                   rev.exe.manifest
 out00-PYZ.pyz                 select.pyd
 out00-PYZ.pyz_extracted       struct
 pyiboot01_bootstrap           unicodedata.pyd
 pyimod01_os_path

Poking around a bit, we realize the rev file is pretty interesting.

atak@silver matruşka.exe>xxd rev
00000000: 6300 0000 0000 0000 0003 0000 0040 0000  c............@..
00000010: 0073 3000 0000 6400 0064 0100 6c00 005a  .s0...d..d..l..Z
00000020: 0000 6402 006a 0100 6403 0083 0100 5a02  ..d..j..d.....Z.
00000030: 0065 0000 6a03 0065 0200 8301 0064 0100  .e..j..e.....d..
00000040: 0455 6401 0053 2804 0000 0069 ffff ffff  .Ud..S(....i....
00000050: 4e73 cc03 0000 5977 4141 4141 4145 4141  Ns....YwAAAAAEAA
00000060: 4141 4b51 4141 4145 4d41 4141 427a 4b41  AAKQAAAEMAAABzKA
00000070: 4541 4147 5142 4147 6f41 4147 6341 4147  EAAGQBAGoAAGcAAG
<snip, too long>
000003f0: 526f 6232 356c 6543 3577 6558 5144 4141  Rob25leC5weXQDAA
00000400: 4141 5933 526d 4241 4141 4148 4d4b 4141  AAY3RmBAAAAHMKAA
00000410: 4141 4141 466c 4151 7742 4441 4769 4167  AAAAFlAQwBDAGiAg
00000420: 3d3d 7406 0000 0062 6173 6536 3428 0400  ==t....base64(..
00000430: 0000 7407 0000 006d 6172 7368 616c 7406  ..t....marshalt.
00000440: 0000 0064 6563 6f64 6574 0700 0000 7061  ...decodet....pa
00000450: 796c 6f61 6474 0500 0000 6c6f 6164 7328  yloadt....loads(
00000460: 0000 0000 2800 0000 0028 0000 0000 7306  ....(....(....s.
00000470: 0000 0072 6576 2e70 7974 0800 0000 3c6d  ...rev.pyt....<m
00000480: 6f64 756c 653e 0100 0000 7304 0000 000c  odule>....s.....
00000490: 010f 01                                  ...

So we have a base64 encoded marshall object in there. Let's carve it out and import it.

>>> import marshal
>>> with open("sus.marshal","rb") as mf:
...     hmm = marshal.load(mf)
...
>>> hmm
<code object ctf at 0x7fbb5dd36e30, file "pythonex.py", line 4>

After a bit of research, we learn that you can disassemble code objects.

>>> import dis
>>> dis.dis(hmm)
  5           0 LOAD_CONST               1 ('')
              3 LOAD_ATTR                0 (join)
              6 BUILD_LIST               0
              9 LOAD_CONST               2 ('y')
             12 LOAD_CONST               3 ('_')
             15 LOAD_CONST               4 ('5')
             18 LOAD_CONST               5 ('w')
             21 LOAD_CONST               2 ('y')
             24 LOAD_CONST               6 ('&')
             27 LOAD_CONST               7 ('d')
             30 LOAD_CONST               8 ('8')
             33 LOAD_CONST               9 ('r')
             36 LOAD_CONST              10 ('6')
             39 LOAD_CONST              11 ('s')
             42 LOAD_CONST               7 ('d')
             45 LOAD_CONST               9 ('r')
             48 LOAD_CONST              10 ('6')
             51 LOAD_CONST              12 ('x')
             54 LOAD_CONST              10 ('6')
             57 LOAD_CONST              11 ('s')
             60 BUILD_LIST              17
             63 GET_ITER
        >>   64 FOR_ITER                28 (to 95)
             67 STORE_FAST               0 (x)
             70 LOAD_GLOBAL              1 (chr)
             73 LOAD_GLOBAL              2 (ord)
             76 LOAD_FAST                0 (x)
             79 CALL_FUNCTION            1
             82 LOAD_CONST              13 (3)
             85 BINARY_ADD
             86 CALL_FUNCTION            1
             89 LIST_APPEND              2
             92 JUMP_ABSOLUTE           64
        >>   95 CALL_FUNCTION            1
             98 STORE_FAST               1 (passw)

  6         101 LOAD_GLOBAL              3 (raw_input)
            104 LOAD_CONST              14 ('bul parolayi al flagi : ')
            107 CALL_FUNCTION            1
            110 STORE_FAST               2 (parola)

  7         113 LOAD_FAST                1 (passw)
            116 LOAD_FAST                2 (parola)
            119 COMPARE_OP               2 (==)
            122 POP_JUMP_IF_FALSE      287

  8         125 LOAD_CONST               1 ('')
            128 LOAD_ATTR                0 (join)
            131 BUILD_LIST               0
            134 LOAD_CONST              15 ('}')
            137 LOAD_CONST              16 ('1')
            140 LOAD_CONST              17 ('$')
            143 LOAD_CONST              18 ('3')
            146 LOAD_CONST              19 ('m')
            149 LOAD_CONST              20 ('7')
            152 LOAD_CONST              21 ('z')
            155 LOAD_CONST               3 ('_')
            158 LOAD_CONST              16 ('1')
            161 LOAD_CONST              22 ('Y')
            164 LOAD_CONST              23 ('4')
            167 LOAD_CONST              24 ('e')
            170 LOAD_CONST              23 ('4')
            173 LOAD_CONST              25 ('l')
            176 LOAD_CONST               3 ('_')
            179 LOAD_CONST              16 ('1')
            182 LOAD_CONST              26 ('f')
            185 LOAD_CONST              18 ('3')
            188 LOAD_CONST              27 ('g')
            191 LOAD_CONST              28 ('0')
            194 LOAD_CONST               2 ('y')
            197 LOAD_CONST              16 ('1')
            200 LOAD_CONST              19 ('m')
            203 LOAD_CONST              16 ('1')
            206 LOAD_CONST              12 ('x')
            209 LOAD_CONST               3 ('_')
            212 LOAD_CONST              29 ('h')
            215 LOAD_CONST              18 ('3')
            218 LOAD_CONST               3 ('_')
            221 LOAD_CONST              12 ('x')
            224 LOAD_CONST              17 ('$')
            227 LOAD_CONST              23 ('4')
            230 LOAD_CONST              30 ('{')
            233 LOAD_CONST              31 ('S')
            236 LOAD_CONST              32 ('G')
            239 LOAD_CONST              33 ('P')
            242 LOAD_CONST              34 ('Z')
            245 LOAD_CONST              32 ('G')
            248 LOAD_CONST              35 ('F')
            251 BUILD_LIST              39
            254 GET_ITER
        >>  255 FOR_ITER                21 (to 279)
            258 STORE_FAST               3 (e)
            261 LOAD_FAST                3 (e)
            264 LOAD_ATTR                4 (decode)
            267 LOAD_CONST              36 ('ROT13')
            270 CALL_FUNCTION            1
            273 LIST_APPEND              2
            276 JUMP_ABSOLUTE          255
        >>  279 CALL_FUNCTION            1
            282 PRINT_ITEM
            283 PRINT_NEWLINE
            284 JUMP_FORWARD             5 (to 292)

 10     >>  287 LOAD_CONST              37 ('tutmadi be ..')
            290 PRINT_ITEM
            291 PRINT_NEWLINE
        >>  292 LOAD_CONST               0 (None)
            295 RETURN_VALUE

We could put the password back together, re-assemble the program and run it to get the flag but the flag is right there, so we just reverse and ROT13 it and recover it, it's STMCTF{4$k_3u_k1z1l0t3s1_y4r4L1_m7z3$1}.

SICP Exercises Chapter 1 Part 1

Ata Kuyumcu — Mon, 03 Jan 2022 20:45:04 +0000

I started reading through "Structure and Interpretation of Computer Programs" and thought it would be a good idea to publish my progress here. Here are my solutions for the first ten exercises in the book.

Exercise 1.1: Below is a sequence of expressions. What is the result printed by the interpreter in response to each expression? Assume that the sequence is to be evaluated in the order in which it is presented.

Answer:

10
; 10

(+ 5 3 4)
; 12

(- 9 1)
; 8

(/ 6 2)
; 3

(+ (* 2 4) (- 4 6))
; 6

(define a 3)
; 3

(define b (+ a 1))
; 4

(+ a b (* a b))
; 19

(= a b)
; false

(if (and (> b a) (< b (* a b)))
    b
    a)
; 4

(cond ((= a 4) 6)
      ((= b 4) (+ 6 7 a))
      (else 25))
; 16

(+ 2 (if (> b a) b a))
; 6

(* (cond ((> a b) a)
         ((< a b) b)
         (else -1))
   (+ a 1))
; 16

Exercise 1.2: Translate the following expression into prefix form.

{4\over5})))\over3(6 - 2)(2 - 7)}

Answer:

(/ (+ 5 4 (- 2 3 (/ 4 5)))
   (* 3 (- 6 2) (- 2 7)))

Exercise 1.3: Define a procedure that takes three numbers as arguments and returns the sum of the squares of the two larger numbers.

Answer:

(define (sqr a) (* a a))

(define (caterpillar x y z)
  (- (+ (sqr x) (sqr y) (sqr z))
     (sqr (min x y z))))

(define (bookworm x y z)
  (if (> x y)
      (+ (sqr x) (sqr (max y z)))
      (+ (sqr y) (sqr (max x z)))))

(define (ladybug x y z)
  (define sumsqr a b (+ (sqr a) (sqr b)))
  (max (sumsqr x y) (sumsqr x z) (sumsqr y z)))

Exercise 1.4: Observe that our model of evaluation allows for combinations whose operators are compound expressions. Use this observation to describe the behavior of the following procedure:

(define (a-plus-abs-b a b)
  ((if (> b 0) + -) a b))

Answer: If b is positive, add it to a. Otherwise, subtract it from a. This gives us the sum of a and the absolute value of b.

Exercise 1.5: Ben Bitdiddle has invented a test to determine whether the interpreter he is faced with is using applicative-order evaluation or normal-order evaluation. He defines the following two procedures:

(define (p) (p))
(define (test x y)
  (if (= x 0)
      0
      y))

Then he evaluates the expression

(test 0 (p))

What behavior will Ben observe with an interpreter that uses applicative-order evaluation? What behavior will he observe with an interpreter that uses normal-order evaluation? Explain your answer. (Assume that the evaluation rule for the special form if is the same whether the interpreter is using normal or applicative order: The predicate expression is evaluated first, and the result determines whether to evaluate the consequent or the alternative expression.)

Answer: An interpreter that uses applicative-order evaluation would evaluate the parameter (p) in the expression (test 0 (p)) before it is expanded. Trying to evaluate the expression (p) would cause an infinite loop.

In normal-order evaluation, the expression (test 0 (p)) is expanded to (if (= 0 0) 0 (p)) in which (p) isn't evaluated because the predicate (= 0 0) evaluates to true.

Exercise 1.6: Alyssa P. Hacker doesn't see why if needs to be provided as a special form. "Why can't I just define it as an ordinary procedure in terms of cond?" she asks. Alyssa's friend Eva Lu Ator claims this can indeed be done, and she defines a new version of if:

(define (new-if predicate then-clause else-clause)
  (cond (predicate then-clause)
        (else else-clause)))

Eva demonstrates the program for Alyssa:

(new-if (= 2 3) 0 5)
; 5

(new-if (= 1 1) 0 5)
; 0

Delighted, Alyssa uses new-if to rewrite the square-root program:

(define (sqrt-iter guess x)
  (new-if (good-enough? guess x)
          guess
          (sqrt-iter (improve guess x)
                     x)))

What happens when Alyssa attempts to use this to compute square roots? Explain.

Answer: The recursion stop condition does not work as intended as new-if evaluates else-clause even when the predicate evaluates to false.

Exercise 1.7: The good-enough? test used in computing square roots will not be very effective for finding the square roots of very small numbers. Also, in real computers, arithmetic operations are almost always performed with limited precision. This makes our test inadequate for very large numbers. Explain these statements, with examples showing how the test fails for small and large numbers. An alternative strategy for implementing good-enough? is to watch how guess changes from one iteration to the next and to stop when the change is a very small fraction of the guess. Design a square-root procedure that uses this kind of end test. Does this work better for small and large numbers?

Answer: The given test good-enough? will not be very effective for finding the square roots of very small numbers because of the fixed tolerance value 0.001, e.g. (sqrt 0.000004) would return 0.03129261341049664. Also, most computers have native support for precision up to 64 bits but variable-precision can be achieved in software with libraries such as GMP.

(define (square x) (* x x))
(define (average x y) (/ (+ x y) 2))
(define (improve guess x) (average guess (/ x guess)))
(define (good-enough? guess x) (< (abs (- (square guess) x)) 0.001))

(define (sqrt-iter guess x)
  (if (good-enough? guess x)
      guess
      (sqrt-iter (improve guess x) x)))

(define (sqrt x) (sqrt-iter 1.0 x))

(sqrt 0.000004)
; 0.03129261341049664 :(

(sqrt 9999999999999)
; 3162277.660168221 :)

(define (good-enough? previous-guess guess x)
  (< (/ (abs (- guess previous-guess)) x) 0.001))

(define (sqrt-iter previous-guess guess x)
  (if (good-enough? previous-guess guess x)
      guess
      (sqrt-iter guess (improve guess x) x)))

(define (sqrt x) (sqrt-iter 0 1.0 x))

(sqrt 0.000004)
; 0.0020000000000000235 :)

(sqrt 9999999999999)
; 1.0

As you can see above, our solution works better for small numbers but not so much for big numbers.

Exercise 1.8: Newton’s method for cube roots is based on the fact that if y is an approximation to the cube root of x, then a better approximation is given by the value

y^2 + 2y \over 3

Use this formula to implement a cube-root procedure analogous to the square-root procedure. (In Section 1.3.4 we will see how to implement Newton’s method in general as an abstraction of these square-root and cube-root procedures.)

Answer:

(define (improve-cube guess x)
  (/ (+ (/ x guess guess) (* 2 guess)) 3))

(define (cbrt-iter previous-guess guess x)
  (if (good-enough? previous-guess guess x)
      guess
      (cbrt-iter guess (improve-cube guess x) x)))

Exercise 1.9: Each of the following two procedures defines a method for adding two positive integers in terms of the procedures inc, which increments its argument by 1, and dec, which decrements its argument by 1.

(define (+ a b)
  (if (= a 0) b (inc (+ (dec a) b))))

(define (+ a b)
  (if (= a 0) b (+ (dec a) (inc b))))

Using the substitution model, illustrate the process generated by each procedure in evaluating (+ 4 5). Are these processes iterative or recursive?

Answer:

(+ 4 5)
(inc (+ (dec 4) 5))
(inc (inc (+ (dec 3) 5)))
(inc (inc (inc (+ (dec 2) 5))))
(inc (inc (inc (inc (+ (dec 1) 5)))))
(inc (inc (inc (inc 5))))
(inc (inc (inc 6)))
(inc (inc 7))
(inc 8)
9

This process is clearly recursive, it grows with the recursion and rolls back when it hits the stop condition.

(+ 4 5)
(+ 3 6)
(+ 2 7)
(+ 1 8)
(+ 0 9)
9

This process is iterative thanks to applicative order evaluation.

Exercise 1.10: The following procedure computes a mathematical function called Ackermann’s function.

(define (A x y)
  (cond ((= y 0) 0)
        ((= x 0) (* 2 y))
        ((= y 1) 2)
        (else (A (- x 1) (A x (- y 1))))))

What are the values of the following expressions?

(A 1 10)
(A 2 4)
(A 3 3)

Consider the following procedures, where A is the procedure defined above:

(define (f n) (A 0 n))
(define (g n) (A 1 n))
(define (h n) (A 2 n))
(define (k n) (* 5 n n))

Give concise mathematical definitions for the functions computed by the procedures f, g, and h for positive integer values of n. For example, (k n) computes $5n^2$ .

Answer:

(A 1 10) ; 1024
(A 2 4)  ; 65536
(A 3 3)  ; 65536
(define (f n) (A 0 n)) ; computes 2n
(define (g n) (A 1 n)) ; computes 2^n unless n is 0
(define (h n) (A 2 n)) ; computes 2^(2^(2^(2...(n times)))) unless n is 0

Custom commands in Bevy with extension traits

Ata Kuyumcu — Mon, 03 Jan 2022 02:11:35 +0000

Bevy is an ECS-based game engine built in Rust. Extension traits are a pattern in rust that allows you to add methods to an existing type defined outside of your crate. You can probably guess where I'm going with this.

In bevy, any system can access the Commands structure to issue commands manipulate the World. The most common one would probably be the
Commands#spawn method which lets you spawn an entity with the components you specify. You can pass a structure implementing the Bundle trait to this method. Luckily, tuples of none to many components implement this trait thanks to macro magic, so you can just call the method like:

commands.spawn((Component1 {x: 3.0, y: 4.0}, Component2 {value: true}))

Or, you can easily define your own bundles and use them:

use bevy::ecs::*;

#[derive(Bundle)]
struct HumbleBundle {
    component1: Component1,
    component2: Component2,
}

// ... lines later, somewhere in a system
commands.spawn(HumbleBundle {
    component1: Component1 {x: 3.0, y: 4.0},
    component2: Component2 {value: true}
});

But maybe you need to spawn multiple entities that refer to each other or something. Then, you need to implement a new
Command yourself.

use bevy::ecs::*;

struct ReferringComponent {
    refers_to: Entity
}

struct ComponentFoo {
    bar: i32
}

struct SpawnReferringPair {
    first_bar: i32,
    second_bar: i32,
}

// create two entities, the second one referring to the first one
impl Command for SpawnReferringPair {
    fn write(self: Box<Self>, world: &mut World, resources: &mut Resources) {
        let first_entity = world.spawn((ComponentFoo {bar: self.first_bar}, ));
        world.spawn((ComponentFoo {bar: self.second_bar}, ReferringComponent {refers_to: first_entity}));
    }
}

And we can use this Command with Commands, like:

commands.add_command(SpawnReferringPair {first_bar: 5, second_bar: 10});

Now, this is completely fine and functional. But I think we can make it prettier, so we can use it like:

commands.spawn_referring_pair(5, 10);

We just have to add a method to Bevy's already defined Commands structure with an extension trait.

// imagine that the code defining SpawnReferringPair is here as well :)

trait CommandsExt {
    fn spawn_referring_pair(&mut self, first_bar: i32, second_bar: i32) -> &mut Self;
}

impl CommandsExt for Commands {
    fn spawn_referring_pair(&mut self, first_bar: i32, second_bar: i32) -> &mut Self {
        self.add_command(SpawnReferringPair {
            first_bar, second_bar // field init shorthand
        });
        self
    }
}

And voila, we can use this method just like the spawn method:

commands
    .spawn_referring_pair(5, 10)
    .spawn((SomeOtherComponent,))
    .spawn_referring_pair(1024, 1);

In conclusion, don't let the computer tell you what to do, make it do what you want, however arbitrary it might be. Also, Bevy is pre-1.0 and as much as they try to keep things backwards-compatible, this article might not be correct beyond 0.4, or it could be, check the source code, nerd.